#!/usr/bin/env bash
set -euo pipefail

if [ "$#" -ne 2 ]; then
  echo "usage: $0 <client-certificate.pem> <revoked-fingerprint-file>" >&2
  exit 2
fi
certificate=$1
list=$2
[ -f "$certificate" ] || {
  echo "certificate does not exist: $certificate" >&2
  exit 1
}

fingerprint=$(openssl x509 -in "$certificate" -outform DER | sha256sum | awk '{print $1}')
[ "${#fingerprint}" -eq 64 ] || {
  echo "could not calculate certificate fingerprint" >&2
  exit 1
}
mkdir -p "$(dirname "$list")"
lock="$list.lock"
exec 9>"$lock"
flock -x 9
if [ -f "$list" ] && grep -Fqx "$fingerprint" "$list"; then
  printf '%s\n' "$fingerprint"
  exit 0
fi
temporary="${list}.tmp.$$"
trap 'rm -f "$temporary"' EXIT
if [ -f "$list" ]; then
  cat "$list" >"$temporary"
fi
printf '%s\n' "$fingerprint" >>"$temporary"
chmod 600 "$temporary"
mv -f "$temporary" "$list"
printf '%s\n' "$fingerprint"