#! /bin/bash

# PQC KEYS
# there is no such thing as a PQC keyring
# but we maintain the mechanism of gathering all the keys in one place to be found by zypper/reposync
# so vendor keys and customer imported keys are simply copied in one place

PQC_UYUNI_VENDOR_KEYS_SRC_DIR="/usr/lib/uyuni/pqkeys"
PQC_MLM_VENDOR_KEYS_SRC_DIR="/usr/lib/susemanager/pqkeys"
PQC_CUSTOMER_KEYS_SRC_DIR="/var/spacewalk/pqkeys"

PQC_KEYS_TARGET_DIR="/var/lib/spacewalk/pqkeys"

#create target dir just in case it does not exist
if [ ! -d ${PQC_KEYS_TARGET_DIR} ]; then
  mkdir -p "${PQC_KEYS_TARGET_DIR}"
  chown -R tomcat:susemanager "${PQC_KEYS_TARGET_DIR}"
  chmod 0700 "${PQC_KEYS_TARGET_DIR}"
fi

#import uyuni vendor PQC keys
if [ -d ${PQC_UYUNI_VENDOR_KEYS_SRC_DIR} ]; then
  echo -n "importing Uyuni PQC keys to target directory... "
  cp -a "${PQC_UYUNI_VENDOR_KEYS_SRC_DIR}"/*.pem "${PQC_KEYS_TARGET_DIR}"
  echo "done."
fi

#import MLM vendor PQC keys
if [ -d ${PQC_MLM_VENDOR_KEYS_SRC_DIR} ]; then
  echo -n "importing SUSE Multi-Linux Manager PQC keys to target directory... "
  cp -a "${PQC_MLM_VENDOR_KEYS_SRC_DIR}"/*.pem "${PQC_KEYS_TARGET_DIR}"
  echo "done."
fi

#import custom PQC keys
if [ -d ${PQC_CUSTOMER_KEYS_SRC_DIR} ]; then
    echo -n "importing Customers PQC keys to target directory... "
    cp -a "${PQC_CUSTOMER_KEYS_SRC_DIR}"/*.pem "${PQC_KEYS_TARGET_DIR}"
    echo "done."
else
    echo "No customer PQC keys to import"
fi


# GPG KEYS

PUBRINGDIR="/var/lib/spacewalk/gpgdir"
PUBRING="${PUBRINGDIR}/pubring.gpg"
PRODUCTRING="/usr/lib/susemanager/susemanager-build-keys.gpg"
ALTPRODUCTRING="/usr/lib/uyuni/uyuni-build-keys.gpg"
CUSTRING="/var/spacewalk/gpg/customer-build-keys.gpg"

export GNUPGHOME="${PUBRINGDIR}"

mkdir -p "${PUBRINGDIR}"

# when run as root, the PUBRINGDIR is owned by tomcat. ensure the files have
# correct ownership, so gpg calls via the tomcat user can write to it.
PUBRING_OWNER=""
if [ -d "${PUBRINGDIR}" ] && [ "$(id -u)" = "0" ]; then
    PUBRING_OWNER="$(stat -c '%U:%G' "${PUBRINGDIR}")"
    if [ "${PUBRING_OWNER}" = "root:root" ]; then
        PUBRING_OWNER=""
    fi
fi
restore_pubring_owner() {
    if [ -n "${PUBRING_OWNER}" ]; then
        chown -R "${PUBRING_OWNER}" "${PUBRINGDIR}" 2>/dev/null || true
    fi
}
trap restore_pubring_owner EXIT

if [ ! -f ${PUBRING} ]; then
    touch ${PUBRING}
fi
if [ ! -f ${PRODUCTRING} -a ! -f ${ALTPRODUCTRING} ]; then
    echo "cannot find product ring"
    exit -1
fi
if [ ! -f ${PRODUCTRING} ]; then
    PRODUCTRING=${ALTPRODUCTRING}
fi

