#!/bin/sh
# vobuda installer.
#
# It downloads the signed package, checks its SHA-256 against the value baked in
# here, checks Apple's own signature on it, and installs it. Nothing else is
# written to your machine: no shell profile is edited, no launch agent is added,
# nothing is sent anywhere. Run the same line again to update.
#
# Read it before you run it. That is what a script piped into a shell owes you.
#   curl -fsSL https://vobuda.com/install.sh | sh

set -eu

VERSION="0.2.3"
PKG="vobuda-0.2.3-macos.pkg"
URL="https://vobuda.com/${PKG}"
SHA="ad246578ef8c7bc0fb477466c3a28ab1b46d6e5fc95e8b7e573a7d04c977f3d5"
MIN_MACOS="10.15"

say()  { printf '  %s\n' "$*"; }
die()  { printf '\n  %s\n\n' "$*" >&2; exit 1; }

printf '\n  vobuda %s\n\n' "$VERSION"

[ "$(uname -s)" = "Darwin" ] || die "vobuda is macOS only. This machine reports $(uname -s)."

os="$(sw_vers -productVersion 2>/dev/null || echo 0)"
lowest="$(printf '%s\n%s\n' "$MIN_MACOS" "$os" | sort -t. -k1,1n -k2,2n | head -1)"
[ "$lowest" = "$MIN_MACOS" ] || die "vobuda needs macOS ${MIN_MACOS} or newer. This machine is on ${os}."

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT INT TERM

say "Downloading ${PKG}"
curl -fSL --proto '=https' --tlsv1.2 -o "${tmp}/${PKG}" -- "$URL" \
  || die "Download failed. Take the package from https://vobuda.com/download/ instead."

say "Checking the checksum"
got="$(shasum -a 256 "${tmp}/${PKG}" | awk '{print $1}')"
[ "$got" = "$SHA" ] || die "Checksum does not match.
  expected ${SHA}
  got      ${got}
  Nothing was installed. Do not run that file."

say "Checking Apple's signature"
pkgutil --check-signature "${tmp}/${PKG}" >"${tmp}/sig" 2>&1 \
  || die "The package is not signed as expected. Nothing was installed."
grep -q "Developer ID Installer: Shifton Inc" "${tmp}/sig" \
  || die "The package is signed by somebody else. Nothing was installed."

say "Installing"
if installer -pkg "${tmp}/${PKG}" -target CurrentUserHomeDirectory >/dev/null 2>&1; then
  where="${HOME}/Applications/vobuda.app"
elif sudo -n true 2>/dev/null && sudo installer -pkg "${tmp}/${PKG}" -target / >/dev/null 2>&1; then
  where="/Applications/vobuda.app"
else
  say "This package installs into /Applications and macOS is asking for your password."
  sudo installer -pkg "${tmp}/${PKG}" -target / >/dev/null \
    || die "Install failed. Download the package and double-click it instead:
  https://vobuda.com/download/"
  where="/Applications/vobuda.app"
fi

printf '\n  Installed: %s\n' "$where"
printf '  Open it from Spotlight, or put the command line where your shell can find it:\n'
printf '    ln -s "%s/Contents/Resources/cli/vobuda" /usr/local/bin/vobuda\n' "$where"
printf '\n  The guide is inside the program: Help, then How to use vobuda.\n\n'