#!/bin/bash
# Copyright 2017 gRPC authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Source this rc script to prepare the environment for macos builds

# Print basic info about the mac worker
{ set +x; } 2>/dev/null

# Example: + [13:25:45 PDT] prepare_build_macos_rc:41	mount
export PS4='+ [\D{%H:%M:%S %Z}] ${BASH_SOURCE[0]##*/}:${LINENO}\011 '

echo "-- Kokoro worker info --"
echo "Kokoro pool: ${KOKORO_JOB_POOL:-undefined}"
if [[ -f /VERSION ]]; then
  echo "Kokoro VM image: $(cat /VERSION)"
fi
echo "-- System --"
echo "System: $(uname -a)"
echo "Python: $(python3 -VV)"
echo -e "-- OS --\n$(sw_vers -productName) $(sw_vers -productVersion) $(sw_vers -buildVersion)"
echo "-- CPU --"
echo "CPU: $(sysctl -n machdep.cpu.vendor) $(uname -m) Family $(sysctl -n machdep.cpu.family) Model $(sysctl -n machdep.cpu.brand_string)"
echo "CPU Cores: $(sysctl -n hw.ncpu)"
echo -e "-- Memory --\n$(sysctl -n hw.memsize)"
set -x

# Info on disk usage and mounted volumes
mount
df -h /tmpfs /

# show original open file limit values
launchctl limit maxfiles
ulimit -a

# Use temp variable to detect version
# will be cleaned up after migration is complete
os_version=$(sw_vers -productVersion)
is_sonoma=false
if [[ "$os_version" == "14."* ]]; then
  is_sonoma=true
fi

# WARNING: TRY TO KEEP THIS FILE AS LEAN AS POSSIBLE
# The rules:
# - think twice before adding installer that takes long time (builds are already slow)
# - do not add any steps that are flaky (builds will become flaky)
# - try adding a dependency under a language-specific section first (reduces latency and increases build stability)
# - only add stuff that you absolutely need for your builds to work (add comment to explain why its needed)

# Disable HOMEBREW update to avoid new updates which potentially have problems.
# Brew packages installed when Kokoro image was built tend to have less conflict.
export HOMEBREW_NO_AUTO_UPDATE=1
export HOMEBREW_NO_INSTALL_CLEANUP=1
# A temporary fix for ca-certificates brew install:
# ==> Pouring ca-certificates--2026-05-14.all.bottle.tar.gz
# Error: undefined method '[]' for nil
# TODO(sergiitk): consider undoing once ca-certificates is installable.
# See:
# - https://github.com/grpc/grpc/pull/43193 - Initial ca-certificates fix.
export HOMEBREW_NO_INSTALL_FROM_API=1
export HOMEBREW_CURL_RETRIES=8
export HOMEBREW_DOWNLOAD_CONCURRENCY=1
export HOMEBREW_CURLRC=1

# Configure pip to retry on transient connection drops and cache wheels on
# tmpfs to reduce network round-trips and avoid CDN rate-limiting across test
# virtualenvs. These settings also apply to downstream pip invocations outside
# this script, including but not limited to build_python.sh.
export PIP_RETRIES=5
export PIP_DEFAULT_TIMEOUT=60
# Skip pip's self-update check: its state is kept per interpreter/venv in
# PIP_CACHE_DIR, which starts empty on each job, so it costs a PyPI request
# for every interpreter and venv that runs pip.
export PIP_DISABLE_PIP_VERSION_CHECK=1
# PIP_CACHE_DIR is pip's internal cache, keyed by download URL and pip version.
# PIP_FIND_LINKS is needed for pip to discover loose wheel files pre-built with
# `pip wheel --wheel-dir` (see Python 3.10 pre-warming below).
export PIP_CACHE_DIR="/tmpfs/grpc-caches/pip-cache"
export PIP_FIND_LINKS="/tmpfs/grpc-caches/pip-wheels"
mkdir -p "${PIP_CACHE_DIR}" "${PIP_FIND_LINKS}"

# Configure Git to use HTTP/1.1 to avoid libcurl HTTP/2 multiplexing stalls on
# macOS, and increase lowSpeedTime to 90s to accommodate server-side packfile
# assembly for large repos.
git config --global http.version HTTP/1.1
git config --global http.postBuffer 524288000
git config --global http.lowSpeedLimit 1000
git config --global http.lowSpeedTime 90

