#!/usr/bin/bash
# Install the checksum-pinned Rosenpass runtime required by WireShield.
set -euo pipefail

ROSENPASS_VERSION="0.2.3"
ROSENPASS_ARCHIVE="rosenpass-x86_64-linux-${ROSENPASS_VERSION}.tar"
ROSENPASS_URL="https://github.com/rosenpass/rosenpass/releases/download/v${ROSENPASS_VERSION}/${ROSENPASS_ARCHIVE}"
ROSENPASS_SHA256="53158a8c339e3be1a9520b91c33a9e83eab05ea49af346cdb7e6eec522f2318b"
INSTALL_PATH="${ROSENPASS_INSTALL_PATH:-/usr/libexec/wireshield/rosenpass}"

if [[ "$(uname -m)" != "x86_64" ]]; then
    echo "ERROR: WireShield Rosenpass ${ROSENPASS_VERSION} supports x86_64 Linux only." >&2
    exit 1
fi
if [[ -x "$INSTALL_PATH" ]] && [[ "$($INSTALL_PATH --version 2>/dev/null)" == "rosenpass ${ROSENPASS_VERSION}" ]]; then
    echo "[SUCCESS] Rosenpass ${ROSENPASS_VERSION} is already installed."
    exit 0
fi
for command in curl sha256sum tar install; do
    command -v "$command" >/dev/null 2>&1 || {
        echo "ERROR: $command is required to install Rosenpass." >&2
        exit 1
    }
done

tmp_dir=$(mktemp -d)
trap 'rm -rf "$tmp_dir"' EXIT
archive="$tmp_dir/$ROSENPASS_ARCHIVE"

echo "[*] Downloading Rosenpass ${ROSENPASS_VERSION}..."
curl -fL --retry 3 --proto '=https' --tlsv1.2 -o "$archive" "$ROSENPASS_URL"
printf '%s  %s\n' "$ROSENPASS_SHA256" "$archive" | sha256sum -c -
tar -xf "$archive" -C "$tmp_dir" bin/rosenpass
install -d -m 0755 "$(dirname "$INSTALL_PATH")"
install -m 0755 "$tmp_dir/bin/rosenpass" "$INSTALL_PATH"

[[ "$($INSTALL_PATH --version)" == "rosenpass ${ROSENPASS_VERSION}" ]] || {
    echo "ERROR: Rosenpass installation verification failed." >&2
    exit 1
}
echo "[SUCCESS] Rosenpass ${ROSENPASS_VERSION} installed at $INSTALL_PATH."
