From 8f58aa00ee81a0797ab237878506f5d78273b1d5 Mon Sep 17 00:00:00 2001
From: David Prevot <dprevot+git@evolix.fr>
Date: Tue, 17 Oct 2023 17:26:44 +0200
Subject: [PATCH] IS_SURY: check that if sury is enabled, then a safeguard must
 be in place

---
 linux/CHANGELOG   |  1 +
 linux/evocheck.sh | 11 ++++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/linux/CHANGELOG b/linux/CHANGELOG
index d4ac687..6df70fe 100644
--- a/linux/CHANGELOG
+++ b/linux/CHANGELOG
@@ -9,6 +9,7 @@ and this project **does not adhere to [Semantic Versioning](http://semver.org/sp
 * IS_OLDPUB: pub.evolix.net has been supersed by pub.evolix.org since Stretch
 * IS_NEWPUB: verify that the new public repository is present
 * IS_DRBDTWOPRIMARIES: check there are not 2 DRBD primaries at the same time.
+* IS_SURY: check that if sury is enabled, then a safeguard must be in place
 
 ### Changed
 
diff --git a/linux/evocheck.sh b/linux/evocheck.sh
index fe32e92..e4d6d28 100755
--- a/linux/evocheck.sh
+++ b/linux/evocheck.sh
@@ -200,9 +200,17 @@ check_oldpub() {
 }
 check_newpub() {
     # Look for enabled pub.evolix.org sources
-    apt-cache policy | grep --quiet pub.evolix.org
+    apt-cache policy | grep "\bl=Evolix\b" | grep --quiet -v php
     test $? -eq 0 || failed "IS_NEWPUB" "New pub.evolix.org repository is missing"
 }
+check_sury() {
+    # Look for enabled packages.sury.org sources
+    apt-cache policy | grep --quiet packages.sury.org
+    if [ $? -eq 0 ]; then
+         apt-cache policy | grep "\bl=Evolix\b" | grep php --quiet
+	 test $? -eq 0 || failed "IS_SURY" "packages.sury.org is present but our safeguard pub.evolix.org repository is missing"
+    fi
+}
 check_aptitude() {
     test -e /usr/bin/aptitude && failed "IS_APTITUDE" "aptitude may not be installed on Debian >=8"
 }
@@ -1454,6 +1462,7 @@ main() {
     test "${IS_DEBIANSECURITY:=1}" = 1 && check_debiansecurity
     test "${IS_OLDPUB:=1}" = 1 && check_oldpub
     test "${IS_NEWPUB:=1}" = 1 && check_newpub
+    test "${IS_SURY:=1}" = 1 && check_sury
     test "${IS_APTITUDE:=1}" = 1 && check_aptitude
     test "${IS_APTGETBAK:=1}" = 1 && check_aptgetbak
     test "${IS_USRRO:=1}" = 1 && check_usrro