# Maintainer: Christopher Mosetick <office@cpm.is>

# Arch Linux / AUR package for rcvd
# Also the correct package for Arch derivatives that use pacman + AUR
#
# Builds the binary from the signed source release tarball. All packaged files
# (systemd unit, default config, sysctl + example profiles, license, man page)
# come from inside that tarball; the only extra local source is rcvd.sysusers.
# Nothing else is fetched at build time. See package() for the full file list.
#
# This is the canonical copy. To publish: copy PKGBUILD + rcvd.install into the
# AUR git repo (ssh://aur@aur.archlinux.org/rcvd.git), run `updpkgsums` (from
# pacman-contrib), `makepkg --printsrcinfo > .SRCINFO`, then commit + push to
# master. Bump pkgver (reset pkgrel=1) on an upstream release; bump only pkgrel
# for packaging-only fixes.

pkgname=rcvd
pkgver=0.2.0
pkgrel=1
pkgdesc="Resilient, Cryptographic, Verifiable DNS - privacy-first encrypted DNS engine (DoQ/DoT/DoH)"
# rcvd is a static go binary and supports x86_64, aarch64
arch=('x86_64' 'aarch64')
url="https://rcvd.net"
license=('MIT')
# Static Go binary, so the only runtime dependency is the system CA trust store:
#   - Classic usage (default config): DoT/DoH/DoQ upstreams are verified against
#     the system CAs, so ca-certificates is required. rcvd sets no RootCAs, so
#     Go's x509.SystemCertPool() is what validates the upstream certificate.
#   - Pinned upstreams (pinned_pubkey / SPKI pin): validated by the pin, not the
#     CA store, so those deployments don't strictly need system certs. We still
#     depend on ca-certificates because the shipped default config is unpinned.
depends=('ca-certificates')
makedepends=('go')
install="$pkgname.install"
# Default config is installed to /etc/rcvd/rcvd.toml; preserve user edits on upgrade.
backup=('etc/rcvd/rcvd.toml')
# !lto: Go handles its own linking. !debug: binary is stripped in build() via
# -s -w, so there are no debug symbols to split into an rcvd-debug package.
options=('!lto' '!debug')
source=(
  "$pkgname-$pkgver.tar.gz::https://github.com/rcvd-dns/rcvd/archive/refs/tags/v$pkgver.tar.gz"
  "$pkgname.sysusers"    # local: creates the rcvd service user via systemd-sysusers
  "$pkgname.tmpfiles"    # local: creates /var/log/rcvd via systemd-tmpfiles
)
# First entry gets the release-tarball digest via `updpkgsums`; local files are SKIP.
sha256sums=('SKIP'
            'SKIP'
            'SKIP')

build() {
  cd "$pkgname-$pkgver"

  # Match the upstream production recipe (Makefile / build scripts / Alpine aport):
  # static pure-Go binary, reproducible paths, stripped (-s -w), and stamped so
  # `rcvd --version` reports version/date/source. Without -s -w this ships an
  # unstripped (effectively debug) binary. PIE via Go's internal linker.
  local _date
  _date="$(date -u -d "@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%dT%H:%M:%SZ)"

  export CGO_ENABLED=0
  export GOFLAGS="-trimpath -mod=readonly -modcacherw"
  export GOPATH="$srcdir/gopath"

  go build -buildmode=pie \
    -ldflags "-s -w \
      -X main.version=$pkgver \
      -X main.buildDate=$_date \
      -X main.buildSource=arch" \
    -o rcvd ./cmd/rcvd
}

check() {
  cd "$pkgname-$pkgver"
  export GOPATH="$srcdir/gopath"
  go test ./...
}

package() {
  cd "$pkgname-$pkgver"

  install -Dvm0755 rcvd "$pkgdir/usr/bin/rcvd"

  # sysusers.d: systemd-sysusers creates the rcvd service user at install time.
  install -Dvm0644 "$srcdir/$pkgname.sysusers" \
    "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"

  # tmpfiles.d: systemd-tmpfiles creates /var/log/rcvd (rcvd logs there by default
  # and refuses to start if it is missing). Runs at install time and every boot.
  install -Dvm0644 "$srcdir/$pkgname.tmpfiles" \
    "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"

  # systemd unit ships in the tarball but hardcodes /usr/local/bin (upstream's
  # manual-install default). Arch packages install to /usr/bin, so rewrite the
  # ExecStart path as the unit lands in the package.
  install -dvm0755 "$pkgdir/usr/lib/systemd/system"
  sed 's#/usr/local/bin/rcvd#/usr/bin/rcvd#' \
    packaging/systemd/rcvd.service > "$pkgdir/usr/lib/systemd/system/rcvd.service"

  # sysctl drop-in: larger UDP buffers for quic-go (DoQ / DoH3). Reuse the file
  # shipped for OpenRC/Alpine - net.core.{r,w}mem_max are generic Linux kernel flags
  install -Dvm0644 packaging/OpenRC/rcvd.sysctl.conf \
    "$pkgdir/usr/lib/sysctl.d/30-rcvd.conf"

  # Default config: ship the encrypted-forwarder profile as /etc/rcvd/rcvd.toml
  # (matches the Alpine aport). Listed in backup=() so pacman preserves edits.
  install -Dvm0644 etc/mode1-forwarder-3providers.toml \
    "$pkgdir/etc/$pkgname/rcvd.toml"

  # All example profiles as documentation.
  install -dvm0755 "$pkgdir/usr/share/doc/$pkgname/examples"
  install -m0644 etc/*.toml -t "$pkgdir/usr/share/doc/$pkgname/examples/"
  install -Dvm0644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
  [ -f man/rcvd.1 ] && install -Dvm0644 man/rcvd.1 "$pkgdir/usr/share/man/man1/rcvd.1"
}
