#!/bin/bash
# Daily CRL Update Script for SAW
# Version: 1.0
# Date: 2026-04-02
#
# This script is designed to be run as a cron job to keep the Certificate
# Revocation List (CRL) up to date. It downloads, verifies, and installs
# the CRL from your CA server.
#
# This script should be scheduled to run daily, typically at 2:00 AM.
#
# Setup:
# 1. Copy this script to /usr/local/bin/daily-crl-update.sh
# 2. Make it executable: chmod +x /usr/local/bin/daily-crl-update.sh
# 3. Configure the CRL_URL variable below with your CA server
# 4. Add to crontab: 0 2 * * * root /usr/local/bin/daily-crl-update.sh
#
# SECURITY RATIONALE:
# Regular CRL updates are critical because:
# 1. CRLs are updated when certificates are revoked
# 2. Outdated CRLs may allow revoked certificates
# 3. Daily updates ensure current revocation status
# 4. Meets compliance requirements for regular updates
# 5. Provides defense against compromised CA keys
#
# Reference: https://www.openssl.org/docs/man1.1.1/man1/crl.html

set -e

# Configuration
# TODO: Update this with your CA server URL
CRL_URL="https://your-ca-server.com/crl.pem"
CRL_CACHE_FILE="/var/cache/crl/crl.pem"
CA_KEY_PATH="/etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca"
LOG_FILE="/var/log/crl-update.log"

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Print functions
log_info() {
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo -e "${GREEN}[$timestamp]${NC} [INFO] $1" | tee -a "$LOG_FILE"
}

log_warning() {
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo -e "${YELLOW}[$timestamp]${NC} [WARNING] $1" | tee -a "$LOG_FILE"
}

log_error() {
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo -e "${RED}[$timestamp]${NC} [ERROR] $1" | tee -a "$LOG_FILE"
}

# Main execution
main() {
    echo "=========================================="
    echo "  Daily CRL Update"
    echo "  Fedora Kinoite SAW"
    echo "=========================================="
    echo ""
    
    # Check if CRL URL is configured
    if [ "$CRL_URL" = "https://your-ca-server.com/crl.pem" ]; then
        log_error "CRL URL not configured"
        log_info "Please edit this script and set CRL_URL to your CA server"
        exit 1
    fi
    
    # Create cache directory
    mkdir -p /var/cache/crl
    
    # Download CRL
    log_info "Downloading CRL from: $CRL_URL"
    
    if ! curl -s -o "$CRL_CACHE_FILE" "$CRL_URL"; then
        log_error "Failed to download CRL"
        exit 1
    fi
    
    log_info "CRL downloaded successfully"
    
    # Verify CRL
    log_info "Verifying CRL signature..."
    
    if [ ! -f "$CA_KEY_PATH" ]; then
        log_error "CA key not found: $CA_KEY_PATH"
        exit 1
    fi
    
    if ! openssl crl -in "$CRL_CACHE_FILE" -CAfile "$CA_KEY_PATH" -noout 2>/dev/null; then
        log_error "CRL verification failed"
        exit 1
    fi
    
    log_info "CRL verified successfully"
    
    # Get CRL information
    local this_update=$(openssl crl -in "$CRL_CACHE_FILE" -noout -text 2>/dev/null | grep "Last Update:" | head -1)
    log_info "CRL Last Update: $this_update"
    
    # Update CA trust
    log_info "Updating CA trust database..."
    
    # Copy CRL to CA trust source
    mkdir -p /etc/pki/ca-trust/source/anchors
    cp "$CRL_CACHE_FILE" /etc/pki/ca-trust/source/anchors/crl.pem
    
    # Update CA trust
    update-ca-trust extract
    
    log_info "CA trust database updated"
    
    # Check for revoked certificates in installed packages
    log_info "Checking for revoked certificates..."
    
    local revoked_count=0
    
    # Check a sample of packages (first 100)
    while IFS= read -r pkg; do
        # Extract certificate ID from signature
        local cert_id=$(echo "$pkg" | awk '{print $2}' | cut -d: -f2)
        
        if [ -n "$cert_id" ]; then
            # Check if certificate is in CRL
            if openssl crl -in "$CRL_CACHE_FILE" -noout -text 2>/dev/null | grep -q "$cert_id"; then
                log_error "REVOKED: Package signed with revoked certificate: $cert_id"
                ((revoked_count++))
            fi
        fi
    done < <(rpm -qa --queryformat='%{NAME} %{SIGPGP:pgpsig}\n' 2>/dev/null | head -100)
    
    if [ $revoked_count -gt 0 ]; then
        log_warning "WARNING: $revoked_count packages have revoked certificates!"
        log_info "These packages should be reviewed"
    else
        log_info "No revoked certificates found in checked packages"
    fi
    
    log_info "CRL update completed successfully"
}

# Run main function
main "$@"