#!/bin/sh
set -eu

POLICY_SRC="packaging/qubes/policy.d/40-nsigner.policy"
POLICY_DST="/etc/qubes/policy.d/40-nsigner.policy"

if [ ! -f "$POLICY_SRC" ]; then
    echo "Missing policy source: $POLICY_SRC" >&2
    exit 1
fi

install -m 0644 "$POLICY_SRC" "$POLICY_DST"

echo "Installed qrexec policy to $POLICY_DST"
echo "Tag your signer qube in dom0, for example:"
echo "  qvm-tags nsigner-vault add nsigner-signer"
echo "Then reload policy per your Qubes OS version procedures."