#!/bin/bash
# SPDX-License-Identifier: GPL-3.0-or-later
set -euo pipefail
# A third-party desktop repository is optional. Failure must not abort
# installation of the base system.
trap 'exit 0' ERR

target=$(realpath -- "$1")
work=$(mktemp -d "$target/var/tmp/calamares-denial.XXXXXX")
trap 'rm -rf -- "$work"' EXIT
key="$work/repository.asc"
curl --fail --silent --show-error --location --connect-timeout 8 --max-time 20 'https://packages.denialwm.org/denial-repo-key.asc' -o "$key"
fingerprint=$(gpg --homedir "$work" --batch --show-keys --with-colons "$key" |
    awk -F: '$1 == "fpr" { print $10; exit }')
[[ "$fingerprint" == 'AE4108FA5E91E26BE0EE331E0F5B3AD16E023091' ]]
timeout -k 5s 45s chroot "$target" pacman-key --init
timeout -k 5s 20s chroot "$target" pacman-key --add "/var/tmp/${work##*/}/repository.asc"
timeout -k 5s 20s chroot "$target" pacman-key --lsign-key "$fingerprint"

if ! chroot "$target" pacman-conf --repo-list | grep -Fxq denial; then
    cp -p -- "$target/etc/pacman.conf" "$work/pacman.conf"
    cat >> "$work/pacman.conf" <<'EOF'

[denial]
SigLevel = Required TrustedOnly
Server = https://packages.denialwm.org/arch/$arch
EOF
    timeout -k 5s 75s chroot "$target" pacman --config "/var/tmp/${work##*/}/pacman.conf" -Sy --noconfirm
    mv -- "$work/pacman.conf" "$target/etc/pacman.conf"
else
    timeout -k 5s 75s chroot "$target" pacman -Sy --noconfirm
fi
