#!/bin/sh
# Copyright (C) 2026 Mark Robillard Jr (MARKMENTAL)
# SPDX-License-Identifier: GPL-3.0-or-later
#
# post-build.sh - stamp the Mentalnet root filesystem with a build id
#                  and scrub compromised CAs from the trust store
#
# Invoked by Buildroot (BR2_ROOTFS_POST_BUILD_SCRIPT) with the target
# directory as first argument. The same stamp is recorded in
# output/images/.mn-build-stamp so post-image.sh can name the ISO
# after the exact build that is inside it.
#
# The stamp is visible inside the guest:
#   - /etc/os-release  -> BUILD_ID="YYYYMMDD-HHMMSS"
#   - /etc/issue       -> shown above the login prompt

set -e

TARGET_DIR="${1}"
#STAMP="$(date +%Y%m%d-%H%M%S)"
RELEASE="R1"
CODENAME="Ochatime"
STAMP="${RELEASE} ${CODENAME}"        # pretty form: R1 Ochatime
STAMP_SAFE="${RELEASE}-${CODENAME}"       # sanitized:  R1-Ochatime
IMAGES_DIR="$(dirname "${TARGET_DIR}")/images"

# record the stamp for post-image.sh
mkdir -p "${IMAGES_DIR}"
echo "${STAMP_SAFE}" > "${IMAGES_DIR}/.mn-build-stamp"

# /etc/os-release (regular file lives at /usr/lib/os-release; /etc/os-release
# is a symlink to it) - Mentalnet branding, Buildroot defaults dropped
OS_RELEASE="${TARGET_DIR}/usr/lib/os-release"
cat > "${OS_RELEASE}" <<EOF
NAME="Mentalnet GNU/Linux"
VERSION="${STAMP}"
ID=mentalnet
VERSION_ID="${RELEASE}"
PRETTY_NAME="Mentalnet GNU/Linux ${STAMP}"
BUILD_ID="${STAMP_SAFE}"
EOF

# login banner
ISSUE="${TARGET_DIR}/etc/issue"
sed -i '/^Mentalnet GNU\/Linux build /d' "${ISSUE}"
printf 'Mentalnet GNU/Linux build %s\n' "${STAMP}" >> "${ISSUE}"

# Remove the eMudhra (emSign) root CAs and rebuild the trust store.
#
# Background: R1 Ochatime security response (October 2026) - eight
# eMudhra intermediate CA keys were compromised (EM DV/OV/EV TLS and
# EM OV/OV CS code-signing authorities, e.g. CVE-2026-111943). The
# Debian/Mozilla trust store in this build does not ship intermediates,
# but it does trust the four eMudhra emSign roots below; drop them so
# nothing chaining under eMudhra can validate here.
#
# This must run in a post-build script because the ca-certificates
# bundle (/etc/ssl/certs/ca-certificates.crt) is generated during
# package finalize hooks, which execute *before* post-build scripts.
# Rebuild it here the same way CA_CERTIFICATES_GEN_BUNDLE does.
#
# Drop this once Debian ships a ca-certificates release (bump
# CA_CERTIFICATES_VERSION in package/ca-certificates/ca-certificates.mk)
# that already removed the eMudhra anchors.
EM_SIGN_ROOTS="emSign_Root_CA_-_G1 emSign_Root_CA_-_C1 emSign_ECC_Root_CA_-_G3 emSign_ECC_Root_CA_-_C3"
CERTS_DIR="${TARGET_DIR}/etc/ssl/certs"
for root in ${EM_SIGN_ROOTS}; do
  rm -f "${TARGET_DIR}/usr/share/ca-certificates/mozilla/${root}.crt"
done

# Regenerate /etc/ssl/certs: hash-symlink cleanup, per-name links,
# bundle, and rehash (mirrors CA_CERTIFICATES_GEN_BUNDLE)
rm -f "${CERTS_DIR}"/*
: > "${CERTS_DIR}/ca-certificates.crt"
cd "${TARGET_DIR}" || exit 1
for i in $(find usr/share/ca-certificates -name '*.crt' | LC_COLLATE=C sort); do
  ln -sf "../../../${i}" "etc/ssl/certs/$(basename "${i}" .crt).pem"
  cat "${i}"
done >> "${CERTS_DIR}/ca-certificates.crt"
"${HOST_DIR}/bin/c_rehash" "${CERTS_DIR}" > /dev/null