#!/usr/bin/env bash
set -euo pipefail

readonly version="${HTTPD_VERSION:-2.4.68}"
readonly source_sha256="${HTTPD_SHA256:?missing HTTPD_SHA256}"
readonly package_version="${version}-0ubuntu20.04.3"
readonly out=/out/apache2-2.4.68-focal-overwrite-amd64

rm -rf /work "$out"
mkdir -p /work "$out/rollback"
cd /work

apt-get update
apt-get source apache2
source_dir=$(find . -maxdepth 1 -type d -name 'apache2-*' | head -n 1)
test -n "$source_dir"
mv "$source_dir/debian" /work/debian
rm -rf "$source_dir"

curl --fail --location --retry 3 -o httpd.tar.gz \
  "https://downloads.apache.org/httpd/httpd-${version}.tar.gz"
echo "${source_sha256}  httpd.tar.gz" | sha256sum --check --strict
tar -xzf httpd.tar.gz
source_dir="httpd-${version}"
mv /work/debian "$source_dir/debian"
cd "$source_dir"

# Restore the Ubuntu FHS contract that the source replacement previously lost.
# In particular, HTTPD_ROOT must be /etc/apache2 so relative Include directives
# in existing and third-party module configuration continue to work.
patch --forward -p1 < debian/patches/fhs_compliance.patch

# Focal's configurable suexec patch no longer applies to 2.4.68. Keep the
# standard suexec implementation; sites using apache2-suexec-custom must
# validate or rebuild that extension before this replacement is deployed.
sed -i '/patch -p1 -i debian\/patches\/suexec-custom.patch/d' debian/rules
sed -i '/dh_auto_install -- -j1/a\
\tcp debian/tmp/usr/sbin/suexec debian/tmp/usr/sbin/suexec-pristine\
\tcp debian/tmp/usr/sbin/suexec debian/tmp/usr/sbin/suexec-custom' debian/rules
# The Focal documentation converter cannot process the newer upstream manual.
# Retain the package layout but skip conversion; runtime packages do not depend
# on apache2-doc.
sed -i 's|perl debian/convert_docs debian/apache2-doc/usr/share/doc/apache2-doc/manual|dh_installdocs -i|' debian/rules
# Apache 2.4.68 requires absolute paths for Include/IncludeOptional. Change
# Focal's packaged conffile template, so upgrades receive a compatible default.
sed -i \
  -e 's|^\([[:space:]]*IncludeOptional[[:space:]]*\)ports\.conf$|\1/etc/apache2/ports.conf|' \
  -e 's|^\([[:space:]]*IncludeOptional[[:space:]]*\)mods-enabled/|\1/etc/apache2/mods-enabled/|' \
  -e 's|^\([[:space:]]*IncludeOptional[[:space:]]*\)conf-enabled/|\1/etc/apache2/conf-enabled/|' \
  -e 's|^\([[:space:]]*IncludeOptional[[:space:]]*\)sites-enabled/|\1/etc/apache2/sites-enabled/|' \
  debian/config-dir/apache2.conf.in

DEBFULLNAME='Internal Platform Team' \
DEBEMAIL='platform@example.invalid' \
dch --newversion "$package_version" --distribution focal \
  "Rebuild Apache HTTP Server ${version} for Ubuntu 20.04."

dpkg-buildpackage -b -us -uc

cd /work
for package in apache2 apache2-bin apache2-data apache2-utils; do
  deb=$(find . -maxdepth 1 -name "${package}_${package_version}_*.deb" -print -quit)
  test -n "$deb"
  mkdir -p "$out/upgrade"
  cp "$deb" "$out/upgrade/"
done

# Keep the matching Focal packages so an offline rollback can restore the
# complete version-locked apache2 package set.
rollback_version=$(apt-cache policy apache2 | awk '/Candidate:/ {print $2}')
for package in apache2 apache2-bin apache2-data apache2-utils; do
  apt-get -o Acquire::Retries=5 download "${package}=${rollback_version}"
  rollback_deb=$(find . -maxdepth 1 -name "${package}_${rollback_version}_*.deb" -print -quit)
  test -n "$rollback_deb"
  mv "$rollback_deb" "$out/rollback/"
done

install -m 0755 /templates/install.sh "$out/install.sh"
install -m 0755 /templates/rollback.sh "$out/rollback.sh"
install -m 0644 /templates/UPGRADE_GUIDE_CN.md "$out/UPGRADE_GUIDE_CN.md"

cat > "$out/INSTALL.txt" <<'EOF'
Install:  sudo ./install.sh
Rollback: sudo ./rollback.sh
Do not install individual packages manually unless following the recovery guide.
EOF
(cd "$out" && sha256sum upgrade/*.deb rollback/*.deb install.sh rollback.sh INSTALL.txt UPGRADE_GUIDE_CN.md > SHA256SUMS)
tar -C /out -czf /out/apache2-2.4.68-focal-overwrite-amd64.tar.gz apache2-2.4.68-focal-overwrite-amd64