#!/usr/bin/env bash
# Finish the Defender (mdatp) install on first boot by running the package's
# own %post, saved at build time: it creates the machine GUID, state, logs and
# definitions database under /var and then enables and starts mdatp.service.
set -euo pipefail

MARKER=/var/lib/mdatp-firstboot.done

[[ -f "${MARKER}" ]] && exit 0

# mdatp.service only starts once the marker exists (10-firstboot.conf), and the
# %post starts it, so create the marker first and drop it again on failure.
touch "${MARKER}"
if ! bash /usr/libexec/mdatp-postinst 1; then
  rm -f "${MARKER}"
  exit 1
fi