#!/bin/bash
# Pending upgrades, held packages, reboot flag and age of the package lists as node exporter textfile
# metrics. apt-daily and apt-daily-upgrade run it after their update and upgrade (drop-ins).
set -euo pipefail

host={{ inventory_hostname }}
textfile_dir={{ apt_updates_textfile_dir }}
out=$textfile_dir/apt_updates.prom
tmp=$(mktemp "$textfile_dir/.apt_updates.XXXXXX")
trap 'rm -f "$tmp"' EXIT

# Architectures a pending package can have: the native and foreign ones, plus "all" for architecture-independent
# packages. Each gets a row per kind even at 0, so a resolved backlog reads as 0 and not as a vanished series.
archs="$(dpkg --print-architecture) $(dpkg --print-foreign-architectures | tr '\n' ' ') all"

# The simulated upgrade lists "Inst <package> [<installed>] (<candidate> <origins> [<arch>])" per package. A version in
# several suites lists them all, comma separated. A package counts as security when any origin contains "security",
# everything else as regular.
pending=$(apt-get -s upgrade | awk -v host="$host" -v archs="$archs" '
  /^Inst / {
    line = $0
    sub(/^[^(]*\(/, "", line)
    sub(/\).*$/, "", line)
    n = split(line, f, " ")
    pkg_arch = f[n]
    gsub(/\[|\]/, "", pkg_arch)
    sub(/^[^ ]+ /, "", line)
    kind = (tolower(line) ~ /security/) ? "security" : "regular"
    count[kind, pkg_arch]++
  }
  END {
    split(archs, a, " ")
    for (i in a) {
      if (!(("security", a[i]) in count)) count["security", a[i]] = 0
      if (!(("regular", a[i]) in count)) count["regular", a[i]] = 0
    }
    for (key in count) {
      split(key, k, SUBSEP)
      printf "apt_upgrades_pending{host=\"%s\",origin=\"%s\",arch=\"%s\"} %d\n", host, k[1], k[2], count[key]
    }
  }')

held=$(apt-mark showhold | wc -l)

reboot=0
if [[ -e /run/reboot-required ]]; then
  reboot=1
fi

# Debian writes update-stamp, Ubuntu update-success-stamp; both are touched by a successful update. Both are missing
# until apt.systemd.daily has run an update, then the package cache stands in.
stamp=/var/lib/apt/periodic/update-success-stamp
if [[ ! -e $stamp ]]; then
  stamp=/var/lib/apt/periodic/update-stamp
fi
if [[ ! -e $stamp ]]; then
  stamp=/var/cache/apt/pkgcache.bin
fi
cache=$(stat -c %Y "$stamp")

{
  echo '# TYPE apt_upgrades_pending gauge'
  echo "$pending"
  echo '# TYPE apt_upgrades_held gauge'
  echo "apt_upgrades_held{host=\"$host\"} $held"
  echo '# TYPE node_reboot_required gauge'
  echo "node_reboot_required{host=\"$host\"} $reboot"
  echo '# TYPE apt_package_cache_timestamp_seconds gauge'
  echo "apt_package_cache_timestamp_seconds{host=\"$host\"} $cache"
} > "$tmp"

chmod 0644 "$tmp"
mv -f "$tmp" "$out"