#!/bin/sh
# SPDX-License-Identifier: GPL-3.0-only
# Exact persistent-owner check before operator SSH. Historical filename retained
# for init ordering; no per-unit witness, receipt or signing key is consumed.
DATA_HELPER=/usr/sbin/dcent-s19k-data-mount
RELEASE_MARKER=/etc/dcentos/release-image
SSH_INIT=/etc/init.d/S50dropbear
verify() {
    [ -e "$RELEASE_MARKER" ] || [ -L "$RELEASE_MARKER" ] || return 0
    [ -x "$DATA_HELPER" ] && "$DATA_HELPER" verify
}
case "${1:-start}" in
    start)
        if verify && { [ ! -e "$RELEASE_MARKER" ] || "$SSH_INIT" prepare; }; then
            echo 'S19k persistent access: OK; SSH requires operator credentials'
        else
            echo 'S19k persistent access: BLOCKED (exact /data owner refused)' >&2
            exit 1
        fi
        ;;
    status) verify ;;
    stop) : ;;
    *) echo "Usage: $0 {start|stop|status}" >&2; exit 2 ;;
esac
