# -*- coding: utf-8 -*-
"""把设备上的两个根证书取回本机，准备打进 APK。

证书链：xxmxxs.top <- GTS WE1 <- GTS Root R4 <- GlobalSign Root CA
廉价手表常缺 GTS Root R4，导致 "Chain validation failed"。
把这两个根内置进 APK，校验时"系统库 + 内置"任一通过即可。
"""
from __future__ import annotations

import re
import sys
from pathlib import Path

ROOT = Path(r"C:\Users\shu\Desktop\deepseekagent\LanRemote")
sys.path.insert(0, str(ROOT / "_build"))

from devssh import run          # noqa: E402

TARGETS = {
    "gts_root_r4.pem": "/etc/ssl/certs/GTS_Root_R4.pem",
    "globalsign_root_ca.pem": "/etc/ssl/certs/GlobalSign_Root_CA.pem",
}

OUT_DIR = ROOT / "android" / "certs"


def main() -> int:
    OUT_DIR.mkdir(parents=True, exist_ok=True)
    ok = True

    for local_name, remote_path in TARGETS.items():
        code, out, err = run(f"cat {remote_path}", timeout=60)
        text = out or ""
        # 去掉可能混进来的 shell 提示
        start = text.find("-----BEGIN CERTIFICATE-----")
        end = text.find("-----END CERTIFICATE-----")
        if start < 0 or end < 0:
            print(f"  [失败] {local_name}: 没拿到 PEM")
            ok = False
            continue
        end += len("-----END CERTIFICATE-----")
        pem = text[start:end].strip() + "\n"

        # 校验一下是不是合法证书
        b64 = "".join(re.findall(
            r"-----BEGIN CERTIFICATE-----(.*?)-----END CERTIFICATE-----",
            pem, re.S))
        b64 = re.sub(r"\s+", "", b64)
        target = OUT_DIR / local_name
        target.write_text(pem, encoding="ascii", newline="\n")
        print(f"  {local_name}: {len(b64)} 字符 base64, "
              f"{target.stat().st_size} 字节")

        # 通过 openssl 复核主题
        code, out2, _err = run(
            f'echo "{pem}" | openssl x509 -noout -subject -issuer 2>/dev/null',
            timeout=60)
        for line in (out2 or "").strip().splitlines()[:2]:
            print(f"      {line.strip()}")

    return 0 if ok else 1


if __name__ == "__main__":
    sys.exit(main())