#!/bin/sh
# Copyright (c) 2006, 2013, Oracle and/or its affiliates. All rights reserved.
# $Id: cacerts_upgrade.sh 107843 2013-02-18 09:59:11Z ww161634 $
#
# Called on upgrade, to merge cacerts modifications into new cacerts file.
#
# Usage:
#     $0 KEYTOOL OLDCLEAN_CERTS OLDDIRTY_CERTS NEWCLEAN_CERTS
#
# OLDCLEAN_CERTS is the cacerts file that was originally installed with
# the old SSGD installation which is now being upgraded.
#
# OLDDIRTY_CERTS is the current cacerts file immediately prior to upgrade.
# This will be identical to OLDCLEAN_CERTS unless the SSGD installation has
# been customised by adding or removing certificates from the cacerts file.
#
# First we compare OLDCLEAN_CERTS and OLDDIRTY_CERTS.  If any certs are
# found to have been added to OLDDIRTY_CERTS, we also add them to NEWCLEAN_CERTS.
# Also, any certs that have been deleted from OLDDIRTY_CERTS are deleted
# from NEWCLEAN_CERTS.

[ "${trace}" = x ] && set -x

[ $# -lt 4 ] && exit 1

KEYTOOL=$1
OLDCLEAN_CERTS=$2
OLDDIRTY_CERTS=$3
NEWCLEAN_CERTS=$4
LOG=${5:-/dev/null}

echo "$0" >>${LOG}

LC_COLLATE='' export LC_COLLATE
CFP='Certificate fingerprint'

OLDCLEAN_FINGERPRINTS=${TMPDIR:-/tmp}/cacerts1.$$
OLDDIRTY_FINGERPRINTS=${TMPDIR:-/tmp}/cacerts2.$$
NEWCLEAN_FINGERPRINTS=${TMPDIR:-/tmp}/cacerts3.$$
ADDED_CERT=${TMPDIR:-/tmp}/cacerts4.$$

rm -rf ${TMPDIR:-/tmp}/cacerts[1-4].$$ 2>/dev/null
trap 'rm -f ${TMPDIR:-/tmp}/cacerts[1-4].$$ 2>/dev/null; exit' 1 2 3 15

getFingerPrints()
{
    ${KEYTOOL} -list -storepass changeit -keystore $1 |
    sed "/^${CFP}/!d;s/^${CFP}[^:]*: *//" |
    sort
}

getAlias()
{
    ${KEYTOOL} -list -storepass changeit -keystore $1 |
    awk '$4 == "'"$2"'" {
	print alias; exit
    }
    {
	comma = index($0, ",")
	if (comma > 1) alias = substr($0, 1, comma-1)
    }'
}

getFingerPrints ${OLDCLEAN_CERTS} >${OLDCLEAN_FINGERPRINTS}
getFingerPrints ${OLDDIRTY_CERTS} >${OLDDIRTY_FINGERPRINTS}
getFingerPrints ${NEWCLEAN_CERTS} >${NEWCLEAN_FINGERPRINTS}

comm -13 ${OLDCLEAN_FINGERPRINTS} ${OLDDIRTY_FINGERPRINTS} |
while read added_fingerprint; do
    [ -z "`grep \"${added_fingerprint}\" ${NEWCLEAN_FINGERPRINTS} 2>/dev/null`" ] && {
	added_alias=`getAlias "${OLDDIRTY_CERTS}" "${added_fingerprint}" 2>/dev/null`
	[ -n "${added_alias}" ] && {
	    ${KEYTOOL} -export -alias "${added_alias}" -storepass changeit -keystore "${OLDDIRTY_CERTS}" >${ADDED_CERT}
	    [ -s "${ADDED_CERT}" ] && {
		echo "+ ${KEYTOOL} -import -alias ${added_alias}" >>${LOG}
		${KEYTOOL} -import -alias "${added_alias}" -storepass changeit -keystore "${NEWCLEAN_CERTS}" -trustcacerts -noprompt -file ${ADDED_CERT} 2>>${LOG}
	    }
	}
    }
done

comm -23 ${OLDCLEAN_FINGERPRINTS} ${OLDDIRTY_FINGERPRINTS} |
while read deleted_fingerprint; do
    [ -n "`grep \"${deleted_fingerprint}\" ${NEWCLEAN_FINGERPRINTS} 2>/dev/null`" ] && {
	deleted_alias=`getAlias "${OLDCLEAN_CERTS}" "${deleted_fingerprint}" 2>/dev/null`
	[ -n "${deleted_alias}" ] && {
	    echo "+ ${KEYTOOL} -delete -alias ${deleted_alias}" >>${LOG}
	    ${KEYTOOL} -delete -alias "${deleted_alias}" -storepass changeit -keystore "${NEWCLEAN_CERTS}" 2>>${LOG}
	}
    }
done

rm -f ${TMPDIR:-/tmp}/cacerts[1-4].$$ 2>/dev/null

exit 0
