#!/usr/bin/env bash
# Rename every symbol that libntgcalls.a defines AND that the system OpenSSL
# (libssl/libcrypto) also exports, so the two crypto libraries don't fight at
# static link time. After this, TDLib's calls (compiled against system OpenSSL
# headers) resolve to libcrypto.so.3, while ntgcalls/webrtc's internal calls
# stay wired to its bundled BoringSSL via the renamed names.

set -euo pipefail

LIB=/usr/local/lib/libntgcalls.a
SYS_CRYPTO="${SYS_CRYPTO:-/usr/lib/x86_64-linux-gnu/libcrypto.so.3}"
SYS_SSL="${SYS_SSL:-/usr/lib/x86_64-linux-gnu/libssl.so.3}"
PREFIX=ntgssl_

work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT

nm --defined-only --extern-only "$LIB" 2>/dev/null \
  | awk 'NF>=3 {print $NF}' | sort -u > "$work/ntg_defined.txt"

nm -D --defined-only "$SYS_CRYPTO" "$SYS_SSL" \
  | awk 'NF>=3 {n=$NF; sub(/@@.*/, "", n); print n}' | sort -u > "$work/sys_crypto.txt"

comm -12 "$work/ntg_defined.txt" "$work/sys_crypto.txt" > "$work/clash.txt"
test -s "$work/clash.txt"
awk -v p="$PREFIX" '{print $1, p $1}' "$work/clash.txt" > "$work/redefine.txt"

# objcopy operates on archives natively, transforming each member in place.
# This avoids ar x / ar rcs roundtripping, which would flatten the archive's
# directory structure and silently drop members with duplicate basenames.
objcopy --redefine-syms="$work/redefine.txt" "$LIB"
ranlib "$LIB"

printf 'Isolated %d crypto symbols in libntgcalls.a\n' "$(wc -l < "$work/clash.txt")"