#!/bin/sh
# AERIS OS installer for Linux x86_64 — E:MERGENCE LLC
# https://www.emergencerising.com/aerisOS  ·  agent runbook: https://www.emergencerising.com/aerisOS/install.md
#
# Generated by scripts/aeris-front-door.py from the published channel manifest. Do not edit by hand.
#
#   curl -fsSL https://www.emergencerising.com/aerisOS/install.sh | sh
#   curl -fsSL https://www.emergencerising.com/aerisOS/install.sh | sh -s -- [options]
#
# Options:
#   --deb             install the .deb with apt-get (default when apt-get and dpkg exist)
#   --appimage        install the AppImage for the current user (default otherwise)
#   --download-only   download and verify only; print the install command
#   --dir DIR         where --download-only saves the file (default: current directory)
#   --dry-run         show what would happen; download only the checksum list
#   -h, --help        this help
#
# Nothing is installed unless its sha256 matches the published SHA256SUMS.
# Exit codes: 0 ok, 1 error, 2 usage, 3 unsupported system, 4 download failed,
#             5 checksum mismatch, 6 install failed or needs root.
set -eu

AERIS_BASE_URL="${AERIS_BASE_URL:-https://www.emergencerising.com}"
CHANNEL_URL="$AERIS_BASE_URL/aeris-os-downloads/linux"
SUMS_URL="$AERIS_BASE_URL/aerisOS/linux/SHA256SUMS"
PRICING_URL="$AERIS_BASE_URL/pricing"
PUBLISHED_VERSION="0.2.50"
MIN_GLIBC="2.35"

say()  { printf 'aeris-install: %s\n' "$*"; }
warn() { printf 'aeris-install: warning: %s\n' "$*" >&2; }
die()  { code="$1"; shift; printf 'aeris-install: error: %s\n' "$*" >&2; exit "$code"; }

usage() {
    cat <<'USAGE'
AERIS OS installer for Linux x86_64 (E:MERGENCE LLC)

  curl -fsSL https://www.emergencerising.com/aerisOS/install.sh | sh -s -- [options]

  --deb             install the .deb with apt-get (default when apt-get and dpkg exist)
  --appimage        install the AppImage for the current user (default otherwise)
  --download-only   download and verify only; print the install command
  --dir DIR         where --download-only saves the file (default: current directory)
  --dry-run         show what would happen; download only the checksum list
  -h, --help        this help

Runbook for agents: https://www.emergencerising.com/aerisOS/install.md
USAGE
}

fetch() { # fetch URL OUTFILE
    if command -v curl >/dev/null 2>&1; then
        curl -fL --proto '=https' --tlsv1.2 --retry 3 --connect-timeout 20 -sS -o "$2" "$1"
    elif command -v wget >/dev/null 2>&1; then
        wget -q --https-only -O "$2" "$1"
    else
        die 4 "neither curl nor wget is installed"
    fi
}

sha256_of() {
    if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
    elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | awk '{print $1}'
    else die 1 "no sha256sum or shasum found; cannot verify the download"
    fi
}

version_ge() { # version_ge A B  ->  A >= B (major.minor)
    awk -v a="$1" -v b="$2" 'BEGIN { split(a, x, "."); split(b, y, ".");
        if (x[1] + 0 > y[1] + 0 || (x[1] + 0 == y[1] + 0 && x[2] + 0 >= y[2] + 0)) exit 0; exit 1 }'
}

glibc_version() {
    v=$(getconf GNU_LIBC_VERSION 2>/dev/null | awk '{print $2}') || v=""
    if [ -z "$v" ]; then
        v=$(ldd --version 2>&1 | head -n 1 | grep -o '[0-9][0-9]*\.[0-9][0-9]*' | tail -n 1) || v=""
    fi
    printf '%s' "$v"
}

main() {
    mode=""; download_only=0; dry_run=0; out_dir="."
    while [ $# -gt 0 ]; do
        case "$1" in
            --deb) mode=deb ;;
            --appimage) mode=appimage ;;
            --download-only) download_only=1 ;;
            --dry-run) dry_run=1 ;;
            --dir) [ $# -ge 2 ] || die 2 "--dir needs a directory"; out_dir="$2"; shift ;;
            -h|--help) usage; exit 0 ;;
            *) die 2 "unknown option: $1 (try --help)" ;;
        esac
        shift
    done

    say "AERIS OS by E:MERGENCE — Linux installer (published version $PUBLISHED_VERSION)"

