# Config file for update.sh

stuff_repo="
  fdroid https://f-droid.org/repo
  microg https://microg.org/fdroid/repo
  nanolx https://nanolx.org/fdroid/repo
";

stuff_download="
  /system/app/AppleNLPBackend/AppleNLPBackend.apk					repo	fdroid/org.microg.nlp.backend.apple
  /system/app/AuroraDroid/AuroraDroid.apk							gitlab	AuroraOSS/auroradroid							.apk
  /system/app/AuroraStore/AuroraStore.apk							gitlab	AuroraOSS/AuroraStore							.apk
  /system/app/DejaVuNLPBackend/DejaVuNLPBackend.apk					repo	fdroid/org.fitchfamily.android.dejavu
  /system/app/LocalGSMNLPBackend/LocalGSMNLPBackend.apk				github	ploink/Local-GSM-Backend						.apk
  /system/app/LocalWiFiNLPBackend/LocalWiFiNLPBackend.apk			repo	fdroid/org.fitchfamily.android.wifi_backend
  /system/app/MicroGGSFProxy/MicroGGSFProxy.apk						repo	microg/com.google.android.gsf
  /system/app/MozillaUnifiedNLPBackend/MozillaUnifiedNLPBackend.apk	repo	fdroid/org.microg.nlp.backend.ichnaea
  /system/app/NominatimNLPBackend/NominatimNLPBackend.apk			repo	fdroid/org.microg.nlp.backend.nominatim
  /system/framework/com.google.android.maps.zip						github	microg/android_frameworks_mapsv1				.zip
  /system/priv-app/AuroraServices/AuroraServices.apk				gitlab	AuroraOSS/AuroraServices						.apk
  /system/priv-app/FakeStore/FakeStore.apk							repo	microg/com.android.vending
  /system/priv-app/MicroGGMSCore/MicroGGMSCore.apk					repo	microg/com.google.android.gms
  /system/priv-app/MicroGUNLP/MicroGUNLP.apk						repo	fdroid/com.google.android.gms

