From cd340e6aa44bd9836210a746ab18f57cf1ed032d Mon Sep 17 00:00:00 2001
From: "Matthias B." <m-byte@users.noreply.github.com>
Date: Tue, 6 Aug 2024 23:54:05 +0200
Subject: [PATCH] Fix: only add apt sources for users that want them (#22145)
 (#221285)

Signed-off-by: Matthias Breithaupt <m.breithaupt@vogl-electronic.com>
---
 build/gulpfile.vscode.linux.js            |  6 +++-
 resources/linux/debian/postinst.template  | 36 +++++++++++++++++++----
 resources/linux/debian/postrm.template    | 19 ++++++++++++
 resources/linux/debian/templates.template |  6 ++++
 4 files changed, 61 insertions(+), 6 deletions(-)
 create mode 100644 resources/linux/debian/templates.template

diff --git a/build/gulpfile.vscode.linux.js b/build/gulpfile.vscode.linux.js
index 28ddfb04c3d..79594543c3b 100644
--- a/build/gulpfile.vscode.linux.js
+++ b/build/gulpfile.vscode.linux.js
@@ -108,7 +108,11 @@ function prepareDebPackage(arch) {
 			.pipe(replace('@@NAME@@', product.applicationName))
 			.pipe(rename('DEBIAN/postinst'));
 
-		const all = es.merge(control, postinst, postrm, prerm, desktops, appdata, workspaceMime, icon, bash_completion, zsh_completion, code);
+		const templates = gulp.src('resources/linux/debian/templates.template', { base: '.' })
+			.pipe(replace('@@NAME@@', product.applicationName))
+			.pipe(rename('DEBIAN/templates'));
+
+		const all = es.merge(control, templates, postinst, postrm, prerm, desktops, appdata, workspaceMime, icon, bash_completion, zsh_completion, code);
 
 		return all.pipe(vfs.dest(destination));
 	};
diff --git a/resources/linux/debian/postinst.template b/resources/linux/debian/postinst.template
index 16acb1481bf..7dc5bef8c5c 100755
--- a/resources/linux/debian/postinst.template
+++ b/resources/linux/debian/postinst.template
@@ -35,20 +35,46 @@ if [ "@@NAME@@" != "code-oss" ]; then
 	eval $(apt-config shell APT_TRUSTED_PARTS Dir::Etc::trustedparts/d)
 	CODE_TRUSTED_PART=${APT_TRUSTED_PARTS}microsoft.gpg
 
+	RET=true
+	if [ -e '/usr/share/debconf/confmodule' ]; then
+		. /usr/share/debconf/confmodule
+		db_get @@NAME@@/add-microsoft-repo || true
+	fi
+
 	# Install repository source list
 	WRITE_SOURCE=0
-	if [ ! -f $CODE_SOURCE_PART ] && [ ! -f /etc/rpi-issue ]; then
-		# Write source list if it does not exist and we're not running on Raspberry Pi OS
-		WRITE_SOURCE=1
-	elif grep -Eq "http:\/\/packages\.microsoft\.com\/repos\/vscode" $CODE_SOURCE_PART; then
+	if [ "$RET" = false ]; then
+		# The user does not want to add the microsoft repository
+		WRITE_SOURCE=0
+	elif grep -q "http://packages.microsoft.com/repos/vscode" $CODE_SOURCE_PART; then
 		# Migrate from old repository
+		WRITE_SOURCE=2
+	elif grep -q "http://packages.microsoft.com/repos/code" $CODE_SOURCE_PART; then
+		# Migrate from old repository
+		WRITE_SOURCE=2
+	elif apt-cache policy | grep -q "https://packages.microsoft.com/repos/code"; then
+		# Skip following checks if the repo is already known to apt
+		WRITE_SOURCE=0
+	elif [ ! -f $CODE_SOURCE_PART ] && [ ! -f /etc/rpi-issue ]; then
+		# Write source list if it does not exist and we're not running on Raspberry Pi OS
 		WRITE_SOURCE=1
 	elif grep -q "# disabled on upgrade to" $CODE_SOURCE_PART; then
 		# Write source list if it was disabled by OS upgrade
 		WRITE_SOURCE=1
 	fi
 
-	if [ "$WRITE_SOURCE" -eq "1" ]; then
+	if [ "$WRITE_SOURCE" -eq "1" ] && [ -e '/usr/share/debconf/confmodule' ]; then
+		# Ask the user whether to actually write the source list
+		db_input high @@NAME@@/add-microsoft-repo || true
+		db_go || true
+
+		db_get @@NAME@@/add-microsoft-repo
+		if [ "$RET" = false ]; then
+			WRITE_SOURCE=0
+		fi
+	fi
+
+	if [ "$WRITE_SOURCE" -ne "0" ]; then
 		echo "### THIS FILE IS AUTOMATICALLY CONFIGURED ###
 # You may comment out this entry, but any other modifications may be lost.
 deb [arch=amd64,arm64,armhf] https://packages.microsoft.com/repos/code stable main" > $CODE_SOURCE_PART
diff --git a/resources/linux/debian/postrm.template b/resources/linux/debian/postrm.template
index fb36d522f38..dcbfda95ea0 100755
--- a/resources/linux/debian/postrm.template
+++ b/resources/linux/debian/postrm.template
@@ -14,3 +14,22 @@ fi
 if hash update-mime-database 2>/dev/null; then
 	update-mime-database /usr/share/mime
 fi
+
+RET=true
+if [ -e '/usr/share/debconf/confmodule' ]; then
+	. /usr/share/debconf/confmodule
+	db_get @@NAME@@/add-microsoft-repo || true
+fi
+if [ "$RET" = "true" ]; then
+	eval $(apt-config shell APT_SOURCE_PARTS Dir::Etc::sourceparts/d)
+	CODE_SOURCE_PART=${APT_SOURCE_PARTS}vscode.list
+	rm -f $CODE_SOURCE_PART
+
+	eval $(apt-config shell APT_TRUSTED_PARTS Dir::Etc::trustedparts/d)
+	CODE_TRUSTED_PART=${APT_TRUSTED_PARTS}microsoft.gpg
+	rm -f $CODE_TRUSTED_PART
+fi
+
+if [ "$1" = "purge" ] && [ -e '/usr/share/debconf/confmodule' ]; then
+	db_purge
+fi
diff --git a/resources/linux/debian/templates.template b/resources/linux/debian/templates.template
new file mode 100644
index 00000000000..7be5e039b26
--- /dev/null
+++ b/resources/linux/debian/templates.template
@@ -0,0 +1,6 @@
+Template: @@NAME@@/add-microsoft-repo
+Type: boolean
+Default: true
+Description: Add Microsoft apt repository for Visual Studio Code?
+ The installer would like to add the Microsoft repository and signing
+ key to update VS Code through apt.