#!/usr/bin/env bash

set -euo pipefail

declare -r CERTURL="https://certs.linux.tw1.ru/certs/latest.pem"
declare -r CERTSHA="6C:C0:62:D6:41:96:C8:3C:D8:7F:9E:E7:F0:74:42:0D:EE:69:44:C3"
declare -r CERTNAME="local_network_ca"

if [ "$EUID" -ne 0 ]; then
    echo "error: Please run this script as root"
    exit 1
fi

certs_dir=""
cert_file=""
update_command=""

if command -v update-ca-certificates &> /dev/null; then
    certs_dir="/usr/local/share/ca-certificates"
    cert_file="$certs_dir/$CERTNAME.crt"
    update_command="update-ca-certificates"

elif command -v update-ca-trust &> /dev/null; then
    certs_dir="/etc/ca-certificates/trust-source/anchors"
    cert_file="$certs_dir/$CERTNAME.crt"
    update_command="update-ca-trust"

else
    echo "error: Unknown certificate management system"
    exit 1
fi

if [ "${1:-}" = "install" ]; then
    declare -r tempdir=$(mktemp -d)
    declare -r tempfile="$tempdir/$CERTNAME.crt"
    trap 'rm -rf "$tempdir"' EXIT

    echo "Downloading certificate..."
    echo "  URL: $CERTURL"
    echo "  SHA-1 Fingerprint: $CERTSHA"

    curl -fsSL -o "$tempfile" "$CERTURL"

    echo "Validating SHA-1 fingerprint..."
    declare -r sha=$(openssl x509 -noout -fingerprint -sha1 -in "$tempfile" | cut -d= -f2 | tr '[:lower:]' '[:upper:]')

    if [ "$sha" != "$CERTSHA" ]; then
        echo "error: Checksum validation failed! Expected $CERTSHA, got $sha"
        exit 1
    fi

    echo "Fingerprint validation OK"

    if [ ! -d "$certs_dir" ]; then
        echo "error: Directory $certs_dir does not exist"
        exit 1
    fi

    [ -f "$cert_file" ] && rm "$cert_file"
    cp "$tempfile" "$cert_file"
    "$update_command"

    echo "Successfully installed certificate to $cert_file"

elif [ "${1:-}" = "uninstall" ]; then
    echo "Uninstalling certificate..."

    if [ ! -f "$cert_file" ]; then
        echo "error: File $cert_file does not exist, nothing to remove"
        exit 1
    fi

    rm "$cert_file"
    "$update_command"

    echo "Successfully removed certificate from $cert_file"

else
    echo "error: Invalid command, must be \"install\" or \"uninstall\""
fi