#!/usr/bin/make -f

# The "classic" guest-agent repo is built by `dh-golang` from the top level of
# the source tree, whereas the new plugin-manager repo (google-guest-agent) is
# shipped as a component orig tarball under `./google-guest-agent` (built separately,
# please see debian/README.source for details)

export DH_GOLANG_BUILDPKG := github.com/GoogleCloudPlatform/guest-agent/google_guest_agent github.com/GoogleCloudPlatform/guest-agent/google_metadata_script_runner github.com/GoogleCloudPlatform/guest-agent/gce_workload_cert_refresh
export DH_GOLANG_INSTALL_EXTRA := vendor/google.golang.org/protobuf/internal/editiondefaults/editions_defaults.binpb

# Both `go.mod` files have a toolchain directive pointing to a specific golang
# release that we should "ignore"
export GOTOOLCHAIN := local
export GOCACHE := $(CURDIR)/_build/go-build-cache
export GOTMPDIR := $(CURDIR)/_build/go-tmp

# Splits the changelog version into DEB_VERSION_UPSTREAM and DEB_VERSION_REVISION
include /usr/share/dpkg/pkg-info.mk

# debian/watch uses `uscan`'s group policy, i.e. when the two upstream repos are
# tagged independently the upstream version becomes <classic>+~<new-plugin-manager>,
# (e.g. 20260819.00+~20260820.00). Using that composite version on every binary would
# have each repo report the other repo's tag as well, so we split it back apart and
# hand each half to the repo it actually came from. When both repos share a tag
# there is no "+~", the string is a single word, and the two halves collapse back
# to the same plain version
CLASSIC_UPSTREAM := $(firstword $(subst +~, ,$(DEB_VERSION_UPSTREAM)))
ADDON_UPSTREAM := $(lastword $(subst +~, ,$(DEB_VERSION_UPSTREAM)))

# (the debian revision goes on both, so a binary identifies the package build it came from)
VERSION := $(CLASSIC_UPSTREAM)-$(DEB_VERSION_REVISION)
ADDON_VERSION := $(ADDON_UPSTREAM)-$(DEB_VERSION_REVISION)

# plugin-manager binaries
# keeping them out the source tree means we can stay pristine (and "debian/rules clean" stays simple)
ADDON_SRC := $(CURDIR)/google-guest-agent
ADDON_BIN := $(CURDIR)/_build/addon-bin

# Upstream ships a prebuilt manifest per plugin under
ADDON_CONFIGS := $(ADDON_SRC)/build/configs/usr/lib/google/guest_agent

CLASSIC_LDFLAGS := -s -w -X main.version=$(VERSION)
ADDON_LDFLAGS := -s -w -X main.version=$(ADDON_VERSION)

# The two local plugin extensions have no `main.version` symbol to stamp, so
# they only get the size/debug flags (upstream's own packaging also builds
# these without a version)
EXT_LDFLAGS := -s -w

%:
	dh $@ --builddirectory=_build --buildsystem=golang --with=golang

override_dh_auto_configure:
	# Vendored deps for the "classic" guest-agent repo
	rm -rf vendor
	cp -a debian/extra/vendor vendor

	# Vendored deps for the new plugin-manager repo. This lands as
	# google-guest-agent/vendor (and _not_ .../vendor/vendor) or golang
	# blows up with an "inconsistent vendoring" error
	rm -rf $(ADDON_SRC)/vendor
	cp -a debian/extra/vendor-google-guest-agent/vendor $(ADDON_SRC)/vendor

	dh_auto_configure

override_dh_auto_build:
	mkdir -p $(GOCACHE) $(GOTMPDIR) $(ADDON_BIN)
	dh_auto_build -O--buildsystem=golang -- -ldflags="$(CLASSIC_LDFLAGS)"

