#!/bin/bash
# Switch the target root to use systemd-boot, using the content from SRC
# SRC should contain an "out" subdirectory with:
#   - systemd-boot-unsigned RPM (*.rpm)
#   - signed systemd-boot binary (systemd-boot*.efi)
set -xeuo pipefail

src=$1/out
shift

# systemd-boot (and, when sealed, the UKI) is signed and booted directly
# with our own Secure Boot key, so shim is never in the trust chain
# regardless of sealing. Uninstall bootupd (managed differently for
# sd-boot) and shim together so neither lingers in the image.
case "$(uname -m)" in
  x86_64) shim_pkg=shim-x64 ;;
  aarch64) shim_pkg=shim-aa64 ;;
  *) shim_pkg="" ;;
esac

pkgs_to_remove=()
for pkg in bootupd "${shim_pkg}"; do
  [ -n "${pkg}" ] || continue
  rpm -q "${pkg}" &>/dev/null && pkgs_to_remove+=("${pkg}")
done

if [ "${#pkgs_to_remove[@]}" -gt 0 ]; then
  rpm -e "${pkgs_to_remove[@]}"
fi
rm -vrf /usr/lib/bootupd/updates

# First install the unsigned systemd-boot RPM to get the package in place
rpm -Uvh --replacepkgs "${src}"/*.rpm

# Now find where it installed the binary and override with our signed version
sdboot=$(ls /usr/lib/systemd/boot/efi/systemd-boot*.efi)
sdboot_bn=$(basename "${sdboot}")
# Override with our signed binary
install -m 0644 "${src}/${sdboot_bn}" "${sdboot}"
