#!/bin/bash

## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## This script is executed inside the container and provides basic commands to
## prepare and configure a minimal debian docker image.

set -x
set -o errexit
set -o nounset
set -o pipefail
set -o errtrace

## TODO: root check or use sudo

apt-get update

## TODO: remove
## 'build-steps.d/1100_sanity-tests' function 'check_required_packages_installed' already installs
## '$required_packages_list' which contains packages such as 'approx'. Any missing packages should
## be installed using 'build-steps.d/1100_sanity-tests' not using docker.
## This is difficult, because 'build-steps.d/1100_sanity-tests' assumes some
## dependencies like 'sudo' are already installed. 'ca-certificates' may also
## be required before packages can be installed in some configurations.
## TODO: Debian forky: gpg-from-sq gpgv-from-sq
## TODO: Package 'docker-cli' as of Debian trixie ships '/usr/bin/docker' - Is package 'docker.io'
##       still required?
DEBIAN_FRONTEND=noninteractive \
  apt-get install \
    --no-install-recommends \
    --yes \
    sq sqv sqop sequoia-git sequoia-chameleon-gnupg gpg-agent \
    dbus dbus-user-session ca-certificates git time curl lsb-release fakeroot \
    dpkg-dev fasttrack-archive-keyring safe-rm adduser sudo approx docker.io \
    docker-cli

## Create the derivative account + passwordless sudo drop-in only when
## this script runs inside the docker image (where 'USER=user' and
## 'HOME=/home/user' come from 'Dockerfile' ENV). When the same script
## is executed on the host via
##   'sudo --non-interactive -- ./docker/derivative-maker-docker-setup'
## (see 'help-steps/dm-build-official-one' CI branch) 'sudo' leaves
## 'USER=root' / 'HOME=/root', and creating user 'root' or a
## 'root ALL=(ALL) NOPASSWD:ALL' drop-in is pointless and confusing.
if [ "${USER}" != "root" ]; then
   adduser --quiet --disabled-password --home "${HOME}" --gecos "${USER},,,," "${USER}"
   printf '%s\n' "${USER} ALL=(ALL) NOPASSWD:ALL" | tee -- /etc/sudoers.d/passwordless_sudo >/dev/null
   chmod 440 -- /etc/sudoers.d/passwordless_sudo
fi

apt-get clean

safe-rm -r -f -- /var/lib/apt/lists/* /var/cache/apt/*
