#!/bin/sh
#
# Copyright 2009 The Chromium Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# This script is part of the brave-browser package.
#
# It creates the repository configuration file for package updates, and it
# monitors that config to see if it has been disabled by the overly aggressive
# distro upgrade process (e.g.  intrepid -> jaunty). When this situation is
# detected, the respository will be re-enabled. If the respository is disabled
# for any other reason, this won't re-enable it.
#
# This functionality can be controlled by creating the $DEFAULTS_FILE and
# setting "repo_reenable_on_distupgrade" to "true" or "false" as desired.
# An empty $DEFAULTS_FILE is the same as setting it to "false".
#
# The $DEFAULTS_FILE also has a setting "repo_add_once" which can be set
# to "false" to prevent the package install from adding the repo altogether.

# Don't add the Chrome repo (brave/brave-browser#1084)
exit 0

# System-wide package configuration.
DEFAULTS_FILE="/etc/default/brave-browser"

# sources.list setting for brave-browser updates.
REPOCONFIG="deb [arch=amd64] https://dl.google.com/linux/chrome/deb/ stable main"
REPOCONFIGREGEX="deb (\[arch=[^]]*\bamd64\b[^]]*\][[:space:]]*) https?://dl.google.com/linux/chrome/deb/ stable main"
# This file is automatically generated by update_key_include.py
# Do not edit this file directly.

