#!/bin/sh
set -eu

# Exact Debian security versions from the staging image scan. Keep these pins
# explicit: a release build must fail rather than silently consume newer OS
# packages that were not scanned.
gzip_version='1.13-1+deb13u1'
pcre2_version='10.46-1~deb13u2'
sqlite3_version='3.46.1-7+deb13u2'
openssl_version='3.5.7-1~deb13u2'
perl_base_version='5.40.1-6+deb13u1'
util_linux_version='2.41.5-0+deb13u1'
bsdutils_version='1:2.41.5-0+deb13u1'
login_version='1:4.16.0-2+really2.41.5-0+deb13u1'

apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
  "bsdutils=${bsdutils_version}" \
  "gzip=${gzip_version}" \
  "libblkid1=${util_linux_version}" \
  "liblastlog2-2=${util_linux_version}" \
  "libmount1=${util_linux_version}" \
  "libpcre2-8-0=${pcre2_version}" \
  "libsqlite3-0=${sqlite3_version}" \
  "libssl3t64=${openssl_version}" \
  "libsmartcols1=${util_linux_version}" \
  "libuuid1=${util_linux_version}" \
  "login=${login_version}" \
  "mount=${util_linux_version}" \
  "openssl=${openssl_version}" \
  "openssl-provider-legacy=${openssl_version}" \
  "perl-base=${perl_base_version}" \
  "util-linux=${util_linux_version}"

assert_package_version() {
  actual="$(dpkg-query -W -f='${Version}' "$1")"
  if [ "${actual}" != "$2" ]; then
    printf 'Expected %s=%s but found %s\n' "$1" "$2" "${actual}" >&2
    exit 1
  fi
}

assert_package_version "bsdutils" "${bsdutils_version}"
assert_package_version "login" "${login_version}"
for package in libblkid1 liblastlog2-2 libmount1 libsmartcols1 libuuid1 mount util-linux; do
  assert_package_version "${package}" "${util_linux_version}"
done
assert_package_version "gzip" "${gzip_version}"
assert_package_version "libpcre2-8-0" "${pcre2_version}"
assert_package_version "libsqlite3-0" "${sqlite3_version}"
assert_package_version "libssl3t64" "${openssl_version}"
assert_package_version "openssl" "${openssl_version}"
assert_package_version "openssl-provider-legacy" "${openssl_version}"
assert_package_version "perl-base" "${perl_base_version}"

rm -rf /var/lib/apt/lists/*