PrintToVeraeTimeStamp/platform/linux/deb/build-deb.sh

#!/usr/bin/env bash
# Build Debian/Ubuntu .deb packages for verae-print.
# Run on a Debian/Ubuntu host (or any system with dpkg-deb + fakeroot).
#
# Usage:
#   ./platform/linux/deb/build-deb.sh [amd64|arm64|all]
# Env:
#   VERSION=0.1.2
#   BIN_AMD64=path/to/verae-print   BIN_ARM64=path/to/verae-print
#   OUT=build/deb
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
VERSION="${VERSION:-0.1.2}"
OUT="${OUT:-$ROOT/build/deb}"
ARCHS="${1:-all}"
PKG_NAME="verae-print"

mkdir -p "$OUT"

if ! command -v dpkg-deb >/dev/null 2>&1; then
  echo "dpkg-deb required (run on Debian/Ubuntu, e.g. host 138)" >&2
  exit 1
fi

build_arch() {
  local arch="$1"
  local bin="$2"
  if [[ ! -f "$bin" ]]; then
    echo "missing binary for $arch: $bin" >&2
    exit 1
  fi

  local stage="$OUT/stage-${arch}"
  rm -rf "$stage"
  mkdir -p "$stage/DEBIAN" \
    "$stage/usr/bin" \
    "$stage/usr/lib/cups/backend" \
    "$stage/usr/share/doc/$PKG_NAME" \
    "$stage/usr/share/man/man1"

  install -m 755 "$bin" "$stage/usr/bin/verae-print"
  if [[ -f "$ROOT/platform/linux/cups/backend-verae.sh" ]]; then
    install -m 755 "$ROOT/platform/linux/cups/backend-verae.sh" "$stage/usr/lib/cups/backend/verae"
  fi

  cat >"$stage/usr/share/doc/$PKG_NAME/copyright" <<EOF
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: PrintToVeraeTimeStamp
Source: https://printit.verae.ai/

Files: *
Copyright: Verae / George Lambert
License: UNLICENSED
EOF

  cat >"$stage/usr/share/doc/$PKG_NAME/README.Debian" <<EOF
verae-print for Debian/Ubuntu
=============================

After install:
  verae-print setup
  verae-print stamp document.pdf

Optional CUPS queue (if cups-client is installed):
  sudo lpadmin -p Verae_Timestamping -E -v verae:/ -m raw -D "Verae Timestamping" || true
  sudo cupsenable Verae_Timestamping; sudo cupsaccept Verae_Timestamping

Portal: https://customer.verae.ai/portal/
Downloads: https://printit.verae.ai/
EOF
  gzip -9n -c "$stage/usr/share/doc/$PKG_NAME/README.Debian" >"$stage/usr/share/doc/$PKG_NAME/README.Debian.gz" 2>/dev/null || true

  # Simple man page
  cat >"$stage/usr/share/man/man1/verae-print.1" <<EOF
.TH VERAE-PRINT 1 "$VERSION" "Verae" "User Commands"
.SH NAME
verae-print \\- stamp a PDF digest with Verae Time
.SH SYNOPSIS
.B verae-print
setup
.br
.B verae-print
stamp [options] file.pdf
.SH DESCRIPTION
Digests-only timestamping. Document bytes stay local.
.SH SEE ALSO
https://printit.verae.ai/
EOF
  gzip -9n -f "$stage/usr/share/man/man1/verae-print.1"

  local size
  size=$(du -sk "$stage" | awk '{print $1}')

  cat >"$stage/DEBIAN/control" <<EOF
Package: $PKG_NAME
Version: $VERSION
Section: utils
Priority: optional
Architecture: $arch
Maintainer: Verae <support@verae.ai>
Depends: libc6
Recommends: cups-client
Installed-Size: $size
Homepage: https://printit.verae.ai/
Description: Digests-only Verae timestamping from Print / CLI
 Verae Print Stamp hashes a document locally and registers only the
 SHA-256 digest with Verae. Includes an optional CUPS backend for a
 "Verae Timestamping" print destination.
EOF

  cat >"$stage/DEBIAN/postinst" <<'EOF'
#!/bin/sh
set -e
if command -v lpadmin >/dev/null 2>&1 && [ -x /usr/lib/cups/backend/verae ]; then
  lpadmin -x Verae_Timestamping 2>/dev/null || true
  lpadmin -p Verae_Timestamping -E -v verae:/ -m raw \
    -D "Verae Timestamping" -L "Digests-only Verae stamp" 2>/dev/null || \
  lpadmin -p Verae_Timestamping -E -v verae:/ -m everywhere \
    -D "Verae Timestamping" 2>/dev/null || true
  cupsenable Verae_Timestamping 2>/dev/null || true
  cupsaccept Verae_Timestamping 2>/dev/null || true
fi
echo "verae-print installed. Next: verae-print setup"
exit 0
EOF
  chmod 755 "$stage/DEBIAN/postinst"

  cat >"$stage/DEBIAN/prerm" <<'EOF'
#!/bin/sh
set -e
if command -v lpadmin >/dev/null 2>&1; then
  lpadmin -x Verae_Timestamping 2>/dev/null || true
fi
exit 0
EOF
  chmod 755 "$stage/DEBIAN/prerm"

  local deb="$OUT/${PKG_NAME}_${VERSION}_${arch}.deb"
  if command -v fakeroot >/dev/null 2>&1; then
    fakeroot dpkg-deb --build "$stage" "$deb"
  else
    dpkg-deb --build "$stage" "$deb"
  fi
  # Stable name
  cp -f "$deb" "$OUT/${PKG_NAME}_${arch}.deb"
  echo "built $deb"
  dpkg-deb -I "$deb" | head -20
}

resolve_bin() {
  local arch="$1"
  local val=""
  case "$arch" in
    amd64) val="${BIN_AMD64:-}" ;;
    arm64) val="${BIN_ARM64:-}" ;;
  esac
  if [[ -n "$val" && -f "$val" ]]; then
    echo "$val"
    return
  fi
  local label="linux-amd64"
  [[ "$arch" == "arm64" ]] && label="linux-arm64"
  local cand
  for cand in \
    "$ROOT/build/win-linux/VeraePrintStamp-${label}-${VERSION}/verae-print" \
    "$ROOT/build/win-linux/VeraePrintStamp-${label}-0.1.2/verae-print" \
    "$ROOT/build/linux-bins/verae-print-${arch}"
  do
    if [[ -f "$cand" ]]; then
      echo "$cand"
      return
    fi
  done
  echo ""
}

do_one() {
  local arch="$1"
  local bin
  bin="$(resolve_bin "$arch")"
  if [[ -z "$bin" ]]; then
    echo "No binary for $arch — set BIN_AMD64 / BIN_ARM64 or run scripts/build-win-linux.sh first" >&2
    exit 1
  fi
  build_arch "$arch" "$bin"
}

case "$ARCHS" in
  all)
    do_one amd64
    # arm64 deb can be built on amd64 host (just packages the arm64 binary)
    if [[ -n "$(resolve_bin arm64)" ]]; then
      do_one arm64
    else
      echo "(skip arm64 — no binary)"
    fi
    ;;
  amd64|arm64)
    do_one "$ARCHS"
    ;;
  *)
    echo "Usage: $0 [amd64|arm64|all]" >&2
    exit 2
    ;;
esac

(cd "$OUT" && shasum -a 256 *.deb 2>/dev/null | tee SHA256SUMS) || \
  (cd "$OUT" && sha256sum *.deb | tee SHA256SUMS)
ls -lh "$OUT"/*.deb