# Instruct curl to retry on all errors including TCP connection resets (code 56)
cat << 'EOF' > ~/.curlrc
retry = 5
retry-all-errors
retry-delay = 1
EOF

# Helper function to retry commands on transient network failures.
retry_with_backoff() {
  local max_attempts=5
  local attempt=1
  local sleep_time=5
  until "$@"; do
    local status=$?
    if [ "${attempt}" -ge "${max_attempts}" ]; then
      echo "Command '$*' failed after ${max_attempts} attempts (exit code ${status})." >&2
      return "${status}"
    fi
    local jitter=$((10 + RANDOM % 21))
    local total_sleep=$((sleep_time + jitter))
    echo "Command '$*' failed with exit code ${status} (attempt ${attempt}/${max_attempts}). Retrying in ${total_sleep} seconds..." >&2
    sleep "${total_sleep}"
    sleep_time=$((sleep_time * 2))
    attempt=$((attempt + 1))
  done
}

# Helper function to retry brew install on transient network failures.
brew_install_with_retry() {
  retry_with_backoff brew install "$@"
}

# Dump the brew configuration for debugging just in case. Check "Core tap HEAD" field
# because it should be the same as below unless it's been updated.
# - Kokoro MacOS Mojave: 27fa87c94a6cf7be40fc8f8fc96bc7c387b7781e
brew config

if $is_sonoma; then
  export HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1

  # Pin Homebrew to version 5.0.5 and homebrew/core to the matching Sonoma snapshot
  HOMEBREW_REPO="$(brew --repository)"
  git -C "${HOMEBREW_REPO}" checkout -f 5.0.5 2>/dev/null || {
    retry_with_backoff git -C "${HOMEBREW_REPO}" fetch --depth 1 https://github.com/Homebrew/brew.git tag 5.0.5
    git -C "${HOMEBREW_REPO}" checkout -f 5.0.5
  }

  HOMEBREW_CORE_DIR="${HOMEBREW_REPO}/Library/Taps/homebrew/homebrew-core"
  mkdir -p "${HOMEBREW_CORE_DIR}"
  git -C "${HOMEBREW_CORE_DIR}" init
  retry_with_backoff git -C "${HOMEBREW_CORE_DIR}" fetch --depth 1 https://github.com/Homebrew/homebrew-core.git 3aa5cf1d47f4fda4decbfc999ea919cd499a204e
  git -C "${HOMEBREW_CORE_DIR}" checkout -f FETCH_HEAD

  brew config
  brew_install_with_retry cmake
  brew_install_with_retry ccache
  export PATH="${HOME}/.pyenv/shims:/opt/homebrew/bin::${PATH}"
  cmake --version
fi

# Add GCP credentials for BQ access
retry_with_backoff pip install --user google-api-python-client oauth2client
export GOOGLE_APPLICATION_CREDENTIALS=${KOKORO_GFILE_DIR}/GrpcTesting-d0eeee2db331.json
DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
echo $DIR
pwd

# If this is a PR using RUN_TESTS_FLAGS var, then add flags to filter tests
if [ -n "$KOKORO_GITHUB_PULL_REQUEST_NUMBER" ]; then
  export RUN_TESTS_FLAGS="--filter_pr_tests --base_branch origin/$KOKORO_GITHUB_PULL_REQUEST_TARGET_BRANCH $RUN_TESTS_FLAGS"
fi

# Changes not needed for sonoma(Already have version available)
# cleanup this once migration complete
if [ "${PREPARE_BUILD_INSTALL_DEPS_RUBY}" == "true" ] && ! $is_sonoma;
then
  # Workaround for https://github.com/rvm/rvm/issues/5133
  export CURL_CA_BUNDLE=$(pwd)/etc/roots.pem

  # Fetch keys per https://rvm.io/rvm/install
  gpg_recv_keys_success=0
  for ((i=0;i<5;i++)); do
    # Use the Ubuntu keyserver instead of pool.sks-keyservers.net because sks-keyservers is now deprecated.
    GPG_KEYSERVER_ADDRESS="keyserver.ubuntu.com"
    gpg --keyserver "hkp://${GPG_KEYSERVER_ADDRESS}" --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB \
      && gpg_recv_keys_success=1
    [[ "$gpg_recv_keys_success" == 1 ]] && break
    sleep 3
  done
  [[ "$gpg_recv_keys_success" == 1 ]] || exit 1
  # fix .rvm directory ownership on kokoro monterey image
  sudo chown -R "${USER}" ~/.rvm
  rvm get stable # Per https://stackoverflow.com/questions/65477613/rvm-where-is-ruby-3-0-0
  # stop echoing bash commands temporarily to prevent rvm from polluting the logs
  set +x
  source $HOME/.rvm/scripts/rvm