	# New plugin-manager binaries built from the vendored tree, `dh-golang` passes
	# `-trimpath` for us already on the guest-agent side, but these new builds are manual so we
	# have to do it explicitly (without it every binary ends up with a few hundred
	# copies of the absolute build directory baked into it, which leaks the
	# buildd path _and_ stops the package building in a reproducible way)
	cd $(ADDON_SRC) && GOFLAGS=-mod=vendor go build -trimpath -o $(ADDON_BIN)/core_plugin -ldflags="$(ADDON_LDFLAGS)" ./cmd/core_plugin
	cd $(ADDON_SRC) && GOFLAGS=-mod=vendor go build -trimpath -o $(ADDON_BIN)/google_guest_agent -ldflags="$(ADDON_LDFLAGS)" ./cmd/google_guest_agent
	cd $(ADDON_SRC) && GOFLAGS=-mod=vendor go build -trimpath -o $(ADDON_BIN)/google_guest_compat_manager -ldflags="$(ADDON_LDFLAGS)" ./cmd/google_guest_compat_manager
	cd $(ADDON_SRC) && GOFLAGS=-mod=vendor go build -trimpath -o $(ADDON_BIN)/gce_metadata_script_runner -ldflags="$(ADDON_LDFLAGS)" ./cmd/gce_metadata_script_runner
	cd $(ADDON_SRC) && GOFLAGS=-mod=vendor go build -trimpath -o $(ADDON_BIN)/gce_compat_metadata_script_runner -ldflags="$(ADDON_LDFLAGS)" ./cmd/metadata_script_runner_compat
	cd $(ADDON_SRC) && GOFLAGS=-mod=vendor go build -trimpath -o $(ADDON_BIN)/ggactl_plugin -ldflags="$(ADDON_LDFLAGS)" ./cmd/ggactl

	# Bundled local plugin extensions (the generated *.pb.go files that
	# `mwlid_extension` needs are shipped in the tarball so as to not kick
	# upstream's `fetch-mwlid-proto` target)
	cd $(ADDON_SRC) && GOFLAGS=-mod=vendor go build -trimpath -o $(ADDON_BIN)/guest_telemetry -ldflags="$(EXT_LDFLAGS)" ./cmd/guest_telemetry_extension
	cd $(ADDON_SRC) && GOFLAGS=-mod=vendor go build -trimpath -o $(ADDON_BIN)/mwlid_extension -ldflags="$(EXT_LDFLAGS)" ./cmd/mwlid_extension

override_dh_auto_test:
	# The upstream test suites reach out to the network
	dh_auto_test -O--buildsystem=golang -- -short

override_dh_auto_install:
	# Binary-only package.
	dh_auto_install -- --no-source

	# vlan_setup_enabled defaults to false upstream but Ubuntu wants it to be true
	install -d debian/google-guest-agent/usr/share/google-guest-agent
	sed 's/vlan_setup_enabled = false/vlan_setup_enabled = true/g' instance_configs.cfg \
		> debian/google-guest-agent/usr/share/google-guest-agent/instance_configs.cfg
	chmod 0644 debian/google-guest-agent/usr/share/google-guest-agent/instance_configs.cfg

	# New plugin-manager binaries
	install -d debian/google-guest-agent/usr/bin
	install -d debian/google-guest-agent/usr/sbin
	install -d debian/google-guest-agent/usr/lib/google/guest_agent
	install -p -m 0755 $(ADDON_BIN)/google_guest_agent debian/google-guest-agent/usr/bin/google_guest_agent_manager
	install -p -m 0755 $(ADDON_BIN)/google_guest_compat_manager debian/google-guest-agent/usr/bin/google_guest_compat_manager
	install -p -m 0755 $(ADDON_BIN)/gce_metadata_script_runner debian/google-guest-agent/usr/bin/gce_metadata_script_runner
	install -p -m 0755 $(ADDON_BIN)/gce_compat_metadata_script_runner debian/google-guest-agent/usr/bin/gce_compat_metadata_script_runner

