#!/bin/sh
set -e

if ! grep -q '^openssl_conf =' /etc/ssl/openssl.cnf; then
    COMMENT_LINE=$(grep -n '^# System default$' /etc/ssl/openssl.cnf | cut -d: -f1)

    if [ -n "$COMMENT_LINE" ]; then
        sed -i "${COMMENT_LINE}a openssl_conf = default_conf" /etc/ssl/openssl.cnf
    else
        LAST_COMMENT=$(grep -n '^#' /etc/ssl/openssl.cnf | tail -n 1 | cut -d: -f1)
        [ -n "$LAST_COMMENT" ] && sed -i "${LAST_COMMENT}a openssl_conf = default_conf" /etc/ssl/openssl.cnf
    fi
fi

cat > /etc/ssl/gost.cnf << 'EOF'
[default_conf]
engines = engines_section

[engines_section]
gost = gost_section

[gost_section]
engine_id = gost
dynamic_path = /usr/lib/x86_64-linux-gnu/engines-1.1/gost.so
default_algorithms = ALL
CRYPT_PARAMS = id-Gost28147-89-CryptoPro-A-ParamSet
EOF

if ! grep -q '^\.include /etc/ssl/gost.cnf' /etc/ssl/openssl.cnf; then
    printf '\n.include /etc/ssl/gost.cnf\n' >> /etc/ssl/openssl.cnf
fi

if ! openssl engine -t gost | grep -q available; then
    echo "Error: GOST engine failed to load!" >&2
    exit 1
fi

exit 0