#!/usr/bin/make -f

%:
	dh $@

binary: checkkeyrings

sq := sq --home=none
export-cert = $(sq) --keyring keyrings/$(1).gpg cert export --cert $(3) | $(sq) packet dearmor > keyrings/$(2).gpg

regenerate-key-fragments:
	rm -f keyrings/ubuntu-keyring-*.gpg
	$(call export-cert,ubuntu-archive-keyring,ubuntu-keyring-2018-archive,0xF6ECB3762474EDA9D21B7022871920D1991BC93C)
	$(call export-cert,ubuntu-cloud-keyring,ubuntu-keyring-2012-cloud-archive,0x391A9AA2147192839E9DB0315EDB1B62EC4926EA)
	$(call export-cert,ubuntu-oem-keyring,ubuntu-keyring-2008-oem,0x236252602787D6BDC2336849F9FDA6BED73CDC22)
	$(call export-cert,ubuntu-oem-keyring,ubuntu-keyring-2020-oem,0x59AC787C2A8C78BA5ECA0B2ED4D1EAED36962F69)
	$(call export-cert,ubuntu-dbgsym-keyring,ubuntu-keyring-2016-dbgsym,0xF2EDC64DC5AEE1F6B9C621F0C8CAB6595FDFF622)
	sha512sum keyrings/*.gpg | sq sign --cleartext --signer-self > SHA512SUMS.txt.asc

checkkeyrings:
	$(sq) verify --signer-file /usr/share/keyrings/debian-keyring.gpg --cleartext SHA512SUMS.txt.asc | tee verified | sha512sum -c -
	# Check what are the current fragments
	sha512sum keyrings/*.gpg > current
	# Check that all fragments were in the verified SHA512SUMS file
	! grep -f verified -v current

override_dh_installdeb:
	dh_installdeb
	# currently all keyring snippets are _not_ conffiles, keep it that way.
	rm -f debian/*/DEBIAN/conffiles

override_dh_clean:
	rm -rf verified current
	dh_clean
