#!/bin/bash
# Rocky Linux 8 - PHP 7.4 Security Update
# CVE patch released October 21, 2026

set -euo pipefail

EXPECTED_DATE="Oct 21 2026"
EXPECTED_RELEASE="7.4.33-8.module+el8.10.0+40393+c071e357"

echo "========================================"
echo " PHP 7.4 Security Update - Rocky Linux 8"
echo "========================================"

# Check root privileges
if [[ $EUID -ne 0 ]]; then
    echo "ERROR: This script must be run as root."
    exit 1
fi

# Check Rocky Linux 8
if ! grep -qE '^Rocky Linux release 8\.' /etc/rocky-release 2>/dev/null; then
    echo "ERROR: This script requires Rocky Linux 8."
    exit 1
fi

# Step 1: Enable PHP 7.4 stream
echo
echo "[1/5] Enabling PHP 7.4 module stream..."
dnf -y module enable php:7.4

# Step 2: Clean DNF cache
echo
echo "[2/5] Cleaning DNF cache..."
dnf clean all

# Step 3: Update PHP
echo
echo "[3/5] Updating PHP packages..."
dnf update php

# Step 4: Verify PHP version
echo
echo "[4/5] Checking PHP version..."
PHP_OUTPUT=$(php -v)
echo "$PHP_OUTPUT"

# Step 5: Verify patched RPM and build date
echo
echo "[5/5] Verifying security update..."

INSTALLED_RELEASE=$(rpm -q --qf '%{VERSION}-%{RELEASE}' php-common)
echo "Installed PHP RPM: $INSTALLED_RELEASE"

if [[ "$INSTALLED_RELEASE" != "$EXPECTED_RELEASE" ]]; then
    echo "ERROR: Expected PHP RPM release not installed."
    echo "Expected: $EXPECTED_RELEASE"
    exit 1
fi

if ! grep -Eq "built: ${EXPECTED_DATE}" <<< "$PHP_OUTPUT"; then
    echo "ERROR: PHP build date does not match $EXPECTED_DATE."
    exit 1
fi

echo
echo "========================================"
echo " SUCCESS: PHP security update verified!"
echo " Version: $INSTALLED_RELEASE"
echo " Build date: $EXPECTED_DATE"
echo "========================================"

exit 0