#!/usr/bin/env sh
# Skeg installer —  curl -fsSL https://skeg.dev/install.sh | sh
# Env: SKEG_VERSION (default latest) · SKEG_DOWNLOAD_BASE · SKEG_INSTALL_DIR
#      SKEG_SHA256 (pin one build) · SKEG_SKIP_VERIFY=1 (not recommended)
# Integrity: the downloaded binary is checked against the release's signed SHA256SUMS by default.
set -e
VERSION="${SKEG_VERSION:-latest}"
BASE="${SKEG_DOWNLOAD_BASE:-https://github.com/skeg-dev/skeg/releases}"
OS=$(uname -s | tr '[:upper:]' '[:lower:]'); ARCH=$(uname -m)
case "$ARCH" in x86_64|amd64) ARCH=amd64;; arm64|aarch64) ARCH=arm64;; *) echo "skeg: unsupported architecture $ARCH"; exit 1;; esac
case "$OS" in
  linux|darwin) ;;
  msys*|mingw*|cygwin*) echo "skeg: on Windows run  irm https://skeg.dev/install.ps1 | iex  (or use scoop/winget)"; exit 1;;
  *) echo "skeg: unsupported OS $OS"; exit 1;;
esac
if [ "$VERSION" = "latest" ]; then URL="$BASE/latest/download/skeg-$OS-$ARCH"; else URL="$BASE/download/$VERSION/skeg-$OS-$ARCH"; fi
DIR="${SKEG_INSTALL_DIR:-}"
if [ -z "$DIR" ]; then
  if [ -w /usr/local/bin ] 2>/dev/null; then DIR=/usr/local/bin; else DIR="$HOME/.local/bin"; mkdir -p "$DIR"; fi
fi
TMP=$(mktemp); trap 'rm -f "$TMP"' EXIT
printf 'skeg: downloading %s\n' "$URL"
if command -v curl >/dev/null 2>&1; then
  curl -fsSL --proto '=https' --tlsv1.2 "$URL" -o "$TMP" || { echo "skeg: download failed. If the release is not published yet, request access at https://skeg.dev/feedback or set SKEG_DOWNLOAD_BASE to a location that serves the binary."; exit 1; }
else
  wget -qO "$TMP" "$URL" || { echo "skeg: download failed (wget)"; exit 1; }
fi
[ -s "$TMP" ] || { echo "skeg: downloaded file is empty"; exit 1; }

# Integrity is verified by default. Every release publishes SHA256SUMS (signed with Sigstore).
# Set SKEG_SKIP_VERIFY=1 only if you have a reason; set SKEG_SHA256 to pin one exact build.
NAME="skeg-$OS-$ARCH"
verify_sha() {
  have=$(sha256sum "$TMP" | cut -d' ' -f1)
  if [ -n "${SKEG_SHA256:-}" ]; then
    [ "$have" = "$SKEG_SHA256" ] || { echo "skeg: checksum mismatch — refusing to install"; exit 1; }
    echo "skeg: checksum verified (pinned)"; return 0
  fi
  [ "${SKEG_SKIP_VERIFY:-0}" = "1" ] && { echo "skeg: WARNING integrity check skipped at your request"; return 0; }
  SUMS=$(mktemp)
  if [ "$VERSION" = "latest" ]; then SUMS_URL="$BASE/latest/download/SHA256SUMS"; else SUMS_URL="$BASE/download/$VERSION/SHA256SUMS"; fi
  if command -v curl >/dev/null 2>&1; then curl -fsSL --proto '=https' --tlsv1.2 "$SUMS_URL" -o "$SUMS" 2>/dev/null || true
  else wget -qO "$SUMS" "$SUMS_URL" 2>/dev/null || true; fi
  if [ -s "$SUMS" ]; then
    want=$(awk -v n="$NAME" '$2 ~ n {print $1}' "$SUMS" | head -1)
    rm -f "$SUMS"
    [ -n "$want" ] || { echo "skeg: $NAME is not listed in SHA256SUMS — refusing to install"; exit 1; }
    [ "$have" = "$want" ] || { echo "skeg: checksum mismatch against the published SHA256SUMS — refusing to install"; exit 1; }
    echo "skeg: checksum verified against the published SHA256SUMS"
  else
    rm -f "$SUMS"
    echo "skeg: could not fetch SHA256SUMS — refusing to install unattested binary."
    echo "      Request access at https://skeg.dev/feedback, pin a build with SKEG_SHA256=<sha256>,"
    echo "      or set SKEG_SKIP_VERIFY=1 if you accept the risk."
    exit 1
  fi
  if command -v cosign >/dev/null 2>&1; then
    echo "skeg: cosign found — verify the signature and provenance for full assurance:"
    echo "      cosign verify-blob SHA256SUMS --signature SHA256SUMS.sig --certificate SHA256SUMS.pem \\"
    echo "        --certificate-identity-regexp 'https://github.com/skeg-dev/skeg/' \\"
    echo "        --certificate-oidc-issuer https://token.actions.githubusercontent.com"
  fi
}
verify_sha
chmod +x "$TMP"
if ! mv "$TMP" "$DIR/skeg" 2>/dev/null; then
  echo "skeg: cannot write to $DIR — retrying with sudo"
  sudo mv "$TMP" "$DIR/skeg"
fi
trap - EXIT
printf 'skeg: installed %s/skeg\n' "$DIR"
"$DIR/skeg" version
case ":$PATH:" in *":$DIR:"*) ;; *) printf 'skeg: add it to your PATH —  export PATH="%s:$PATH"\n' "$DIR";; esac
cat <<'NEXT'

next:
  cd <your-repo> && skeg try     # adds the template, runs a security baseline (undo with: skeg undo)
  skeg                           # where you are and the one next step
  skeg glossary <term>           # any word, explained
  skeg feedback bug "..."        # tell us what to fix
NEXT