#!/bin/sh
# get.portainer.run — thin bootstrap for the portainer-run-installer binary.
#
# This script does exactly three things: detect OS/arch, download the
# matching pre-built binary (verifying its checksum), and exec it,
# forwarding any args given to this script (e.g. `sh -s -- --configure`).
# All real install logic lives in the downloaded binary — see
# cmd/portainer-run-installer and internal/ for the actual pipeline.
#
# Same shape as rustup/deno/k3s's own installers, and as kubesolo's own
# install.sh -> kubesoloctl relationship.

set -eu

CF_WORKER_BASE="https://get.portainer.run"
# Unpinned installs resolve to releases/latest/ on R2 — a prefix only ever
# updated by an explicit `release` promotion run (see PLA-930's Plan
# comment), never by an ordinary version cut. Rolling back a bad release
# means re-promoting an older, already-published version there — cheap,
# no rebuild — not reverting this script. Pin a specific version via the
# env var below for testing a particular release.
VERSION="${PORTAINER_RUN_INSTALLER_VERSION:-}"
# Dev/test override only — points the download at a different base (e.g. a
# dev/<branch> build) instead of the published release path.
BASE_URL_OVERRIDE="${PORTAINER_RUN_INSTALLER_BASE_URL:-}"

log() { printf '%s\n' "$*" >&2; }
die() { log "error: $*"; exit 1; }

need_cmd() {
  command -v "$1" >/dev/null 2>&1 || die "'$1' is required but not found on PATH"
}

need_cmd curl
need_cmd uname
need_cmd sha256sum

detect_os() {
  case "$(uname -s)" in
    Linux) echo "linux" ;;
    *) die "unsupported OS: $(uname -s) (Linux only for v1)" ;;
  esac
}

detect_arch() {
  case "$(uname -m)" in
    x86_64 | amd64) echo "amd64" ;;
    aarch64 | arm64) echo "arm64" ;;
    *) die "unsupported architecture: $(uname -m)" ;;
  esac
}

OS="$(detect_os)"
ARCH="$(detect_arch)"
ASSET="portainer-run-installer-${OS}-${ARCH}"
if [ -n "$VERSION" ]; then
  BASE_URL="${BASE_URL_OVERRIDE:-${CF_WORKER_BASE}/releases/${VERSION}}"
else
  BASE_URL="${BASE_URL_OVERRIDE:-${CF_WORKER_BASE}/releases/latest}"
  # Only releases/latest/ publishes a VERSION marker — a dev/test
  # BASE_URL_OVERRIDE doesn't, so this is purely cosmetic for the log
  # line below and never blocks the actual download either way.
  if [ -z "$BASE_URL_OVERRIDE" ]; then
    VERSION="$(curl -sfL "${BASE_URL}/VERSION" 2>/dev/null || true)"
  fi
  VERSION="${VERSION:-latest}"
fi

TMPDIR="$(mktemp -d)"
trap 'rm -rf "$TMPDIR"' EXIT

log "downloading portainer-run-installer ${VERSION} (${OS}/${ARCH})..."
curl -sfL "${BASE_URL}/${ASSET}" -o "${TMPDIR}/${ASSET}" \
  || die "failed to download ${BASE_URL}/${ASSET}"
curl -sfL "${BASE_URL}/checksums.txt" -o "${TMPDIR}/checksums.txt" \
  || die "failed to download checksums.txt"

EXPECTED="$(grep " ${ASSET}\$" "${TMPDIR}/checksums.txt" | awk '{print $1}')"
[ -n "$EXPECTED" ] || die "no checksum entry found for ${ASSET}"
ACTUAL="$(sha256sum "${TMPDIR}/${ASSET}" | awk '{print $1}')"
[ "$EXPECTED" = "$ACTUAL" ] || die "checksum mismatch for ${ASSET} (got $ACTUAL, want $EXPECTED)"

chmod +x "${TMPDIR}/${ASSET}"
exec "${TMPDIR}/${ASSET}" "$@"