#!/bin/sh
#
# Copyright 2009 The Chromium Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# This script is part of the prisma-access-browser package.
#
# It creates the repository configuration file for package updates, and it
# monitors that config to see if it has been disabled by the overly aggressive
# distro upgrade process (e.g.  intrepid -> jaunty). When this situation is
# detected, the respository will be re-enabled. If the respository is disabled
# for any other reason, this won't re-enable it.
#
# This functionality can be controlled by creating the $DEFAULTS_FILE and
# setting "repo_reenable_on_distupgrade" to "true" or "false" as desired.
# An empty $DEFAULTS_FILE is the same as setting it to "false".
#
# The $DEFAULTS_FILE also has a setting "repo_add_once" which can be set
# to "false" to prevent the package install from adding the repo altogether.

# System-wide package configuration.
DEFAULTS_FILE="/etc/default/prisma-access-browser"

# sources.list setting for prisma-access-browser updates.
REPOCONFIG="deb [arch=amd64] https://updates.talon-sec.com/linux/prisma-browser-stable/deb/ stable main"
REPOCONFIGREGEX="deb (\[arch=[^]]*\bamd64\b[^]]*\][[:space:]]*) https?://updates.talon-sec.com/linux/prisma-browser-stable/deb/ stable main"
# This file is automatically generated by update_key_include.py
# Do not edit this file directly.

