# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
name    = "ca-certificates"
version = "20260611"
license = "MPL-2.0"

[source]
tarball = "https://gitlab.alpinelinux.org/alpine/ca-certificates/-/archive/20260611/ca-certificates-20260611.tar.bz2"
# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
# sha512 = "f473a1111eb508ef5d1096489479dba07db6b0d76ef2b900b3473933d57419429061d83e9c1e881ab61c4b0f17c64859ec74d670da6fc1d83d9b0fa73e1b7d8d"
sha256  = "32ca73f2e81e2b88dc614f12e1ee04a82b1ec5a8e29d9f359ddf8905a0afcbb0"

[build]
compiler = "zig-cc"
target   = "x86_64-linux-musl"
link     = "static"

# Split de la info de depuración (SDD 23 etapa 4, tanda de HOJAS). Entra en `hash_inputs`.
strip_debug = true
flags    = []

# openssl aporta libcrypto.a al overlay del sandbox (/usr/lib) para enlazar c_rehash
# (`-lcrypto`). El resto del build (mk-ca-bundle.pl → cert.pem → split-ca-bundle.sh) usa
# el perl + coreutils del rootfs; no requiere el CLI de openssl.
[deps]
build = ["binutils", "openssl", "perl"]

[build.phases]
# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
compile = '''
_abuild_phase() {
make
}
_abuild_phase
'''
# de package() de Alpine (traducido $pkgdir→/out):
install = '''
_abuild_phase() {
make install DESTDIR="/out"

	(
		echo "# Automatically generated by ca-certificates-20260611-r$pkgrel"
		echo "# $(date -ud@$SOURCE_DATE_EPOCH)"
		echo "#"
		cd "/out"/usr/share/ca-certificates
		find . -name '*.crt' | sort | cut -b3-
	) > "/out"/etc/ca-certificates.conf

	# generate the bundle in similar way as update-ca-certificates would do
	find -- *.crt | sort | while read -r i; do
		cat "$i"
		printf "\n"
	done > "/out"/etc/ssl/certs/ca-certificates.crt

	mkdir -p "/out"/etc/apk/protected_paths.d
	cat > "/out"/etc/apk/protected_paths.d/ca-certificates.list <<-EOF
		-etc/ssl/certs/ca-certificates.crt
		-etc/ssl/certs/ca-cert-*.pem
		-etc/ssl/certs/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].[r0-9]*
	EOF

	cat > "/out"/etc/ca-certificates/update.d/certhash <<-EOF
		#!/bin/sh
		exec /usr/bin/c_rehash /etc/ssl/certs
	EOF
	chmod +x "/out"/etc/ca-certificates/update.d/certhash
}
_abuild_phase
'''