#!/bin/sh
#
# Copyright 2009 The Chromium Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# This script is part of the yandex-browser package.
#
# It creates the repository configuration file for package updates, since
# we cannot do this during the yandex-browser installation since the repository
# is locked.
#
# This functionality can be controlled by creating the $DEFAULTS_FILE and
# setting "repo_add_once" to "true" or "false" as desired. An empty
# $DEFAULTS_FILE is the same as setting the value to "false".

# System-wide package configuration.
DEFAULTS_FILE="/etc/default/yandex-browser"


# sources.list setting for yandex-browser updates.
REPOCONFIG="http://repo.yandex.ru/yandex-browser/rpm/stable"
REPOCONFIGREGEX=""

# This file is automatically generated by update_key_include.py
# Do not edit this file directly.

# This is used as a priority value for the key file, so newer
# keyrings should always take priority.
PGP_KEY_VERSION=2


# pub   rsa4096 2023-05-16 [SC]
#       224974DB7FED6DECB7D855EF60B9CD3A083A7A9A
# uid                      Yandex Browser Repository Key <browser@support.yandex.ru>
# sub   rsa4096 2023-05-16 [E]

PGP_KEY_DATA=$(cat <<KEYDATA
mQINBGRjrD4BEADQ/RQI4bgIf5XpqaqZPA1EtSXpqoJphfbQ9wnMD1E4AExTf6aU
bPiKdU0g1YnCBbhl74tM2S+apQIBj+TdewF04q8nck9IBp2OSQWYXWDj7oe5DUvK
s9SgQgDQxH/+S56+m0tkJt5hjPausibfWVon7j/RQnTYG3479Qp/lCsw1OwFzpfJ
kDY16U4hLYHmYYMQ28DGiIEjYXCthhJkMo4G5I89hJQR1jgUjmkH34tV2q0y3Q06
Ln49s6O40TM18ViTK9ZiFZBsV70QsNKiTNXMSXFAINfD7+zwcmHUXpVWgBpeeYF6
ensruZbgQ3LOHqSv+Lk0w80d+3kNV+WUHDP8jz4rOx/6FIyks4Ldmk3E0/clf7B2
SkSc1xSUVV2RcqQOAOKl2ql8T167EcpbX8i9JpwRW6LSP9iUetudYTk72NKNhQbp
Iaz/LwqXquTPYYi0fsYwCTDacZ4QiHvMqLeal+4vjQIEsu+D51Y2t1gyRQ+kmCgL
zYB/1oTHvjV3Tl1ONXAJgVe4oY3wae21N+uUV00Vb1mUpHsVOjW42QivsYyLtKU0
ulDVSeOt8KwBm7cYOiZeiGn1oFz/fSNfCf+DI0PQPmKLvirCP96sRK6ERG61R2vC
iPdLAe5EVSNUKknYAUna7bjl+Hg206q4jqVrd4s0CpNt7uI79Mpcq26izQARAQAB
tDlZYW5kZXggQnJvd3NlciBSZXBvc2l0b3J5IEtleSA8YnJvd3NlckBzdXBwb3J0
LnlhbmRleC5ydT6JAk4EEwEKADgWIQQiSXTbf+1t7LfYVe9guc06CDp6mgUCZGOs
PgIbAwULCQgHAwUVCgkICwUWAgMBAAIeBQIXgAAKCRBguc06CDp6mshjD/9PnDuo
NjaGaNoP05BsGTJ5NXWX1I8yIyRH2oe99gaQa2yB9OePL0eAR3QdQos7+YT/zWQW
nHqG5aDHrhs+zRuMsG5/1eS00wMxlwzRYo73jSmCrzvRyiYFVQLiVIR8ChBEQdsG
nDPJ3+LTCFaVMJ5vlBOoHT4x/j/TehCukOAPCobqnfCHZVD/RaCIxBYFkUFsnj8h
eeUb1DSvy0G5zXYDl+fl3zfkv8qf9D6Mls0SMeqofs61rJkg0lgPd6WHcbC/MHEE
XqG/7PWgLDrMZrI4dVw7quifWsnSOTJIxhrSixP4xro5blMFxeaJx5kVb7xWsbqU
ccsOAYzJeqO4Yew0QuFeMWwKAUW9Hx3g9bs2Iu/J1OhzGpz4aDCdtXV+k3B6Al5s
Xn1Xoyqd70OP4RweSeSlufkMhsgsKQg1l+0npN3cqWV9FcxYLzdw1cPsjXIXj+8u
GXku8ax+J4VmVSGXh4lMnqQH9/WZkiKSDKkHvFfRXTIpmaUMUkH3Tw6muHkntol6
cZ+9H3/naLf+4HtYnav1jHXrYiaBQFHPFV0AsFqCIaiKS6OWME8F7plecgD56wVt
