#!/usr/bin/env bash
# osdl installer — served at https://os.webservice.digital/cli
# Safe defaults: install to ~/.local/bin, verify download, no root required.
set -euo pipefail

CHANNEL="os.webservice.digital"
BASE_URL="${OSDL_BASE_URL:-https://os.webservice.digital}"
OSDL_SRC_URL="${OSDL_SRC_URL:-$BASE_URL/cli/osdl}"
INSTALL_DIR="${OSDL_INSTALL_DIR:-$HOME/.local/bin}"
BIN_NAME="osdl"

printf '==> %s — osdl CLI installer\n' "$CHANNEL"
printf '    source: %s\n' "$OSDL_SRC_URL"
printf '    target: %s/%s\n' "$INSTALL_DIR" "$BIN_NAME"

if ! command -v curl >/dev/null 2>&1; then
  printf 'error: curl is required\n' >&2
  exit 1
fi

tmpdir=$(mktemp -d)
trap 'rm -rf "$tmpdir"' EXIT

printf '==> fetching osdl\n'
curl -fsSL -A "osdl-installer/1.0 (+$CHANNEL)" "$OSDL_SRC_URL" -o "$tmpdir/osdl"

# Basic sanity checks before install
if ! head -n1 "$tmpdir/osdl" | grep -qE '^#!.*bash'; then
  printf 'error: downloaded file does not look like a bash script\n' >&2
  exit 1
fi
if ! grep -q 'osdl — OS Distribution Mirror Gateway CLI' "$tmpdir/osdl"; then
  printf 'error: downloaded file failed identity check\n' >&2
  exit 1
fi

mkdir -p "$INSTALL_DIR"
install -m 0755 "$tmpdir/osdl" "$INSTALL_DIR/$BIN_NAME"

printf '==> installed %s/%s\n' "$INSTALL_DIR" "$BIN_NAME"

case ":$PATH:" in
  *":$INSTALL_DIR:"*) ;;
  *)
    printf '\nNOTE: %s is not on your PATH.\n' "$INSTALL_DIR"
    printf 'Add this to your shell profile:\n'
    printf '  export PATH="%s:$PATH"\n\n' "$INSTALL_DIR"
    ;;
esac

printf '==> quick check\n'
if "$INSTALL_DIR/$BIN_NAME" version >/dev/null 2>&1; then
  "$INSTALL_DIR/$BIN_NAME" version
else
  printf 'warning: could not execute installed binary\n' >&2
fi

cat <<EOF

Next steps:
  $BIN_NAME list
  $BIN_NAME info debian
  $BIN_NAME get ubuntu --print
  $BIN_NAME get rocky --verify

Metadata API: $BASE_URL/api/v1/latest.json

SECURITY: Inspect the installer and tool before use in sensitive environments:
  curl -fsSL $BASE_URL/cli
  curl -fsSL $BASE_URL/cli/osdl

Hash verification confirms bit-identity only. Always GPG-verify official
checksum files from the distribution project for production media.

EOF