# Verified upstream kit plus a separately pinned Omarchy patch.
# Normal reruns need a fresh build directory; makepkg -e reuses verified extracted trees.
# Profile kit: original source bytes and separately committed packaging tooling.
# shellcheck shell=bash disable=SC2034,SC2154
pkgname=cua-hyprland-plugin
pkgver=0.32.0
# Profile validation starts package releases at 2, above upstream's generic -1 build of the same Driver.
pkgrel=3
pkgdesc='Cua input candidate for reviewed profile omarchy-hyprland-0562r4-remaps'
arch=('x86_64')
url='https://github.com/trycua/cua'
license=('MIT')
depends=('hyprland=0.56.2-4' 'aquamarine=0.15.1-1' 'glibc=2.44+r50+g1848099f063e-1' 'hyprcursor=0.1.13-7' 'hyprgraphics=0.5.1-4' 'hyprlang=0.6.8-5' 'hyprutils=0.14.2-1' 'libgcc=16.2.1+r23+gd564253eb6c8-1' 'libstdc++=16.2.1+r23+gd564253eb6c8-1' 'libxkbcommon=1.13.2-1' 'wayland=1.26.0-1' 'python>=3.11' 'binutils')
makedepends=('cmake>=3.30' 'ninja' 'pkgconf' 'gcc' 'patch')
options=('!strip' '!debug' '!lto')
_stem='cua-hyprland-plugin-0.32.0-58aba84b5b83d77e7e2b0f006547699eb594e50d'
_archive_sha256='25bc3b2d353ba6bb6ecd17e4b67b11b0d6b731a5ae01025197442c97e50acf7a'
_kit_sha256='3c2141dcb2583d918ef2cdb6ff3805dec62119a439a29c811a93cc980d621423'
_profile_sha256='b20d98979137fb5216768d95215f80d372d9bfd2269b541d7bcf664a12f80b97'
_verifier_sha256='480f649cbd35a0ddc7f49dc0a3a44785402c9e0ec9653b0f8ea4965d52d7f900'
_cxx="${CUA_RELEASE_CXX:-/usr/bin/g++}"
_download_name='cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz'
_download_sha256='a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520'
source=('https://github.com/trycua/cua/releases/download/cua-hyprland-kit-v1.1.0-omarchy-stable-20260910/cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7-profile-omarchy-stable-20260910-kit-1.1.0-5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a-67f89ceb47edd973aa748820eadd02ddbfb3d3e4.tar.gz'
        "https://github.com/trycua/cua/releases/download/cua-driver-rs-v${pkgver}/${_stem}.tar.gz"
        'PROFILE.json')
noextract=("$_download_name" "${_stem}.tar.gz")
sha256sums=('a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520'
            '25bc3b2d353ba6bb6ecd17e4b67b11b0d6b731a5ae01025197442c97e50acf7a'
            'b20d98979137fb5216768d95215f80d372d9bfd2269b541d7bcf664a12f80b97')

# Downstream inputs are also checked explicitly when makepkg integrity is skipped.
declare -gA _downstream_sha256=(
  ['downstream.patch']='87d3f560cfbd195748321a7e7ad2cb921c77cc022877de7890d3a711940f6e3c'
  ['DOWNSTREAM-PROVENANCE.json']='814e136f4684886107b5ccfa7ffc773a1ad0cea7dcddebd977c6f35c6e87ce00'
  ['downstream.py']='7c9725805ad038737bd4d346c85f27991ce9ddfff436a32ebf515cad1bf98ca1'
  ['downstream_test.py']='7b9a992979b22a5e061fdf011ac6be59a3f1ae6e0d7c0a8ff631f74e71984c5a'
)
source+=('downstream.patch' 'DOWNSTREAM-PROVENANCE.json' 'downstream.py' 'downstream_test.py')
sha256sums+=('87d3f560cfbd195748321a7e7ad2cb921c77cc022877de7890d3a711940f6e3c' '814e136f4684886107b5ccfa7ffc773a1ad0cea7dcddebd977c6f35c6e87ce00' '7c9725805ad038737bd4d346c85f27991ce9ddfff436a32ebf515cad1bf98ca1' '7b9a992979b22a5e061fdf011ac6be59a3f1ae6e0d7c0a8ff631f74e71984c5a')