i5piS0Iz2xTDA9O50aBEwe/Zl4YQ+xuNAsuYtb2UudziPQfgS38ec2qywOZJfz+n
vSpN/t7SBZiuUr9FrWnClnhqKTAdXUPnwIx+MLkCDQRkY6w+ARAApGIX1HdNDqqd
1KyZhXTQdqkBfIFb9JFCGNVUbh9IYucPA8CSDtCmKrFrqqslNVCqEwgLu5monEzP
KNUlEf8/PsW7UQsDdAzYfN3ev7DP5xKmFf1pcxaCidj/xOTxMZegvs4v1o8JmcOa
u3leEbZWd0F0g25+AeJR7fXOFctLJthNeC19gZAG62vg7+UL+haR3ufUayqK4fh3
RYn0cjXMQseWK/YxHFbUZ+MbWwGM0454h7l1mr2pCzUH/dscuG5VjogPIUS9yVV3
467IPF1xfTv0mCJseQIt61xuUMG/+x5iWeMjd4CThEnoYMHQyEYi0BIwFlFd56iW
87NgRwngvTNRmoEQ/MGVdBOAf354p9RocUmUu3tqqzlZYwlFbRuIjSZqy/KbIEmC
HmvrKwNDukMfdd7crvWL8oc6KaoC564FNYr2rlIEpgZDO0bZ9mlRNwZM4AoSh0kw
ZE2fSDY1eEDDHZmnOULO5xuAvn7DxeUaOQ2NegeRDTkodQUotSkcEz8JiA0PbAhC
uOQYYfFbMnjbF3ckTu0w2SdrRlxnebpF7aUV+pOnrEz3L88b6OZ6BZORpMCOav4O
suu+qsoSf8f5W9wQ5VVWycQTreDJzDBbGNoYVMHbgn8A5GEeM5v0fa7Vmd03PFEX
RxGFNJ3FtZmN5X9mL89cPd8uUFY85vEAEQEAAYkCNgQYAQoAIBYhBCJJdNt/7W3s
t9hV72C5zToIOnqaBQJkY6w+AhsMAAoJEGC5zToIOnqaskcQAKtfnpkzo/jcH2tp
BCsd49V1ocQvQj+l19h3/bYG4LGxr6cZPJSPua+rktZkgjbRyuJ5j/O3IO76pD9y
BfZyzPn8+rzvO0lvJLq/5Wf8LDikWlTYX31yaF379WU+rwv7yJVw3dlUnpIO3ktE
SyEc92i9MuAs/zc8J+6ceYQlozXD2wkCwMwy+YlgdYXjX4N/lO01SJ52O9Er5L99
fyxdFDcYOvN8VxrJw2VGT6zzVyL2OUNmNsBl5Gr2P7J4G5YWAOYm+o0Ui/aEcXWs
HgTtxIyAhNT4nP8mgdB6CFJF0E7OLPk8gcubZFgXwxaoAyPPgLKVCo3+9eBbMTUu
JxxnHUWbJovHuZwFRq8eJAoTZp78ZjAvku65uSUcYayux2del94/+pksQFRwy1RF
XYdWfSMk7QNwGTWPee4Qu5bCw5Rtg/R8w6dFhVaXfbrfCkTIsu1L8QMU6Gj9Zlpx
4CGZ2xmYc6+2coXfR7NUKIWIfk3JqhD3O1xuBzFgicgJ0WjBhjsfY/a7N1JtXOcF
kJDzgMH21llsbUdvtEoZgPdyy9iTA/U7FnPpDV/+uV4sMyMNvr6nA1N8HifoMLNM
pZifZYbNHFRptZ7MGjhVmqJZl96H3D84q5253xaI4/3THgBfKWuoJiLBm4siPsC4
9f/ZjpTnNxlKtuKyXULMET5MIxzB
KEYDATA

)

PGP_KEY_CHECKSUM="=XKpA"
PGP_FINGERPRINT="224974DB7FED6DECB7D855EF60B9CD3A083A7A9A"


PGP_SUBKEYS="32EE5355A6BC6E42 FD533C07C264648F"


# Install the repository signing key
install_rpm_key() {
  KEY_PACKAGE="gpg-pubkey-cc5fdb34-540dae43"

  # Make sure no older version of the key is installed because it appears
  # 'rpm --import' won't overwrite an existing key package.
  rpm -q ${KEY_PACKAGE} >/dev/null 2>&1
  if [ "$?" -eq "0" ]; then
    # Note, if this is run during the package install, it will fail because rpm
    # can't recursively run rpm, but it should work when run later as part of
    # the installed cron job (and probably nothing needs the new keys before
    # then).
    # BROWSER-145817: Alter Linux install hangs on 'rpm -e'... instruction.
    # Skip it.
    OS_VER=$(uname -a)
    IS_ALTER_LINUX=$(echo $OS_VER | grep "\.el7\.x86_64")
    if [ "$?" -eq "0" ]; then
      echo "Skip rpm -e on Alter Linux"
      return
    fi
    rpm -e --allmatches ${KEY_PACKAGE} >/dev/null 2>&1 || return
  fi

