#!/bin/bash

set -euo pipefail

if [[ $# -ne 1 ]]; then
  echo "usage: omarchy-iso-sign [release/omarchy.iso]"
  exit 1
fi

iso="$1"
key_ref="op://Shared/Omarchy GPG Private Key/omarchy-private.asc"

if [[ ! -f $iso ]]; then
  echo "ISO not found: $iso" >&2
  exit 1
fi

if ! command -v op >/dev/null; then
  echo "1Password CLI is required to retrieve the signing key." >&2
  exit 1
fi

if ! pacman -Q gnupg >/dev/null 2>&1; then
  sudo pacman -S --noconfirm --needed --quiet gnupg
fi

gnupg_home="$(mktemp -d)"
chmod 700 "$gnupg_home"
trap 'rm -rf "$gnupg_home"' EXIT

op read "$key_ref" --account Omarchy |
  gpg --batch --homedir "$gnupg_home" --import >/dev/null

signing_key="$(
  gpg --batch --homedir "$gnupg_home" --with-colons --list-secret-keys |
    awk -F: '$1 == "fpr" { print $10; exit }'
)"

if [[ -z $signing_key ]]; then
  echo "No private signing key found in $key_ref" >&2
  exit 1
fi

gpg --batch --yes \
  --homedir "$gnupg_home" \
  --local-user "$signing_key" \
  --output "$iso.sig" \
  --detach-sig "$iso"