#!/bin/bash
# SPDX-License-Identifier: GPL-3.-or-later
#
# Authors: - 2025 Igor Zubiaurre <izubiaurre@botergia.com>
#          - 2026 Fioddor Superconcentrado <fioddor@gmail.com>
# -----------------------------------------------------------------------------

VERSION=20251010B

indent()
{
  local margin='   '
  # indents both stdout and stderr:
  { "$@" 2> >(sed "s/^/$margin/g" >&2); } | sed "s/^/$margin/g"
}

which_os()
{
    for os in "Ubuntu" "Debian"
    do
      chk=`hostnamectl | grep 'Operating System: ' | grep "$os" | wc -l`
      if [[ $chk -eq 1 ]]
      then
          echo "$os"
          return 0
      fi
    done
    echo "Unknown OS"
    return 255
}

chk_debian_hd_encrypted()
{
      # See https://www.baeldung.com/linux/check-disk-encryption)
      ls -l /etc/crypttab   # check date (old) and permissions (only root)
      cat /etc/crypttab     # check disk is encrypted
}

chk_debian_updated()
{
      # sudo grep -B 2 "upgrade" /var/log/apt/history.log
      sudo zcat /var/log/apt/history.log.1.gz | grep -B 2 "upgrade"
}

chk_ufw()
{   # See: man ufw
    sudo ufw status verbose
}

chk_usbguard()
{
   sudo grep -vE '^$|^#' /etc/usbguard/usbguard-daemon.conf
}

chk_clamav()
{
    cat /etc/clamav/freshclam.conf            #
    sudo cat /var/log/clamav/freshclam.log | tail -20   # updated
    # Share the screen and spawn clamtk to proof run within the week
}

chk_firefox_extensions_under_dir()
{
    file=$2/addons.json
    if [ -f $file ]
    then
        echo "Firefox is installed via $1."
        echo "Plug-ins in $file:"
        grep -oP '(?<=\},\"name\":\")([^"]*)' $file

        #cat ~/.mozilla/firefox/*.default-esr/addons.json |
        #python3 -c 'import json,sys;obj=json.load(sys.stdin);for (i, x) in enumerate(obj["addons"]): ; print(x["name"])' |
        #uniq

    else
        echo "Firefox is NOT installed via $1."
    fi
    echo "-"
}

chk_firefox_extensions()
{
    chk_firefox_extensions_under_dir APT  $HOME/.mozilla/firefox/*.default-esr
    chk_firefox_extensions_under_dir Snap $HOME/snap/firefox/common/.mozilla/firefox/*
}

chk_chrome_extensions_under_dir()
{
    if [ -d "$2" ]
    then
        echo "Chrome is installed via $1."
        echo "Plgins in $1/manifest.json:"
        for i in $(find $1 -name 'manifest.json')
        do
           n=$(grep -hIr name $i| cut -f4 -d '"'| sort)
           u="https://chrome.google.com/extensions/detail/"
           ue=$(basename $(dirname $(dirname $i)))
           echo -e "$n:\n$u$ue\n"
        done
    else
        echo "Chrome is NOT installed via  $1."
    fi
    echo "-"
}

chk_chrome_extensions()
{   # See: https://superuser.com/questions/1604992/how-to-get-a-list-of-google-chrome-extensions-from-the-command-line

    chk_chrome_extensions_under_dir "Snap" "$HOME/snap/chromium/common/chromium/Default/Extensions/"
    chk_chrome_extensions_under_dir "Google's official .deb file" "/opt/google/chrome/"
}

chk_debian_packages()
{
    echo "contrib:"
    dpkg-query -W -f='${Section}\t${Package}\n' | grep ^contrib
    echo "non-free:"
    dpkg-query -W -f='${Section}\t${Package}\n' | grep ^non-free
}

chk_snap_packages()
{
    snap list
}

chk_flatpak_packages()
{
    flatpak list
}

chk_git_repos()
{
    find / -name .git 2>&1 | grep -v "denied" | grep -v "denegado" 
}



echo "0. Preparations"

echo "Bitergia Laptop configuration checks v"$VERSION

OS=`which_os`
OS_result=$?
if [[ $OS_result -eq 255 ]]
   then
       echo "Unknown operating system. Aborting..."
       exit $OS_result
   else
       indent echo "The operating system is $OS"
fi


if  [[ $OS == "Ubuntu" ]] || [[ $OS == "Debian" ]]
then
    echo "1. Hard disk is encrypted?"
         indent chk_debian_hd_encrypted
    echo "2. Operating system and packages are updated?"
         indent chk_debian_updated
    echo "3. Firewall is filtering incoming connections?"
         indent chk_ufw
    echo "4. Antimalware (ClamAV) is updated, and run at least once during the last week?"
         indent chk_clamav
         indent echo "Now, please share screen to verify that it ran last week!"
    echo "5. Web filtering (uBlock) is enabled in the web browser?"
              indent chk_firefox_extensions
              indent chk_chrome_extensions
    echo "6. Report software installed from non-standard sources:"
         echo " .1 Apt:"
              indent chk_debian_packages
         echo " .2  Snap:"
              indent chk_snap_packages
         echo " .3  Flatpak:"
              indent chk_flatpak_packages
         echo " .4  Git:"
              indent chk_git_repos
    echo "7. Screen lock is active and set to 5 minutes. Unlock requires a secret."
         indent echo "Now, please share screen to verify the screenlock settings"
    echo "8. USB protection"
         indent chk_usbguard
fi
#exit 0