PGP_KEY=$(cat <<EOF
-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEZ0Ry9xYJKwYBBAHaRw8BAQdADh17kEVl/aQlV4RWEL0LvDX7pQotfCvxi+0f
DycrA2i0QFF1YW50aW51dW0gQ3liZXJzZWN1cml0eSBQYWNrYWdlIFNpZ25pbmcg
PG9yaWdpbkBxdWFudGludXVtLmNvbT6IkwQTFgoAOxYhBOrPp7vZcs3ejf3NZFyu
TffcukYNBQJnRHL3AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEFyu
TffcukYNLhoBANVFjkAahA51vGI1ZZdx1wk41HNv9Q2nyCdXdh/gaLZgAP0dh0ZU
8hwQU9nbuYqfmhDebLDR8Jc9Kuto9vO7SfB/Cg==
=GmWv
-----END PGP PUBLIC KEY BLOCK-----
EOF
)

POLICY=$(cat <<EOF
<?xml version="1.0"?>
<!DOCTYPE Policy SYSTEM "https://www.debian.org/debsig/1.0/policy.dtd">
<Policy xmlns="https://www.debian.org/debsig/1.0/">

  <!-- This is mainly a sanity check, since our filename is that of the ID
       anyway. -->
  <Origin Name="Quantum Origin" id="5CAE4DF7DCBA460D" Description="Quantum Origin Package Signing"/>

  <!-- This is required to match in order for this policy to be used. We
       reject the release Type, since we want a different rule set for
       that. -->
  <Selection>
    <Required Type="origin" File="debsig.gpg" id="5CAE4DF7DCBA460D"/>
  </Selection>

  <!-- Once we decide to use this policy, this must pass in order to verify
       the package. -->
  <Verification MinOptional="0">
    <Required Type="origin" File="debsig.gpg" id="5CAE4DF7DCBA460D"/>
  </Verification>
</Policy>
EOF
)

CMD=""
if [ "$(id -u)" != "0" ]; then
  CMD="sudo"
fi

set -x
${CMD} mkdir -p /usr/share/debsig/keyrings/5CAE4DF7DCBA460D/
${CMD} touch /usr/share/debsig/keyrings/5CAE4DF7DCBA460D/debsig.gpg
${CMD} mkdir -p /etc/debsig/policies/5CAE4DF7DCBA460D

set +x
echo "Importing QO public key..."
echo -n "$PGP_KEY" |${CMD} gpg --no-default-keyring --keyring /usr/share/debsig/keyrings/5CAE4DF7DCBA460D/debsig.gpg --import
echo "Importing QO debsig-verify policy..."
echo -n "$POLICY" |${CMD}  tee /etc/debsig/policies/5CAE4DF7DCBA460D/debsig-verify.pol >/dev/null

echo "Done"