  /system/app/GoogleCalendarSyncAdapter/-19-21-22-23-24-25-26-27-28-29-/GoogleCalendarSyncAdapter.apk	direct	https://gitlab.opengapps.org/opengapps/all/raw/master/app/com.google.android.syncadapters.calendar/15/nodpi/2015080710.apk
  /system/app/GoogleContactsSyncAdapter/-19-/GoogleContactsSyncAdapter.apk								direct	https://gitlab.opengapps.org/opengapps/all/raw/master/app/com.google.android.syncadapters.contacts/19/nodpi/19.apk
  /system/app/GoogleContactsSyncAdapter/-21-22-/GoogleContactsSyncAdapter.apk							direct	https://gitlab.opengapps.org/opengapps/all/raw/master/app/com.google.android.syncadapters.contacts/21/nodpi/21.apk
  /system/app/GoogleContactsSyncAdapter/-23-/GoogleContactsSyncAdapter.apk								direct	https://gitlab.opengapps.org/opengapps/all/raw/master/app/com.google.android.syncadapters.contacts/23/nodpi/23.apk
  /system/app/GoogleContactsSyncAdapter/-24-25-/GoogleContactsSyncAdapter.apk							direct	https://gitlab.opengapps.org/opengapps/all/raw/master/app/com.google.android.syncadapters.contacts/24/nodpi/24.apk
  /system/app/GoogleContactsSyncAdapter/-26-27-/GoogleContactsSyncAdapter.apk							direct	https://gitlab.opengapps.org/opengapps/all/raw/master/app/com.google.android.syncadapters.contacts/26/nodpi/26.apk
  /system/app/GoogleContactsSyncAdapter/-28-/GoogleContactsSyncAdapter.apk								direct	https://gitlab.opengapps.org/opengapps/all/raw/master/app/com.google.android.syncadapters.contacts/28/nodpi/28.apk
  /system/app/GoogleContactsSyncAdapter/-29-/GoogleContactsSyncAdapter.apk								direct	https://gitlab.opengapps.org/opengapps/all/raw/master/app/com.google.android.syncadapters.contacts/29/nodpi/29.apk
  /system/bin/npem																						direct	https://gitlab.com/nanolx/nanodroid/raw/master/Full/system/xbin/nanodroid-perm
  /system/framework/com.google.android.media.effects.jar												direct	https://gitlab.opengapps.org/opengapps/all/raw/master/framework/19/com.google.android.media.effects.jar
  /system/framework/com.google.widevine.software.drm.jar												direct	https://gitlab.opengapps.org/opengapps/all/raw/master/framework/19/com.google.widevine.software.drm.jar
  /system/lib/-arm--19-21-22-23-24-25-26-27-28-29-/libjni_keyboarddecoder.so							direct	https://gitlab.opengapps.org/opengapps/arm/raw/master/lib/23/libjni_keyboarddecoder.so
  /system/lib/-x86--19-21-22-23-24-25-26-27-28-29-/libjni_keyboarddecoder.so							direct	https://gitlab.opengapps.org/opengapps/x86/raw/master/lib/23/libjni_keyboarddecoder.so
  /system/lib/-arm--19-/libjni_latinimegoogle.so														direct	https://gitlab.opengapps.org/opengapps/arm/raw/master/lib/19/libjni_latinimegoogle.so
  /system/lib/-arm--21-/libjni_latinimegoogle.so														direct	https://gitlab.opengapps.org/opengapps/arm/raw/master/lib/21/libjni_latinimegoogle.so
  /system/lib/-arm--22-/libjni_latinimegoogle.so														direct	https://gitlab.opengapps.org/opengapps/arm/raw/master/lib/22/libjni_latinimegoogle.so
  /system/lib/-arm--23-24-25-26-/libjni_latinimegoogle.so												direct	https://gitlab.opengapps.org/opengapps/arm/raw/master/lib/23/libjni_latinimegoogle.so
  /system/lib/-arm--27-/libjni_latinimegoogle.so														direct	https://gitlab.opengapps.org/opengapps/arm/raw/master/lib/27/libjni_latinimegoogle.so
  /system/lib/-arm--28-29-/libjni_latinimegoogle.so														direct	https://gitlab.opengapps.org/opengapps/arm/raw/master/lib/28/libjni_latinimegoogle.so
  /system/lib/-x86--19-21-22-23-24-25-26-27-28-29-/libjni_latinimegoogle.so								direct	https://gitlab.opengapps.org/opengapps/x86/raw/master/lib/23/libjni_latinimegoogle.so
  /system/lib64/-arm64--19-21-22-23-24-25-26-27-28-29-/libjni_keyboarddecoder.so						direct	https://gitlab.opengapps.org/opengapps/arm64/raw/master/lib64/23/libjni_keyboarddecoder.so
  /system/lib64/-x86_64--19-21-22-23-24-25-26-27-28-29-/libjni_keyboarddecoder.so						direct	https://gitlab.opengapps.org/opengapps/x86_64/raw/master/lib64/23/libjni_keyboarddecoder.so
  /system/lib64/-arm64--19-21-/libjni_latinimegoogle.so													direct	https://gitlab.opengapps.org/opengapps/arm64/raw/master/lib64/21/libjni_latinimegoogle.so
  /system/lib64/-arm64--22-/libjni_latinimegoogle.so													direct	https://gitlab.opengapps.org/opengapps/arm64/raw/master/lib64/22/libjni_latinimegoogle.so
  /system/lib64/-arm64--23-24-25-26-/libjni_latinimegoogle.so											direct	https://gitlab.opengapps.org/opengapps/arm64/raw/master/lib64/23/libjni_latinimegoogle.so
  /system/lib64/-arm64--27-/libjni_latinimegoogle.so													direct	https://gitlab.opengapps.org/opengapps/arm64/raw/master/lib64/27/libjni_latinimegoogle.so
  /system/lib64/-arm64--28-29-/libjni_latinimegoogle.so													direct	https://gitlab.opengapps.org/opengapps/arm64/raw/master/lib64/28/libjni_latinimegoogle.so
  /system/lib64/-x86_64--19-21-22-23-24-25-26-27-28-29-/libjni_latinimegoogle.so						direct	https://gitlab.opengapps.org/opengapps/x86_64/raw/master/lib64/23/libjni_latinimegoogle.so
  /system/priv-app/GoogleBackupTransport/-19-/GoogleBackupTransport.apk									direct	https://gitlab.opengapps.org/opengapps/all/raw/master/priv-app/com.google.android.backuptransport/19/nodpi/19.apk
  /system/priv-app/GoogleBackupTransport/-21-22-/GoogleBackupTransport.apk								direct	https://gitlab.opengapps.org/opengapps/all/raw/master/priv-app/com.google.android.backuptransport/21/nodpi/21.apk
  /system/priv-app/GoogleBackupTransport/-23-/GoogleBackupTransport.apk									direct	https://gitlab.opengapps.org/opengapps/all/raw/master/priv-app/com.google.android.backuptransport/23/nodpi/23.apk
  /system/priv-app/GoogleBackupTransport/-24-25-/GoogleBackupTransport.apk								direct	https://gitlab.opengapps.org/opengapps/all/raw/master/priv-app/com.google.android.backuptransport/24/nodpi/24.apk
  /system/priv-app/GoogleBackupTransport/-26-27-/GoogleBackupTransport.apk								direct	https://gitlab.opengapps.org/opengapps/all/raw/master/priv-app/com.google.android.backuptransport/26/nodpi/26.apk
  /system/priv-app/GoogleBackupTransport/-28-29-/GoogleBackupTransport.apk								direct	https://gitlab.opengapps.org/opengapps/all/raw/master/priv-app/com.google.android.backuptransport/28/nodpi/28.apk
  /system/priv-app/PatchPhonesky/PatchPhonesky.apk														repo	nanolx/com.android.vending
";