# This is used as a priority value for the key file, so newer
# keyrings should always take priority.
PGP_KEY_VERSION=4

# pub   rsa4096 2025-03-12 [SCEA]
#       50AD129E9687023E085C68E18F8B8DD2F5F7C303
# uid           [ unknown] Palo Alto Networks, Inc. (Prisma Access Browser) <dl-browser-team@paloaltonetworks.com>
# sub   rsa4096 2026-05-25 [S] [expires: 2028-05-24]
#       C0AA1931278B8596D3312F886765647966A2D090
PGP_KEY_DATA=$(cat <<KEYDATA
mQINBGfRTr0BEADEbUFbs/UbllfrWQBHthcZdH5sXSXoeNGhkrzSsa3F1mqk7MVs
+u3gT7HCVaPG58qyXAngYgY9mrnUasOm4WuQ8q8WHlgA/mRneh/wCfrtXmC97YTB
KhjN3ldhwUPpCZ9YQ2xlUGj6hrhRT7VR+R6mvfoxayfjtok7YeQ49ImPVEOeVoGn
74adNgA/HuPTan5H5uB+YguBh4ZlmzlPuFq7ksrU0p7r3V2wmmxThGudvv5UeHVf
fUxyUHcC9Toky7jQ1/dIiQ24mh+MX6C/K5QeSSHBlxoQ00HdyBLOrlgE3OpkrA7/
FPYpI6O5UiZQJaa+np/TbpvdMOaCQKzlyhjQhHb4Xjsn4W61krmwSQrhdHnjqUVJ
p+/7B6zpYh2wJbdVDLwm9S2Nd1QeVu/QrRpub2dcm7KkH8WUAT8mQ2g646pweiU0
dJJPRth2oPcJT8bThIPGoQxxFfgpHtjczb6clH75OaYyBy/mG8NGzbwG0Hfx2fa+
Kr6CHJbKuKixQv5e361glkNODfFjcf8FLi7A4extshzdgNv6/tl47LtQ6LbVb+Qs
zAQF4p8vmTXJUdn2xN3wInCKs02awhZKgZF9QKg3NGQQd7BwKZb7USxgKJRstNEA
b8HZqk/rjcefps0iFTuic9Do/aLuMWyagwGcLne++APPzsolnxzHeJfs9wARAQAB
tFdQYWxvIEFsdG8gTmV0d29ya3MsIEluYy4gKFByaXNtYSBBY2Nlc3MgQnJvd3Nl
cikgPGRsLWJyb3dzZXItdGVhbUBwYWxvYWx0b25ldHdvcmtzLmNvbT6JAk4EEwEK
ADgWIQRQrRKelocCPghcaOGPi43S9ffDAwUCZ9FOvQIbLwULCQgHAgYVCgkICwIE
FgIDAQIeAQIXgAAKCRCPi43S9ffDA6HoD/0V9ZNWCxrPsgJRMZACoPlgw6p2z9rF
HZ6V2ZOwJJ0WWB8ILRS9plYoDwN88hbRmYaV6t8/iI3sSx+C4WKnHfIDGtqkVIaZ
lS5y2rfkdafaVFFWDtkyYenTOHOVYoWaPVh59PtsNwNyqLegOtPUuITMCIPKm7wK
3B0VNsoUfp+3AILm7EZodUHLVIh3W0V0ElM7+/AUu7dfAQ0pAVU/hpVC1A5vYJXa
aqkDoubZpAS24W6KyCabsZ/D05yfB7JozJnltnIXu4/4us4NzMj9X+AcV11GtrhO
VlFX+pXLbfglMSFjuEtehX4WC2JtVQWObWq8rLU6RH8fzRkJuMi0/vXBz0ldF6TH
T4wr4UJ1Eqpx3Scimx6N7me9R5ZfuIYe7WUCu8ZEVy9xaS5RNCF6FWpzuatXM8f4
GIQGFoCNLzJ5mIKd0oqTU1+TsMLhyna2RkZY6MEcpl925xmYgO73TYHSaP843QSa
f6rdS7NAp5PvPlS+OmVqAZ7e+y/s8Yb0CSOnIb9Y0nYhsbkPVWLLhabnrzC/2Xdw
PPpF/CJhxv9MIg6E8vh+/kmBXS8Z349TbPOpW3y/jpGBqcjFDIJav689BUCCVS0H
fYEqaB3hcdsOZHQwMeCoNb7dfErZyKwUCxjlNtTtuUwGlfWX2LLqrEbzOh+hMfot
ecUZ4K9DYJ5D8LkCDQRqFGMoARAAsRgRrJgohTqMb+6tM2uksVFOI70UvxgrnwzQ
aVVGM0p2eg5JppHd7DucGQEQzP0fqRhUVPH8hKHcpL3vfz3Uqvu0/4CXmiAotTo4
6/bgmYzr7aTm3s2ZqkXXhtz74/QZrl7+mZ/OWVVwrVttGgqUEPWM/KQ6ZZy8CeXu
xKCxrVHaDg3Jjc1OfjKj9QSMOsRpljo0jbilbScgMOkFWEgM0QzYU2HTP6a3Ga35
13pFV/M3SRxDjgomiO929FYWhA+2mT0GNwU06tSrTAo1th5WOdu1yd7lOW/LcQu/
QVIupJXxEL1GOJCROodJuYXlTUQnhZgOY69IHKab0Ul6MiADs6beaUKVFYxYGcAg
mwXnxi2MPI7gHzT7t+CBdu/afJHftdRcfFniztcy25PGatmpq8jg0jqdKvC9OzBg
RMNeOQ5Wk7Hc+qZdrILlcpBuxnq3RnVLM3w/zJ6Kf0DuAcYSQz2WMLoBE2UWHuOJ
OZ/4B0+xGvtvb/4KW58/RC3hHjWuMmyMhGfUiViIupBf4rN/5urrGyBBpbvEwGqP
HpQKbgQPUOY0QVdm3ejsAQfH/3cFC+hw/1U/kMzIou5vZTZBNnEoRRWDLe1mceEF
EhojzZHqWR/Co+jayUhm79XqnTPTz57UBFb9e53JLn/pYAAeSirV/KXbyv65Ay84
oXGauRkAEQEAAYkEcgQYAQoAJhYhBFCtEp6WhwI+CFxo4Y+LjdL198MDBQJqFGMo
AhsCBQkDwmcAAkAJEI+LjdL198MDwXQgBBkBCgAdFiEEwKoZMSeLhZbTMS+IZ2Vk
eWai0JAFAmoUYygACgkQZ2VkeWai0JDKrRAAr1tXVCwMTnNAXtlnyoQv3XNLH15E
xnZ93xc+Sj8N9EKct/YSF291hcr5h1wVowGj9Ld/vr8fLA4y5ej5OvOh+hHOB4r/
r3m+V9VutzviN14Ti9W+oQ7lt1IKblQ1QIchngeJZaYCS1jB2el2g/v4SEyAR/ym
mOnAbOtFrzllkPKY8P1gJvdJgKfbtTXddUdaZUB4EEwXJ5wv7/Xmatvl7+pWCD40
zUsNhqjrfW4S7q4Lwida5Bp7wXIkUxv2jDPPX6q2w6lPg7NJuAOpjtF2r/rB10r0
8DFMI1z9CUZFEEKEgQvyVZQS+f5471Ulp8p3zYqqBktt+Ni+0ChLKPKHT/ltiN18
6oZzh0gawe12jbD2e94Kw9kZO74rLbyDTsesRZeF1Ek003UiWvmyZ7IqcI9/3BDt
WPLJMMRdjZhNA0cngb7beuGe3W2WyYScLTHASwvb08ePtN4LbuuVJ3DT0VwCi+ju
xYDGXLgXzWjvMbTNX3LwTZZZJxXIXLcNVELtN88KSjrzuXCDUvQ91WgCoeLZEzjB
tDYyv17yk0SNbkNC1Ha5MeJP1V+dxzLD6YO8WDjtrQsLlCpFyVMhaeJCRZEnJPW4
4Zp+LtHj6i7eJyuWayka9LbY4ZkbxmEpHQVH1OqxGthe3XvINPD7TygbncxRkCYt
TxZEugs/EKfXr1PZ3RAAh2bJaDNcXhcbhtkio5J+VJHFzREXsPW1iUe8CMJRwQz9
upkpJ1NAPxd5cnM/vvcaKwdES397eE7yQ6+tYBP69LwwW+XkA4P89FO5tI/wvxrk
S7ChLq5JVa5arRMoaZ3HYvR78KY9A8yhEkyq4pkvFkNUSR10BfkP1jkug9q62F//
cH1+bZAHUCHBiAJJ7Rz/12g/8FFdDi7f7AfKb19loNzLAe6sPNVbj02bMx82QYvh
0vCRefthbwtWOpYm/L/7QFRJFNOoR5WNaiWglzhsrLXl4hCiSLiZEskECvik3K08
FAiROWrTNXrrkGEWbPLbh3BmBEYiK7HEvSxDteDsJjgXTbjegG5psyLmrwSe2rvQ
KNK9RzJ9Fs6OBljQjM0KQVXE4sc4L3PJpRB7MPVXQUK2jbUefgC9AOoY0uBySRvl
m/oI4qTbPtoHANdtQ4K6bIkzhEVKxsFXfgE1R6QTjm+ZQi9RCsR9jhNrbXC/hcL8
SfARLoGAxj1HBoJCNkEyyzbj5Tf6Y6RWmhK7yYCoPtBEn+m0l5yBZJnE7Vpu+giq
/I8qsHbT4iDBek8JTVE00Ky3OoKfZLF/gMpubSxWTz59Bcw0OtNoqUVlQ/2LJutM
0JpHz9cNXq4CbQ4zw/2hqSI+xSHC4M6BV/00GQDOc7OGukJnyjxpDbuDmwmJOoU=
KEYDATA
)

