#!/bin/bash
set -euo pipefail
shopt -s inherit_errexit

# shellcheck source=scripts/libcc
. /usr/lib/common-criteria/scripts/libcc

CC_STRICT_MODULE="/etc/crypto-policies/policies/modules/CC-STRICT.pmod"

check_51_config_crypto_policies() {
	local active
	active=$(update-crypto-policies --show)
	if [ "$active" != "FIPS:OSPP:CC-STRICT" ]; then
		echo "active crypto policy is '$active', expected FIPS:OSPP:CC-STRICT"
		return 1
	fi
}

apply_51_config_crypto_policies() {
	[ -f "$CC_STRICT_MODULE" ] || {
		cc_echo "FAILED: $CC_STRICT_MODULE missing - is this package installed correctly?"
		return 1
	}

	if check_51_config_crypto_policies; then
		cc_echo "Crypto policy already set to FIPS:OSPP:CC-STRICT"
		return 0
	fi

	update-crypto-policies --set FIPS:OSPP:CC-STRICT

	check_51_config_crypto_policies || {
		cc_echo "FAILED: crypto policy verification failed after applying"
		return 1
	}

	cc_echo "Crypto policy set to FIPS:OSPP:CC-STRICT"
}

if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
	cc_start_logging
	trap 'cc_exit $?' ERR
	apply_51_config_crypto_policies
	cc_exit 0
fi
