#!/usr/bin/env bash
# ════════════════════════════════════════════════════════════════════════════
# pcr-apt-update-install.sh — Installer for the kernel-update-tpm toolset
#
# Copies files from the script directory to system locations:
#
#   kernel-update-tpm.sh        → /usr/local/sbin/kernel-update-tpm.sh
#   update-clevis-pcrs.sh       → /usr/local/sbin/update-clevis-pcrs.sh
#   kernel-update-tpm-apt-hook  → /usr/local/sbin/kernel-update-tpm-apt-hook
#   90-kernel-update-tpm.conf   → /etc/apt/apt.conf.d/90-kernel-update-tpm.conf
#
# Usage:
#   sudo bash pcr-apt-update-install.sh
#
# The script checks for root, verifies source files exist, copies them,
# and sets owner/permissions per the install instructions.
# ════════════════════════════════════════════════════════════════════════════

set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; CYAN='\033[0;36m'; YELLOW='\033[1;33m'; NC='\033[0m'
log()  { echo -e "${CYAN}[install]${NC}      $*"; }
ok()   { echo -e "${GREEN}[install] OK:${NC}  $*"; }
warn() { echo -e "${YELLOW}[install] WARN:${NC} $*" >&2; }
fail() { echo -e "${RED}[install] FAIL:${NC} $*" >&2; exit 1; }

[[ "${EUID}" -eq 0 ]] || fail "Run as root: sudo $0"

# Determine the script directory (where this installer lives)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

echo ""
log "kernel-update-tpm toolset installer"
echo ""

# ════════════════════════════════════════════════════════════════════════════
# Helper: copy file with verification
# ════════════════════════════════════════════════════════════════════════════
install_file() {
  local src="$1" dst="$2" mode="$3"

  [[ -f "$src" ]] || fail "Source file not found: $src"

  log "Writing $dst ..."
  cp "$src" "$dst"
  chmod "$mode" "$dst"
  ok "$dst → $dst"
}

# ════════════════════════════════════════════════════════════════════════════
# FILE 1 — kernel-update-tpm.sh
# Install path:  /usr/local/sbin/kernel-update-tpm.sh
# Permissions:   755  root:root
# Purpose:       Main three-phase automation script. Manages the Clevis slot
#                transition across reboots when a kernel update changes PCRs.
#                Called directly by the user or via the APT hook.
# ════════════════════════════════════════════════════════════════════════════
install_file "$SCRIPT_DIR/kernel-update-tpm.sh" "/usr/local/sbin/kernel-update-tpm.sh" 755

# ════════════════════════════════════════════════════════════════════════════
# FILE 2 — update-clevis-pcrs.sh
# Install path:  /usr/local/sbin/update-clevis-pcrs.sh
# Permissions:   755  root:root
# Purpose:       Utility to re-enroll Clevis bindings against current PCR state.
#                Called by Phase 2 and Phase 3 to refresh bindings after updates.
# ════════════════════════════════════════════════════════════════════════════
install_file "$SCRIPT_DIR/update-clevis-pcrs.sh" "/usr/local/sbin/update-clevis-pcrs.sh" 755

# ════════════════════════════════════════════════════════════════════════════
# FILE 3 — kernel-update-tpm-apt-hook
# Install path:  /usr/local/sbin/kernel-update-tpm-apt-hook
# Permissions:   755  root:root
# Purpose:       APT hook executable. Called by apt before kernel package installation.
#                Invokes kernel-update-tpm.sh with --hook-mode flag.
# ════════════════════════════════════════════════════════════════════════════
install_file "$SCRIPT_DIR/kernel-update-tpm-apt-hook" "/usr/local/sbin/kernel-update-tpm-apt-hook" 755

# ════════════════════════════════════════════════════════════════════════════
# FILE 4 — 90-kernel-update-tpm.conf
# Install path:  /etc/apt/apt.conf.d/90-kernel-update-tpm.conf
# Permissions:   644  root:root
# Purpose:       APT configuration file. Registers the Pre-Install-Pkgs hook.
# ════════════════════════════════════════════════════════════════════════════
install_file "$SCRIPT_DIR/90-kernel-update-tpm.conf" "/etc/apt/apt.conf.d/90-kernel-update-tpm.conf" 644

echo ""
log "Installation complete. Files installed:"
ls -lh /usr/local/sbin/kernel-update-tpm.sh /usr/local/sbin/update-clevis-pcrs.sh /usr/local/sbin/kernel-update-tpm-apt-hook /etc/apt/apt.conf.d/90-kernel-update-tpm.conf \
  | awk '{print "  " $9 " (" $1 ")"}'

echo ""
ok "Full toolset installed. Run 'sudo /usr/local/sbin/kernel-update-tpm.sh' to start a manual update cycle."
echo ""