import os
import time
import tempfile
import shlex
import shutil
import fnmatch
import re
# TODO: Use util.command
from subprocess import Popen, PIPE, STDOUT, check_call, call

from util.archives import unpacktar, tar_dir, MAR, SEVENZIP
from release.info import fileInfo

import logging
log = logging.getLogger(__name__)

MAC_DESIGNATED_REQUIREMENTS = """\
=designated => ( (anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9] ) or (anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = "%(subject_ou)s"))
"""


def signfile(filename, keydir, fake=False, passphrase=None, timestamp=True):
    """Perform authenticode signing on the given file with keys in keydir.

    If passphrase is set, it will be sent as stdin to the process.

    If fake is True, then don't actually sign anything, just sleep for a
    second to simulate signing time.

    If timestamp is True, then a signed timestamp will be included with the
    signature."""
    if fake:
        time.sleep(1)
        return
    basename = os.path.basename(filename)
    dirname = os.path.dirname(filename)
    stdout = tempfile.TemporaryFile()
    command = ['signcode',
               '-spc', '%s/MozAuthenticode.spc' % keydir,
               '-v', '%s/MozAuthenticode.pvk' % keydir,
               ]
    if timestamp:
        command.extend(
            ['-t', 'http://timestamp.verisign.com/scripts/timestamp.dll'])
    command.extend([
        '-i', 'http://www.mozilla.com',
        '-a', 'sha1',
        # Try 5 times, and wait 60 seconds between tries
        '-tr', '5',
        '-tw', '60',
        basename])
    try:
        log.debug("Running %s", command)
        proc = Popen(
            command, cwd=dirname, stdout=stdout, stderr=STDOUT, stdin=PIPE)
        if passphrase:
            proc.stdin.write(passphrase)
        proc.stdin.close()
        if proc.wait() != 0:
            raise ValueError("signcode didn't return with 0")
        stdout.seek(0)
        data = stdout.read()
        # Make sure that the command output "Succeeded".  Sometimes signcode
        # returns with 0, but doesn't output "Succeeded", which in the past has
        # meant that the file has been signed, but is missing a timestmap.
        if data.strip() != "Succeeded" and "Success" not in data:
            raise ValueError("signcode didn't report success")
    except:
        stdout.seek(0)
        data = stdout.read()
        log.exception(data)
        raise


def osslsigncode_signfile(inputfile, outputfile, keydir, fake=False, passphrase=None, timestamp=None):
    """Perform Authenticode signing on "inputfile", writing a signed version
    to "outputfile". See signcode_signfile for a description of other
    arguments.

    See https://bugzilla.mozilla.org/show_bug.cgi?id=711210#c15 for background
    on why we want both methods.
    """
    if fake:
        time.sleep(1)
        return

    stdout = tempfile.TemporaryFile()
    args = [
        '-certs', '%s/MozAuthenticode.spc' % keydir,
        '-key', '%s/MozAuthenticode.pvk' % keydir,
        '-i', 'http://www.mozilla.com',
        '-h', 'sha1',
        '-in', inputfile,
        '-out', outputfile,
    ]
    if timestamp:
        args.extend(['-t', 'http://timestamp.verisign.com/scripts/timestamp.dll'])

    try:
        import pexpect
        proc = pexpect.spawn('osslsigncode', args)
        # We use logfile_read because we only want stdout/stderr, _not_ stdin.
        proc.logfile_read = stdout
        proc.expect('Enter PEM pass phrase')
        proc.sendline(passphrase)
        proc.wait()
    except:
        stdout.seek(0)
        data = stdout.read()
        log.exception(data)
        raise


def gpg_signfile(filename, sigfile, gpgdir, fake=False, passphrase=None):
    """Sign the given file with the default key from gpgdir. The signature is
    written to sigfile.

    If fake is True, generate a fake signature and sleep for a bit.

    If passphrase is set, it will be passed to gpg on stdin
    """
    if fake:
        open(sigfile, "wb").write("""
-----BEGIN FAKE SIGNATURE-----
Version: 1.2.3.4

I am ur signature!
-----END FAKE SIGNATURE-----""")
        time.sleep(1)
        return

    command = ['gpg', '--homedir', gpgdir, '-bsa', '-o', sigfile, '-q',
               '--batch']
    if passphrase:
        command.extend(['--passphrase-fd', '0'])
    command.append(filename)
    log.info('Running %s', command)
    stdout = tempfile.TemporaryFile()
    try:
        proc = Popen(command, stdout=stdout, stderr=STDOUT, stdin=PIPE)
        if passphrase:
            proc.stdin.write(passphrase)
        proc.stdin.close()
        if proc.wait() != 0:
            raise ValueError("gpg didn't return 0")
        stdout.seek(0)
        data = stdout.read()
    except:
        stdout.seek(0)
        data = stdout.read()
        log.exception(data)
        raise


def emevoucher_signfile(inputfile, outputfile, key, chain, fake=False, passphrase=None):
    """Perform SMIME signing on "inputfile", writing a signed version
    to "outputfile", using passed in "key". This is necessary for the EME voucher.