PGP_KEY_CHECKSUM="=Omzd"

PGP_SUBKEYS="6765647966A2D090"

APT_CONFIG="$(command -v apt-config 2>/dev/null)"

GPG_FILE="/usr/share/keyrings/prisma-access-browser.gpg"

# Set variables for the locations of the apt trusted keyrings.
find_apt_trusted() {
  eval $("$APT_CONFIG" shell APT_TRUSTEDDIR 'Dir::Etc::trustedparts/d')
}

# Set variables for the locations of the apt sources lists.
find_apt_sources() {
  eval $("$APT_CONFIG" shell APT_SOURCESDIR 'Dir::Etc::sourceparts/d')
  SOURCES_FILE="$APT_SOURCESDIR/prisma-access-browser.sources"
}

# Install the repository/package signing keys. The key cannot be part of the
# package since it's still needed if the package is removed but not purged.
install_key() {
  if [ ! -e /usr/share/keyrings ]; then
    mkdir -p /usr/share/keyrings
    chmod 755 /usr/share/keyrings
  fi

  # Use a temporary file to ensure atomic updates
  echo "$PGP_KEY_DATA" | base64 -d >"$GPG_FILE.$$.tmp"
  chmod 644 "$GPG_FILE.$$.tmp"
  mv "$GPG_FILE.$$.tmp" "$GPG_FILE"
}

uninstall_key() {
  rm -f "$GPG_FILE"
}

remove_legacy_key() {
  find_apt_trusted
  rm -f "$APT_TRUSTEDDIR/prisma-access-browser.gpg"
}

remove_legacy_list() {
  find_apt_sources
  LEGACY_LIST="$APT_SOURCESDIR/prisma-access-browser.list"
  if [ ! -f "$LEGACY_LIST" ]; then
    return
  fi

