#!/usr/bin/env bash
# Arcline OS — one-time MOK enrollment (runs at first boot, then disables itself)
# No-op when no key was shipped in the image (secure boot off by default).
set -euo pipefail

KEY=/etc/arcline/MOK.der
UNIT=arcline-mok-enroll.service

if [[ ! -f "$KEY" ]]; then
  echo "arcline: no MOK key shipped — secure boot enrollment skipped"
  systemctl disable --now "$UNIT" 2>/dev/null || true
  exit 0
fi

if mokutil --test-key "$KEY" 2>/dev/null | grep -q enabled; then
  echo "arcline: MOK already enrolled"
else
  echo "arcline: importing MOK — you will be prompted to confirm it on the next reboot"
  mokutil --import "$KEY" || true
fi

# enrollment is one-time; disable ourselves so this never runs again
systemctl disable --now "$UNIT" 2>/dev/null || true