#!/bin/sh
# Installs the newest release of @REPO@ for this machine, checked against its SHA-256 (§22.5).
#   curl -fsSL @BASE@/install.sh | sh
# INSTALL_DIR picks the folder (default ~/.local/bin).
set -eu

repo=@REPO@
base=@BASE@/releases

fail() {
	echo "$repo: $*" >&2
	exit 1
}

case "$(uname -s)" in
Linux) os=linux ;;
Darwin) os=macos ;;
*) fail "no builds for $(uname -s)" ;;
esac
case "$(uname -m)" in
x86_64 | amd64) arch=x86_64 ;;
arm64 | aarch64) arch=aarch64 ;;
*) fail "no builds for $(uname -m)" ;;
esac
platform=$os-$arch

command -v curl >/dev/null 2>&1 || fail "installing needs curl"
if command -v sha256sum >/dev/null 2>&1; then
	sha256() { sha256sum "$1" | cut -d ' ' -f 1; }
elif command -v shasum >/dev/null 2>&1; then
	sha256() { shasum -a 256 "$1" | cut -d ' ' -f 1; }
else
	fail "installing needs sha256sum or shasum"
fi

version=$(curl -fsSL "$base/latest/version.txt") || fail "no release found"
expected=$(curl -fsSL "$base/$version/checksums.txt" |
	awk -v name="$repo-$platform" '$2 == name && sub(/^sha256:/, "", $1) { print $1 }')
[ -n "$expected" ] || fail "$version has no build for $platform"

dir=${INSTALL_DIR:-$HOME/.local/bin}
mkdir -p "$dir"
tmp=$(mktemp "$dir/.$repo.XXXXXX")
trap 'rm -f "$tmp"' EXIT
curl -fsSL -o "$tmp" "$base/latest/$platform" || fail "download failed"
[ "$(sha256 "$tmp")" = "$expected" ] || fail "checksum mismatch; nothing installed"
chmod 755 "$tmp"
mv "$tmp" "$dir/$repo"
echo "$repo $version installed to $dir/$repo"