#!/bin/sh
# /etc/ssl/openssl.cnf reads the .cnf and .conf files in /etc/ssl/openssl.cnf.d
# (#1152488). A snippet there that activates the legacy provider, and keeps the
# default one, takes effect; without it only the default provider is active.
set -e
dir=/etc/ssl/openssl.cnf.d
snippet="$dir/autopkgtest-legacy.cnf"

test -d "$dir"
trap 'rm -f "$snippet"' EXIT

providers() { openssl list -providers; }

providers | grep -q 'OpenSSL Default Provider'
if providers | grep -q 'OpenSSL Legacy Provider'; then
	echo "the legacy provider is active before any snippet" >&2
	exit 1
fi

printf '[provider_sect]\nlegacy = legacy_sect\n\n[legacy_sect]\nactivate = 1\n\n[default_sect]\nactivate = 1\n' > "$snippet"
providers | grep -q 'OpenSSL Legacy Provider'
providers | grep -q 'OpenSSL Default Provider'
echo hello | openssl dgst -md4 > /dev/null
echo hello | openssl dgst -sha256 > /dev/null

rm -f "$snippet"
if providers | grep -q 'OpenSSL Legacy Provider'; then
	echo "the legacy provider is still active after its snippet was removed" >&2
	exit 1
fi
echo "drop-in directory: ok"