# This is used as a priority value for the key file, so newer
# keyrings should always take priority.
PGP_KEY_VERSION=2

# pub   rsa4096 2016-04-12 [SC]
#       EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796
# uid           [ unknown] Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>
# sub   rsa4096 2024-01-30 [S] [expires: 2027-01-29]
# sub   rsa4096 2025-01-07 [S] [expires: 2028-01-07]
PGP_KEY_DATA=$(cat <<KEYDATA
mQINBFcMjNMBEAC6Wr5QuLIFgz1V1EFPlg8ty2TsjQEl4VWftUAqWlMevJFWvYEx
BOsOZ6kNFfBfjAxgJNWTkxZrHzDl74R7KW/nUx6X57bpFjUyRaB8F3/NpWKSeIGS
pJT+0m2SgUNhLAn1WY/iNJGNaMl7lgUnaP+/ZsSNT9hyTBiH3Ev5VvAtMGhVI/u8
P0EtTjXp4o2U+VqFTBGmZ6PJVhCFjZUeRByloHw8dGOshfXKgriebpioHvU8iQ2U
GV3WNIirB2Rq1wkKxXJ/9Iw+4l5m4GmXMs7n3XaYQoBj28H86YA1cYWSm5LR5iU2
TneI1fJ3vwF2vpSXVBUUDk67PZhg6ZwGRT7GFWskC0z8PsWd5jwK20mA8EVKq0vN
BFmMK6i4fJU+ux17Rgvnc9tDSCzFZ1/4f43EZ41uTmmNXIDsaPCqwjvSS5ICadt2
xeqTWDlzONUpOs5yBjF1cfJSdVxsfshvln2JXUwgIdKl4DLbZybuNFXnPffNLb2v
PtRJHO48O2UbeXS8n27PcuMoLRd7+r7TsqG2vBH4t/cB/1vsvWMbqnQlaJ5VsjeW
Tp8Gv9FJiKuU8PKiWsF4EGR/kAFyCB8QbJeQ6HrOT0CXLOaYHRu2TvJ4taY9doXn
98TgU03XTLcYoSp49cdkkis4K+9hd2dUqARVCG7UVd9PY60VVCKi47BVKQARAQAB
tFRHb29nbGUgSW5jLiAoTGludXggUGFja2FnZXMgU2lnbmluZyBBdXRob3JpdHkp
IDxsaW51eC1wYWNrYWdlcy1rZXltYXN0ZXJAZ29vZ2xlLmNvbT6JAk4EEwEIADgC
GwMCHgECF4AWIQTrTBv9TwQvbd3M7JF3IfY704tHlgUCVwyM0wULCQgHAgYVCgkI
CwIEFgIDAQAKCRB3IfY704tHlkGrD/9aIOPxoABbhHDa+GbM1XHSeV99q2UOIsYc
A5Jg3k2+Vbjr/006cL9Kk+rdbruZJtERo2z+HVVhkJisvySbsd0UbWfiY5AdHzNP
azpitbX9cNYi0ghDZsD5UgP3cWdx21BJPO0v9PBG9U4z1TQ+pmsQphtNzMC4tK+A
H/7WTXnVPzKXTYziIEIPgHeassSj7Yfwa8kLiBR5tAehHDNNMi/mMf4d6a+wO46x
hhRx/BLjoaIxsZw9f5VxDAqGbCrW8IccwJX8vTc89y+6vpzSurdqYrplZWGpcnfT
3SPBxodLhS7wMehdy6NKNO14vDGR/GP43+6oZ91Cyv2CYHSPpZM6+qMwMmGVkHS2
6PrCVPhPoDywf/7UeFsC4KZMI6LIGD2YI9UEOlcCAEbRwWVjXCSwRZ9vRkxOxK4Q
xNMLAIf3YmUZPnqGVcvNssgsapvjmI3CAWpAPWlP5GTcHxrVGiYz7hNZcA0PfgxF
pmB0QXNxr/x737I9Q8FCZasSlNqocaiKF6gKBxFOKfiKx5DRZ63EZ07Z3HE6y+w3
+97UIJhjxVrONgb7ZX9paE8NtLG/X0ZldUzqWngfnFVasnCDiQC+ls2Tu9Oa+yMJ
rMe3VM4EcZTjYoESUjKzEHP72hn+GoAk7saWWVK6xYUJPM18Ua1mGx8xwoXt/t95
W40b92HbJrkCDQRluVp2ARAAxKbVA+3KMCtd0zWLZjrjf0lz8AnLfKRWPFNoOLqf
nPuWBCKlpAFKlZvC6fg6nRbl+zW3ytgTaI8D8oqipWgQDejce2zvW40r5W22Qa1S
