#!/bin/sh
# Public Go entrypoint. No host changes occur until the immutable installer verifies.
set -eu
die() { printf '%s\n' "GameRail install failed: $*" >&2; exit 1; }
sha256_file() { if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'; else shasum -a 256 "$1" | awk '{print $1}'; fi; }
resolve_public_release() {
  # The website is the independent authenticated channel. The artifact host
  # cannot choose either root, and redirects cannot change the release namespace.
  announcement="$(curl -fsSL --connect-timeout 10 --max-time 60 --max-filesize 1024 --proto '=https' --proto-redir '=https' https://dashboard.gamerail.app/releases/current)" || die "cannot load the accepted hosting release"
  [ "$(printf '%s\n' "$announcement" | wc -l | tr -d ' ')" -eq 4 ] || die "invalid release announcement"
  tag="$(printf '%s\n' "$announcement" | sed -n 's/^release //p')"
  release_source="$(printf '%s\n' "$announcement" | sed -n 's/^source //p')"
  GAMERAIL_V2_RELEASE_SHA256SUMS_SHA256="$(printf '%s\n' "$announcement" | sed -n 's/^checksums //p')"
  GAMERAIL_V2_OFFICIAL_CATALOG_TRUST_SHA256="$(printf '%s\n' "$announcement" | sed -n 's/^trust //p')"
  printf '%s\n' "$tag" | grep -Eq '^v([2-9]|[1-9][0-9]+)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$' || die "invalid announced Go release"
  printf '%s\n' "$release_source" | grep -Eq '^[0-9a-f]{40}$' || die "invalid announced source"
  for pin in "$GAMERAIL_V2_RELEASE_SHA256SUMS_SHA256" "$GAMERAIL_V2_OFFICIAL_CATALOG_TRUST_SHA256"; do
    [ "${#pin}" -eq 64 ] && printf '%s\n' "$pin" | grep -Eq '^[0-9a-f]{64}$' || die "invalid independent release pin"
  done
  GAMERAIL_V2_CANDIDATE_BASE_URL="https://github.com/Logan9312/GameRail-releases/releases/download/$tag"
  GAMERAIL_V2_RELEASE_SOURCE_REVISION="$release_source"
  export GAMERAIL_V2_CANDIDATE_BASE_URL GAMERAIL_V2_RELEASE_SHA256SUMS_SHA256 GAMERAIL_V2_OFFICIAL_CATALOG_TRUST_SHA256 GAMERAIL_V2_RELEASE_SOURCE_REVISION
}
command -v curl >/dev/null 2>&1 || die "curl is required"
command -v sha256sum >/dev/null 2>&1 || command -v shasum >/dev/null 2>&1 || die "SHA-256 verification is required"
resolve_public_release
export GAMERAIL_V2_CANDIDATE_BASE_URL
GAMERAIL_V2_RELEASE_CHANNEL=stable
export GAMERAIL_V2_RELEASE_CHANNEL
work="$(mktemp -d)"
cleanup() { rm -f "$work/SHA256SUMS" "$work/install-candidate.sh"; rmdir "$work"; }
trap cleanup EXIT
trap 'exit 1' HUP INT TERM
for asset in SHA256SUMS install-candidate.sh; do
  curl -fsSL --connect-timeout 10 --max-time 120 --proto '=https' --proto-redir '=https' "$GAMERAIL_V2_CANDIDATE_BASE_URL/$asset" -o "$work/$asset" || die "download $asset"
  if [ "$asset" = SHA256SUMS ]; then
    [ "$(sha256_file "$work/SHA256SUMS")" = "$GAMERAIL_V2_RELEASE_SHA256SUMS_SHA256" ] || die "release checksum pin mismatch"
  fi
done
expected="$(awk '$2 == "install-candidate.sh" {print $1}' "$work/SHA256SUMS")"
[ -n "$expected" ] && [ "$(sha256_file "$work/install-candidate.sh")" = "$expected" ] || die "installer checksum mismatch"
/bin/sh "$work/install-candidate.sh"