#!/bin/sh
# Install or update pantry's apps for this user, on Linux:
#
#   curl -fsSL https://pantry.pschulz.at/install.sh | sh
#   curl -fsSL https://pantry.pschulz.at/install.sh | sh -s -- --uninstall
#
# It downloads the newest Linux archive, checks it against the release's
# SHA256SUMS (and the signature of SHA256SUMS, when minisign is installed),
# then runs the install.sh inside it, which puts the apps into ~/.local.
set -eu

BASE=${PANTRY_RELEASES:-https://pantry.pschulz.at/releases/latest}
PUBLIC_KEY='RWSeCB4Ic6MXUyl58LXhO/N/hkjyi+cZgjUhdNRn8nA8/mcrSrF+anci'

die() {
    echo "pantry install: $*" >&2
    exit 1
}

case $(uname -s)/$(uname -m) in
Linux/x86_64) ;;
*) die "pantry is for Linux on x86_64 for now, this is $(uname -s) on $(uname -m)" ;;
esac
for tool in curl sha256sum tar; do
    command -v $tool >/dev/null || die "$tool is missing"
done

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT

proto=
case $BASE in
https://*) proto="--proto =https --tlsv1.2" ;;
esac
fetch() {
    # shellcheck disable=SC2086
    curl -fsSL $proto -o "$tmp/$1" "$BASE/$1" || die "cannot download $BASE/$1"
}

fetch VERSION
version=$(cat "$tmp/VERSION")
case $version in
'' | *[!0-9A-Za-z.+-]*) die "the release's VERSION file looks wrong: $version" ;;
esac
archive=pantry-$version-linux-x86_64.tar.gz
echo "downloading pantry $version"
fetch "$archive"
fetch SHA256SUMS

if command -v minisign >/dev/null; then
    fetch SHA256SUMS.minisig
    minisign -Vqm "$tmp/SHA256SUMS" -P "$PUBLIC_KEY" ||
        die "the signature of SHA256SUMS does not match pantry's key"
    echo "signature checked"
else
    echo "minisign is not installed: checking the SHA-256 only"
fi
grep -q "  $archive\$" "$tmp/SHA256SUMS" || die "$archive is not in SHA256SUMS"
(cd "$tmp" && grep "  $archive\$" SHA256SUMS | sha256sum --check --status) ||
    die "$archive does not match its SHA-256"
echo "checksum checked"

tar -xzf "$tmp/$archive" -C "$tmp"
installer=$tmp/pantry-$version/install.sh
[ -x "$installer" ] || die "the archive has no pantry-$version/install.sh"
"$installer" "$@"