  # Check for other sources (strict check for 'ours')
  # If there are any lines starting with 'deb' (commented or not) that do NOT
  # match our strict regex, keep the file.
  if grep -E "^[[:space:]]*#?[[:space:]]*deb" "$LEGACY_LIST" |
    grep -v -E \
    "^[[:space:]]*#?[[:space:]]*$REPOCONFIGREGEX" >/dev/null;
  then
    # Other sources exist, comment out ours (strict match)
    sed -i -E "s|^[[:space:]]*($REPOCONFIGREGEX)|# \1|" "$LEGACY_LIST"
  else
    # No other sources, safe to remove
    rm -f "$LEGACY_LIST"
  fi
}

# Generate the content of the .sources file
gen_sources_content() {
  cat <<EOF
### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# Changes to this file will not be preserved.
# This file will not be recreated if removed.
X-Repolib-Name: Prisma Access Browser
Types: deb
URIs: https://updates.talon-sec.com/linux/prisma-browser-stable/deb/
Suites: stable
Components: main
Architectures: amd64
Signed-By: $GPG_FILE
EOF
}

# Add the Google repository to the apt sources. The sources cannot be part of
# the package since it's still needed if the package is removed but not purged.
create_sources_lists() {
  find_apt_sources

  gen_sources_content >"$SOURCES_FILE.$$.tmp"
  chmod 644 "$SOURCES_FILE.$$.tmp"
  mv "$SOURCES_FILE.$$.tmp" "$SOURCES_FILE"

  if [ -r "$DEFAULTS_FILE" ]; then
    if grep -q "^[[:space:]]*repo_add_once=" "$DEFAULTS_FILE"; then
      sed -i -e \
        's/^[[:space:]]*repo_add_once=.*/repo_add_once="false"/' \
        "$DEFAULTS_FILE"
    else
      echo 'repo_add_once="false"' >>"$DEFAULTS_FILE"
    fi
  fi
}

# Remove our custom sources file.
clean_sources_lists() {
  find_apt_sources
  rm -f "$SOURCES_FILE"
}

install_deb822_sources() {
  find_apt_sources
  LEGACY_LIST="$APT_SOURCESDIR/prisma-access-browser.list"

  SHOULD_INSTALL_SOURCES=0
  # Detect new installs.
  if [ -r "$DEFAULTS_FILE" ]; then
    if grep -E -q \
      '^[[:space:]]*repo_add_once=[[:space:]]*["'\'']?true["'\'']?' \
      "$DEFAULTS_FILE"; then
      SHOULD_INSTALL_SOURCES=1
    fi
  else
    SHOULD_INSTALL_SOURCES=1
    echo 'repo_add_once="true"' >"$DEFAULTS_FILE"
    echo 'repo_reenable_on_distupgrade="true"' >>"$DEFAULTS_FILE"
  fi

  if [ -f "$SOURCES_FILE" ]; then
    # The new .sources file already exists. Recreate it in case it got disabled
    # during a dist upgrade.
    SHOULD_INSTALL_SOURCES=1
  elif [ -f "$LEGACY_LIST" ]; then
    # Migrate a legacy .list file to the new .sources format.
    if grep -E -q "^[[:space:]]*$REPOCONFIGREGEX" "$LEGACY_LIST"; then
      SHOULD_INSTALL_SOURCES=1
    elif grep -E -q \
      "^[[:space:]]*#[[:space:]]*$REPOCONFIGREGEX[[:space:]]*# disabled on \
upgrade to .*" \
      "$LEGACY_LIST"; then
      SHOULD_INSTALL_SOURCES=1
    fi
  fi

  if [ "$SHOULD_INSTALL_SOURCES" -eq 1 ]; then
    create_sources_lists
  fi
}

## MAIN ##
if [ -r "$DEFAULTS_FILE" ]; then
  . "$DEFAULTS_FILE"
fi

install_key

if [ "$repo_add_once" = "true" ]; then
  create_sources_lists
elif [ "$repo_reenable_on_distupgrade" = "true" ]; then
  install_deb822_sources
fi
