#!/bin/bash

## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
  # shellcheck source=../../helper-scripts/usr/libexec/helper-scripts/pre.bsh
  source /usr/libexec/helper-scripts/pre.bsh
fi

set -e

tpo_keys_add() {
  set -x

  ## TODO: port to sequoia-pgp, extrepo-offline-data or deb.torproject.org-keyring

  ## The torproject archive key has been manually downloaded using the key fingerprint from
  ## https://www.torproject.org/docs/debian.html.en and https://www.torproject.org/docs/signing-keys.html.en
  ## using gpg:
  ##    gpg --keyserver keys.gnupg.net --recv "A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89"
  ## Verified using:
  ##    gpg --list-sigs "A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89"
  ##    gpg --check-sigs "A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89"
  ## And added to derivative-maker source code using:
  ##    gpg --armor --export "A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89" > ~/derivative-maker/packages/kicksecure/anon-shared-build-apt-sources-tpo/usr/share/anon-shared-build-apt-sources-tpo/tpoarchive-keys.d/torprojectarchive.asc

  ## Update 04 December 2026
  ## Review already imported key fingerprint.
  ## gpg --fingerprint "A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89"
  # pub   rsa2048 2009-09-04 [SC] [expires: 2022-08-05]
  #       A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89
  # uid           [ unknown] deb.torproject.org archive signing key
  ## Review already imported key fingerprint.
  ## gpg --keyid-format long --import --import-options show-only --with-fingerprint
  # gpg: key EE8CBC9E886DDD89: 79 signatures not checked due to missing keys
  # pub   rsa2048/EE8CBC9E886DDD89 2009-09-04 [SC] [expires: 2022-08-05]
  #       Key fingerprint = A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89
  # uid                            deb.torproject.org archive signing key
  ## Downloaded using scurl:
  ## scurl-download https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc
  ## Show fingerprint without key import:
  ## gpg --keyid-format long --import --import-options show-only --with-fingerprint A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc
  ## Output:
  # gpg: key EE8CBC9E886DDD89: 79 signatures not checked due to missing keys
  # pub   rsa2048/EE8CBC9E886DDD89 2009-09-04 [SC] [expires: 2028-08-29]
  #       Key fingerprint = A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89
  # uid                            deb.torproject.org archive signing key
  # sub   rsa2048/74A941BA219EC810 2009-09-04 [S] [expires: 2027-11-01]
  ## Imported key:
  ## gpg --import A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc
  # gpg: key 0xEE8CBC9E886DDD89: 79 signatures not checked due to missing keys
  # gpg: key 0xEE8CBC9E886DDD89: "deb.torproject.org archive signing key" 1 new signature
  # gpg: Total number processed: 1
  # gpg:         new signatures: 1
  # gpg: marginals needed: 3  completes needed: 1  trust model: pgp
  # gpg: Note: third-party key signatures using the SHA1 algorithm are rejected
  # gpg: (use option "--allow-weak-key-signatures" to override)
  # gpg: depth: 0  valid:   1  signed:   1  trust: 0-, 0q, 0n, 0m, 0f, 1u
  # gpg: depth: 1  valid:   1  signed:   1  trust: 1-, 0q, 0n, 0m, 0f, 0
  ## Review fingerprint after having imported updated key file:
  ## gpg --fingerprint "A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89"
  # pub   rsa2048/0xEE8CBC9E886DDD89 2009-09-04 [SC] [expires: 2028-08-29]
  #       Key fingerprint = A3C4 F0F9 79CA A22C DBA8  F512 EE8C BC9E 886D DD89
  # uid                   [ unknown] deb.torproject.org archive signing key
  # sub   rsa2048/0x74A941BA219EC810 2009-09-04 [S] [expires: 2027-11-01]
  ## Conclusion:
  ## Same fingerprint but with extended key expiration.
  ## Update key in package:
  #mv --verbose -- ./A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc ./usr/share/anon-shared-build-apt-sources-tpo/tpoarchive-keys.d/torprojectarchive.asc

  ## /usr/share/anon-shared-build-apt-sources-tpo/tpoarchive-keys.d/torprojectarchive.asc cannot be simply moved to
  ## /usr/share/keyrings/deb.torproject.org-keyring.gpg in this package since it would break APT since then another package
  ## deb.torproject.org-keyring would also try to own that file.
  ##
  ## Need to write to /usr/share/keyrings/deb.torproject.org-keyring.gpg because that is hardcoded in
  ## /etc/apt/sources.list.d/torproject.sources signed-by.
  ## key format: '.asc' (gpg armored public key file)
  apt_source_key="/usr/share/anon-shared-build-apt-sources-tpo/tpoarchive-keys.d/torprojectarchive.asc"
  ## key format: '.gpg' (gpg binary public key file)
  apt_target_key="/usr/share/keyrings/deb.torproject.org-keyring.gpg"

  if test -f '/usr/share/keyrings/deb.torproject.org-keyring.gpg'; then
    printf '%s\n' "INFO: File '/usr/share/keyrings/deb.torproject.org-keyring.gpg' already exists, not overwriting, ok."
    return 0
  fi

  ## 'apt-key-install' includes sanity tests and error handling.
  apt-key-install "$apt_source_key" "$apt_target_key"
}

true "
#####################################################################
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
#####################################################################
"

case "$1" in
configure)
  true "INFO: Configuring $DPKG_MAINTSCRIPT_PACKAGE..."
  ## Doing this only once,
  ## because when the user updates, the 'deb.torproject.org-keyring' deb package is already
  ## installed, which does a better job updating Tor Project's signing key.
  if [ ! -f "/var/lib/anon-dist/do_once/tpo_keys_add" ]; then
    tpo_keys_add
    mkdir --parents -- "/var/lib/anon-dist/do_once"
    touch -- "/var/lib/anon-dist/do_once/tpo_keys_add"
  fi
  true "INFO: End configuring $DPKG_MAINTSCRIPT_PACKAGE."
  ;;
*)
  true "INFO: No action."
  ;;
esac

true "INFO: debhelper beginning here."

#DEBHELPER#

true "INFO: Done with debhelper."

true "
#####################################################################
## INFO: END  : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
#####################################################################
"

## Explicitly "exit 0", so eventually trapped errors can be ignored.
exit 0