  # RPM on Mandriva 2009 is dumb and does not understand "rpm --import -"
  TMPKEY=$(mktemp /tmp/yandex.sig.XXXXXX)
  if [ -n "$TMPKEY" ]; then
    cat > "$TMPKEY" <<KEYDATA
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.11 (GNU/Linux)

$PGP_KEY_DATA
$PGP_KEY_CHECKSUM
-----END PGP PUBLIC KEY BLOCK-----
KEYDATA
    rpm --import "$TMPKEY"
    rc=$?
    rm -f "$TMPKEY"
    if [ "$rc" -eq "0" ]; then
      return 0
    fi
  fi
  return 1
}

determine_rpm_package_manager() {
  local RELEASE

  # Modern method using os-release(5)
  if [ -f "/etc/os-release" ]; then
    RELEASE=$(. "/etc/os-release"; echo "$ID")
    case $RELEASE in
    "fedora"|"rhel"|"centos"|"amzn"|"mageia"|"openmandriva")
      PACKAGEMANAGERS=(yum)
      ;;
    "suse"|"sles"|"sled"|"opensuse"|"opensuse-leap"|"opensuse-tumbleweed")
      PACKAGEMANAGERS=(zypp)
      ;;
    esac
  fi

  if [ "$PACKAGEMANAGERS" ]; then
    return
  fi

  # Fallback method using lsb_release(1)
  LSB_RELEASE="$(command -v lsb_release 2> /dev/null)"
  if [ -x "$LSB_RELEASE" ]; then
    RELEASE=$(lsb_release -i 2> /dev/null | sed 's/:\t/:/' | cut -d ':' -f 2-)
    case $RELEASE in
    "Fedora"|"Amazon"|"Mageia"|"OpenMandrivaLinux")
      PACKAGEMANAGERS=(yum)
      ;;
    "SUSE LINUX"|"openSUSE")
      PACKAGEMANAGERS=(zypp)
      ;;
    esac
  fi

  if [ "$PACKAGEMANAGERS" ]; then
    return
  fi

  # Fallback methods that are probably unnecessary on modern systems.
  if [ -f "/etc/fedora-release" ] || [ -f "/etc/redhat-release" ]; then
    PACKAGEMANAGERS=(yum)
  elif [ -f "/etc/system-release" ] && grep -Fq "Amazon Linux" "/etc/system-release"; then
    PACKAGEMANAGERS=(yum)
  elif [ -f "/etc/SuSE-release" ]; then
    PACKAGEMANAGERS=(zypp)
  fi
}

DEFAULT_ARCH="x86_64"
YUM_REPO_FILE="/etc/yum.repos.d/yandex-browser.repo"
ZYPPER_REPO_FILE="/etc/zypp/repos.d/yandex-browser.repo"

install_yum() {
  OS_VER=$(uname -a)
  IS_ALT_LINUX=$(echo $OS_VER | grep "\-std\-def\-alt")
  if [ "$?" -ne "0" ]; then
    install_rpm_key
  fi

  if [ ! "$REPOCONFIG" ]; then
    return 0
  fi

  if [ -d "/etc/yum.repos.d" ]; then
cat > "$YUM_REPO_FILE" << REPOCONTENT
[yandex-browser]
name=yandex-browser
baseurl=$REPOCONFIG/$DEFAULT_ARCH
enabled=1
gpgcheck=1
gpgkey=https://repo.yandex.ru/yandex-browser/YANDEX-BROWSER-KEY.GPG
REPOCONTENT
  fi
}

install_zypp() {
  if [ ! "$REPOCONFIG" ]; then
    return 0
  fi

  # Ideally, we would run: zypper addrepo -t YUM -f \
  # "$REPOCONFIG/$DEFAULT_ARCH" "yandex-browser"
  # but that does not work when zypper is running.
  if [ -d "/etc/zypp/repos.d" ]; then
cat > "$ZYPPER_REPO_FILE" << REPOCONTENT
[yandex-browser]
name=yandex-browser
enabled=1
autorefresh=1
baseurl=$REPOCONFIG/$DEFAULT_ARCH
gpgcheck=1
gpgkey=https://repo.yandex.ru/yandex-browser/YANDEX-BROWSER-KEY.GPG
type=rpm-md
keeppackages=0
REPOCONTENT
  fi
}