    If fake is True, generate a fake signature and sleep for a bit.

    If passphrase is set, it will be passed to gpg on stdin
    """
    if fake:
        time.sleep(1)
        return

    stdout = tempfile.TemporaryFile()
    args = ['smime', '-sign', '-in', inputfile,
            '-out', outputfile, '-signer', key,
            '-certfile', chain,
            '-md', 'sha256', '-binary', '-nodetach',
            '-outform', 'DER']

    try:
        import pexpect
        proc = pexpect.spawn("openssl", args)
        # We use logfile_read because we only want stdout/stderr, _not_ stdin.
        proc.logfile_read = stdout
        proc.expect('Enter pass phrase')
        proc.sendline(passphrase)
        if proc.wait() != 0:
            raise ValueError("openssl didn't return 0")
    except:
        stdout.seek(0)
        data = stdout.read()
        log.exception(data)
        raise


def mar_signfile(inputfile, outputfile, mar_cmd, fake=False, passphrase=None):
    # Now sign it
    if isinstance(mar_cmd, basestring):
        mar_cmd = shlex.split(mar_cmd)
    else:
        mar_cmd = mar_cmd[:]
    command = mar_cmd + [inputfile, outputfile]
    log.info('Running %s', command)
    stdout = tempfile.TemporaryFile()
    try:
        proc = Popen(command, stdout=stdout, stderr=STDOUT, stdin=PIPE)
        if passphrase:
            proc.stdin.write(passphrase)
            proc.stdin.write("\n")
        proc.stdin.close()
        if proc.wait() != 0:
            raise ValueError("mar didn't return 0")
        stdout.seek(0)
        data = stdout.read()
    except:
        stdout.seek(0)
        data = stdout.read()
        log.exception(data)
        raise


def jar_unsignfile(filename):
    # Find all the files in META-INF
    command = ['unzip', '-l', filename]
    stdout = tempfile.TemporaryFile()
    log.debug("running %s", command)
    proc = Popen(command, stdout=stdout, stderr=STDOUT, stdin=PIPE)
    if proc.wait() != 0:
        stdout.seek(0)
        data = stdout.read()
        log.error("unzip output: %s", data)
        raise ValueError("Couldn't list zip contents")

    stdout.seek(0)
    data = stdout.read()
    meta_files = re.findall(r'\b(META-INF/.*)$', data, re.I + re.M)
    if not meta_files:
        # Nothing to do
        return

    # Now delete them
    command = ['zip', filename, '-d'] + meta_files
    stdout = tempfile.TemporaryFile()
    log.debug("running %s", command)
    proc = Popen(command, stdout=stdout, stderr=STDOUT, stdin=PIPE)
    # Zip returns with 0 in normal operatoin
    # it returns with 12 if it has nothing to do
    if proc.wait() not in (0, 12):
        stdout.seek(0)
        data = stdout.read()
        log.error("zip output: %s", data)
        raise ValueError("Couldn't remove previous signature")


def jar_signfile(filename, keystore, keyname, fake=False, passphrase=None):
    """Sign a jar file
    """
    # unsign first
    jar_unsignfile(filename)
    command = ["jarsigner", "-keystore", keystore, filename]
    if keyname:
        command.append(keyname)
    stdout = tempfile.TemporaryFile()
    try:
        log.debug("running %s", command)
        proc = Popen(command, stdout=stdout, stderr=STDOUT, stdin=PIPE)
        if passphrase:
            passphrases = passphrase.split(' ')
            for p in passphrases:
                proc.stdin.write(p)
                proc.stdin.write("\n")
        proc.stdin.close()
        if proc.wait() != 0:
            stdout.seek(0)
            data = stdout.read()
            log.error("jarsigner output: %s", data)
            raise ValueError("jarsigner didn't return 0")
    except:
        stdout.seek(0)
        data = stdout.read()
        log.exception(data)
        raise


def get_bundle_executable(appdir):
    """Return the CFBundleIdentifier from a Mac application."""
    import plistlib
    return plistlib.readPlist(os.path.join(appdir, 'Contents', 'Info.plist'))['CFBundleExecutable']


def dmg_signfile(filename, keychain, signing_identity, subject_ou, fake=False):
    """Sign a mac .app folder, including handling subapps within.
    """
    # Only some directories contain files that get explicitly signed by
    # codesign. Others (such as .app/Contents/Resources) have their checksums
    # embedded into the CodeResources file that codesign creates when the .app
    # is signed at the end.
    SIGN_DIRS = ("MacOS", "Library")
    log.debug("Signing %s", filename)
    app = os.path.basename(filename)
    appdir = os.path.dirname(filename)
    app_executable = get_bundle_executable(filename)
    stdout = tempfile.TemporaryFile()

    sign_command = ['codesign',
                    '-s', signing_identity, '-fv',
                    '--keychain', keychain,
                    '--requirement', MAC_DESIGNATED_REQUIREMENTS % locals()]

