#!/bin/bash

set -e

if [[ $# -ne 2 ]]; then
    printf 'Usage: bash %s URL KEY_FILENAME\n' "$0" >&2
    exit 1
fi

key_url="$1"
key_filename="$2"

# Принимаем только имя файла, а не произвольный путь.
case "${key_filename}" in
    ""|*/*|.|..)
        printf 'Invalid key filename: %s\n' "${key_filename}" >&2
        exit 1
        ;;
esac

if [[ "${key_filename}" != *.gpg ]]; then
    printf 'Key filename must end with .gpg\n' >&2
    exit 1
fi

command -v curl >/dev/null 2>&1 || {
    printf 'curl is required\n' >&2
    exit 1
}

command -v gpg >/dev/null 2>&1 || {
    printf 'gpg is required\n' >&2
    exit 1
}

mkdir -p /etc/apt/keyrings

temporary=$(mktemp -d)
trap 'rm -rf "${temporary}"' EXIT

curl -fsSL "${key_url}" -o "${temporary}/key.asc"

gpg --batch --yes --dearmor --output "${temporary}/key.gpg" "${temporary}/key.asc"

if [[ ! -s "${temporary}/key.gpg" ]]; then
    printf 'Downloaded key is empty: %s\n' "${key_url}" >&2
    exit 1
fi

gpg --batch --show-keys "${temporary}/key.gpg" >/dev/null

cat "${temporary}/key.gpg" > "/etc/apt/keyrings/${key_filename}"