pax-pre-install

#!/bin/bash
# Thanks to https://gist.github.com/jordansissel/748313
# This script patches blacklisted files inside any .deb during apt install time.
# This is the best way that I found to do a thing that shouldn't be required.
set -eu

function unpack(){
	tmpdir="$(mktemp -d)"
	dpkg-deb -x "$1" "$tmpdir" >&2
	dpkg-deb -e "$1" "$tmpdir"/DEBIAN >&2
	echo "$tmpdir"
}

function repack(){
	dpkg-deb -b "$1" "$2" >&2
	rm -rf "$1"
}

if [ "$1" = "--install" ]; then
	echo "=> Installing pre-install-pkgs hook"
	echo "DPkg::Pre-Install-Pkgs {\"xargs -rL1 $0\";};" > \
	/etc/apt/apt.conf.d/99pax
	if [ -n "$(which paxctl)" ]; then
		exit
	fi
	apt update
	apt install -y --no-install-recommends paxctl gnupg dirmngr
	apt-get clean
	exit
fi

deb="$1"

# handle expected behaviour
#echo "$deb" | /usr/sbin/dpkg-preconfigure --apt || true

if [ -z "$(which paxctl)" ]; then
	echo "=> paxctl not installed, can't continue" >&2
	exit
fi

if dpkg-deb -c "$deb" | grep -q "jre/bin/java$"; then
	echo "=> Detected 'jre/bin/java' in $deb"
	tmpdir="$(unpack "$deb")"
	badfile="$(find "$tmpdir" -path '*/jre/bin/java')"
	echo "=> Fixing $badfile"
	paxctl -cm "$badfile"
	repack "$tmpdir" "$deb"
fi