#!/bin/sh

if [ -z "$1" ]; then
	echo "Usage: pull-updates keyring [dir | keyring]" >&2
	exit 1
fi

# avoid gnupg touching ~/.gnupg
GNUPGHOME=$(mktemp -d -t jetring.XXXXXXXX)
export GNUPGHOME
cat > "$GNUPGHOME"/gpg.conf <<EOF
keyid-format 0xlong
import-options import-clean,merge-only
export-options export-clean,no-export-attributes
no-auto-check-trustdb
no-autostart
quiet
EOF
trap cleanup exit
cleanup () {
	rm -rf "$GNUPGHOME"
}

if [ ! -e output/keyrings/debian-keyring.pgp ]; then
	echo "Keyrings don't appear to be built. Run make?"
	exit 1
fi

# Build a set of keyrings
for keyring in output/keyrings/debian-keyring.pgp output/keyrings/debian-nonupload.pgp \
		output/keyrings/debian-maintainers.pgp; do
	gpg --import-options no-import-clean,no-merge-only --import $keyring
done

mkdir updates/
if [ ! -z "$2" -a -d "$2" ]; then
	# Old style with directory as second parameter
	scripts/explode-keyring $1 updates
else
	# New style. Keyrings all the way.
	touch update-keyring.pgp
	echo Exploding keyrings
	for keyring in $*; do
		scripts/explode-keyring $keyring updates
		cd updates
		for i in 0x*; do
			if [ ! -e ../debian-*-pgp/$i ]; then
				echo $i no longer exists, removing.
				rm $i
			elif cmp -s $i ../debian-*-pgp/$i; then
				echo $i matches old key version, removing.
				rm $i
			fi
		done
		if [ "$(echo 0x*)" != "0x*" ]; then
			cat 0x* >> ../update-keyring.pgp
			rm 0x*
		fi
		cd ..
	done
	echo Importing updates
	gpg --import update-keyring.pgp
	echo Exploding keyring
	for key in $(gpg --list-keys --with-colons --no-default-keyring --keyring ./update-keyring.pgp | awk -F: '/^pub/ {print $5}'); do
		gpg --export 0x$key > updates/0x$key
	done
	rm update-keyring.pgp
fi

cd updates
if [ "$(echo 0x*)" = "0x*" ]; then
	echo "No updated keys".
	cd ..
	rmdir updates/
	exit 0
fi

for i in 0x*; do
	if [ ! -e ../debian-*-pgp/$i ]; then
		echo $i no longer exists, removing.
		rm $i
	elif cmp -s $i ../debian-*-pgp/$i; then
		echo $i matches old key version, removing.
		rm $i
	fi
done

echo Updated keys are:
ls

cd ..

for i in updates/0x*; do
	if [ -f $i ]; then
		scripts/update-key --no-clean $i \
			$(dirname debian-*-pgp/$(basename $i))
		rm $i
	fi
done

rmdir updates/