echo -n "importing SUSE Multi-Linux Manager build key to rpm keyring... "
TF=`mktemp /tmp/gpg.XXXXXX`
if [ -z "$TF" ]; then
  echo "import-suma-build-keys: cannot make temporary file. Fatal error."
  exit 20
fi
if [ -z "$HOME" ]; then
  HOME=/root
  export HOME
fi
if [ ! -d "$HOME" ]; then
  mkdir "$HOME"
fi
gpg -q --batch --no-options < /dev/null > /dev/null 2>&1 || true
# no kidding... gpg won't initialize correctly without being called twice.
gpg < /dev/null > /dev/null 2>&1 || true
gpg < /dev/null > /dev/null 2>&1 || true

gpg -q --batch --no-options --no-default-keyring --no-permission-warning \
         --keyring ${PRODUCTRING}    --export -a > $TF
a="$?"
gpg -q --batch --no-options --no-default-keyring --no-permission-warning \
         --keyring ${PUBRING}   --import < $TF
b="$?"
rm -f "$TF"
if [ "$a" = 0 -a "$b" = 0 ]; then
    echo "done."
else
    echo "importing the key from the file ${PRODUCTRING}"
    echo "returned an error. This should not happen. It may not be possible"
    echo "to properly verify the authenticity of rpm packages from SUSE sources."
    exit -1
fi

# we need to trust them, otherwise the verify will fail
echo -n "Trusting SUSE Multi-Linux Manager build keys... "
TF=`mktemp /tmp/gpg.XXXXXX`
if [ -z "$TF" ]; then
  echo "import-suma-build-keys: cannot make temporary file. Fatal error."
  exit 20
fi
gpg -q --batch --no-options --no-default-keyring --no-permission-warning \
    --keyring ${PRODUCTRING} --list-keys --with-fingerprint \
    --with-colons | awk -F: '/fpr/ {printf("%s:6:\n", $10);}' > $TF
c="$?"
gpg -q --batch --no-default-keyring --no-permission-warning \
    --homedir ${PUBRINGDIR} --import-ownertrust < $TF
d="$?"
rm -f "$TF"
if [ "$c" = 0 -a "$d" = 0 ]; then
    echo "done."
else
    echo "trusting the key from the file ${PRODUCTRING}"
    echo "returned an error. This should not happen. It may not be possible"
    echo "to properly sync repositories using spacewalk-repo-sync."
    exit -1
fi

if [ ! -s ${CUSTRING} ]; then
    echo "No customer keyring to import"
    exit 0
fi

echo -n "importing Customers build key to rpm keyring... "
TF=`mktemp /tmp/gpg.XXXXXX`
if [ -z "$TF" ]; then
  echo "import-suma-build-keys: cannot make temporary file. Fatal error."
  exit 20
fi
if [ -z "$HOME" ]; then
  HOME=/root
  export HOME
fi
if [ ! -d "$HOME" ]; then
  mkdir "$HOME"
fi

gpg -q --batch --no-options --no-default-keyring --no-permission-warning \
         --keyring ${CUSTRING}    --export -a > $TF
e="$?"
gpg -q --batch --no-options --no-default-keyring --no-permission-warning \
         --keyring ${PUBRING}   --import < $TF
f="$?"
rm -f "$TF"
if [ "$e" = 0 -a "$f" = 0 ]; then
    echo "done."
else
    echo "importing the key from the file ${CUSTRING}"
    echo "returned an error. This should not happen. It may not be possible"
    echo "to properly verify the authenticity of rpm packages from 3rd party sources."
    exit -1
fi

# we need to trust them, otherwise the verify will fail
echo -n "Trusting Customers build keys... "
TF=`mktemp /tmp/gpg.XXXXXX`
if [ -z "$TF" ]; then
  echo "import-suma-build-keys: cannot make temporary file. Fatal error."
  exit 20
fi
gpg -q --batch --no-options --no-default-keyring --no-permission-warning \
    --keyring ${CUSTRING} --list-keys --with-fingerprint \
    --with-colons | awk -F: '/fpr/ {printf("%s:6:\n", $10);}' > $TF
g="$?"
gpg -q --batch --no-default-keyring --no-permission-warning \
    --homedir ${PUBRINGDIR} --import-ownertrust < $TF
h="$?"
rm -f "$TF"
if [ "$g" = 0 -a "$h" = 0 ]; then
    echo "done."
else
    echo "trusting the key from the file ${CUSTRING}"
    echo "returned an error. This should not happen. It may not be possible"
    echo "to properly sync repositories using spacewalk-repo-sync."
    exit -1
fi
