#!/usr/bin/env bash
# Mock p11-kit `trust`. NEVER touches the real trust store.
#
# `ca_untrust_system_direct` enumerates `trust list` and, for anything that
# turns out to be one of ours, runs `trust anchor --remove <uri>`. In a sandbox
# there is no p11-kit store to enumerate, so `list` prints nothing (the honest
# answer for an empty store) and every other subcommand is logged to
# $SONOMOS_TEST_TRUST_LOG so a test can assert on the argv the script BUILT
# without a real anchor ever being added or removed.
[ -n "${SONOMOS_TEST_TRUST_LOG:-}" ] && printf '%s\n' "$*" >> "$SONOMOS_TEST_TRUST_LOG"
case "${1:-}" in
  list)    printf '%s' "${SONOMOS_TEST_TRUST_LIST:-}" ;;
  extract) exit 1 ;;   # nothing to extract from an empty store
  anchor)  exit "${SONOMOS_TEST_TRUST_ANCHOR_EXIT:-0}" ;;
  *)       exit 0 ;;
esac