	# The plugin manager discovers local plugins by scanning for
	# `$PLUGIN_DIR/manifest.binpb`, then launches the absolute `entry_point`
	# recorded inside the manifest. So the binary has to live in its own
	# directory alongside the matching manifest
	install -d debian/google-guest-agent/usr/lib/google/guest_agent/GuestAgentCorePlugin
	install -p -m 0755 $(ADDON_BIN)/core_plugin \
		debian/google-guest-agent/usr/lib/google/guest_agent/GuestAgentCorePlugin/core_plugin
	install -p -m 0644 $(ADDON_CONFIGS)/GuestAgentCorePlugin/manifest.binpb \
		debian/google-guest-agent/usr/lib/google/guest_agent/GuestAgentCorePlugin/manifest.binpb

	# Same one-directory-per-plugin layout for the two bundled extensions
	install -d debian/google-guest-agent/usr/lib/google/guest_agent/GuestTelemetryExtension
	install -p -m 0755 $(ADDON_BIN)/guest_telemetry \
		debian/google-guest-agent/usr/lib/google/guest_agent/GuestTelemetryExtension/guest_telemetry
	install -p -m 0644 $(ADDON_CONFIGS)/GuestTelemetryExtension/manifest.binpb \
		debian/google-guest-agent/usr/lib/google/guest_agent/GuestTelemetryExtension/manifest.binpb
	install -d debian/google-guest-agent/usr/lib/google/guest_agent/ManagedWorkloadIdentityExtension
	install -p -m 0755 $(ADDON_BIN)/mwlid_extension \
		debian/google-guest-agent/usr/lib/google/guest_agent/ManagedWorkloadIdentityExtension/mwlid_extension
	install -p -m 0644 $(ADDON_CONFIGS)/ManagedWorkloadIdentityExtension/manifest.binpb \
		debian/google-guest-agent/usr/lib/google/guest_agent/ManagedWorkloadIdentityExtension/manifest.binpb

	# This alias is kept purely for compatibility, older versions of the pkg
	# shipped this path and the `/usr/sbin` entries preserve the pre-merged `/usr` locations
	# Nothing in the systemd units or in either upstream repo references either name today
	install -p -m 0755 $(ADDON_BIN)/ggactl_plugin debian/google-guest-agent/usr/bin/ggactl_plugin
	ln -sf ggactl_plugin debian/google-guest-agent/usr/bin/ggactl_plugin_cleanup
	ln -sf ../bin/ggactl_plugin debian/google-guest-agent/usr/sbin/ggactl_plugin
	ln -sf ../bin/ggactl_plugin debian/google-guest-agent/usr/sbin/ggactl_plugin_cleanup

	install -p -m 0755 google_metadata_script_runner_adapt debian/google-guest-agent/usr/bin/

# (lintian) reproduce the `NOTICE` files
NOTICE_DIR := usr/share/doc/google-guest-agent/NOTICE

override_dh_installdocs:
	dh_installdocs
	install -d debian/google-guest-agent/$(NOTICE_DIR)/google.golang.org/grpc
	install -p -m 0644 debian/extra/vendor/google.golang.org/grpc/NOTICE.txt \
		debian/google-guest-agent/$(NOTICE_DIR)/google.golang.org/grpc/NOTICE.txt
	install -d debian/google-guest-agent/$(NOTICE_DIR)/gopkg.in/yaml.v3
	install -p -m 0644 debian/extra/vendor/gopkg.in/yaml.v3/NOTICE \
		debian/google-guest-agent/$(NOTICE_DIR)/gopkg.in/yaml.v3/NOTICE

override_dh_installsystemd:
	# The new plugin manager is now the entry point: so we enable/start the manager
	# units and ship (but don't enable) the legacy units. The `postinst` script migrates
	# existing installs
	dh_installsystemd google-guest-agent-manager.service google-guest-compat-manager.service
	dh_installsystemd --no-enable --no-start google-guest-agent.service gce-workload-cert-refresh.timer
	dh_installsystemd --no-start --no-restart-after-upgrade --no-stop-on-upgrade google-startup-scripts.service google-shutdown-scripts.service

override_dh_clean:
	dh_clean vendor/
	rm -rf $(ADDON_SRC)/vendor
