# fdroidserver-ipfs: docker-executable-fdroidserver patched for IPFS publishing.
#
# Two changes vs. upstream (see SPEC.md):
#   1. Install ipfs-cid so fdroidserver populates ipfsCIDv1 on all package
#      files (APKs, icons, screenshots). fdroidclient with an IPFS-gateway
#      mirror configured then fetches those by CID.
#   2. Install rehash.py as `fdroidserver-ipfs-rehash` — a post-`fdroid update`
#      wrapper that adds ipfsCIDv1 to entry["index"], renames the index to a
#      content-addressed filename, and re-signs entry.jar. Run it once after
#      every `fdroid update`.
#
# Base is pinned via build-arg. The weekly cron in .gitea/workflows/build.yaml
# picks up upstream :master refreshes without a source change.

ARG FDROIDSERVER_IMAGE=registry.gitlab.com/fdroid/docker-executable-fdroidserver:master
ARG IMAGE_SOURCE=

FROM ${FDROIDSERVER_IMAGE}
ARG IMAGE_SOURCE

# Links the published OCI package to its source repo so Gitea inherits
# visibility (public repo → publicly pullable image, no auth needed).
LABEL org.opencontainers.image.source="${IMAGE_SOURCE}"
LABEL org.opencontainers.image.description="fdroidserver with ipfs-cid + post-update CID/cache-bust wrapper for IPFS publishing."
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"

# Change 1. Debian's ipfs-cid package installs the `ipfs_cid` *binary* that
# fdroidserver finds via shutil.which(). The PyPI package of the same name
# is a Python library only and ships no binary — using pip would silently
# leave CID generation disabled.
RUN apt-get update \
 && apt-get install -y --no-install-recommends ipfs-cid \
 && rm -rf /var/lib/apt/lists/*

# Change 2.
COPY rehash.py /usr/local/bin/fdroidserver-ipfs-rehash
RUN chmod +x /usr/local/bin/fdroidserver-ipfs-rehash

# Override the upstream entrypoint so `fdroid update` automatically chains
# into `fdroidserver-ipfs-rehash`. Drop-in for the wrapper script — callers
# don't change their invocation.
COPY entrypoint.sh /usr/local/bin/fdroidserver-ipfs-entrypoint
RUN chmod +x /usr/local/bin/fdroidserver-ipfs-entrypoint
ENTRYPOINT ["/usr/local/bin/fdroidserver-ipfs-entrypoint"]
CMD ["--help"]

# Sanity gate: source bsenv.sh (the upstream entrypoint does the same) so
# ${fdroidserver} resolves, then verify every component our additions touch.
RUN . /etc/profile.d/bsenv.sh \
 && command -v ipfs_cid \
 && test -x "${fdroidserver}/fdroid" \
 && command -v fdroidserver-ipfs-rehash \
 && command -v fdroidserver-ipfs-entrypoint \
 && PYTHONPATH="${fdroidserver}" python3 -c "from fdroidserver import common, signindex"