pre_update_actions() {

  return 0;

}

post_update_actions() {

  unzipmaps;
  updatedelta;
  verifycerts;
  checkwhitelist;
  return 0;

}

unzipmaps() {

  mapsfile="system/framework/com.google.android.maps";

  [ -f "$resdldir/$mapsfile.zip" ] || return 0;

  echo " ";
  echo " - Unzipping maps JAR...";

  rm -rf "$resdldir/$mapsfile.jar";
  unzip -oq -j "$resdldir/$mapsfile.zip" "$mapsfile.jar" -d "$resdldir/$(dirname "$mapsfile")/";
  rm -rf "$resdldir/$mapsfile.zip";

}

updatedelta() {

  echo " ";
  echo " - Checking resdl delta between updates...";

  newlog=""
  oldlogs=""
  for log in $(ls -t $reldir/update-*.log); do
    [ "$newlog" ] && oldlogs="$oldlogs $(basename "$log")" || newlog="$(basename "$log")";
  done;
  [ "$oldlogs" ] || { echo " -- No old logs to compare"; return 0; }
  for entry in $(cat "$reldir/$newlog" | grep -Po "FILE: [^,;]*" | cut -d" " -f2); do
    line="$(grep "FILE: $entry," "$reldir/$newlog")";
    file="$entry";
    url="$(echo $line | grep -Po "URL: [^,;]*" | cut -d" " -f2)";
    oldurl="";
    for log in $oldlogs; do
      oldurl="$(grep "FILE: $file," "$reldir/$log" | grep -Po "URL: [^,;]*" | cut -d" " -f2)";
      [ "$oldurl" ] && break;
    done;
    [ "$oldurl" ] || oldurl="None";
    [ "$url" = "$oldurl" ] && continue;
    echo " -- Updated file: $file"
    echo "   ++ Old URL: $oldurl"
    echo "   ++ New URL: $url"
    echo "   ++ Old name: $(basename $oldurl)"
    echo "   ++ New name: $(basename $url)"
  done;

}

verifycerts() {

  [ "$(which jarsigner)" ] && [ "$(which openssl)" ] || {
    echo " ";
    echo " !! Not checking certificates (missing jarsigner or openssl)";
    return 0;
  }

  certdir="$resdldir/util/certs";

  echo " ";
  echo " - Checking certs for repos...";

  for repo in $(echo "$stuff_repo" | select_word 1); do
    certobject="repo/$repo.cer";
    jarsigner -verify "$tmpdir/repos/$repo.jar" > /dev/null || {
      echo "  !! Verification failed for repo ($repo)" >&2;
      continue;
    }
    [ -f "$certdir/$certobject" ] || {
      echo "  -- Adding cert for new repo ($repo)";
      mkdir -p "$certdir/$(dirname "$certobject")";
      unzip -p "$tmpdir/repos/$repo.jar" "META-INF/*.RSA" | openssl pkcs7 -inform der -print_certs > "$certdir/$certobject";
      continue;
    }
    unzip -p "$tmpdir/repos/$repo.jar" "META-INF/*.RSA" | openssl pkcs7 -inform der -print_certs > "$tmpdir/tmp.cer";
    [ "$(diff -w "$tmpdir/tmp.cer" "$certdir/$certobject")" ] && {
      echo "  !! Cert mismatch for repo ($repo)" >&2;
      cp -f "$tmpdir/tmp.cer" "$certdir/$certobject.new";
    }
  done;

