#! /bin/sh
set -e

# Automatically added by dh_installdeb/12.1.1
dpkg-maintscript-helper symlink_to_dir /usr/share/doc/shim-signed shim-signed-common 1.36~ shim-signed -- "$@"
# End automatically added section


# If we're not on an EFI system, do nothing else
if [ ! -d /sys/firmware/efi ]; then
    exit 0
fi

# Must load the confmodule for our template to be installed correctly.
. /usr/share/debconf/confmodule

# Select the right target architecture for grub-install
ARCH=$(dpkg --print-architecture)
case ${ARCH} in
    i386|amd64)
	FW_SIZE=$(cat /sys/firmware/efi/fw_platform_size)
	if [ "$FW_SIZE"x = "32"x ]; then
	    GRUB_EFI_TARGET="i386-efi"
	elif [ "$FW_SIZE"x = "64"x ]; then
	    GRUB_EFI_TARGET="x86_64-efi"
	else
	    echo "Unable to read a valid value from fw_platform_size, ABORT"
	    exit 1
	fi
	;;
    arm64)
	GRUB_EFI_TARGET="arm64-efi"
	;;
    *)
	echo "Unsupported dpkg architecture ${ARCH} in $0. ABORT"
	exit 1
	;;
esac

# Pull out a config value from /etc/default/grub
config_item ()
{
    if [ -f /etc/default/grub ]; then
	. /etc/default/grub || return
	for x in /etc/default/grub.d/*.cfg; do
	    if [ -e "$x" ]; then
		# Lose any output here so we don't confuse our
		# caller. The xen packages echo stuff here, Aargh!
		. "$x" > /dev/null
	    fi
	done
    fi
    eval echo "\$$1"
}

# Call grub-install but don't fail on errors. Let's not break upgrades
run_grub_install()
{
    if ! grub-install $@ ; then
        echo "Failed: grub-install $@" >&2
        echo "WARNING: Bootloader is not properly installed, system may not be bootable" >&2
    fi
}

case $1 in
    configure)
	bootloader_id="$(config_item GRUB_DISTRIBUTOR | tr A-Z a-z | \
			 cut -d' ' -f1)"
	case $bootloader_id in
	    kubuntu) bootloader_id=ubuntu ;;
	esac

	# Call grub-install to make sure we're added to the ESP as
	# needed
	if [ "$bootloader_id" ] && \
	   [ -d "/boot/efi/EFI/$bootloader_id" ] && \
	   which grub-install >/dev/null 2>&1
	then
	    # Check for some of the options that matter, so we can
	    # call grub-install safely without dropping them
	    OPTIONS=""

	    db_get grub2/force_efi_extra_removable || RET=false
	    if [ "$RET" = true ]; then
		OPTIONS="$OPTIONS --force-extra-removable"
	    fi

	    db_get grub2/update_nvram || RET=true
	    if [ "$RET" = false ]; then
		OPTIONS="$OPTIONS --no-nvram"
	    fi

	    run_grub_install --target=${GRUB_EFI_TARGET} $OPTIONS

            if dpkg --compare-versions "$2" lt-nl "1.22~"; then
                rm -f /boot/efi/EFI/ubuntu/MokManager.efi
            fi
	fi

	# Finally, trigger the policy script from the -common package
	if which update-secureboot-policy >/dev/null 2>&1; then
	    SHIM_NOTRIGGER=y update-secureboot-policy
	fi
	;;
esac

exit 0