#!/usr/bin/env bash
# osdl installer (Linux/macOS) — served at https://os.webservice.digital/cli
# Installs: osdl + osdl-push (air-gap corridor helper)
# Safe defaults: ~/.local/bin, no root required.
set -euo pipefail

CHANNEL="os.webservice.digital"
BASE_URL="${OSDL_BASE_URL:-https://os.webservice.digital}"
INSTALL_DIR="${OSDL_INSTALL_DIR:-$HOME/.local/bin}"
UA="osdl-installer/1.2.0 (+$CHANNEL)"

printf '==> %s — osdl CLI installer (bash)\n' "$CHANNEL"
printf '    target: %s\n' "$INSTALL_DIR"

if ! command -v curl >/dev/null 2>&1; then
  printf 'error: curl is required\n' >&2
  exit 1
fi

tmpdir=$(mktemp -d)
trap 'rm -rf "$tmpdir"' EXIT

fetch_check() {
  local url="$1" dest="$2" marker="$3"
  curl -fsSL -A "$UA" "$url" -o "$dest"
  if ! head -n1 "$dest" | grep -qE '^#!.*bash'; then
    printf 'error: %s does not look like a bash script\n' "$url" >&2
    exit 1
  fi
  if ! grep -q "$marker" "$dest"; then
    printf 'error: %s failed identity check\n' "$url" >&2
    exit 1
  fi
}

printf '==> fetching osdl\n'
fetch_check "$BASE_URL/cli/osdl" "$tmpdir/osdl" 'osdl — OS Distribution Mirror Gateway CLI'

printf '==> fetching osdl-push (air-gap helper)\n'
fetch_check "$BASE_URL/cli/osdl-push" "$tmpdir/osdl-push" 'osdl-push — Air-gap ISO transfer'

mkdir -p "$INSTALL_DIR"
install -m 0755 "$tmpdir/osdl" "$INSTALL_DIR/osdl"
install -m 0755 "$tmpdir/osdl-push" "$INSTALL_DIR/osdl-push"

printf '==> installed:\n'
printf '    %s/osdl\n' "$INSTALL_DIR"
printf '    %s/osdl-push\n' "$INSTALL_DIR"

case ":$PATH:" in
  *":$INSTALL_DIR:"*) ;;
  *)
    printf '\nNOTE: %s is not on your PATH.\n' "$INSTALL_DIR"
    printf 'Add this to your shell profile:\n'
    printf '  export PATH="%s:$PATH"\n\n' "$INSTALL_DIR"
    ;;
esac

printf '==> quick check\n'
if "$INSTALL_DIR/osdl" version >/dev/null 2>&1; then
  "$INSTALL_DIR/osdl" version
else
  printf 'warning: could not execute installed binary\n' >&2
fi

cat <<EOF

Next steps:
  osdl list
  osdl info debian
  osdl get ubuntu --print
  osdl get rocky --verify
  osdl push --host ops@10.10.50.20 --iso ./rocky.iso --distro rocky

Windows PowerShell:
  irm https://os.webservice.digital/cli/install.ps1 | iex

Metadata API: $BASE_URL/api/v1/latest.json

SECURITY: Inspect installers and tools before use in sensitive environments:
  curl -fsSL $BASE_URL/cli/
  curl -fsSL $BASE_URL/cli/osdl
  curl -fsSL $BASE_URL/cli/osdl-push
  curl -fsSL $BASE_URL/cli/osdl.ps1

Hash verification confirms bit-identity only. Always GPG-verify official
checksum files from the distribution project for production media.

EOF