#!/bin/bash
# dracut module: 95linuxmdm
#
# This module ships the LinuxMDM initramfs recovery hook. When the agent
# is installed, the customer/operator regenerates the initramfs:
#
#   sudo dracut -f
#
# The local-bottom hook then runs every boot, checks whether
# /sysroot/usr/local/bin/linuxmdm-agent is present + matches the SHA in
# /sysroot/boot/linuxmdm-recovery.json. If it's missing or tampered with,
# the hook decompresses /sysroot/boot/linuxmdm-recovery.tar.gz back into
# /sysroot/, restoring the agent before init starts.

check() {
    # Always include in the initramfs when the recovery archive is present.
    [[ -f /boot/linuxmdm-recovery.tar.gz ]] || return 1
    return 0
}

depends() {
    # We use no dracut deps — only base tools (cat, gzip, cpio).
    return 0
}

install() {
    # Install the runtime hook into local-bottom (runs after the rootfs is
    # mounted at /sysroot but before init takes over).
    inst_hook pre-pivot 99 "$moddir/linuxmdm-recover.sh"

    # Bring along the tools the hook needs. Most are already in dracut's
    # core but we ask explicitly to be safe.
    inst_multiple sha256sum cat cp tar gzip mkdir test
}