_verify_download() {
  python3 -I - "$SRCDEST/$_download_name" "$_download_sha256" "$srcdir" "$1" "$SRCDEST/PROFILE.json" \
    "$SRCDEST/${_stem}.tar.gz" <<'CUA_DOWNLOAD_PY'
import hashlib
import io
import json
from pathlib import Path, PurePosixPath
import sys
import tarfile

expected = {'KIT-PROVENANCE.json': '7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997', 'PKGBUILD': 'b945a6a6eda13d0e382770edd5419485e3196041956663eb38f5183b05d30db3', 'PROFILE-PKGBUILD.in': 'c350d1b2375946cb0166893d67a1fc01344ee5e3215bbe801b4d54bb361d6bce', 'PROFILE-USAGE.md': 'c14d8e8103fccab59e558758f4249f86bce700a8723cd4ba1b97b1102e02bbd2', 'PROFILE.json': '5dacea79a6a5927e59fca7b51e6c04e94fa45133ac1b8fb7f4e1f442d113eb9a', 'SHA256SUMS': '34a2126bcfab983f171382aafac3ef218475b652f4583c58f4a04088044cb935', 'SOURCE-PROVENANCE.json': '54f514664c84e1358a435f29cd6befd5661b0b133d76997191c000b10f021a75', 'cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7.tar.gz': '47bca9e018f32f4fcfe683f91c7475c60368f3b65d318cc35c1f2de88a4ee9ab', 'lifecycle.py': 'b18dceb8b8e05b93586ddd3a2f1d90d70ae1c36088e54fc05c89e08585290990', 'profile_bundle.py': 'ac883883814787da477c037f017939ee92c9fb5f46f373af7de1331b24f1f6da', 'profile_verify.py': '480f649cbd35a0ddc7f49dc0a3a44785402c9e0ec9653b0f8ea4965d52d7f900'}
kit_stem = 'cua-hyprland-plugin-0.26.1-cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7'
stem = 'cua-hyprland-plugin-0.32.0-58aba84b5b83d77e7e2b0f006547699eb594e50d'

def require(condition, message):
    if not condition:
        raise SystemExit(message)

def digest(data):
    return hashlib.sha256(data).hexdigest()

