#!/bin/sh

cd /etc/uci-defaults || exit 0
# Keep dnsmasq ipset with old method
rm -f /etc/uci-defaults/50-dnsmasq-migrate-ipset.sh
# omr-bypass' 41_omr-bypass turns the entries of the old omr-bypass into
# bypass domains, and removes them: deleted here first, it never saw them
if [ -f /etc/uci-defaults/41_omr-bypass ]; then
	for entry in $(uci -q get dhcp.@dnsmasq[0].ipset); do
		case "$entry" in
			/*/ss_rules_dst_bypass_all) ;;
			*) uci -q del_list dhcp.@dnsmasq[0].ipset="$entry" ;;
		esac
	done
else
	uci -q del dhcp.@dnsmasq[0].ipset
fi

source /etc/os-release

files="$(ls /etc/uci-defaults/)"
[ -n "$files" ] && {
	mkdir -p /usr/share/omr-update
	if [ "$(grep rom /etc/mtab)" = "" ]; then
		#rm /usr/share/omr-update/*
		cp /etc/uci-defaults/* /usr/share/omr-update
	fi
}

# Do not keep /etc/nftables.d
rm -f /lib/upgrade/keep.d/firewall4

# Package signatures are checked: an image and its repositories share the
# build's key. Only a package file uploaded in LuCI (a local path, with no
# signed index behind it) goes in without a trusted signature, as before.
# --allow-untrusted is an apk option, opkg doesn't know it.
pmc=/usr/libexec/package-manager-call
if [ -f "$pmc" ]; then
	sed -i 's:cmd="$ipkg_bin --allow-untrusted":cmd="$ipkg_bin":' "$pmc"
	[ -x /usr/bin/apk ] && ! grep -q 'omr: local package file' "$pmc" && sed -i '/^[[:space:]]*if flock -x 200; then/i\
			# omr: local package file (LuCI upload), no signed index behind it\
			for _pkg in "$@"; do [ -f "$_pkg" ] \&\& { cmd="$cmd --allow-untrusted"; break; }; done' "$pmc"
fi

exit 0