  RUBY_VERSION=3.2.0
  echo "Installing ruby-${RUBY_VERSION}"
  time rvm install "ruby-${RUBY_VERSION}"
  echo "Setting default ruby version."
  rvm use "$RUBY_VERSION" --default
  echo "Updating osx-ssl-certs."
  gem install bundler -v 2.4
  rvm osx-ssl-certs status all
  rvm osx-ssl-certs update all

  # restore echo
  set -x
fi

if [ "${PREPARE_BUILD_INSTALL_DEPS_OBJC}" == "true" ]
then
  # cocoapods
  export LANG=en_US.UTF-8

# 1. Install the latest stable Ruby via Homebrew
brew_install_with_retry ruby

# 2. Add the Homebrew-installed Ruby to the PATH
# Homebrew usually installs the latest Ruby to /usr/local/opt/ruby/bin
export PATH="/usr/local/opt/ruby/bin:$PATH"

# 3. Ensure the gem command points to the new Ruby
# This installs CocoaPods into the user's gem directory to avoid permission issues
gem install cocoapods -v 1.15.2 --no-document --user-install

# 4. Add the gem binary directory to PATH
export PATH="$(ruby -e 'puts Gem.user_dir')/bin:$PATH"

  # 2. Verify the installation
  ruby --version
  pod --version

  # pre-fetch cocoapods master repo's most recent commit only
  mkdir -p ~/.cocoapods/repos
  time retry_with_backoff bash -c 'rm -rf ~/.cocoapods/repos/master && git clone --depth 1 https://github.com/CocoaPods/Specs.git ~/.cocoapods/repos/master'

  # Needed for ios-binary-size
  time retry_with_backoff pip install --user -r "${DIR}/requirements.macos.txt"

  # Store intermediate build files of ObjC tests into /tmpfs
  # TODO(jtattermusch): this has likely been done to avoid running
  # out of disk space when running ios-binary-size tests, but
  # it would be good to revisit.
  mkdir /tmpfs/Build-ios-binary-size
  ln -s /tmpfs/Build-ios-binary-size src/objective-c/examples/Sample/Build
  mkdir -p /tmpfs/DerivedData
  rm -rf ~/Library/Developer/Xcode/DerivedData
  mkdir -p ~/Library/Developer/Xcode
  ln -s /tmpfs/DerivedData ~/Library/Developer/Xcode/DerivedData
fi

if [ "${PREPARE_BUILD_INSTALL_DEPS_PYTHON}" == "true" ]
then
  # add /usr/local/bin to path to override built in Python version
  export PATH="/usr/local/bin::${PATH}"

  # Host tools for the default Python (version printed in the worker info
  # section at the top of this script): ios-binary-size PR checks
  # (requirements.macos.txt), optional HTML test reports (Mako), and twisted
  # for test/cpp/naming/utils and test/http2_test.
  time retry_with_backoff pip install --user -r "${DIR}/requirements.macos.txt"
  time retry_with_backoff pip install --user --upgrade pip wheel Mako tox setuptools==77.0.1 twisted

  # Install Python 3.10 if it doesn't exist
  if [ ! -f "/usr/local/bin/python3.10" ]; then
    time curl -O https://www.python.org/ftp/python/3.10.5/python-3.10.5-macos11.pkg
    echo "568c69b4361af1faf0ae35c4cac7236c1a332f5c  python-3.10.5-macos11.pkg" > /tmp/python_installer_checksum.sha256
    shasum -c /tmp/python_installer_checksum.sha256
    time sudo installer -pkg ./python-3.10.5-macos11.pkg -target /
  fi