  echo " ";
  echo " - Checking certs for APKs...";

  for object in $(echo "$stuff_download" | grep -P "^[ \t]*[^ \t]+.apk[ \t]+" | select_word 1); do
    certobject="$(dirname "$object")/$(basename "$object" .apk).cer";
    jarsigner -verify "$resdldir/$object" > /dev/null || {
      echo "  !! Verification failed for APK ($object)" >&2;
      continue;
    }
    [ -f "$certdir/$certobject" ] || {
      echo "  -- Adding cert for new APK ($object)";
      mkdir -p "$certdir/$(dirname "$certobject")";
      unzip -p "$resdldir/$object" "META-INF/*.RSA" | openssl pkcs7 -inform der -print_certs > "$certdir/$certobject";
      continue;
    }
    unzip -p "$resdldir/$object" "META-INF/*.RSA" | openssl pkcs7 -inform der -print_certs > "$tmpdir/tmp.cer";
    [ "$(diff -w "$tmpdir/tmp.cer" "$certdir/$certobject")" ] && {
      echo "  !! Cert mismatch for APK ($object)" >&2;
      cp -f "$tmpdir/tmp.cer" "$certdir/$certobject.new";
    }
  done;

}

checkwhitelist() {

  [ "$(which aapt)" ] || {
    echo " ";
    echo " !! Not checking privperms (missing aapt)";
    return 0;
  }

  privpermlist="util/privperms.lst";
  privpermurl="https://developer.android.com/reference/android/Manifest.permission";

  echo " ";
  echo " - Getting priv-app permissions...";

  curl --progress-bar "$privpermurl" -o "$tmpdir/tmppage" || { echo "ERROR: Android permission docpage failed to download" >&2; return 1; }

  lines="$(grep -Pn "<!-- [=]* [A-Z ]* [=]* -->" "$tmpdir/tmppage" | grep -A1 "ENUM CONSTANTS DETAIL" | sed "s|:| |g" | select_word 1)";
  for line in $lines; do
    [ "$startline" ] && endline="$line" || startline="$line";
  done;
  cat "$tmpdir/tmppage" | tail -n+"$(($startline + 1))" | head -n"$(($endline - $startline - 1))" | tr -d "\n" | sed "s|<div data|\n|g" | grep "Not for use by third-party applications" | grep -oE "android.permission.[A-Z_]*" > "$tmpdir/tmplist";
  echo "android.permission.FAKE_PACKAGE_SIGNATURE" >> "$tmpdir/tmplist";

  cat "$resdldir/$privpermlist" "$tmpdir/tmplist" 2>/dev/null | sort -u > "$tmpdir/sortedlist";
  mkdir -p "$resdldir/$(dirname "$privpermlist")"
  mv -f "$tmpdir/sortedlist" "$resdldir/$privpermlist";

  echo " ";
  echo " - Checking priv-app permissions...";

  for object in $(echo "$stuff_download" | grep -P "^[ \t]*/system/priv-app/[^ \t]+.apk[ \t]+" | select_word 1); do
    [ -f "$resdldir/$object" ] || { echo "ERROR: Privapp $object not found" >&2; continue; }
    privperms="";
    privapppackage="$(aapt dump badging "$resdldir/$object" | grep -o "package: name=[^ ]*" | sed "s|'| |g" | select_word 3)"
    privappperms="$(aapt dump permissions "$resdldir/$object" | grep -o "uses-permission: name=[^ ]*" | sed "s|'| |g" | select_word 3 | sort -u)";
    for privperm in in $privappperms; do
      grep -q "$privperm" "$resdldir/$privpermlist" || continue;
      grep -q "$privperm" "$resdir/system/etc/permissions/$privapppackage.xml" 2>/dev/null && continue;
      privperms="$privperm $privperms";
    done;
    [ "$privperms" ] || continue;
    echo " ";
    echo " -- File: $object";
    echo " -- Package: $privapppackage";
    for permentry in $privperms; do
      echo "   ++ Needs whitelisting perm $permentry";
    done;
  done;

}