#!/bin/bash

DIR_BIN=$1
DIR_SIGNED=$2

if [ -z $DIR_BIN ]; then
        echo "Specify original directory as first argument."
        exit 1
fi

[ "$DIR_BIN" == "${DIR_BIN#/}" ] && DIR_BIN=$(pwd)/$DIR_BIN

if [ -z $DIR_SIGNED ]; then
        echo "Specify destination directory as second argument."
        exit 1
fi

[ "$DIR_SIGNED" == "${DIR_SIGNED#/}" ] && DIR_SIGNED=$(pwd)/$DIR_SIGNED

if [ ! -e $DIR_BIN ]; then
        echo "Original directory $DIR_BIN doesn't exist."
        exit 1
fi

if [ ! -e $DIR_SIGNED ]; then
        mkdir -p $DIR_SIGNED
fi

TMP_DIR=$DIR_SIGNED/tmp$$

if [ `id -g` -ne 0 -o `id -u` -ne 0 ]; then
        FAKEROOT_ENV=$DIR_SIGNED/fakeroot-env$$
        FAKEROOT=fakeroot
        FAKEROOT_IN="$FAKEROOT -i $FAKEROOT_ENV -s $FAKEROOT_ENV -- "
        FAKEROOT_OUT="$FAKEROOT -i $FAKEROOT_ENV -s $FAKEROOT_ENV -- "
        which $FAKEROOT >/dev/null 2>&1 || { echo "Error: fakeroot not found, exiting."; exit 1; }
        touch $FAKEROOT_ENV
else
        FAKEROOT_ENV=
        FAKEROOT_IN=
        FAKEROOT_OUT=
fi

function finish {
        echo "Cleaning up."
        [ -e ${FAKEROOT_ENV} ] && rm -f ${FAKEROOT_ENV}
        rm -rf ${TMP_DIR}
}

trap finish EXIT INT HUP

os_release=$(cat /etc/astra_version || echo "<not found>")
case "${os_release}" in
        "SE 1.4 (smolensk)")
                key_id="12345678"
                key_package="keyring-1.4"
                ;;
        "SE 1.5 (smolensk)")
                key_id="87654321"
                key_package="keyring-1.5"
                ;;
        *)      key_id="'unknown'"
                echo "Unsupported OS release ('${os_release}')."
                exit 1
                ;;
esac

echo "Using key with ID = ${key_id} for signing at ${os_release}."

list_of_packages=`find $DIR_BIN -type f -name "*.deb"`
list_of_udebs=`find $DIR_BIN -type f -name "*.udeb"`
#echo $list_of_packages

for i in $list_of_packages ; do
        pack_name=`echo $i | awk '{sub(/^.+\//,"",$0) ; a=$0; print a}'`
        mkdir -p $TMP_DIR/{control,data}
        cp $i $TMP_DIR
        pushd $TMP_DIR
        $FAKEROOT_IN ar x $pack_name

        # Defining archives type
        data_arch_type=`ls data.tar* | cut -d'.' -f3`
        control_arch_type=`ls control.tar* | cut -d'.' -f3`
        popd

        # Unpack data archive
        pushd $TMP_DIR/data
        case $data_arch_type in
                gz)
                $FAKEROOT_IN tar --same-permissions --same-owner -xzf ../data.tar.gz
                ;;
                bz2)
                $FAKEROOT_IN tar --same-permissions --same-owner -xjf ../data.tar.bz2
                ;;
                lzma)
                $FAKEROOT_IN tar --same-permissions --same-owner --lzma -xf ../data.tar.lzma
                ;;
        esac
        popd

        # Unpack control archive
        pushd $TMP_DIR/control
        case $control_arch_type in
                gz)
                $FAKEROOT_IN tar --same-permissions --same-owner -xzf ../control.tar.gz
                ;;
                bz2)
                $FAKEROOT_IN tar --same-permissions --same-owner -xjf ../control.tar.bz2
                ;;
                lzma)
                $FAKEROOT_IN tar --same-permissions --same-owner --lzma -xf ../control.tar.lzma
                ;;
        esac
        popd

        # Sign files
        pushd $TMP_DIR/data
        for file in `find . -type f` ; do
                oldstat=`stat -c %a $file`
                # bsign is statically linked, so fakeroot doen't matter at all
                # change fakeroot environment regarding to the new file ino, created by bsign
                oldino=`stat -c %i $file`
                bsign -N -s --pgoptions "--default-key=${key_id}" $file  
                newino=`stat -c %i $file`
                [ -e $FAKEROOT_ENV ] && sed -i s,ino=$oldino,ino=$newino,g $FAKEROOT_ENV
                bsign -V $file | grep -v "not ELF64"
                bsign -w $file | grep -v "not ELF64"
                newstat=`stat -c %a $file`
                [ $newstat != $oldstat ] && echo "BSIGN_CHMOD_ERROR in $file"
        done
        popd

        # Counting md5sums
        pushd $TMP_DIR/control
        if [ -e ./md5sums ]; then
                filenames=`cat md5sums | awk -F'  ' '{print $2}'`
                popd
                pushd $TMP_DIR/data
                for j in $filenames; do
                        ${FAKEROOT_OUT} bash -c "echo `md5sum $j` >> $TMP_DIR/control/md5sums.new"
                done
                ${FAKEROOT_OUT} bash -c "sed -e 's/\ /\ \ /g' $TMP_DIR/control/md5sums.new > $TMP_DIR/control/md5sums.new_mod"
                popd
                ${FAKEROOT_OUT} mv -f $TMP_DIR/control/md5sums.new_mod $TMP_DIR/control/md5sums
                ${FAKEROOT_OUT} rm -f $TMP_DIR/control/md5sums.new
        fi

        # Packing back in deb
        pushd $TMP_DIR/data
        case $data_arch_type in
                gz)
                $FAKEROOT_OUT tar --same-permissions --same-owner -czf ../data.tar.gz .
                ;;
                bz2)
                $FAKEROOT_OUT tar --same-permissions --same-owner -cjf ../data.tar.bz2 .
                ;;
                lzma)
                $FAKEROOT_OUT tar --same-permissions --same-owner --lzma -cf ../data.tar.lzma .
                ;;
        esac
        popd

        pushd $TMP_DIR/control
        case $control_arch_type in
                gz)
                $FAKEROOT_OUT tar --same-permissions --same-owner -czvf ../control.tar.gz .
                ;;
                bz2)
                $FAKEROOT_OUT tar --same-permissions --same-owner -cjvf ../control.tar.bz2 .
                ;;
                lzma)
                $FAKEROOT_OUT tar --same-permissions --same-owner --lzma -cvf ../control.tar.lzma .
                ;;
        esac
        popd
        pushd $TMP_DIR
        $FAKEROOT_OUT chmod -v ug+w $TMP_DIR/$pack_name
        $FAKEROOT_OUT ar rcs $TMP_DIR/$pack_name debian-binary control.tar.$control_arch_type data.tar.$data_arch_type
        cp $pack_name $DIR_SIGNED/
        popd
        rm -rf $TMP_DIR
        [ -e $FAKEROOT_ENV ] && echo -n > ${FAKEROOT_ENV}
done

for j in $list_of_udebs ; do
        cp $j $DIR_SIGNED
done

sed -e '1,/^# Script EOF/d' < $0 | tar --strip-components=1 -zxv -C ${DIR_SIGNED} "${key_package}" 

exit 0

# vim: set ts=8 sts=8 sw=8 et:
# Script EOF