d5i/pO8axXUxi3g0kk5RAXrI+xVytcyu0lvQFd5+OZZjiwF0wtd1UNytEhF2/uvR
cF699f4ueDYE3zP9S3CWYSKEejLrRyQkmCrjumR8WGjnX4+PARklo+0SBGxefayB
Mw0e6QZOtXy5v9opZU0E8XTBhgXksDY0eBWnXjydLXUXg6CI2kKQBmYlAI+XKnh6
Zh/GSKGOH5NkrDopyvHA4LHth5x4orrBa+scevCMnGXaeFq0Mhg0iWdWSpOUGngD
2BN0LGZyJnXFdv5CWUvJwFgxaC7aWjUqTjQ059WWMgotq1jzxfCYlTJJgsbJfmR4
8jb2Rz7JUbJxgexKCg6XIz9XD4Zd+6P8FGKcoi2MhPFvpgzbnB+GBy1R6v80Bqjt
1emsUwNQ7PoLvbR1f9/shKyKqaLtfVTnzyiY2Au8n87yA+fIy2TWBavCEVkOVVgj
kCVjHHczCgee0tmW+byISZH5f0uSEjBlw1299p8ilX7wuU5ojG367M3NwywMcIai
ZQB/8Zhdsjz/HWIeiilkiH31Rk5t/LHLPZJJtW1QQEdfIpcenRsVYzUjPYt9DDF4
1FEAEQEAAYkEcgQYAQoAJhYhBOtMG/1PBC9t3czskXch9jvTi0eWBQJluVp2AhsC
BQkFo5qAAkAJEHch9jvTi0eWwXQgBBkBCgAdFiEEDwb/hr7q9OcYZu5SMu5TVaa8
bkIFAmW5WnYACgkQMu5TVaa8bkKYHg//VGdcoevKndSVo4Cr9QAXZgoVL00CCBXA
fw+GwVzqdmmu5z4IVTWzmPAK5b1qJaBD5OMEW9DSH9sctu6OVNKZ/LLKj8iP7i9L
FHOWZRryUc+rKq/t8ixDzYACzxYT+ZXwOJ/biGzElJkQfXfQNORGq2ddLQUHqw5A
8aPkQoAW3e/S839nVBFfZ4uZlzaM7tB+R1Gy2u8XduitvvF23br88zyDxGBhob5+
ogn820ZAXRcj5ZTG5D6a1EYTJWkviqfDCeiTLGOwzGwm+8Yho9QspHUJqEYkPi0C
XITcO82KQxEjZIOiNobKHlzDbiYklVmbHjrtDe0Th3CYC7ykIYKV1RAEbp6mtMv9
Zq7IlyaQmvWqxIruDLH5TLybBcRJj+zlvAOTOGXNonRaMHGpd+gcUgSUcl+EtLR5
+oivo0WY9S7hwEokqhmgUHBM9NMSZbPu0TaYOBU71npD1+rsLBlLon8ZyGJ5CADL
dHGbkGLMFmxaKxjcFDglfXDrAfQJp7itgJ5uS60UVYGDskDePaeSB/OwPeRgdh/k
GWUvbJXnz10Shw2M+Kiznq8+LmSD1RA4U7VJpfgR+7V4Cs1w214HEp/mkfyiQNyC
OqP3JdlGzp8jZST3PPPRQvrf6JFKpKPwq/qJ6ksLM6mHUMedja0WCGlIViqVrKF2
mswlWTsaYsWiJg//WdPrCryT9ENLf9bscQEnxG3GzW8vnWdTR7kruOBtRP2RobYo
GaWdFuCQQuO+7SVfrMsWLI9xzkmS8TYDJ9nu3lwh9qc5LiFzRb0LrpFCjZy9TGSf
aC0KszsoJNzXojB7+4wLZE0Sd40uIJ63BzkOGmNgTFHn2zPND02nHfWl5+yaRLAp
260TPxb3qXb3IdiAgOgthbdvqe4FEF+nicBdDWBap8SYU0WUpkFrak+wo2UWClyE
L4SIxD91vUSVU3Jbfwrsg7HqE0akQEnBs+4c15/1ZTefYMgiAwEdMc+9s0eII1N+
44zX78ExuYrn1GZbrpNLRRrFmyzAcctm3u803tIrNey95P34DV3rBmVWjLxjeDKQ
EqcEcZFoY7TNpdzMe3hixQDgveKzqUCNsiilTkzePYXVEUpGv3n4dlP81c14ZsW+
x0qa8/gQu0MC5hUyBhHwaqMjnI/9xxUyyL+aFP5xTE78Xv7ueLHDUajrfsmqv80X
mSOOsEPwSIbLxCsabq4FHc0Zp3QGcxYprZihgoXWbcWz968GRzKZH6FLAXORebpZ
I5vyHMkhrIVrqQBzu5IrJHmIbTSn+d6JtuozVpQBAMHBXuD3A+Zx1EiMlLYy0rUl
cdkJHWBUpv4Q5ty3pEk5XDyznwRLk73AZmZtW0hn4kdNu4f62DQShE1wJvO5Ag0E
Z31b7QEQAMEWM0g1KKIxE7q8JK7QblKom7++NYn92E3suHv3WxqzrhRT9tYNDSao