    [ "$(uname -s)" = "Linux" ] || die 3 "this installer is for Linux. Windows: irm $AERIS_BASE_URL/aerisOS/install.ps1 | iex. macOS: not available yet."
    arch=$(uname -m)
    case "$arch" in
        x86_64|amd64) ;;
        *) die 3 "AERIS OS needs an x86_64 CPU; this machine is $arch" ;;
    esac
    glibc=$(glibc_version)
    [ -n "$glibc" ] || die 3 "could not find glibc (musl systems such as Alpine are not supported)"
    version_ge "$glibc" "$MIN_GLIBC" || die 3 "glibc $glibc is too old; AERIS OS needs $MIN_GLIBC or newer (Ubuntu 22.04+, Debian 12+)"
    say "system: Linux $arch, glibc $glibc (ok)"

    if [ -z "$mode" ]; then
        if command -v apt-get >/dev/null 2>&1 && command -v dpkg >/dev/null 2>&1; then mode=deb; else mode=appimage; fi
    fi
    case "$mode" in
        deb) pattern='AERIS-OS-[0-9][0-9A-Za-z.+~-]*-amd64\.deb'; stable='AERIS-OS-amd64.deb' ;;
        appimage) pattern='AERIS-OS-[0-9][0-9A-Za-z.+~-]*-x86_64\.AppImage'; stable='AERIS-OS-x86_64.AppImage' ;;
    esac
    say "package: $mode"

    sudo_cmd=""
    if [ "$mode" = deb ] && [ "$download_only" = 0 ]; then
        if [ "$(id -u)" = 0 ]; then
            sudo_cmd=""
        elif command -v sudo >/dev/null 2>&1; then
            sudo_cmd="sudo"
            if ! sudo -n true 2>/dev/null && ! [ -r /dev/tty ]; then
                [ "$dry_run" = 1 ] || die 6 "installing the .deb needs root and sudo would ask for a password with no terminal. Run: curl -fsSL $AERIS_BASE_URL/aerisOS/install.sh | sudo sh   (or per-user: ... | sh -s -- --appimage)"
            fi
        else
            [ "$dry_run" = 1 ] || die 6 "installing the .deb needs root and sudo is not installed. Run this as root, or install per-user: curl -fsSL $AERIS_BASE_URL/aerisOS/install.sh | sh -s -- --appimage"
        fi
    fi

    tmp=$(mktemp -d "${TMPDIR:-/tmp}/aeris-os-install.XXXXXX") || die 1 "could not create a temporary directory"
    trap 'rm -rf "$tmp"' EXIT INT TERM
    chmod 755 "$tmp"

    say "checksums: $SUMS_URL"
    fetch "$SUMS_URL" "$tmp/SHA256SUMS" || die 4 "could not download $SUMS_URL"
    line=$(grep -E "^[0-9a-f]{64}  $pattern\$" "$tmp/SHA256SUMS" | head -n 1) || line=""
    [ -n "$line" ] || line=$(grep -E "^[0-9a-f]{64}  $stable\$" "$tmp/SHA256SUMS" | head -n 1) || line=""
    [ -n "$line" ] || die 4 "SHA256SUMS lists no $mode package"
    expected=$(printf '%s' "$line" | awk '{print $1}')
    file=$(printf '%s' "$line" | awk '{print $2}')
    url="$CHANNEL_URL/$file"

    if [ "$dry_run" = 1 ]; then
        say "dry run: would download $url"
        say "dry run: would verify sha256 $expected"
        if [ "$download_only" = 1 ]; then say "dry run: would save it to $out_dir/$file"
        elif [ "$mode" = deb ]; then say "dry run: would run: ${sudo_cmd:+$sudo_cmd }apt-get install -y ./$file"
        else say "dry run: would install to ${XDG_BIN_HOME:-$HOME/.local/bin}/aeris-os"
        fi
        say "dry run: nothing was downloaded or installed"
        exit 0
    fi

