#!/bin/bash
# vim: syntax=sh

set -e

[ -d "$statedir" ]
cafile="$statedir/ca-bundle.pem"
cadir="$statedir/pem"

for i in "$@"; do
	if [ "$i" = "-f" ]; then
		fresh=1
	elif [ "$i" = "-v" ]; then
		verbose=1
	fi
done

if [ -z "$fresh" -a "$cafile" -nt "$cadir" ]; then
	exit 0
fi
[ -z "$verbose" ] || echo "creating $cafile ..."
trust extract --format=pem-bundle --purpose=server-auth --filter=ca-anchors --overwrite $cafile.tmp
cat - $cafile.tmp > "$cafile.new" <<EOF
#
# automatically created by $0. Do not edit!
#
# Use of this file is deprecated and should only be used as last
# resort by applications that do not support p11-kit or reading /etc/ssl/certs.
# You should avoid hardcoding any paths in applications anyways though. Use
# functions that know the operating system defaults instead:
#
# - openssl: SSL_CTX_set_default_verify_paths()
# - gnutls: gnutls_certificate_set_x509_system_trust(cred)
#
EOF
rm -f $cafile.tmp
mv -f "$cafile.new" "$cafile"
