#!/usr/bin/env bash
# Author:  cirakg & claude ai
# Summary: Generate the RSA-4096 developer key that signs every build, never overwriting an existing one.
#
# Generate the developer key that signs every build (README section 15.6).
#
# Output: .cache/keys/developer_key.der (PKCS#8 DER, what monkeyc wants) and
# developer_key.pem, both mode 600 and git-ignored. An existing key is never
# overwritten: the Connect IQ Store rejects updates signed with a different
# key, so replacing it by accident would strand the published app.
set -euo pipefail
# shellcheck source=ciq-env.sh
source "$(dirname "${BASH_SOURCE[0]}")/ciq-env.sh"

umask 077
mkdir -p "${KEY_DIR}"

if [[ -f "${DEV_KEY}" ]]; then
  log "Developer key already exists at .cache/keys/developer_key.der; leaving it untouched."
  exit 0
fi

log "Generating a 4096-bit RSA developer key (this takes a few seconds)..."
openssl genrsa -out "${KEY_DIR}/developer_key.pem" 4096 2>/dev/null
openssl pkcs8 -topk8 -inform PEM -outform DER -nocrypt \
  -in "${KEY_DIR}/developer_key.pem" -out "${DEV_KEY}"
chmod 600 "${KEY_DIR}/developer_key.pem" "${DEV_KEY}"

# A short fingerprint of the public key, so a backup can be recognised later.
fingerprint="$(openssl pkey -in "${KEY_DIR}/developer_key.pem" -pubout -outform DER \
  | sha256sum | cut -c1-16)"

cat >&2 <<EOF

Developer key created: .cache/keys/developer_key.der
Public key fingerprint (SHA-256, first 16 hex digits): ${fingerprint}

BACK IT UP NOW. Copy the folder .cache/keys/ to an encrypted place (a password
manager attachment or an encrypted USB drive). Garmin rejects app updates that
are signed with a different key; without this key you would have to publish a
new app and re-add every entry on the watch. 'make nuke' deletes this folder.
EOF