OazQP+haNA2BqkdFcB7G4jKdtK2VLFc7RBpcR2rnQEJWgpeP03DHrdZYFdpH9zAB
oFsotgZRKwwTOoxdm6XtV+47LEY9yAefPrt1gPJQ4h1SKwWIFSRPChQ1cThBz2QD
2LaPAGtjWzr6+0xf0nm4xTDvya0EbdTpMOvtyDCUp7qe41u34RelGxoo0+rmoL/0
cTJGCr2L3xWijlvWCMLhp2dgVnvRIpvo+tOSSl/pvTCLgE0nFjNQFbNh3D1Qo/AH
hEz3MzbQ9JbEy7MF+fiw83YULRKN1kZ673Z1ng1wLA0m4+EWrh/PpMPp1raYQT0f
SqUkiGBo25MfIjdheAuTgUf/4aHKU7vi4yFwxr8DWcKrxiv7g6xxbFvI3p+/wmyD
bLXBBh2ciqwQfW/H32TlfL+cXqtapB93L1xR4IPTRvMnIVJBA+J6I/jlqx6RqPAB
emHudFvL2sAJu91lQjL5GxEmgVNL7l+UKGsy+h8mg4Sonnw3MI1c1KrvvIhJlkTp
qiCqCnaGBBjZQWkuiyVJSq8VLHq2LxlWJd9nt73MpOLgj79ylD5G7OQEVgGBbvKw
qdRYvKik8UTYYu7sTolNFVNMvQoCIJxropO/xk17qK0a4LtaZ8oVABEBAAGJBHIE
GAEKACYWIQTrTBv9TwQvbd3M7JF3IfY704tHlgUCZ31b7QIbAgUJBaOagAJACRB3
IfY704tHlsF0IAQZAQoAHRYhBA4iWRdBRnD0RCwlDf1TPAfCZGSPBQJnfVvtAAoJ
EP1TPAfCZGSPphkP/iHWjnYuEXC7uKzt+zvsqjkGkGkXVApXgZGm9h1/ujlab0FK
+9VA1JlVuzqw9SBYuwUwkGX0TVVCCc5KAxDa6sYH2IggcC+dN4ZjCMiUrJlEHNVE
6f7Fjg59STScr+jWOckKnP5p2x4xmH0kZX/rkZ+90lfniPUvVt/g5aunoEQDvtMO
ZBn3Opgx4zOWxqK4vGMtF1bhFUieMtg5B3E5jlNeNwmkDYV3MHGu+oMYy1TFMA3O
QuTOz5deD86xE73hK9HQ3DBoETPIuzlYXP0qoQswVKBI4z7HjRLmfBQagXCXj+64
LEUaumAZlWWV3zzxZnAk4kzJv51+vESxaMm6Ll5VG18MLrzv3Zi4Ez4BMr7OjbAn
xfcgrsITDlwrweCYC7Rq9fWw5USyk93h0kNJ8AVT6CG2a5/LsCztfW4jkg7LFDWW
kMISoN/rCaR2sJfvy2aijZ33yAWUnEpWZG6+8811YAFdn9g1bnuWLHx9Z7q8Vjal
zJhVFe9f8Mhwk2K764VUL7pnNNYxl4Kj0oTAqVVGDZoMWHCcE7nxqGbzjn8H/unT
Y0vtK5k8BPyuUt0Dtel8fspjlDl5o5VbeBQo6cFBEzZSd5rbavXmtixhL7CGKqCW
aHbJ6OYTa85W14ndUmRJ5qPdLcYakdl16Uj/DrFuKHOPrulgAbs+hmgm1q/nYdgP
/3UUMgaqxU6efsiWi3M3pz9nTu0mcI8kpJzvfov7WINjLLu2+yVRyRbS98473Zr6
KS49BFqOXNQBmtZl77bcz5shfhPxoKLd8YJVayvnBQrjCIE1CACvmJBZGDZSNY0v
Ea4G+n6WT3DwEan6plZ3/xM6s4caZfP43ZZkEiu1M1svQtgzF98HFxAhX5oLyMPw
x8R61X0XtKxmjVbNrTBwRfJf/FRDmmv5qSxoO2g1gpbCcm2VGoGBvoDws95GvPFN
lWUes4xQMclIo01JuynJGLyOaEm19TXu4T36ulCTO/b1lGIOLi+25vpFKlwBrD6y
q4yrt81t6vGvtI1pZrt1Wcm7hce8CFLrzfzo2D28yHPIsT0YvK7AnwUK/SMKIV1E
UNrLIRhnTMBnP+BaOF0HxcAYnlRLSwScPx2pATglHmIvNcRkCsfIZQOXjn8lvFXs
7lnkP5KUF5/+ccsJj8kEdzcsYaczQe3wY2N36ibqRPOfPeVmPFAKPQsUdgx47cAP
KTm6PxIp73IxceGXbkOXJ7W1lqVPKiwQh09RkwWpMtJA2HSdbmInxBiE71tJqSxQ
pp2EfNXOgWTTrs46lkuW39I7dr0NOAGomeaNnOuexMmlTZy2Rf77BfozRZIZ+RAY
lZu5/W1Ed2X4iR8i76QET6ICFmgxADKzB4WnpeBaBqAr
KEYDATA
)