    # We scan "Contents" here to make it easier to find inner apps
    # (by looking for things that end with ".app")
    contents_d = os.path.join(filename, "Contents")
    for top, dirs, files in os.walk(contents_d):
        for d in dirs:
            abs_d = os.path.join(top, d)
            # We only want to sign individual files in certain directories.
            # Removing items from "dirs" prevents walk() from descending into
            # those directories.
            # See SIGN_DIRS above for further explanation.
            if top == contents_d and d not in SIGN_DIRS:
                log.debug("Skipping %s because it's not in SIGN_DIRS.", abs_d)
                dirs.remove(d)
                continue
            # Make sure to sign any inner apps, too
            if d.endswith(".app"):
                dmg_signfile(abs_d, keychain, signing_identity, subject_ou, fake)

        # None of the individual files in Contents (eg, Info.plist) need
        # explicit signing. They get taken care of during the overall .app
        # signing, so there's no point in iterating over files if we're still
        # in the root directory.
        if top == contents_d:
            log.debug("Skipping file iteration in %s because it's the root directory.", top)
            continue

        for f in files:
            abs_f = os.path.join(top, f)
            # If we find any ".app" after the app we're currently signing
            # this means it's an inner app, which was handled above.
            # We shouldn't do any further processing here.
            if top[len(filename):].count(".app") > 0:
                log.debug("Skipping %s because it's part an inner app.", abs_f)
                continue
            # We also need to skip the main executable, because this gets
            # signed with the outer package, which happens below.
            if f == app_executable:
                log.debug("Skipping %s because it's the main executable.", abs_f)
                continue
            try:
                dir_ = os.path.dirname(abs_f)
                log.debug("Signing with command: %s %s", " ".join(sign_command), f)
                check_call(sign_command + [f], cwd=dir_, stdout=stdout, stderr=STDOUT)
            except:
                stdout.seek(0)
                data = stdout.read()
                log.exception(data)
                raise

    try:
        log.debug("Signing with command: %s %s", " ".join(sign_command), app)
        check_call(sign_command + [app], cwd=appdir, stdout=stdout, stderr=STDOUT)
    except:
        stdout.seek(0)
        data = stdout.read()
        log.exception(data)
        raise


def dmg_signpackage(pkgfile, dstfile, keychain, mac_id, subject_ou, fake=False, passphrase=None):
    """ Sign a mac build, putting results into `dstfile`.
        pkgfile must be a tar, which gets unpacked, signed, and repacked.
    """
    # Keep track of our output in a list here, and we can output everything
    # when we're done This is to avoid interleaving the output from
    # multiple processes.
    from flufl.lock import Lock, TimeOutError, NotLockedError
    from datetime import timedelta
    import pexpect

    # TODO: Is it even possible to do 'fake' signing?
    logs = []
    logs.append("Repacking %s to %s" % (pkgfile, dstfile))

    # pexpect requires a string as input
    unlock_command = 'security unlock-keychain ' + keychain
    lock_command = ['security', 'lock-keychain', keychain]
    lockfile = os.path.join(os.path.dirname(keychain), '.lock')

    tmpdir = tempfile.mkdtemp()
    try:
        # Unpack it
        logs.append("Unpacking %s to %s" % (pkgfile, tmpdir))
        unpacktar(pkgfile, tmpdir)


        for macdir in os.listdir(tmpdir):
            macdir = os.path.join(tmpdir, macdir)
            log.debug('Checking if we should sign %s', macdir)
            if shouldSign(macdir, 'mac'):
                log.debug('Need to sign %s', macdir)

                try:
                    sign_lock = None
                    # Acquire a lock for the signing command, to ensure we don't have a
                    # race condition where one process locks the keychain immediately after another
                    # unlocks it.
                    log.debug("Try to acquire %s", lockfile)
                    sign_lock = Lock(lockfile)
                    # Put a 30 second timeout on waiting for the lock.
                    sign_lock.lock(timedelta(0, 30))

