#!/bin/sh
# Add the NorviTech APT repository to this machine.
#
#   curl -fsSL https://apt.globalentry.systems/setup.sh | sudo sh
#
# It checks the archive key against the fingerprint below, uses that key for a
# temporary source that leaves /etc/apt untouched, and installs
# norvi-archive-keyring from it. From then on that package owns the source
# (/etc/apt/sources.list.d/norvi.sources), the key, and the unattended-upgrades
# origin, so a key rotation or an update arrives as an ordinary upgrade.
#
# Running it again is safe. It is also how a machine set up before 2026-10
# (a hand-written norvi.sources and a key in /etc/apt/keyrings) moves onto the
# package. Piping a script into a root shell hands this machine to whoever
# controls the domain: read it first if that matters to you.
set -eu

REPO=https://apt.globalentry.systems
FINGERPRINT=4C9602FE8FEAEEAE32C291A050159FFFA890C47F
OLD_KEY=/etc/apt/keyrings/norvi-archive-keyring.asc
SUPPORTED=resolute
SUPPORTED_ARCH=amd64

die() { echo "error: $*" >&2; exit 1; }

# CI tests branch builds of the archive, which are signed with a throwaway key.
if [ -n "${NORVI_APT_FINGERPRINT:-}" ]; then
  echo "warning: NORVI_APT_FINGERPRINT replaces the archive key fingerprint" >&2
  FINGERPRINT=$NORVI_APT_FINGERPRINT
fi

[ "$(id -u)" = 0 ] || die "run me as root (sudo)"
for tool in curl gpg; do
  command -v "$tool" >/dev/null || die "$tool is required (apt-get install $tool)"
done

# These packages link against the Ubuntu release they were built on, so take
# the suite from the machine. A signed index for the wrong release or
# architecture makes `apt update` succeed and `apt install` then say "Unable to
# locate package" with nothing to explain it.
SUITE=""
if [ -r /etc/os-release ]; then
  SUITE=$(. /etc/os-release && echo "${VERSION_CODENAME:-}")
fi
[ "$SUITE" = "$SUPPORTED" ] ||
  die "this repository has no packages for '${SUITE:-unknown}' (supported: $SUPPORTED)"
ARCH=$(dpkg --print-architecture)
[ "$ARCH" = "$SUPPORTED_ARCH" ] ||
  die "this repository only has $SUPPORTED_ARCH packages, and this machine is $ARCH"

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -m 0700 "$tmp/gnupg"
mkdir -p "$tmp/sources.list.d" "$tmp/lists/partial"
# apt downloads as the unprivileged _apt user when it can.
chmod 0755 "$tmp"
chown _apt "$tmp/lists/partial" 2>/dev/null || :

# Refuse anything but exactly one key with the published fingerprint: a second
# key in the file would be trusted by the temporary source too.
curl -fsSL "$REPO/norvi-archive-keyring.asc" -o "$tmp/key.asc"
got=$(GNUPGHOME="$tmp/gnupg" gpg --show-keys --with-colons "$tmp/key.asc" 2>/dev/null |
  awk -F: '$1 == "pub" { n++; want = 1; next }
           want && $1 == "fpr" { fpr = $10; want = 0 }
           END { if (n == 1) print fpr }')
[ "$got" = "$FINGERPRINT" ] ||
  die "signing key fingerprint mismatch: expected $FINGERPRINT, got ${got:-<unreadable or not exactly one key>}"
chmod 0644 "$tmp/key.asc"

# A temporary source with its own lists directory: the machine's sources are
# not read, so an older hand-written norvi.sources cannot conflict with it, and
# the machine's package lists are not touched.
cat > "$tmp/sources.list.d/norvi.sources" <<EOF
Types: deb
URIs: $REPO
Suites: $SUITE
Components: main
Architectures: $SUPPORTED_ARCH
Signed-By: $tmp/key.asc
EOF
tmp_apt() {
  apt-get -o Dir::Etc::SourceList=/dev/null \
    -o Dir::Etc::SourceParts="$tmp/sources.list.d" \
    -o Dir::State::Lists="$tmp/lists" "$@"
}
# </dev/null: under `curl | sh` this script is stdin, and nothing apt starts
# may read it. --force-confold keeps a locally edited norvi.sources.
tmp_apt update </dev/null
DEBIAN_FRONTEND=noninteractive tmp_apt install -y \
  -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold \
  norvi-archive-keyring </dev/null

# The package now owns the key. Remove the copy older versions of this script
# put in /etc/apt/keyrings, unless a source apt reads still names it.
if [ -e "$OLD_KEY" ] && ! grep -qsF "$OLD_KEY" /etc/apt/sources.list \
    /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; then
  rm -f "$OLD_KEY"
fi

apt-get update </dev/null
echo
echo "NorviTech repository added. Its packages update with the rest of the system,"
echo "including through unattended-upgrades. See what is available with:"
echo "  apt list '?origin(Norvi)'"