#!/usr/bin/make -f
export PYBUILD_NAME=dangerzone
export DEB_BUILD_OPTIONS=nocheck
export PYBUILD_INSTALL_ARGS=--install-lib=/usr/lib/python3/dist-packages
export PYTHONDONTWRITEBYTECODE=1
export DH_VERBOSE=1

# Reproducible builds: pin the build epoch to the latest debian/changelog
# entry (dpkg, debhelper, and dh_builddeb honor SOURCE_DATE_EPOCH for file
# mtimes and archive metadata), and force a deterministic locale/timezone
# so that any tool that emits sorted output or timestamps does so
# identically across machines.
# https://reproducible-builds.org/docs/source-date-epoch/
export SOURCE_DATE_EPOCH ?= $(shell dpkg-parsechangelog -STimestamp)
export LC_ALL=C.UTF-8
export TZ=UTC

%:
	dh $@ --with python3 --buildsystem=pybuild

override_dh_install:
	dh_install
	# pybuild stages the dangerzone package and its console_scripts under
	# debian/python3-dangerzone/. Since python3-dangerzone is not shipped
	# as a binary package, fold its contents into debian/dangerzone/ so
	# /usr/bin/dangerzone-* and the Python module land in the slim package.
	cp -a debian/python3-dangerzone/. debian/dangerzone/
	# Populate the dangerzone-full staging directory from the slim one.
	# Both packages are identical except dangerzone-full keeps container.tar.
	cp -a debian/dangerzone/. debian/dangerzone-full/
	# Explicitly install container.tar into dangerzone-full: pybuild does not
	# include it because it is gitignored and absent from the build environment.
	install -Dm 644 share/container.tar debian/dangerzone-full/usr/share/dangerzone/container.tar
	rm -f debian/dangerzone/usr/share/dangerzone/container.tar

override_dh_builddeb:
	./install/linux/debian-vendor-pymupdf.py --dest debian/dangerzone/usr/lib/python3/dist-packages/dangerzone/vendor/
	./install/linux/debian-vendor-pymupdf.py --dest debian/dangerzone-full/usr/lib/python3/dist-packages/dangerzone/vendor/
	rm -f debian/dangerzone/usr/bin/dangerzone-machine
	rm -f debian/dangerzone-full/usr/bin/dangerzone-machine
	# Clamp file mtimes in the staging trees to SOURCE_DATE_EPOCH so the
	# resulting data.tar inside each .deb is byte-identical across builds.
	# `install` and pybuild do not preserve mtimes, so without this step
	# the .deb embeds the wall-clock time of the build.
	find debian/dangerzone debian/dangerzone-full -exec \
		touch --no-dereference --date=@$(SOURCE_DATE_EPOCH) {} +
	dh_builddeb $@
