#!/usr/bin/env bash
# Install Product OS Proxy MITM CA on Debian/Ubuntu-style systems.
set -euo pipefail

CERT_PATH="${1:?certificate path required}"
TRUST="${2:-}"

if [[ ! -f "$CERT_PATH" ]]; then
  echo "certificate not found: $CERT_PATH" >&2
  exit 1
fi

DEST="/usr/local/share/ca-certificates/product-os-proxy-ca.crt"
if [[ "$TRUST" == "--trust" ]]; then
  sudo cp "$CERT_PATH" "$DEST"
  sudo update-ca-certificates
else
  cp "$CERT_PATH" "${DEST}.local" 2>/dev/null || cp "$CERT_PATH" "$HOME/product-os-proxy-ca.crt"
  echo "copied CA; run with --trust and sudo to install system-wide"
fi

echo "installed CA: $CERT_PATH"