                    # Unlock the keychain so that we do not get a user-interaction prompt to use
                    # the keychain for signing. This operation requires a password.
                    child = pexpect.spawn(unlock_command)
                    child.expect('password to unlock .*')
                    child.sendline(passphrase)
                    # read output until child exits
                    child.read()
                    child.close()
                    if child.exitstatus != 0:
                        raise ValueError("keychain unlock failed")

                    # Sign the thing!
                    dmg_signfile(macdir, keychain, mac_id, subject_ou, fake)

                except TimeOutError:
                    # timed out acquiring lock, give an error
                    log.exception("Timeout acquiring lock  %s for codesign, is something broken? ", lockfile)
                    raise
                except:
                    # catch any other locking error
                    log.exception("Error acquiring  %s for codesign, is something broken?", lockfile)
                    raise
                finally:
                    # Lock the keychain again, no matter what happens
                    # This command does not require a password
                    check_call(lock_command)

                    # Release the lock, if it was acquired
                    if sign_lock:
                        try:
                            sign_lock.unlock()
                            log.debug("Release %s", lockfile)
                        except NotLockedError:
                            log.debug("%s was already unlocked", lockfile)


        # Repack it
        logs.append("Packing %s" % dstfile)
        tar_dir(dstfile, tmpdir)
    except:
        log.exception("Error signing %s", pkgfile)
        raise
    finally:
        # Clean up after ourselves, and output our logs
        shutil.rmtree(tmpdir)
        log.info("\n  ".join(logs))


def filterFiles(files, product):
    """ Filter out files that we can't sign. Right now this means that
    anything that isn't a win32 .exe or .mar file gets filtered out"""
    for f in files[:]:
        skip = False
        try:
            info = fileInfo(f, product)
            if info['platform'] != 'win32':
                skip = True
            if info['contents'] not in ('complete', 'installer'):
                skip = True
        except ValueError:
            skip = True

        if skip:
            files.remove(f)
            if 'win32' in f:
                if 'xpi' not in f:
                    log.info("Skipping %s", f)

    return files


def sortFiles(files, product, firstLocale):
    """sort files into a specific ordering using the key function defined
    within"""
    # Utility function for sorting files
    # Makes sure that .mar files follow their corresponding .exe files
    def fileKey(f):
        info = fileInfo(f, product)
        locale = info['locale']
        leading_path = info['leading_path']
        if locale == firstLocale and not leading_path:
            localeVal = 0
        else:
            localeVal = 1
        if info['format'] == 'exe':
            exeVal = 0
        else:
            exeVal = 1
        return (localeVal, leading_path, locale, exeVal, f)

    return sorted(files, key=fileKey)


def sums_are_equal(base_package, packages):
    """ Check to make sure that the dictionaries of files:checksums are
    exactly equal across a list of packages """
    success = True
    for signed_file in base_package.keys():
        log.debug("comparing file %s", signed_file)
        if not len([p for p in packages if p[signed_file] ==
                    packages[0][signed_file]]) == len(packages):
            log.error("%s differs!", signed_file)
            success = False
    return success


def shouldSign(filename, platform='win32'):
    """Returns True if filename should be signed."""
    # These should already be signed by Microsoft.
    _dont_sign = [
        'D3DCompiler_42.dll', 'd3dx9_42.dll',
        'D3DCompiler_43.dll', 'd3dx9_43.dll',
        'msvc*.dll',
    ]
    ext = os.path.splitext(filename)[1]
    b = os.path.basename(filename)
    if platform == 'mac':
        if b.endswith('.app'):
            return True
    elif platform in ('win32', 'win64'):
        if ext in ('.dll', '.exe') and not any(fnmatch.fnmatch(b, p) for p in _dont_sign):
            return True
    else:
        # We should never get here.
        log.debug("Invalid Platform: %s", platform)
    return False


def getChkFile(filename):
    _special_files = ['freebl3.dll', 'softokn3.dll', 'nssdbm3.dll']
    b = os.path.basename(filename)
    if b in _special_files:
        d = os.path.dirname(filename)
        f = os.path.splitext(b)[0] + '.chk'
        return os.path.join(d, f)
    return None


def checkTools():
    """Returns True if all of the helper commands ($MAR, $SEVENZIP) are
    runnable.

    Raises a OSError if they can't be found.
    """
    # Check that MAR and SEVENZIP are executable
    null = open(os.devnull, "w")
    try:
        call([MAR, '-h'], stdout=null)
    except OSError:
        raise OSError("mar must be in your $PATH, or set via $MAR")
    try:
        call([SEVENZIP, '-h'], stdout=null)
    except OSError:
        raise OSError("7z must be in your $PATH, or set via $SEVENZIP")