archive, checksum, srcdir, mode, profile_path, source_path = sys.argv[1:]
archive, srcdir = Path(archive), Path(srcdir)
require(mode in {'check', 'extract'}, 'invalid kit verification mode')
require(archive.is_file() and not archive.is_symlink(), 'outer archive must be a regular file')
data = archive.read_bytes()
require(digest(data) == checksum, 'outer archive checksum mismatch')
payload = {}
with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as contents:
    for member in contents:
        require(member.isfile() and not member.issparse() and not member.pax_headers,
                'nonregular outer kit member')
        require(member.name in expected and member.name not in payload, 'outer kit inventory mismatch')
        content = contents.extractfile(member).read()
        require(digest(content) == expected[member.name], 'outer kit member checksum mismatch')
        payload[member.name] = content
require(payload.keys() == expected.keys(), 'outer kit inventory mismatch')
# Rebase the kit onto the Driver 0.32.0 source release, whose manifest has the fields
# this verifier checks, and derive the reviewed Omarchy edge profile for it.
# Tooling, compiler and runtime hashes stay upstream's. The compositor and its
# headers are re-measured from Arch's 0.56.2-4 rebuild of the same Hyprland release.
source_file = Path(source_path)
require(source_file.is_file() and not source_file.is_symlink(), 'source archive must be a regular file')
source_data = source_file.read_bytes()
require(digest(source_data) == '25bc3b2d353ba6bb6ecd17e4b67b11b0d6b731a5ae01025197442c97e50acf7a',
        'source archive checksum mismatch')
with tarfile.open(fileobj=io.BytesIO(source_data), mode='r:gz') as contents:
    manifest_data = contents.extractfile(stem + '/SOURCE-PROVENANCE.json').read()
manifest = json.loads(manifest_data)
del payload[kit_stem + '.tar.gz']
payload[stem + '.tar.gz'] = source_data
payload['SOURCE-PROVENANCE.json'] = manifest_data
identity = {'revision': manifest['source_revision'], 'driver_version': manifest['driver_version'],
          'archive_sha256': digest(source_data), 'manifest_sha256': digest(manifest_data)}
profile_data = Path(profile_path).read_bytes()
require(digest(profile_data) == 'b20d98979137fb5216768d95215f80d372d9bfd2269b541d7bcf664a12f80b97',
        'local profile checksum mismatch')
profile = json.loads(payload['PROFILE.json'])
profile.update(profile_id='omarchy-hyprland-0562r4-remaps', package_release=3, source=identity)
profile['hyprland'].update(package_version='0.56.2-4',
                           sha256='55da553be71222566ee73b973d2f56dbb9939044d8f22f81aa54b66c83f2f6d1',
                           headers_sha256='1fdefe6ac027a159d04a5dfee4928ec7ebd15544a9a25b5f66d2f5a46fcf364a')
profile['runtime']['packages'].update(aquamarine='0.15.1-1', glibc='2.44+r50+g1848099f063e-1')
require(json.loads(profile_data) == profile,
        'local profile changes more than the reviewed source, package versions and re-measured compositor')
payload['PROFILE.json'] = profile_data
provenance = json.loads(payload['KIT-PROVENANCE.json'])
provenance.update(profile_sha256=digest(profile_data), source=identity)
payload['KIT-PROVENANCE.json'] = (json.dumps(provenance, sort_keys=True, indent=2) + '\n').encode()
# Render the recipe the way the kit's own profile_verify.render_recipe does.
recipe = payload['PROFILE-PKGBUILD.in'].decode()
for key, value in {'DRIVER_VERSION': identity['driver_version'], 'PKGREL': str(profile['package_release']),
                   'PROFILE_ID': profile['profile_id'], 'STEM': stem,
                   'HYPRLAND_PACKAGE': profile['hyprland']['package_version'],
                   'RUNTIME_DEPENDS': ' '.join(f"'{name}={version}'" for name, version
                                               in sorted(profile['runtime']['packages'].items())),
                   'ARCHIVE_SHA256': identity['archive_sha256'], 'PROFILE_SHA256': digest(profile_data),
                   'KIT_SHA256': digest(payload['KIT-PROVENANCE.json']),
                   'VERIFIER_SHA256': provenance['tooling_files']['profile_verify.py']}.items():
    recipe = recipe.replace(f'@{key}@', value)
payload['PKGBUILD'] = recipe.encode()
payload['SHA256SUMS'] = ''.join(f'{digest(body)}  {name}\n' for name, body in sorted(payload.items())
                              if name != 'SHA256SUMS').encode()
del expected[kit_stem + '.tar.gz']
expected.update({stem + '.tar.gz': '25bc3b2d353ba6bb6ecd17e4b67b11b0d6b731a5ae01025197442c97e50acf7a',
                 'SOURCE-PROVENANCE.json': '292ac8fa09bec96cbd499d5d57cc8ea9b1c00fe6347162fb6960c45f972bdb9d',
                 'PROFILE.json': 'b20d98979137fb5216768d95215f80d372d9bfd2269b541d7bcf664a12f80b97',
                 'KIT-PROVENANCE.json': '3c2141dcb2583d918ef2cdb6ff3805dec62119a439a29c811a93cc980d621423',
                 'PKGBUILD': '610d426d6f88238fc6fae56afc1d54ba7866800d14e97777d9b47ddc9b347cc0',
                 'SHA256SUMS': '093dc8708a9b440977662d7f00bccace24b0b9253e6bf0d1decad2655b886881'})
require(payload.keys() == expected.keys(), 'derived kit inventory mismatch')
for name, content in payload.items():
    require(digest(content) == expected[name], 'derived kit checksum mismatch: ' + name)
require(srcdir.is_dir() and not srcdir.is_symlink(), 'srcdir must be a real directory')
kit, source = srcdir / 'cua-profile-kit', srcdir / stem
if mode == 'extract':
    require(not kit.exists() and not kit.is_symlink() and not source.exists() and not source.is_symlink(),
            'prepare requires fresh kit and source destinations; use a clean srcdir')
    source_payload = {}
    with tarfile.open(fileobj=io.BytesIO(payload[stem + '.tar.gz']), mode='r:gz') as contents:
        for member in contents:
            require(member.isfile() and not member.issparse() and not member.pax_headers and
                    member.name.startswith(stem + '/'), 'invalid source member')
            name = member.name[len(stem) + 1:]
            path = PurePosixPath(name)
            require(name and path.as_posix() == name and not path.is_absolute() and
                    '..' not in path.parts and '\\' not in name and name not in source_payload,
                    'unsafe or duplicate source path')
            source_payload[name] = contents.extractfile(member).read()
    kit.mkdir()
    source.mkdir()
    for name, content in payload.items():
        (kit / name).write_bytes(content)
    for name, content in source_payload.items():
        destination = source / name
        destination.parent.mkdir(parents=True, exist_ok=True)
        destination.write_bytes(content)
require(kit.is_dir() and not kit.is_symlink(), 'kit must be a real directory')
require({path.name for path in kit.iterdir()} == expected.keys(), 'extracted kit inventory mismatch')
for name, checksum in expected.items():
    path = kit / name
    require(path.is_file() and not path.is_symlink() and digest(path.read_bytes()) == checksum,
            'extracted kit checksum mismatch: ' + name)
CUA_DOWNLOAD_PY
}

