#!/bin/bash
#
# Synchronise le depot de paquets depuis Forgejo.
# Execute par winget-sync.timer sous le compte rewinged.
#
set -euo pipefail

REPO_DIR="/srv/winget"
BRANCH="main"

cd "$REPO_DIR"

BEFORE=$(git rev-parse HEAD)

git fetch origin "$BRANCH"
git merge --ff-only "origin/${BRANCH}"
git lfs pull origin

AFTER=$(git rev-parse HEAD)

if [ "$BEFORE" != "$AFTER" ]; then
    # Verification de signature : voir section 13.3
    if ! git verify-commit HEAD >/dev/null 2>&1; then
        logger -t winget-sync -p auth.crit \
            "SIGNATURE INVALIDE sur ${AFTER:0:8} - retour a ${BEFORE:0:8}"
        git reset --hard "$BEFORE"
        exit 1
    fi
    logger -t winget-sync "Publication verifiee: ${BEFORE:0:8} -> ${AFTER:0:8}"
fi

exit 0