#!/bin/sh
# Shinux Repository -- one-shot repository installer.
#   curl -fsSL https://abdallah-shehawey.github.io/shinux-repo/install.sh | sudo sh
set -eu

BASE_URL="https://abdallah-shehawey.github.io/shinux-repo"
REPO_ID="shinux"
RELEASE_RPM_URL="https://github.com/abdallah-shehawey/shinux-repo/releases/download/pool/shinux-release-1.2-1.noarch.rpm"
# Where the packages themselves are. Metadata, keys and signatures still come
# from Pages; only the download of a package moves, because that is the one
# GitHub counts.
ASSET_BASE="https://github.com/abdallah-shehawey/shinux-repo/releases/download/pool"

if [ "$(id -u)" -ne 0 ]; then
  echo "This installer writes to /etc, run it with sudo." >&2
  exit 1
fi

fetch() {
  if command -v curl >/dev/null 2>&1; then curl -fsSL "$1" -o "$2"
  elif command -v wget >/dev/null 2>&1; then wget -qO "$2" "$1"
  else echo "need curl or wget" >&2; exit 1; fi
}

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

if command -v dnf >/dev/null 2>&1 || command -v yum >/dev/null 2>&1; then
  pm="$(command -v dnf || command -v yum)"
  echo "==> rpm system detected, installing ${REPO_ID}-release"
  fetch "${BASE_URL}/RPM-GPG-KEY-${REPO_ID}" "$tmp/key" \
    || { echo "cannot reach ${BASE_URL}" >&2; exit 1; }
  rpm --import "$tmp/key"
  "$pm" install -y "${RELEASE_RPM_URL}"
  echo "==> done. try: sudo $pm install hello-${REPO_ID}"

elif command -v apt-get >/dev/null 2>&1; then
  echo "==> deb system detected, installing ${REPO_ID}-archive-keyring"
  install -d -m 0755 /etc/apt/keyrings
  fetch "${BASE_URL}/${REPO_ID}.gpg" "/etc/apt/keyrings/${REPO_ID}.gpg"
  chmod 0644 "/etc/apt/keyrings/${REPO_ID}.gpg"
  fetch "${BASE_URL}/${REPO_ID}.sources" "/etc/apt/sources.list.d/${REPO_ID}.sources"
  apt-get update
  # --force-confnew, because this script has just written that same sources
  # file by hand and the package ships it as a conffile. The two are generated
  # from one template and normally match byte for byte, so dpkg says nothing --
  # but if they ever drift, dpkg stops at an interactive conffile prompt, and
  # this script is run through a pipe with no stdin: "end of file on stdin at
  # conffile prompt", and the install fails having already added the repository.
  # The package's copy is the canonical one, so taking it is the right answer.
  DEBIAN_FRONTEND=noninteractive apt-get install -y \
    -o Dpkg::Options::=--force-confnew "${REPO_ID}-archive-keyring"
  echo "==> done. try: sudo apt install hello-${REPO_ID}"

elif command -v pacman >/dev/null 2>&1; then
  echo "==> Arch system detected, adding ${REPO_ID} pacman repository"
  fetch "${BASE_URL}/${REPO_ID}.gpg" "$tmp/${REPO_ID}.gpg" \
    || { echo "cannot reach ${BASE_URL}/${REPO_ID}.gpg" >&2; exit 1; }
  # `pacman-key --init`, not `install -d`. --lsign-key signs with pacman's own
  # local master key and fails with "There is no secret key available to sign
  # with" if that keyring has not been initialised -- and the `install -d -m
  # 0755` this replaces made it worse, because 0755 is exactly the mode gpg
  # refuses to use a home directory at. --init is idempotent and is what the
  # Arch documentation asks for before --add on any machine.
  pacman-key --init >/dev/null 2>&1
  pacman-key --add "$tmp/${REPO_ID}.gpg" >/dev/null
  pacman-key --lsign-key "$(gpg --show-keys --with-colons "$tmp/${REPO_ID}.gpg" | awk -F: '$1 == "fpr" { print $10; exit }')" >/dev/null
  # The release, not Pages: pacman asks for shinux.db and then for a bare
  # %FILENAME% off this one URL, and both are release assets, so the install is
  # a download GitHub counts. Rewritten on every run, which is how a machine
  # that added the repository before this moves over -- re-run install.sh.
  cat > "/etc/pacman.d/${REPO_ID}-mirrorlist" <<EOF_MIRROR
Server = ${ASSET_BASE}
EOF_MIRROR
  if ! grep -q '^\[${REPO_ID}\]$' /etc/pacman.conf; then
    cat >> /etc/pacman.conf <<EOF_REPO

[${REPO_ID}]
Include = /etc/pacman.d/${REPO_ID}-mirrorlist
SigLevel = Required DatabaseOptional
EOF_REPO
  fi
  pacman -Sy --noconfirm
  echo "==> done. try: sudo pacman -S hello-${REPO_ID}"

else
  echo "Unsupported system: no dnf, yum or apt-get found." >&2
  exit 1
fi