#!/usr/bin/env bash
set -Eeuo pipefail

REPO_URL="https://software.gkmoss.com"
KEY_URL="${REPO_URL}/public.key"
INRELEASE_URL="${REPO_URL}/dists/bionic/InRelease"

KEYRING_DIR="/etc/apt/keyrings"
KEYRING="${KEYRING_DIR}/moss-repo.gpg"
OLD_KEYRING="${KEYRING_DIR}/moss-repo.asc"
SOURCE_FILE="/etc/apt/sources.list.d/moss-mirror.list"

EXPECTED_PRIMARY_FINGERPRINT="4A43C4F8D339662FDF7E5A57F99D26FB15AFE144"

TEMP_ARMOR="$(mktemp)"
TEMP_KEYRING="$(mktemp)"
TEMP_INRELEASE="$(mktemp)"

cleanup() {
    rm -f \
        "${TEMP_ARMOR}" \
        "${TEMP_KEYRING}" \
        "${TEMP_INRELEASE}"
}

trap cleanup EXIT

# ============================================================
# 1. Create the APT keyring directory
# ============================================================

sudo install -d -m 0755 "${KEYRING_DIR}"

# Remove the old repository-specific keyring. This does not touch
# unrelated system keyrings.
sudo rm -f "${OLD_KEYRING}"

# ============================================================
# 2. Download and validate the armored public key
# ============================================================

echo "==> Downloading repository public key..."

curl \
    --fail \
    --silent \
    --show-error \
    --location \
    "${KEY_URL}" \
    -o "${TEMP_ARMOR}"

echo "==> Validating repository key fingerprint..."

ACTUAL_PRIMARY_FINGERPRINT="$(
    gpg \
        --batch \
        --with-colons \
        --import-options show-only \
        --import "${TEMP_ARMOR}" 2>/dev/null \
        | awk -F: '$1 == "fpr" { print $10; exit }'
)"

if [[ "${ACTUAL_PRIMARY_FINGERPRINT}" != "${EXPECTED_PRIMARY_FINGERPRINT}" ]]; then
    echo "ERROR: Repository key fingerprint mismatch." >&2
    echo "       Expected: ${EXPECTED_PRIMARY_FINGERPRINT}" >&2
    echo "       Found:    ${ACTUAL_PRIMARY_FINGERPRINT:-none}" >&2
    exit 1
fi

echo "==> Repository key fingerprint validated:"
echo "    ${ACTUAL_PRIMARY_FINGERPRINT}"

# ============================================================
# 3. Convert the key to a binary .gpg keyring
# ============================================================

echo "==> Installing APT keyring..."

gpg \
    --batch \
    --dearmor \
    < "${TEMP_ARMOR}" \
    > "${TEMP_KEYRING}"

sudo install \
    -o root \
    -g root \
    -m 0644 \
    "${TEMP_KEYRING}" \
    "${KEYRING}"

# Confirm that APT's sandbox user can read the keyring.
if ! sudo -u _apt test -r "${KEYRING}"; then
    echo "ERROR: APT keyring is not readable by the _apt user." >&2
    exit 1
fi

# Validate the installed binary keyring without --show-keys.
INSTALLED_PRIMARY_FINGERPRINT="$(
    gpg \
        --batch \
        --with-colons \
        --import-options show-only \
        --import "${KEYRING}" 2>/dev/null \
        | awk -F: '$1 == "fpr" { print $10; exit }'
)"

if [[ "${INSTALLED_PRIMARY_FINGERPRINT}" != "${EXPECTED_PRIMARY_FINGERPRINT}" ]]; then
    echo "ERROR: Installed keyring fingerprint mismatch." >&2
    echo "       Expected: ${EXPECTED_PRIMARY_FINGERPRINT}" >&2
    echo "       Found:    ${INSTALLED_PRIMARY_FINGERPRINT:-none}" >&2
    exit 1
fi

echo "==> Installed keyring validated."

# ============================================================
# 4. Configure the APT source
# ============================================================

echo "==> Configuring APT source..."

SOURCE_LINE="deb [signed-by=${KEYRING}] ${REPO_URL} bionic main universe"

printf '%s\n' "${SOURCE_LINE}" \
    | sudo tee "${SOURCE_FILE}" >/dev/null

# ============================================================
# 5. Verify the repository metadata before apt update
# ============================================================

echo "==> Verifying repository InRelease signature..."

curl \
    --fail \
    --silent \
    --show-error \
    --location \
    "${INRELEASE_URL}" \
    -o "${TEMP_INRELEASE}"

gpgv \
    --keyring "${KEYRING}" \
    "${TEMP_INRELEASE}"

echo "==> Repository signature verified."

# ============================================================
# 6. Update package lists
# ============================================================

echo "==> Updating APT package lists..."

sudo apt-get update

echo "==> Moss APT repository configured successfully."