  # Pre-warm pip for Python 3.10 with retries, so that downstream
  # build_python.sh installs from local disk instead of PyPI.
  #
  # WARNING: tools/run_tests/run_tests.py restricts basic Python testing on
  # macOS to gRPC's minimum supported Python version (currently Python 3.10).
  # When gRPC bumps the minimum supported Python version in run_tests.py,
  # this pre-warming target MUST be updated to match that version.
  #
  # Mirror build_python.sh in a throwaway venv: a new venv starts with the
  # interpreter's old bundled pip, and pip changed its cache format in 23.3.
  # Upgrading pip with the bundled pip caches the new pip in the format the
  # bundled pip reads. The upgraded pip then caches the remaining packages in
  # the format build_python.sh's venv reads after upgrading its own pip.
  PY310_PREWARM_VENV="/tmpfs/grpc-caches/py310-prewarm-venv"
  /usr/local/bin/python3.10 -m venv "${PY310_PREWARM_VENV}"
  time retry_with_backoff "${PY310_PREWARM_VENV}/bin/python" -m pip install \
      --upgrade pip
  time retry_with_backoff "${PY310_PREWARM_VENV}/bin/python" -m pip wheel \
      --wheel-dir "${PIP_FIND_LINKS}" \
      wheel 'setuptools==77.0.1' 'cython==3.1.1' 'protobuf>=7.35.1,<8.0.0'

  # NOTE: For Python 3.10, gevent has to be built from source because upstream
  # does not publish 3.10 macOS wheels. This triggers PEP 517 build isolation,
  # generating extra requests to PyPI and increasing the chances of network
  # drops. Pre-building the wheel into PIP_FIND_LINKS with retries avoids those.
  # Since Python 3.10 is EOL, this workaround won't be needed once gRPC updates
  # the minimum Python version to 3.11.
  time retry_with_backoff "${PY310_PREWARM_VENV}/bin/python" -m pip wheel \
      --wheel-dir "${PIP_FIND_LINKS}" \
      gevent

  # Install Python 3.11 if it doesn't exist
  if [ ! -f "/usr/local/bin/python3.11" ]; then
    time curl -O https://www.python.org/ftp/python/3.11.0/python-3.11.0rc1-macos11.pkg
    echo "eec3f817797b1d61f48f29b96ac0443ea19f3170  python-3.11.0rc1-macos11.pkg" > /tmp/python_installer_checksum.sha256
    shasum -c /tmp/python_installer_checksum.sha256
    time sudo installer -pkg ./python-3.11.0rc1-macos11.pkg -target /
  fi

  # Install Python 3.12 if it doesn't exist
  if [ ! -f "/usr/local/bin/python3.12" ]; then
    time curl -O https://www.python.org/ftp/python/3.12.0/python-3.12.0rc2-macos11.pkg
    echo "e5dc5511b604b501b892991d257d117bb5757437  python-3.12.0rc2-macos11.pkg" > /tmp/python_installer_checksum.sha256
    shasum -c /tmp/python_installer_checksum.sha256
    time sudo installer -pkg ./python-3.12.0rc2-macos11.pkg -target /
  fi

  # Install Python 3.13 if it doesn't exist
  if [ ! -f "/usr/local/bin/python3.13" ]; then
    time curl -O https://www.python.org/ftp/python/3.13.0/python-3.13.0rc2-macos11.pkg
    echo "75579065f9ee5c25207353fbe0f79275123ff556  python-3.13.0rc2-macos11.pkg" > /tmp/python_installer_checksum.sha256
    shasum -c /tmp/python_installer_checksum.sha256
    time sudo installer -pkg ./python-3.13.0rc2-macos11.pkg -target /
  fi

  # Install Python 3.14 if it doesn't exist
  if [ ! -f "/usr/local/bin/python3.14" ]; then
    time curl -O https://www.python.org/ftp/python/3.14.0/python-3.14.0rc1-macos11.pkg
    echo "05b17ddad5a7c3641d0ecfe5ccf3a97f89c1757e  python-3.14.0rc1-macos11.pkg" > /tmp/python_installer_checksum.sha256
    shasum -c /tmp/python_installer_checksum.sha256
    time sudo installer -pkg ./python-3.14.0rc1-macos11.pkg -target /
  fi

  # Install Python 3.15 if it doesn't exist
  if [ ! -f "/usr/local/bin/python3.15" ]; then
    time curl -O https://www.python.org/ftp/python/3.15.0/python-3.15.0rc1-macos11.pkg
    echo "57e0b1095f5dda52a8ff8b3b73140a52dfb3b76bdcf9e0284f2dbe10f7ee92ea  python-3.15.0rc1-macos11.pkg" > /tmp/python_installer_checksum.sha256
    shasum -a 256 -c /tmp/python_installer_checksum.sha256
    time sudo installer -pkg ./python-3.15.0rc1-macos11.pkg -target /
  fi
fi

if [ "${PREPARE_BUILD_INSTALL_DEPS_CSHARP}" == "true" ]
then
  # Disable some unwanted dotnet options
  export NUGET_XMLDOC_MODE=skip
  export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=true
  export DOTNET_CLI_TELEMETRY_OPTOUT=true

