#!/bin/sh
# Ciao host bootstrap installer.
#
#     curl -fsSL https://ciaooo.app/install.sh | sh
#
# Downloads the latest release archive for this machine from the release
# base, verifies its SHA-256 against the sidecar checksum, and installs the
# `ciao` binary to ~/.local/bin (the same stable path `ciao install` uses).
# Updates after this are handled by the binary itself:
#
#     ciao install --release-base https://ciaooo.app/dist
#
# Site layout expected: /install.sh, /dist/release.json, /dist/ciao-<v>-<t>.tar{,.sha256}
set -eu

BASE="${CIAO_BASE_URL:-https://ciaooo.app/dist}"

# The default is https, but the override is taken verbatim, and over plaintext the checksum is
# worth nothing: the sidecar travels the same interceptable channel as the archive it vouches
# for, so whoever can rewrite one rewrites the other. `ciao install` — the update path in every
# binary already out there — refuses a non-https release base in fetch_release_file(); this keeps
# the bootstrap to the same rule instead of leaving the first install as the weak one.
case "$BASE" in
    https://*) ;;
    *)
        if [ "${CIAO_ALLOW_INSECURE_BASE:-}" = "1" ]; then
            echo "ciao: WARNING: installing over a non-https base ($BASE); nothing is authenticated" >&2
        else
            echo "ciao: refusing a non-https release base: $BASE" >&2
            echo "ciao: the checksum arrives over that same channel, so it proves nothing there." >&2
            echo "ciao: set CIAO_ALLOW_INSECURE_BASE=1 to override for local testing." >&2
            exit 1
        fi
        ;;
esac

case "$(uname -s)-$(uname -m)" in
    Darwin-arm64) target="aarch64-apple-darwin" ;;
    Linux-x86_64) target="x86_64-unknown-linux-gnu" ;;
    # Mirrors install::current_release_target(): refuse rather than guess.
    *) echo "ciao: no released build for $(uname -s) $(uname -m)" >&2; exit 1 ;;
esac

version="$(curl -fsSL "$BASE/release.json" | sed -n 's/.*"version": *"\([0-9A-Za-z.-]*\)".*/\1/p' | head -n1)"
[ -n "$version" ] || { echo "ciao: could not read version from $BASE/release.json" >&2; exit 1; }

file="ciao-$version-$target.tar"
tmp="$(mktemp -d)"
stage=""
cleanup() {
    rm -rf "$tmp"
    [ -z "$stage" ] || rm -f "$stage"
}
trap cleanup EXIT

echo "Downloading ciao $version ($target)..."
curl -fsSL -o "$tmp/$file" "$BASE/$file"
curl -fsSL -o "$tmp/$file.sha256" "$BASE/$file.sha256"

if command -v sha256sum >/dev/null 2>&1; then
    (cd "$tmp" && sha256sum -c "$file.sha256" >/dev/null)
else
    (cd "$tmp" && shasum -a 256 -c "$file.sha256" >/dev/null)
fi

tar -xf "$tmp/$file" -C "$tmp" ciao
mkdir -p "$HOME/.local/bin"
# Stage in the destination filesystem so the final replacement is atomic even when
# the system temporary directory lives on another filesystem.
stage="$(mktemp "$HOME/.local/bin/.ciao.install.XXXXXX")"
cp "$tmp/ciao" "$stage"
chmod 755 "$stage"
mv -f "$stage" "$HOME/.local/bin/ciao"
stage=""

echo "Installed ciao $version to ~/.local/bin/ciao"
case ":$PATH:" in
    *:"$HOME/.local/bin":*) echo "Run: ciao" ;;
    *) echo 'Add to PATH first: export PATH="$HOME/.local/bin:$PATH"'; echo "Then run: ciao" ;;
esac