# Check if the automatic repository configuration is done, so we know when to
# stop trying.
verify_install() {
  # It's probably enough to see that the repo configs have been created. If they
  # aren't configured properly, update_bad_repo should catch that when it's run.
  case $1 in
  "yum")
    [ -f "$YUM_REPO_FILE" ]
    ;;
  "zypp")
    [ -f "$ZYPPER_REPO_FILE" ]
    ;;
  esac
}

# Update the Google repository if it's not set correctly.
update_bad_repo() {
  if [ ! "$REPOCONFIG" ]; then
    return 0
  fi

  determine_rpm_package_manager

  for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]}
  do
    case $PACKAGEMANAGER in
    "yum")
      update_repo_file "$YUM_REPO_FILE"
      ;;
    "zypp")
      update_repo_file "$ZYPPER_REPO_FILE"
      ;;
    esac
  done
}

update_repo_file() {
  REPO_FILE="$1"

  # Don't do anything if the file isn't there, since that probably means the
  # user disabled it.
  if [ ! -r "$REPO_FILE" ]; then
    return 0
  fi

  # Check if the correct repository configuration is in there.
  REPOMATCH=$(grep "^baseurl=$REPOCONFIG/$DEFAULT_ARCH" "$REPO_FILE" \
    2>/dev/null)
  # If it's there, nothing to do
  if [ "$REPOMATCH" ]; then
    return 0
  fi

  # Check if it's there but disabled by commenting out (as opposed to using the
  # 'enabled' setting).
  MATCH_DISABLED=$(grep "^[[:space:]]*#.*baseurl=$REPOCONFIG/$DEFAULT_ARCH" \
    "$REPO_FILE" 2>/dev/null)
  if [ "$MATCH_DISABLED" ]; then
    # It's OK for it to be disabled, as long as nothing bogus is enabled in its
    # place.
    ACTIVECONFIGS=$(grep "^baseurl=.*" "$REPO_FILE" 2>/dev/null)
    if [ ! "$ACTIVECONFIGS" ]; then
      return 0
    fi
  fi

  # If we get here, the correct repository wasn't found, or something else is
  # active, so fix it. This assumes there is a 'baseurl' setting, but if not,
  # then that's just another way of disabling, so we won't try to add it.
  sed -i -e "s,^baseurl=.*,baseurl=$REPOCONFIG/$DEFAULT_ARCH," "$REPO_FILE"
}

# We only remove the repository configuration during a purge. Since RPM has
# no equivalent to dpkg --purge, the code below is actually never used. We
# keep it only for reference purposes, should we ever need it.
#
#remove_yum() {
#  rm -f "$YUM_REPO_FILE"
#}
#
#remove_zypp() {
#  # Ideally, we would run: zypper removerepo "yandex-browser"
#  # but that does not work when zypper is running.
#  rm -f /etc/zypp/repos.d/yandex-browser.repo
#}

DEFAULT_ARCH="x86_64"

get_lib_dir() {
  if [ "$DEFAULT_ARCH" = "i386" ] || [ "$DEFAULT_ARCH" = "armhf" ] || \
      [ "$DEFAULT_ARCH" = "mipsel" ]; then
    LIBDIR=lib
  elif [ "$DEFAULT_ARCH" = "x86_64" ] || [ "$DEFAULT_ARCH" = "aarch64" ] || \
        [ "$DEFAULT_ARCH" = "mips64el" ]; then
    LIBDIR=lib64
  else
    echo Unknown CPU Architecture: "$DEFAULT_ARCH"
    exit 1
  fi
}


## MAIN ##
if [ -r "$DEFAULTS_FILE" ]; then
  . "$DEFAULTS_FILE"
fi

install_rpm_key

if [ "$repo_add_once" = "true" ]; then
  determine_rpm_package_manager

  # Let's run through this for each supported package manager as detected...
  for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]}
  do
    # The initial install happens in the post-install scripts, but there have been
    # reports of configuration problems, so just verify that everything looks
    # good, and if not, try to install again.
    verify_install $PACKAGEMANAGER
    if [ $? -ne 0 ]; then
      install_${PACKAGEMANAGER}
    fi
  done

  if [ $? -eq 0 ]; then
    # Do this for each supported package manager...
    for PACKAGEMANAGER in ${PACKAGEMANAGERS[*]}
    do
      # Before we quit auto-configuration, check that everything looks sane, since
      # part of this happened during package install and we don't have the return
      # value of that process.
      verify_install $PACKAGEMANAGER
      if [ $? -eq 0 ]; then
        sed -i -e 's/[[:space:]]*repo_add_once=.*/repo_add_once="false"/' \
          "$DEFAULTS_FILE"
      fi
    done
  fi
else
  update_bad_repo
fi
