"""Generates src/com/miniabs/Roots.java: modern RSA root certificates that Android 2.3's
built-in list lacks (Let's Encrypt, Google Trust Services, Sectigo/ZeroSSL, ...).

Only RSA roots: Android 2.x's TLS 1.0 can't use ECDSA certificates anyway.
Run: python3 tools/gen_roots.py /etc/ssl/certs
"""
import base64
import hashlib
import os
import re
import sys

CERT_DIR = sys.argv[1] if len(sys.argv) > 1 else "/etc/ssl/certs"
NAMES = [
    "ISRG_Root_X1",                                  # Let's Encrypt
    "GTS_Root_R1",                                   # Google Trust Services (also Cloudflare)
    "USERTrust_RSA_Certification_Authority",         # Sectigo, ZeroSSL
    "DigiCert_Global_Root_G2",
    "Amazon_Root_CA_1",
    "Microsoft_RSA_Root_Certificate_Authority_2017",
    "SSL.com_Root_Certification_Authority_RSA",
    "Buypass_Class_2_Root_CA",
    "HARICA_TLS_RSA_Root_CA_2021",
    "Certum_Trusted_Network_CA",
    "Go_Daddy_Root_Certificate_Authority_-_G2",
    "Starfield_Root_Certificate_Authority_-_G2",
]

out = []
for n in NAMES:
    pem = open(os.path.join(CERT_DIR, n + ".pem")).read()
    b64 = "".join(re.search(r"-----BEGIN CERTIFICATE-----(.*?)-----END CERTIFICATE-----", pem, re.S).group(1).split())
    der = base64.b64decode(b64)
    out.append((n, b64, hashlib.sha256(der).hexdigest()))

lines = [
    "package com.miniabs;",
    "",
    "/** Generated by tools/gen_roots.py from the system CA store. Do not edit. */",
    "final class Roots {",
    "    private Roots() {",
    "    }",
    "",
    "    static final String[] DER_BASE64 = {",
]
for n, b64, sha in out:
    lines.append("        // %s  sha256=%s" % (n, sha))
    chunks = [b64[i:i + 100] for i in range(0, len(b64), 100)]
    lines.append("        " + "\n                + ".join('"%s"' % c for c in chunks) + ",")
lines += ["    };", "}", ""]
open(os.path.join(os.path.dirname(__file__), "..", "src", "com", "miniabs", "Roots.java"), "w").write("\n".join(lines))
print("%d roots written" % len(out))