  # Installed versions should be kept in sync with
  # templates/tools/dockerfile/csharp_dotnetcli_deps.include
  time curl -O https://download.visualstudio.microsoft.com/download/pr/e0fe8c99-e33c-4d75-bd4e-2478ed3ee35a/ff06e47afc7c13bdbbaa50a9713ac772/dotnet-sdk-3.1.415-osx-x64.pkg
  time sudo installer -pkg ./dotnet-sdk-3.1.415-osx-x64.pkg -target /

  time curl -O https://download.visualstudio.microsoft.com/download/pr/14a45451-4cc9-48e1-af69-0aff75891d09/ff6e83986a2a9a535015fb3104a90a1b/dotnet-sdk-6.0.100-osx-x64.pkg
  time sudo installer -pkg ./dotnet-sdk-6.0.100-osx-x64.pkg -target /
fi

if [ "${PREPARE_BUILD_INSTALL_DEPS_PHP}" == "true" ]
then
  time brew_install_with_retry php@8.4 || true
  if [ -e "/usr/local/opt/php@8.4/" ]; then
    PHP_PATH="/usr/local/opt/php@8.4/"
  elif [ -e "/opt/homebrew/opt/php@8.4" ]; then
    PHP_PATH="/opt/homebrew/opt/php@8.4"
  else
    echo "Error: Unable to check php install path" >&2
    exit 1
  fi

  export LDFLAGS="-L${PHP_PATH}/lib ${LDFLAGS}"
  export CPPFLAGS="-I${PHP_PATH}include ${CPPFLAGS}"
  export PATH="${PHP_PATH}/bin:${PHP_PATH}/sbin:${PATH}"

  # the exit code from "brew install php@8.4" is useless
  # so instead we check if PHP was indeed installed successfully.
  # Failing early is better than cryptic errors later in the build process.
  php --version

  if $is_sonoma; then
    # See https://getcomposer.org/download.
    # Composer installer checksum verification: https://composer.github.io/pubkeys.html

    # Dynamically load the current checksum per
    # https://getcomposer.org/doc/faqs/how-to-install-composer-programmatically.md
    curl --retry 3 -sL -o composer-installer.sig https://composer.github.io/installer.sig
    EXPECTED_COMPOSER_SHA384_SUM="$(cat composer-installer.sig)"
    if [[ -z "${EXPECTED_COMPOSER_SHA384_SUM}" ]]; then
      echo "Failed to load latest composer installer checksum" >&2
      exit 1
    fi

    curl --retry 3 -sL -o composer-setup.php https://getcomposer.org/installer
    ACTUAL_COMPOSER_SHA384_SUM="$(sha384sum composer-setup.php | cut -w -f1)"

    echo "Expected composer-setup.php sha384 sum: ${EXPECTED_COMPOSER_SHA384_SUM}"
    echo "Downloaded composer-setup.php sha384 sum: ${ACTUAL_COMPOSER_SHA384_SUM}"
    if [[ "${EXPECTED_COMPOSER_SHA384_SUM}" != "${ACTUAL_COMPOSER_SHA384_SUM}" ]]; then
      echo "Invalid composer-setup.php checksum" >&2
      exit 1
    fi
    echo "composer-setup.php checksum matched"

    php composer-setup.php --install-dir /tmp
    rm composer-setup.php

    # Install PHP test dependencies.
    php /tmp/composer.phar global require phpunit/phpunit:^13 --no-security-blocking
  else
    # Workaround for https://github.com/Homebrew/homebrew-core/issues/41081
    mkdir -p /usr/local/lib/php/pecl
    # Download the right version of phpunit to match PHP version
    sudo curl -sSL https://phar.phpunit.de/phpunit-13.phar -o /usr/local/bin/phpunit
    sudo chmod +x /usr/local/bin/phpunit
  fi
fi

# TODO(jtattermusch): better debugging of clock skew, remove once not needed
date

time retry_with_backoff git submodule update --init
