CERT_CA     =russian_trusted_root_ca.cer
CERT_SUBCA  =russian_trusted_sub_ca.cer
CERT_URL    =https://gu-st.ru/content/Other/doc

WGET_FLAGS    =--tries 10 --quiet
OPENSSL_FLAGS =x509 -inform DER

CA_FILE_PATH  =/usr/local/share/ca-certificates
CA_PATH_MOZFF =~/.mozilla*
CA_PATH_MOZTB =~/.thunderbird
CA_PATH_PKI   =~/.pki

define cmd_wget
    wget ${WGET_FLAGS} ${CERT_URL}/$1 -O $1
endef
define cmd_conv_pem
    openssl ${OPENSSL_FLAGS} -in $1 -out ${$2}/$(subst .cer,.crt,$1)
endef
define cmd_updca
     $(call cmd_conv_pem,$1,${CA_FILE_PATH}) && update-ca-certificates
endef

PKI_PROFILES=$(shell find ${CA_PATH_PKI} ${CA_PATH_MOZFF} ${CA_PATH_MOZTB} -name "cert9.db")
define cmd_updpki
    for certDB in $(dir ${PKI_PROFILES}); do \
        certutil -A -n "$1" -t "TC,C,T" -i ${1} -d sql:$${certDB} && \
        echo "PKI certificate" "install '$1' in $${certDB}"; \
    done
endef

.PHONY: clean
clean:
    @rm -f *.cer

install_deb: install_ca_deb install_sca_deb
install_pki: install_ca_pki install_sca_pki

$(CERT_CA):
    @echo "Download $@"
    @$(call cmd_wget,$@)
$(CERT_SUBCA):
    @echo "Download $@"
    @$(call cmd_wget,$@)
install_ca_pki: $(CERT_CA)
    @echo "Install Web $^"
    @$(call cmd_updpki,$^)
install_sca_pki: $(CERT_SUBCA)
    @echo "Install Web $^"
    @$(call cmd_updpki,$^)
install_ca_deb: $(CERT_CA)
    @echo "Install System $^"
    @$(call cmd_updca,$^)
install_sca_deb: $(CERT_SUBCA)
    @echo "Install System $^"
    @$(call cmd_updca,$^)