#!/usr/bin/env bash
# Generate the TANINUX packager signing key — THE DISTRO'S ROOT OF TRUST.
#
# Run this ONCE, by the maintainer, on a trusted machine. The resulting key
# signs every [tanin] package (makepkg --sign) and the repo DB (repo-add -s);
# every user who runs `pacman-key --lsign-key <fingerprint>` is trusting this
# key to vouch for everything TANINUX ships. Guard the private key + its
# passphrase like the root of the distro, because that's what it is.
#
#   ./gen-signing-key.sh                          # prompts for Name-Email + a
#                                                  # gpg-agent passphrase prompt
#   NAME_EMAIL=pkg@taninux.example ./gen-signing-key.sh
#
# This script does NOT set GPGKEY / wire it into the build scripts — that's a
# manual step below, so a compromised shell env can't silently point the
# build at the wrong key.
set -euo pipefail

command -v gpg >/dev/null || { echo "!! gpg not found" >&2; exit 1; }

NAME_REAL="TANINUX Packager"
NAME_EMAIL="${NAME_EMAIL:-}"
EXPIRE="${EXPIRE:-2y}"
ROOT="$(cd "$(dirname "$0")/.." && pwd)"

if [ -z "$NAME_EMAIL" ]; then
  read -rp "Packager key Name-Email (placeholder, doesn't need to receive mail): " NAME_EMAIL
fi
[ -n "$NAME_EMAIL" ] || { echo "!! Name-Email is required" >&2; exit 1; }

echo "== generating: $NAME_REAL <$NAME_EMAIL>  (Ed25519, expires in $EXPIRE) =="
echo "   gpg will prompt (via pinentry/gpg-agent) for a passphrase — set a real one."

PARAMFILE="$(mktemp)"
trap 'rm -f "$PARAMFILE"' EXIT
cat > "$PARAMFILE" <<EOF
%ask-passphrase
Key-Type: eddsa
Key-Curve: ed25519
Key-Usage: sign
Name-Real: $NAME_REAL
Name-Email: $NAME_EMAIL
Expire-Date: $EXPIRE
%commit
EOF

gpg --batch --gen-key "$PARAMFILE"

FPR="$(gpg --list-keys --with-colons "$NAME_EMAIL" 2>/dev/null \
  | awk -F: '/^fpr:/ { print $10; exit }')"

if [ -z "$FPR" ]; then
  echo "!! key created but the fingerprint could not be auto-detected." >&2
  echo "   run: gpg --list-keys \"$NAME_EMAIL\"" >&2
  exit 1
fi

cat <<EOT

============================================================
 TANINUX packager key created
 Fingerprint: $FPR
============================================================

Next steps (manual — nothing below runs automatically):

  1) Export the PUBLIC key into the target keyring source, so
     customize_airootfs.sh's \`pacman-key --add\` picks it up on the next ISO
     build. Re-export replaces/updates the file (see the comment left in
     customize_airootfs.sh for the matching --lsign-key line to add):
       gpg --export "$FPR" > "$ROOT/iso/overrides/airootfs/etc/pacman.d/tanin-repo.gpg"
       gpg --export "$FPR" > "$ROOT/iso/build-profile/airootfs/etc/pacman.d/tanin-repo.gpg"

  2) Publish the public key for existing/new users to import (see the
     Cutover section in docs/distribution.md), e.g.:
       gpg --export "$FPR" > /path/to/served/tanin-repo.gpg
     and record "$FPR" in docs/distribution.md's Cutover section.

  3) Point the build scripts at it (build-tanin-repo.sh, finish-tanin-repo.sh,
     aur-autoupdate.sh all read GPGKEY from the environment and refuse to
     build unsigned if it's unset):
       export GPGKEY="$FPR"
     For the systemd-driven daily rebuild (packaging/systemd/tanin-aur-update.service,
     running as the dedicated tanin-build user — see setup-build-user.sh),
     set Environment=GPGKEY=$FPR in the unit, or an EnvironmentFile it reads,
     and make sure GNUPGHOME for tanin-build actually holds this secret key.

  4) BACK UP THE PRIVATE KEY (\`gpg --export-secret-keys $FPR\`) to an offline,
     encrypted location. Losing it means re-keying the whole distro and
     asking every user to re-import; leaking it means anyone can sign
     packages TANINUX users will install as trusted.
EOT