#!/bin/sh
# Rendered from a verified signed release package. The HTTPS origin supplies
# initial binary and publisher-key trust; a checksum is only a transport check.
# Explicit HTTP bootstrap also trusts the network.

fail() {
    printf 'joinery install: %s\n' "$*" >&2
    exit 1
}

glibc_at_least() {
    current=$1
    minimum=$2
    case "$current" in
        ''|*[!0-9.]*|.*|*.|*..*) return 1 ;;
    esac
    while [ -n "$current$minimum" ]; do
        a=${current%%.*}
        b=${minimum%%.*}
        [ "${a:-0}" -gt "${b:-0}" ] && return 0
        [ "${a:-0}" -lt "${b:-0}" ] && return 1
        case "$current" in *.*) current=${current#*.} ;; *) current= ;; esac
        case "$minimum" in *.*) minimum=${minimum#*.} ;; *) minimum= ;; esac
    done
    return 0
}

shell_quote() {
    printf "'"
    printf '%s' "$1" | sed "s/'/'\\\\''/g"
    printf "'"
}

main() (
    set -eu
    umask 077
    LC_ALL=C
    export LC_ALL
    base=https://joinery.roelof.solar/disk/public
    build=joinery-7f647e1
    revision=2
    publisher=V.xqUcKqdNG2suD_FlHGd_FmmEk0Aj51h0EJeqleHiBtt.H3
    channel=release
    minimum_glibc=2.39
    artifact=joinery-532e555f556b3879625548774e7246694e4968474c71646d306c6b6d6a5339766274564249435f4c367a7353382e4833.tar.gz
    checksum=5f7351a20bf53fe2d2f4a538b93618aef81a62296c52bb93381a83414d0424fc
    protocols==https

    if [ "$#" = 0 ]; then
        [ -n "${HOME:-}" ] || fail 'HOME is unset; use --directory /absolute/nonexisting/directory'
        directory=$HOME/.joinery
    elif [ "$#" = 2 ] && [ "$1" = --directory ]; then
        directory=$2
    else
        fail 'usage: sh install.sh [--directory /absolute/nonexisting/directory]'
    fi
    case "$directory" in /*) ;; *) fail '--directory must be an absolute path' ;; esac
    [ ! -e "$directory" ] && [ ! -L "$directory" ] || fail 'directory already exists; choose a fresh destination'
    for tool in uname getconf curl sha256sum mktemp mkdir tar rm sed; do
        command -v "$tool" >/dev/null 2>&1 || fail "required tool not found: $tool"
    done
    [ "$(uname -s)" = Linux ] || fail 'only Linux is supported'
    [ "$(uname -m)" = x86_64 ] || fail 'only x86_64 is supported'
    libc=$(getconf GNU_LIBC_VERSION 2>/dev/null) || fail "requires glibc $minimum_glibc or newer"
    case "$libc" in
        'glibc '*) libc=${libc#glibc } ;;
        *) fail "requires glibc $minimum_glibc or newer" ;;
    esac
    glibc_at_least "$libc" "$minimum_glibc" || fail "requires glibc $minimum_glibc or newer (found $libc)"

    stage=$(mktemp -d)
    trap 'rm -rf "$stage"' 0
    trap 'exit 129' HUP
    trap 'exit 130' INT
    trap 'exit 143' TERM
    # Ignore curlrc and forbid every non-HTTPS redirect, including downgrades.
    curl --disable --fail --silent --show-error --location \
        --proto "$protocols" --proto-redir '=https' --max-redirs 3 \
        --connect-timeout 10 --max-time 120 --max-filesize 33620814 \
        --output "$stage/archive.tar.gz" "$base/downloads/$artifact" \
        || fail 'download failed; destination not created'
    (cd "$stage" && printf '%s  archive.tar.gz\n' "$checksum" | sha256sum --check --status) \
        || fail 'checksum mismatch; destination not created'
    # The authenticated archive carries joinery, ingredients/ and two bootstrap
    # Seals. Initialization copies ingredients and writes the compact baseline last.
    # mkdir (without -p) reserves a fresh destination; never merge or repair.
    mkdir -- "$directory" || fail 'cannot create fresh directory (parent must exist)'
    tar --extract --gzip --file "$stage/archive.tar.gz" --directory "$directory" \
        --no-same-owner --no-same-permissions \
        || fail 'extraction failed; incomplete destination retained, choose a new directory'
    "$directory/joinery" init "$directory/instance" --bootstrap "$directory" \
        --publisher-by "$publisher" --channel "$channel" \
        || fail 'authenticated initialization failed; incomplete destination retained, choose a new directory'
    printf 'Installed Joinery build %s (%s revision %s) in %s\n' "$build" "$channel" "$revision" "$directory"
    printf '\nRun (nothing has been launched):\n  '
    shell_quote "$directory/joinery"
    printf ' run'
    printf '\n\nKeep instance/ private. Launch selfupdate to synchronize releases. Stop Joinery before running the adjacent executable with update.\n'
)

# A piped download executes no installation work until this complete body arrives.
main "$@"