#!/bin/bash
set -e
VERSION=1
ROOT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
if [ ! -f "${ROOT_DIR}/openssl/.openssl/lib/libcrypto.a" ]; then
    rm -rf "${ROOT_DIR}/openssl"
    git clone --depth 1 https://github.com/openssl/openssl "${ROOT_DIR}/openssl"

    cd "${ROOT_DIR}/openssl"

    ./config \
        --prefix="${ROOT_DIR}/openssl/.openssl" \
        no-shared no-threads enable-legacy enable-weak-ssl-ciphers

    make -j"$(nproc)"
    make install_sw LIBDIR=lib

    cd "${ROOT_DIR}"
fi
rm -rf angie
mkdir angie
cd angie
apt source angie
cd angie-1*
export QUILT_PATCHES=debian/patches
quilt push -a || true
git clone https://github.com/FoxIO-LLC/ja4-nginx-module
rm -rf ja4-nginx-module/.git
tar czf ../ja4-nginx-module.tar.gz ja4-nginx-module
quilt new ja4-nginx.patch
quilt add \
  src/event/ngx_event_openssl.c \
  src/event/ngx_event_openssl.h \
  src/event/quic/ngx_event_quic_ssl.c \
  src/http/modules/ngx_http_ssl_module.c \
  module-wasm-v0-2-beta2/ngx_wasmtime_module/src/ngx_wasmtime_module.c
patch -p1 <<'PATCH'
--- a/ja4-nginx-module/patches/nginx.patch 2026-06-19 08:10:44.077483474 +0300
+++ b/ja4-nginx-module/patches/nginx.patch 2026-06-19 08:10:41.630221022 +0300
@@ -408,9 +408,9 @@
 +        ngx_ssl_parse_client_hello_extensions(c);
 +    }
 +
-     frame = ngx_quic_alloc_frame(c);
-     if (frame == NULL) {
-         return NGX_ERROR;
+     if (qc->conf->post_ssl_handshake
+         && qc->conf->post_ssl_handshake(c, qc->streams.initialized) != NGX_OK)
+     {
 @@ -831,6 +839,74 @@ ngx_quic_crypto_provide(ngx_connection_t *c, ngx_uint_t level)
      for (cl = out; cl; cl = cl->next) {
          b = cl->buf;
PATCH
patch -p1 < ja4-nginx-module/patches/nginx.patch
rm -rf ja4-nginx-module
sed -i '/wasi_config_preopen_dir(/,/guest.data))/c\
            if (!wasi_config_preopen_dir(wti->wasi_config,\
                                     (char *)po[i].host.data,\
                                     (char *)po[i].guest.data,\
                                     WASMTIME_WASI_DIR_PERMS_READ | WASMTIME_WASI_DIR_PERMS_WRITE,\
                                     WASMTIME_WASI_FILE_PERMS_READ | WASMTIME_WASI_FILE_PERMS_WRITE))' \
module-wasm-v0-2-beta2/ngx_wasmtime_module/src/ngx_wasmtime_module.c
quilt refresh
sed -i -e 's/j2/j$(nproc)/g' debian/rules
sed -i "s|--with-threads|--with-threads --add-module=${PWD}/ja4-nginx-module/src|" debian/rules
sed -i '/--with-ssdeep=$(CURDIR)\/sandbox/,/$(MAKE) -j$(nproc) && $(MAKE) -j$(nproc) install/{s/$(MAKE) -j$(nproc) && $(MAKE) -j$(nproc) install/$(MAKE) -j8 \&\& $(MAKE) -j$(nproc) install/}' debian/rules
sed -i '/cd module-otel-v0-1-2 && \\/,/$(MAKE) -j\$(nproc)/ s/-j\$(nproc)/-j8/' debian/rules
sed -i '/^\(\t\|    \)cd wamr-WAMR-1-3-2 && \\/i\
\tWAMR_TARGET=$$(case "$$(dpkg-architecture -qDEB_HOST_ARCH)" in \\\
\t\tamd64) echo X86_64 ;; \\\
\t\ti386) echo X86_32 ;; \\\
\t\tarmhf) echo ARM ;; \\\
\t\tarmel) echo ARM ;; \\\
\t\tarm64) echo AARCH64 ;; \\\
\t\tmipsel) echo MIPS ;; \\\
\t\tmips64el) echo MIPS64 ;; \\\
\t\triscv64) echo RISCV64 ;; \\\
\t\t*) echo "" ;; \\\
\tesac); \\' debian/rules
perl -i -pe '
BEGIN { $count = 0; }
if (/cmake -DCMAKE_INSTALL_PREFIX=\$\(CURDIR\)\/sandbox/) {
    $count++;
    if ($count == 4) {
        s/cmake -DCMAKE_INSTALL_PREFIX=\$\(CURDIR\)\/sandbox/cmake -DCMAKE_INSTALL_PREFIX=\$(CURDIR)\/sandbox -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DWAMR_BUILD_TARGET=\$\$WAMR_TARGET/;
    }
}' debian/rules
sed -i '/cp -Rp wasmtime-v25-0-0\/include\/\*/i\
\tWASMTIME_ARCH=$$(case "$$(dpkg-architecture -qDEB_HOST_ARCH)" in \\\
\t\tamd64) echo x86_64 ;; \\\
\t\tarm64) echo aarch64 ;; \\\
\t\tarmhf) echo armv7 ;; \\\
\t\t*) echo "" ;; \\\
\tesac); \\\
\tif [ -n "$$WASMTIME_ARCH" ]; then \\\
\t\trm -rf wasmtime-v25-0-0; \\\
\t\tcurl -L --retry 10 --retry-all-errors --retry-delay 2 -o wasmtime.tar.xz https://github.com/bytecodealliance/wasmtime/releases/download/v30.0.0/wasmtime-v30.0.0-$$WASMTIME_ARCH-linux-c-api.tar.xz; \\\
\t\ttar -xf wasmtime.tar.xz; \\\
\t\tmv wasmtime-v30.0.0-$$WASMTIME_ARCH-linux-c-api wasmtime-v25-0-0; \\\
\tfi; \\\
' debian/rules
sed -i '/^override_dh_auto_build:$/a\\ttest -d ja4-nginx-module || tar xzf ../ja4-nginx-module.tar.gz' debian/rules
sed -i 's/sudo //g' debian/rules
BASE_VERSION="$(dpkg-parsechangelog -S Version)"
sed -i -E "s/\b(angie(-module-(ndk|wasmtime))?) \(= ([0-9.]+-[0-9]+~(bookworm|trixie))\)/\1 (= \4+ech${VERSION})/g" debian/control
DEBFULLNAME="Евгений Лапик" DEBEMAIL="admin@lpkg.ru" dch --newversion "${BASE_VERSION}+ech${VERSION}" "Add support JA4"
DEB_BUILD_OPTIONS="parallel=$(nproc)" CC_OPT="-I${ROOT_DIR}/openssl/.openssl/include" LD_OPT="-L${ROOT_DIR}/openssl/.openssl/lib" dpkg-buildpackage -us -uc