#!/bin/bash

# Connect an OmarOS install from before 0.0.7 to OmarOS's own repository,
# pkgs.omaros.org, once. Those installs have no [omaros] in pacman.conf and no
# OmarOS key, and the update that adds both comes from [omaros] itself, so
# omaros update can't get there alone. This adds the key and the repository,
# installs the current OmarOS packages, then lets their omaros-channel-set
# finish: the channel's pacman.conf and mirrors, and a full omaros update.
#
#   curl -fsSL https://pkgs.omaros.org/connect.sh | bash -s -- [stable|rc|edge]
#
# Run it as yourself, not root; it asks for sudo. Running it again is safe.

set -euo pipefail

KEY_URL=https://pkgs.omaros.org/omaros.asc
KEY_FPR=7602528EEFEC904018A78F3263E0233C57E1B04C
PACMAN_CONF=/etc/pacman.conf

channel=${1:-stable}

fail() { echo -e "\e[31m$*\e[0m" >&2; exit 1; }
step() { echo -e "\e[32m==>\e[0m $*"; }

case "$channel" in
  stable | rc) packages=(omaros omaros-settings) ;;
  edge) packages=(omaros-dev omaros-settings-dev) ;;
  *) fail "Usage: connect.sh [stable|rc|edge]" ;;
esac

(( EUID != 0 )) || fail "Run this as yourself, not root: it uses sudo where it needs it."
[[ $(uname -m) == x86_64 ]] || fail "pkgs.omaros.org serves x86_64 only so far."
[[ -d /usr/share/omaros ]] || fail "This isn't OmarOS: /usr/share/omaros is missing."
# Prompts read the terminal: under curl | bash, stdin is this script.
[[ -r /dev/tty ]] || fail "Run this from a terminal."

work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT

step "OmarOS signing key"
curl -fsSL "$KEY_URL" -o "$work/omaros.asc" || fail "Couldn't download $KEY_URL"
fprs=$(gpg --show-keys --with-colons "$work/omaros.asc" 2>/dev/null | awk -F: '$1 == "pub" { want = 1 } $1 == "fpr" && want { print $10; want = 0 }')
[[ $fprs == "$KEY_FPR" ]] || fail "$KEY_URL isn't the OmarOS key $KEY_FPR; nothing changed."
if sudo pacman-key --list-keys "$KEY_FPR" &>/dev/null; then
  echo "  already in pacman's keyring"
else
  sudo pacman-key --add "$work/omaros.asc"
fi
sudo pacman-key --lsign-key "$KEY_FPR" >/dev/null

step "[omaros] in $PACMAN_CONF"
if grep -q '^\[omaros\]' "$PACMAN_CONF"; then
  echo "  already there"
else
  # Above [omarchy], as in OmarOS's own pacman.conf, so OmarOS's packages win
  # over any of the same name there.
  awk -v channel="$channel" '
    !done && /^\[(omarchy|core)\]/ {
      print "[omaros]"
      print "Server = https://pkgs.omaros.org/" channel "/$arch"
      print ""
      done = 1
    }
    { print }
    END { if (!done) exit 1 }
  ' "$PACMAN_CONF" >"$work/pacman.conf" || fail "$PACMAN_CONF has neither [omarchy] nor [core]; nothing changed."
  sudo cp -n "$PACMAN_CONF" "$PACMAN_CONF.pre-omaros"
  sudo install -m 644 "$work/pacman.conf" "$PACMAN_CONF"
  echo "  added (the old file is $PACMAN_CONF.pre-omaros)"
fi

step "OmarOS packages: omaros-keyring ${packages[*]}"
# --ask 4 lets pacman replace the conflicting variant (omaros-dev for omaros,
# or the reverse), as omaros-channel-set does.
sudo pacman -Sy --needed --ask 4 omaros-keyring "${packages[@]}" </dev/tty

# omaros-channel-set copies this template over pacman.conf; one without
# [omaros] would drop the repository again.
template=/usr/share/omaros/default/pacman/pacman-$channel.conf
grep -q '^\[omaros\]' "$template" ||
  fail "The installed OmarOS ($(pacman -Q omaros omaros-dev 2>/dev/null | head -1)) predates [omaros] in $template; its rebuild isn't on pkgs.omaros.org yet. Nothing more changed; run this again once it is."

step "Switching to the $channel channel and updating"
OMAROS_PATH=/usr/share/omaros /usr/share/omaros/bin/omaros-channel-set "$channel" </dev/tty

step "Connected to pkgs.omaros.org ($channel). From now on, omaros update keeps this machine current."