#!/bin/bash

## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Static-analysis waivers: 'command -v' below (the 'has' helper is not sourced
## in this cowbuilder chroot) and 'rm' (safe-rm is not guaranteed present in the
## chroot at this stage). '$newer_package_list' is deliberately word-split (a
## space-separated apt package list).
## style-ok: no-has
## style-ok: no-safe-rm
# shellcheck disable=SC2086

set -x
set -o errexit
set -o nounset
set -o pipefail
set -o errtrace
shopt -s inherit_errexit
shopt -s shift_verbose

true "INFO: (hardcoded) this script is: help-steps/repo_download_chroot_script"
true "INFO:  This script is supposed to be either executed:"
true "INFO: - by cowbuilder which is expected to run as root (sudo), or"
true "INFO: - using root (sudo)."
true "INFO: \$0: '$0' | \$*: '$*'"

if [ "$EUID" != "0" ]; then
   printf '%s\n' "ERROR: This must be run as root (sudo)!"
   exit 1
fi

command -v sq >/dev/null

#declare -p | awk '{print $3}' | sort

## Debugging.
cat -- "/home/$user_name/pbuilder_config_file"

source "/home/$user_name/pbuilder_config_file"

true "---------------"
true "INFO: HOMEVAR_VBOX_TEMP: $HOMEVAR_VBOX_TEMP"
true "INFO: BUILDPLACE: $BUILDPLACE"
true "INFO: DIST_APTGETOPT_SERIALIZED: $DIST_APTGETOPT_SERIALIZED"
true "---------------"

mapfile -t DIST_APTGETOPT <<< "$DIST_APTGETOPT_SERIALIZED"
printf "%s\n" "DIST_APTGETOPT: ${DIST_APTGETOPT[*]}"

test -f "${if_no_pbuilder_base_folder}/var/cache/derivative-maker/temporary-repository/newer.sources"

cat -- "${if_no_pbuilder_base_folder}/var/cache/derivative-maker/temporary-repository/newer.sources"

## Delete the binary version in case it is there.
rm -f -- "/etc/apt/trusted.gpg.d/newer.asc"

if [ -f "${if_no_pbuilder_base_folder}/var/cache/derivative-maker/temporary-repository/repo_signing_key.asc" ]; then
   cp --verbose -- "${if_no_pbuilder_base_folder}/var/cache/derivative-maker/temporary-repository/repo_signing_key.asc" "/etc/apt/trusted.gpg.d/newer.asc"
   ## Fix for:
   ## The key(s) in the keyring /etc/apt/trusted.gpg.d/newer.asc are ignored as the file is not readable by user '_apt' executing apt-key.
   chmod o+r -- "/etc/apt/trusted.gpg.d/newer.asc"
   ## Debugging (best-effort). "sq" is a Rust binary that panics ("capacity
   ## overflow") under qemu-user aarch64 emulation, so these purely
   ## informational calls must never abort the build when cross-building
   ## arm64 on a non-arm64 host. This is a qemu-user bug (fixed upstream in
   ## qemu >= 10.2.0), not an sq or derivative-maker bug. apt's own Release
   ## verification uses gpgv and is unaffected.
   sq inspect -- "/etc/apt/trusted.gpg.d/newer.asc" || true
   sq cert lint --cert-file "/etc/apt/trusted.gpg.d/newer.asc" || true
fi

if [ "${temp_newer_packages:-}" = "" ]; then
   printf '%s\n' "ERROR $0: temp_newer_packages is empty!"
   exit 1
fi

if [ "${apt_target_release:-}" = "" ]; then
   printf '%s\n' "ERROR $0: apt_target_release is empty!"
   exit 1
elif [ "${apt_target_release:-}" = "none" ]; then
   target_release_option=""
else
   target_release_option="--target-release=${apt_target_release}"
fi

pushd "$temp_newer_packages"

## Use dpkg multiarch so we can download other architectures than the build host's one using apt-get.
for dist_build_multiarch_package_item in $make_cross_build_platform_list ; do
   dpkg --add-architecture "$dist_build_multiarch_package_item"
done

apt-get \
   "${DIST_APTGETOPT[@]}" \
   $apt_unattended_opts \
   $target_release_option \
   -o Dir::Etc::sourcelist="${if_no_pbuilder_base_folder}/var/cache/derivative-maker/temporary-repository/newer.sources" \
   -o Dir::Etc::sourceparts="-" \
   -- \
   update

# apt-cache \
#    "${DIST_APTGETOPT[@]}" \
#    $apt_unattended_opts \
#    $target_release_option \
#    -o Dir::Etc::sourcelist="${if_no_pbuilder_base_folder}/var/cache/derivative-maker/temporary-repository/newer.sources" \
#    -o Dir::Etc::sourceparts="-" \
#    -- \
#    show \
#    $newer_package_list \
#    || true

# apt-config \
#    "${DIST_APTGETOPT[@]}" \
#    $apt_unattended_opts \
#    $target_release_option \
#    -o Dir::Etc::sourcelist="${if_no_pbuilder_base_folder}/var/cache/derivative-maker/temporary-repository/newer.sources" \
#    -o Dir::Etc::sourceparts="-"
#    -- \
#    dump

#ls -- /var/lib/apt/lists/

apt-get \
   "${DIST_APTGETOPT[@]}" \
   $apt_unattended_opts \
   $target_release_option \
   -o Dir::Etc::sourcelist="${if_no_pbuilder_base_folder}/var/cache/derivative-maker/temporary-repository/newer.sources" \
   -o Dir::Etc::sourceparts="-" \
   download \
   -- \
   $newer_package_list

if [ "${download_source_package:-}" = "true" ]; then
   apt-get \
      "${DIST_APTGETOPT[@]}" \
      $apt_unattended_opts \
      $target_release_option \
      --yes \
      --download-only \
      -o Dir::Etc::sourcelist="${if_no_pbuilder_base_folder}/var/cache/derivative-maker/temporary-repository/newer.sources" \
      -o Dir::Etc::sourceparts="-" \
      -- \
      source \
      $newer_package_list
fi

popd
