#!/bin/sh
# Scutarius finish-install hook for SBC targets (installed as
# /usr/lib/finish-install.d/07scutarius-sbc by the arch_tree rule).
# Spec: docs/superpowers/specs/2026-08-24-installer-sbc-media-design.md S9/S10.
# Board-conditional on the device-tree compatible; no-op elsewhere (GB10 is
# ACPI/DMI, no /proc/device-tree).
. /usr/share/debconf/confmodule

COMPAT=$(tr '\0' '\n' < /proc/device-tree/compatible 2>/dev/null | head -1)
log() { logger -t scutarius-sbc "$@" 2>/dev/null || echo "scutarius-sbc: $@" >&2; }

# Runtime-loaded templates (this hook owns no udeb templates file).
TPL=/tmp/scutarius-sbc.templates
cat > $TPL <<'EOT'
Template: scutarius/sbc-flash-spi
Type: boolean
Default: true
Description: Flash EDK2 firmware to SPI NOR now?
 This board boots from SPI NOR first. Flashing the Scutarius-served
 edk2-rk3588 image to SPI makes the installed system boot from NVMe without
 the SD card. The SPI copy starts with fresh defaults: re-set the Device
 Tree mode setting once on first boot. Only decline if you intend to keep
 booting firmware from the SD card.

Template: scutarius/sbc-wipe-sd
Type: boolean
Default: true
Description: Remove the installer from the SD card (keep u-boot)?
 This board has no SPI flash: the SD card remains the permanent home of
 u-boot, which scans the SD card first at every boot. Wiping the installer
 payload (everything after the first 16 MB) lets u-boot fall through to the
 system installed on NVMe. Only decline to keep the card as installer media.
EOT
debconf-loadtemplate scutarius $TPL || true

case "$COMPAT" in
  radxa,rock-5b*|radxa,rock5b*)
    # S9: flash EDK2 to SPI NOR so the board boots like peter without the SD.
    IMGDIR=/target/usr/share/scutarius-firmware-rk3588-edk2
    IMG=$IMGDIR/rock-5bplus_UEFI_Release_v1.1.img
    if [ ! -f "$IMG" ]; then
      apt-install scutarius-firmware-rk3588-edk2 || true
    fi
    [ -f "$IMG" ] || { log "5b+: firmware package missing in /target; SPI not flashed"; exit 0; }
    MTD=""; for m in /dev/mtd0 /target/dev/mtd0; do [ -c "$m" ] && { MTD=$m; break; }; done
    [ -n "$MTD" ] || { log "5b+: no /dev/mtd0 (SPI NOR not probed); SPI not flashed"; exit 0; }
    db_input critical scutarius/sbc-flash-spi || true
    db_go || true
    db_get scutarius/sbc-flash-spi
    [ "$RET" = true ] || { log "5b+: SPI flash declined"; exit 0; }
    ( cd "$IMGDIR" && sha256sum -c SHA256SUMS ) || { log "5b+: firmware sha256 MISMATCH; refusing to flash"; exit 0; }
    if in-target sh -c 'command -v flashcp' >/dev/null 2>&1 || apt-install mtd-utils; then
      in-target flashcp -v /usr/share/scutarius-firmware-rk3588-edk2/rock-5bplus_UEFI_Release_v1.1.img /dev/mtd0 \
        && log "5b+: SPI NOR flashed (edk2-rk3588 v1.1)" \
        || log "5b+: flashcp FAILED; SPI state unknown -- do not remove the SD"
    else
      log "5b+: mtd-utils unavailable; SPI not flashed"
    fi
    ;;
  radxa,rock-pi-4c-plus*|radxa,rock-4c-plus*)
    # S10: SD stays (holds u-boot, no SPI on this board); remove the
    # installer payload so u-boot falls through to NVMe.
    SD=""
    for d in /dev/mmcblk0 /dev/mmcblk1; do [ -b "$d" ] && { SD=$d; break; }; done
    [ -n "$SD" ] || { log "4c+: no mmcblk device found; SD not wiped"; exit 0; }
    # never touch the disk we just installed to
    TROOT=$(mount | sed -n 's,^\(/dev/[a-z0-9]*\)[0-9p]* on /target .*,\1,p' | head -1)
    [ "$TROOT" = "$SD" ] && { log "4c+: target root is on $SD; SD not wiped"; exit 0; }
    db_input critical scutarius/sbc-wipe-sd || true
    db_go || true
    db_get scutarius/sbc-wipe-sd
    [ "$RET" = true ] || { log "4c+: SD wipe declined"; exit 0; }
    # blank the partition table copies and everything past 16 MiB;
    # bytes 512..16MiB (idbloader @32KiB, u-boot.itb @8MiB) are preserved.
    SIZE=$(blockdev --getsz "$SD")
    dd if=/dev/zero of="$SD" bs=512 count=1 conv=notrunc 2>/dev/null           # MBR/PMBR
    dd if=/dev/zero of="$SD" bs=512 seek=1 count=63 conv=notrunc 2>/dev/null   # GPT hdr+entries area (idbloader starts at 64)
    dd if=/dev/zero of="$SD" bs=512 seek=$((SIZE-34)) count=34 conv=notrunc 2>/dev/null  # backup GPT
    dd if=/dev/zero of="$SD" bs=1M seek=16 count=64 conv=notrunc 2>/dev/null   # installer FAT start
    log "4c+: SD installer payload wiped; u-boot (first 16 MiB) preserved"
    ;;
  *)
    exit 0 ;;
esac
exit 0