    say "downloading $url"
    if ! fetch "$url" "$tmp/$file"; then
        warn "$file is not available (a newer release may be publishing); trying $stable"
        sline=$(grep -E "^[0-9a-f]{64}  $stable\$" "$tmp/SHA256SUMS" | head -n 1) || sline=""
        [ -n "$sline" ] || die 4 "could not download $url"
        expected=$(printf '%s' "$sline" | awk '{print $1}')
        file="$stable"; url="$CHANNEL_URL/$file"
        fetch "$url" "$tmp/$file" || die 4 "could not download $url"
    fi
    actual=$(sha256_of "$tmp/$file")
    if [ "$actual" != "$expected" ]; then
        die 5 "sha256 mismatch for $file: expected $expected, got $actual. Nothing was installed. If a release is in progress, wait a few minutes and try again."
    fi
    say "verified sha256 $actual"
    chmod 644 "$tmp/$file"

    if [ "$download_only" = 1 ]; then
        mkdir -p "$out_dir"
        cp "$tmp/$file" "$out_dir/$file"
        say "saved $out_dir/$file (verified)"
        if [ "$mode" = deb ]; then say "install with: sudo apt-get install -y ./$file"
        else say "run with: chmod +x $file && ./$file"
        fi
        exit 0
    fi

    if [ "$mode" = deb ]; then
        say "installing with apt-get (this also installs the dependencies)"
        if ! $sudo_cmd env DEBIAN_FRONTEND=noninteractive apt-get install -y "$tmp/$file" </dev/null; then
            say "refreshing package lists and trying again"
            $sudo_cmd env DEBIAN_FRONTEND=noninteractive apt-get update </dev/null || true
            $sudo_cmd env DEBIAN_FRONTEND=noninteractive apt-get install -y "$tmp/$file" </dev/null \
                || die 6 "apt-get could not install $file"
        fi
        installed=$(dpkg-query -W -f='${Version}' aeris-os 2>/dev/null) || installed=""
        [ -n "$installed" ] || die 6 "the aeris-os package is not registered after install"
        say "installed aeris-os $installed (app: /usr/bin/aeris-os)"
    else
        bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
        app_dir="${XDG_DATA_HOME:-$HOME/.local/share}/applications"
        mkdir -p "$bin_dir" "$app_dir"
        cp "$tmp/$file" "$bin_dir/aeris-os.new"
        chmod 755 "$bin_dir/aeris-os.new"
        mv -f "$bin_dir/aeris-os.new" "$bin_dir/aeris-os"
        cat > "$app_dir/aeris-os.desktop" <<DESKTOP
[Desktop Entry]
Type=Application
Name=AERIS OS
Comment=E:MERGENCE desktop — connects your mobile apps to your PC
Exec=$bin_dir/aeris-os
Terminal=false
Categories=Utility;
DESKTOP
        installed=$(printf '%s' "$file" | sed -n 's/^AERIS-OS-\(.*\)-x86_64\.AppImage$/\1/p')
        say "installed the AppImage ${installed:+$installed }at $bin_dir/aeris-os (menu entry: AERIS OS)"
        if ! (ldconfig -p 2>/dev/null | grep -q 'libfuse\.so\.2'); then
            warn "FUSE 2 was not found. Install libfuse2 (Ubuntu 24.04: libfuse2t64), or start with: $bin_dir/aeris-os --appimage-extract-and-run"
        fi
        case ":$PATH:" in *":$bin_dir:"*) ;; *) warn "$bin_dir is not on PATH; start it from the menu or with $bin_dir/aeris-os" ;; esac
    fi

    cat <<DONE

AERIS OS is installed.

NEXT STEP — hand this to the person (an agent cannot do it):
  Open AERIS OS (menu entry "AERIS OS", or run: aeris-os) and sign in with an E:MERGENCE account.
  Sign-in needs a paid account: \$19.99/month includes AERIS OS; the Free plan covers the mobile apps.
  On Linux, sign-in is saved in the desktop keyring (GNOME Keyring or KWallet).
  Plans: $PRICING_URL
DONE
}

main "$@"