#!/bin/sh
# Debark Linux CLI installer. https://github.com/inferops/debark
# Downloads an official release and checks its published SHA-256 before installation.
# For publisher signature verification, see https://debark.dev/docs/trust/release-downloads
set -eu

main() {
  version='latest'
  bin_dir="${HOME:?HOME must be set}/.local/bin"
  repo='https://github.com/inferops/debark'
  tmp=''
  staged=''
  fail() { printf 'debark: %s\n' "$*" >&2; exit 1; }
  cleanup() {
    if [ -n "$staged" ]; then rm -f -- "$staged"; fi
    if [ -n "$tmp" ]; then rm -rf -- "$tmp"; fi
  }
  trap cleanup EXIT
  trap 'exit 130' INT
  trap 'exit 143' TERM HUP

  while [ "$#" -gt 0 ]; do
    case "$1" in
      --version)
        [ "$#" -ge 2 ] || fail '--version needs a version such as v0.1.1'
        version="$2"; shift 2 ;;
      --bin-dir)
        [ "$#" -ge 2 ] || fail '--bin-dir needs an absolute directory path'
        bin_dir="$2"; shift 2 ;;
      -h|--help)
        printf '%s\n' 'Install the Debark CLI on Linux amd64 or arm64.' \
          'Usage: sh install.sh [--version vX.Y.Z] [--bin-dir /absolute/path]' \
          'Default: latest stable release, installed into $HOME/.local/bin.' \
          'No sudo, shell profile changes, or background update checks.' \
          'Desktop and Windows downloads: https://debark.dev/download'
        exit 0 ;;
      *) fail "Unknown option: $1 (use --help)" ;;
    esac
  done
  case "$bin_dir" in /*) ;; *) fail '--bin-dir must be an absolute path' ;; esac
  [ "$(uname -s)" = Linux ] || fail 'This installer supports Linux. See https://debark.dev/download for other platforms.'
  case "$(uname -m)" in
    x86_64|amd64) arch=amd64 ;;
    aarch64|arm64) arch=arm64 ;;
    *) fail 'Supported Linux architectures are amd64 and arm64.' ;;
  esac
  for command in curl sha256sum tar awk mktemp install; do
    command -v "$command" >/dev/null 2>&1 || fail "Required command missing: $command"
  done
  if [ "$version" = latest ]; then
    resolved=$(curl -fsSL --proto '=https' --proto-redir '=https' --tlsv1.2 \
      --connect-timeout 15 --max-time 60 -o /dev/null -w '%{url_effective}' "$repo/releases/latest") \
      || fail 'Could not find the latest release. Retry or use --version vX.Y.Z.'
    case "$resolved" in "$repo/releases/tag/"*) version=${resolved##*/} ;;
      *) fail 'Unexpected release redirect.' ;; esac
  fi
  version=${version#v}
  printf '%s\n' "$version" | awk '/^[0-9]+\.[0-9]+\.[0-9]+$/ { ok=1 } END { exit !ok }' \
    || fail 'Use a stable release version such as v0.1.1.'
  archive="debark_${version}_linux_${arch}.tar.gz"
  base="$repo/releases/download/v$version"
  tmp=$(mktemp -d) || fail 'Could not create a temporary directory.'
  printf 'Downloading Debark v%s for Linux %s...\n' "$version" "$arch"
  for file in "$archive" debark_checksums.txt; do
    curl -fsSL --proto '=https' --proto-redir '=https' --tlsv1.2 \
      --connect-timeout 15 --max-time 300 --retry 2 "$base/$file" -o "$tmp/$file" \
      || fail "Download failed: $file. Nothing was installed."
  done
  # Require exactly one checksum for this archive; never accept an empty match.
  expected=$(awk -v name="$archive" '$2 == name { count++; hash=$1 }
    END { if (count != 1 || length(hash) != 64 || hash ~ /[^a-f0-9]/) exit 1; print hash }' \
    "$tmp/debark_checksums.txt") || fail 'Missing or invalid archive checksum. Nothing was installed.'
  (cd "$tmp" && printf '%s  %s\n' "$expected" "$archive" | sha256sum -c -) \
    || fail 'SHA-256 verification failed. Nothing was installed.'
  # Extract only the executable, never arbitrary archive paths.
  tar -xzf "$tmp/$archive" -C "$tmp" -- debark || fail 'Archive does not contain debark.'
  [ -f "$tmp/debark" ] && [ ! -L "$tmp/debark" ] || fail 'Expected a regular executable file.'
  mkdir -p -- "$bin_dir" || fail "Cannot create $bin_dir. Choose a writable --bin-dir."
  [ ! -d "$bin_dir/debark" ] || fail "$bin_dir/debark is a directory."
  staged=$(mktemp "$bin_dir/.debark.XXXXXX") || fail "Cannot write to $bin_dir."
  install -m 755 -- "$tmp/debark" "$staged"
  mv -f -- "$staged" "$bin_dir/debark"
  staged=''
  printf 'Installed Debark v%s at %s/debark\n' "$version" "$bin_dir"
  case ":${PATH:-}:" in
    *":$bin_dir:"*) printf '%s\n' 'Run: debark version' ;;
    *) printf '%s\n' 'Add the installation directory to PATH in your shell profile.'
       printf 'For the default directory, run: export PATH="$HOME/.local/bin:$PATH"\n' ;;
  esac
}

# When piped to sh, read the complete function before performing any installation.
main "$@"