import java.security.KeyStore
import java.security.cert.CertificateFactory
import java.security.cert.X509Certificate

val trustStoreProp = "javax.net.ssl.trustStore"
val privateRootFile = file("private.pem")

beforeSettings {
    if (System.getProperty(trustStoreProp)?.endsWith("+private") == true) return@beforeSettings
    val defaultTrustStore = System.getProperty(trustStoreProp)?.let { File(it) }
        ?: File(System.getProperty("java.home"), "lib/security/cacerts")
    val alternateTrustStore = File(rootDir, "build/tmp/cacerts+private")
    try {
        val keyStore = KeyStore.getInstance(KeyStore.getDefaultType())
        val trustStorePassword = System.getProperty("${trustStoreProp}Password")?.toCharArray()
        if (defaultTrustStore.exists()) defaultTrustStore.inputStream().use { keyStore.load(it, trustStorePassword) }
        val privateRoot = privateRootFile.inputStream()
            .use(CertificateFactory.getInstance("X.509")::generateCertificate) as X509Certificate
        keyStore.setCertificateEntry(privateRoot.subjectX500Principal.name, privateRoot)
        alternateTrustStore.parentFile.mkdirs()
        alternateTrustStore.outputStream().use {
            keyStore.store(it, trustStorePassword ?: "changeit".toCharArray())
        }
    } catch (e: Exception) {
        if (alternateTrustStore.exists()) alternateTrustStore.delete()
        throw e
    }
    System.setProperty(trustStoreProp, alternateTrustStore.absolutePath)
    logger.info("$trustStoreProp set to $alternateTrustStore")
}