name: Install mmdebstrap + Debian archive keyring
description: >
  Installs mmdebstrap and provisions /usr/share/keyrings/debian-archive-keyring.gpg from a
  checksum-pinned debian-archive-keyring .deb — the toolchain every os/mkimage/build-rootfs.sh
  invocation needs. Pinned here ONCE: this block used to be copy-pasted into all three rootfs
  jobs in naros.yml, so a keyring bump meant editing the version and the SHA256 in three places
  and a missed copy failed only that one job.

inputs:
  extra-packages:
    description: >
      Additional apt packages to install alongside mmdebstrap/dpkg-dev. The OCI rootfs job needs
      qemu-user-static + binfmt-support + arch-test to strap a foreign arch; the native-arm64 VM
      jobs need nothing extra.
    required: false
    default: ""
  keyring-version:
    description: Version of the debian-archive-keyring package to install.
    required: false
    default: "2025.1"
  keyring-sha256:
    description: SHA256 of the keyring .deb — bump in lockstep with keyring-version.
    required: false
    default: 9ea7778e443144ca490668737a8ab22dd3e748bb99e805e22ec055abeb3c7fac

runs:
  using: composite
  steps:
    - name: Install mmdebstrap
      shell: bash
      env:
        EXTRA_PACKAGES: ${{ inputs.extra-packages }}
      run: |
        set -euo pipefail
        sudo apt-get update
        # $EXTRA_PACKAGES is deliberately unquoted — it is a space-separated package list that
        # must word-split, and it is empty for the native-arm64 callers.
        # shellcheck disable=SC2086
        sudo apt-get install -y --no-install-recommends mmdebstrap dpkg-dev $EXTRA_PACKAGES

    - name: Provision the Debian archive keyring (checksum-pinned)
      shell: bash
      env:
        KEYRING_VERSION: ${{ inputs.keyring-version }}
        KEYRING_SHA256: ${{ inputs.keyring-sha256 }}
      run: |
        set -euo pipefail
        keyring_deb="$RUNNER_TEMP/debian-archive-keyring_${KEYRING_VERSION}_all.deb"
        curl --fail --location --silent --show-error --retry 5 --retry-all-errors \
          --output "$keyring_deb" \
          "https://deb.debian.org/debian/pool/main/d/debian-archive-keyring/$(basename "$keyring_deb")"
        echo "$KEYRING_SHA256  $keyring_deb" | sha256sum --check --strict
        keyring_root="$RUNNER_TEMP/debian-archive-keyring"
        dpkg-deb --extract "$keyring_deb" "$keyring_root"
        keyring="$keyring_root/usr/share/keyrings/debian-archive-keyring.gpg"
        test -s "$keyring"
        sudo install -m 0644 "$keyring" /usr/share/keyrings/debian-archive-keyring.gpg
