#!/bin/sh
# SCREENUS repository bootstrap. Installs theme; does not activate it or restart services.
set -eu
test "$(id -u)" = 0 || { echo 'Run as root' >&2; exit 1; }
case "$(opnsense-version -v)" in 26.7*) ;; *) echo 'OPNsense 26.7 required' >&2; exit 1;; esac
key=/usr/local/etc/pkg/keys/SCREENUS.pub
repo=/usr/local/etc/pkg/repos/SCREENUS.conf
expected=2d3934e6c1f46f42bdbe8b120a71a162c8d6091ef8852fcafd08d740df19d8fe
tmp=$(mktemp -d /tmp/screenus-bootstrap.XXXXXX)
trap 'rm -f "$tmp/public.key" "$tmp/repo.conf"; rmdir "$tmp"' EXIT HUP INT TERM
fetch -q -o "$tmp/public.key" https://packages.screenus.de/opnsense/screenus-repository.pub
test "$(sha256 -q "$tmp/public.key")" = "$expected" || { echo 'Signing-key mismatch; stopped' >&2; exit 1; }
if test -e "$key"; then cmp -s "$key" "$tmp/public.key" || { echo 'Existing key differs; stopped' >&2; exit 1; }; fi
cat > "$tmp/repo.conf" <<'CONF'
SCREENUS: {
 url: "https://packages.screenus.de/opnsense/26.7",
 signature_type: "pubkey",
 pubkey: "/usr/local/etc/pkg/keys/SCREENUS.pub",
 enabled: yes,
 priority: 5
}
CONF
if test -e "$repo"; then cmp -s "$repo" "$tmp/repo.conf" || { echo 'Existing repository configuration differs; stopped' >&2; exit 1; }; fi
install -d -m 755 /usr/local/etc/pkg/keys /usr/local/etc/pkg/repos
install -m 644 "$tmp/public.key" "$key"
install -m 644 "$tmp/repo.conf" "$repo"
pkg update -r SCREENUS
pkg install -y -r SCREENUS os-theme-screenus
pkg check -s os-theme-screenus
echo 'Installed. Select screenus-26.7 in the UI, or use the supplied theme-only selector.'