_verify() {
  printf '%s  %s\n' "$_download_sha256" "$SRCDEST/$_download_name" | sha256sum -c - || return 1
  _verify_download check || return 1
  # Explicit checks still apply to --skipinteg, --noextract and --repackage.
  printf '%s  %s\n' "$_archive_sha256" "$srcdir/cua-profile-kit/${_stem}.tar.gz" | sha256sum -c - || return 1
  printf '%s  %s\n' "$_kit_sha256" "$srcdir/cua-profile-kit/KIT-PROVENANCE.json" | sha256sum -c - || return 1
  printf '%s  %s\n' "$_profile_sha256" "$srcdir/cua-profile-kit/PROFILE.json" | sha256sum -c - || return 1
  printf '%s  %s\n' "$_verifier_sha256" "$srcdir/cua-profile-kit/profile_verify.py" | sha256sum -c - || return 1
  python3 "$srcdir/cua-profile-kit/profile_verify.py" --kit "$srcdir/cua-profile-kit" --kit-sha256 "$_kit_sha256" \
    --archive "$srcdir/cua-profile-kit/${_stem}.tar.gz" --source "$srcdir/$_stem" --cxx "$_cxx"
}

_downstream() {
  local name
  for name in downstream.patch DOWNSTREAM-PROVENANCE.json downstream.py downstream_test.py; do
    printf '%s  %s\n' "${_downstream_sha256[$name]}" "$SRCDEST/$name" | sha256sum -c - || return 1
  done
  python3 -B "$SRCDEST/downstream.py" "$1" \
    --pristine "$srcdir/$_stem" --source "$srcdir/omarchy-source" \
    --patch "$SRCDEST/downstream.patch" --manifest "$SRCDEST/DOWNSTREAM-PROVENANCE.json" \
    --kit "$srcdir/cua-profile-kit" --kit-sha256 "$_kit_sha256" \
    --archive "$srcdir/cua-profile-kit/${_stem}.tar.gz" --cxx "$_cxx" "${@:2}"
}

prepare() {
  _verify_download extract || return 1
  _verify || return 1
  _downstream prepare
}

build() {
  _verify || return 1
  _downstream check || return 1
  cmake -S "$srcdir/omarchy-source" -B "$srcdir/build" -G Ninja \
    -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER="$_cxx" \
    -DPKG_CONFIG_EXECUTABLE=/usr/bin/pkgconf -DPKG_CONFIG_ARGN= \
    -DPKG_CONFIG_USE_CMAKE_PREFIX_PATH=OFF -DCMAKE_PREFIX_PATH= \
    -DBUILD_TESTING=ON -DCUA_HYPRLAND_BUILD_PLUGIN=ON \
    -DCUA_HYPRLAND_EXPECTED_VERSION=0.56.2 \
    -DCUA_HYPRLAND_INPUT=ON -DCUA_HYPRLAND_TEST_INPUT=OFF \
    -DCUA_HYPRLAND_INPUT_TRACE=OFF -DCUA_HYPRLAND_TEST_OPERATOR_KEY= || return 1
  cmake --build "$srcdir/build"
}

check() {
  _verify || return 1
  _downstream check || return 1
  python3 -B "$SRCDEST/downstream_test.py" || return 1
  (
    unset LD_PRELOAD FAKEROOTKEY FAKED_MODE
    ctest --test-dir "$srcdir/build" --output-on-failure --no-tests=error
  )
}

package() {
  check || return 1
  _downstream build --build "$srcdir/build" --output "$srcdir/BUILD-PROVENANCE.json" || return 1
  install -Dm755 "$srcdir/build/cua-hyprland-plugin.so" \
    "$pkgdir/usr/lib/cua/hyprland/cua-hyprland-plugin.so" || return 1
  install -Dm644 "$srcdir/$_stem/LICENSE.md" \
    "$pkgdir/usr/share/licenses/$pkgname/LICENSE" || return 1
  install -Dm644 "$srcdir/$_stem/SOURCE-PROVENANCE.json" \
    "$pkgdir/usr/share/$pkgname/SOURCE-PROVENANCE.json" || return 1
  local name
  install -Dm644 "$srcdir/BUILD-PROVENANCE.json" "$pkgdir/usr/share/$pkgname/BUILD-PROVENANCE.json" || return 1
  for name in KIT-PROVENANCE.json PROFILE.json profile_verify.py; do
    install -Dm644 "$srcdir/cua-profile-kit/$name" "$pkgdir/usr/share/$pkgname/$name" || return 1
  done
  for name in DOWNSTREAM-PROVENANCE.json downstream.patch; do
    install -Dm644 "$SRCDEST/$name" "$pkgdir/usr/share/$pkgname/$name" || return 1
  done
}