PGP_KEY_CHECKSUM="=AcRC"

PGP_SUBKEYS="32EE5355A6BC6E42 FD533C07C264648F"

APT_CONFIG="$(command -v apt-config 2>/dev/null)"

GPG_FILE="/usr/share/keyrings/brave-browser.gpg"

# Set variables for the locations of the apt trusted keyrings.
find_apt_trusted() {
  eval $("$APT_CONFIG" shell APT_TRUSTEDDIR 'Dir::Etc::trustedparts/d')
}

# Set variables for the locations of the apt sources lists.
find_apt_sources() {
  eval $("$APT_CONFIG" shell APT_SOURCESDIR 'Dir::Etc::sourceparts/d')
  SOURCES_FILE="$APT_SOURCESDIR/brave-browser.sources"
}

# Install the repository/package signing keys. The key cannot be part of the
# package since it's still needed if the package is removed but not purged.
install_key() {
  if [ ! -e /usr/share/keyrings ]; then
    mkdir -p /usr/share/keyrings
    chmod 755 /usr/share/keyrings
  fi

  # Use a temporary file to ensure atomic updates
  echo "$PGP_KEY_DATA" | base64 -d >"$GPG_FILE.$$.tmp"
  chmod 644 "$GPG_FILE.$$.tmp"
  mv "$GPG_FILE.$$.tmp" "$GPG_FILE"
}

uninstall_key() {
  rm -f "$GPG_FILE"
}

remove_legacy_key() {
  find_apt_trusted
  rm -f "$APT_TRUSTEDDIR/brave-browser.gpg"
}

remove_legacy_list() {
  find_apt_sources
  LEGACY_LIST="$APT_SOURCESDIR/brave-browser.list"
  if [ ! -f "$LEGACY_LIST" ]; then
    return
  fi

  # Check for other sources (strict check for 'ours')
  # If there are any lines starting with 'deb' (commented or not) that do NOT
  # match our strict regex, keep the file.
  if grep -E "^[[:space:]]*#?[[:space:]]*deb" "$LEGACY_LIST" |
    grep -v -E \
    "^[[:space:]]*#?[[:space:]]*$REPOCONFIGREGEX" >/dev/null;
  then
    # Other sources exist, comment out ours (strict match)
    sed -i -E "s|^[[:space:]]*($REPOCONFIGREGEX)|# \1|" "$LEGACY_LIST"
  else
    # No other sources, safe to remove
    rm -f "$LEGACY_LIST"
  fi
}

# Generate the content of the .sources file
gen_sources_content() {
  cat <<EOF
### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# Changes to this file will not be preserved.
# This file will not be recreated if removed.
X-Repolib-Name: Brave Web Browser
Types: deb
URIs: https://dl.google.com/linux/chrome-stable/deb/
Suites: stable
Components: main
Signed-By: $GPG_FILE
EOF
}

# Add the Google repository to the apt sources. The sources cannot be part of
# the package since it's still needed if the package is removed but not purged.
create_sources_lists() {
  find_apt_sources

  gen_sources_content >"$SOURCES_FILE.$$.tmp"
  chmod 644 "$SOURCES_FILE.$$.tmp"
  mv "$SOURCES_FILE.$$.tmp" "$SOURCES_FILE"

  if [ -r "$DEFAULTS_FILE" ]; then
    if grep -q "^[[:space:]]*repo_add_once=" "$DEFAULTS_FILE"; then
      sed -i -e \
        's/^[[:space:]]*repo_add_once=.*/repo_add_once="false"/' \
        "$DEFAULTS_FILE"
    else
      echo 'repo_add_once="false"' >>"$DEFAULTS_FILE"
    fi
  fi
}

# Remove our custom sources file.
clean_sources_lists() {
  find_apt_sources
  rm -f "$SOURCES_FILE"
}

install_deb822_sources() {
  find_apt_sources
  LEGACY_LIST="$APT_SOURCESDIR/brave-browser.list"

  SHOULD_INSTALL_SOURCES=0
  # Detect new installs.
  if [ -r "$DEFAULTS_FILE" ]; then
    if grep -E -q \
      '^[[:space:]]*repo_add_once=[[:space:]]*["'\'']?true["'\'']?' \
      "$DEFAULTS_FILE"; then
      SHOULD_INSTALL_SOURCES=1
    fi
  else
    SHOULD_INSTALL_SOURCES=1
    echo 'repo_add_once="true"' >"$DEFAULTS_FILE"
    echo 'repo_reenable_on_distupgrade="true"' >>"$DEFAULTS_FILE"
  fi

  if [ -f "$SOURCES_FILE" ]; then
    # The new .sources file already exists. Recreate it in case it got disabled
    # during a dist upgrade.
    SHOULD_INSTALL_SOURCES=1
  elif [ -f "$LEGACY_LIST" ]; then
    # Migrate a legacy .list file to the new .sources format.
    if grep -E -q "^[[:space:]]*$REPOCONFIGREGEX" "$LEGACY_LIST"; then
      SHOULD_INSTALL_SOURCES=1
    elif grep -E -q \
      "^[[:space:]]*#[[:space:]]*$REPOCONFIGREGEX[[:space:]]*# disabled on \
upgrade to .*" \
      "$LEGACY_LIST"; then
      SHOULD_INSTALL_SOURCES=1
    fi
  fi

  if [ "$SHOULD_INSTALL_SOURCES" -eq 1 ]; then
    create_sources_lists
  fi
}

## MAIN ##
if [ -r "$DEFAULTS_FILE" ]; then
  . "$DEFAULTS_FILE"
fi

install_key

if [ "$repo_add_once" = "true" ]; then
  create_sources_lists
elif [ "$repo_reenable_on_distupgrade" = "true" ]; then
  install_deb822_sources
fi
