#!/bin/sh
# Public Go entrypoint. No host changes occur until the immutable installer verifies.
set -eu
die() { printf '%s\n' "GameRail install failed: $*" >&2; exit 1; }
sha256_file() { if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'; else shasum -a 256 "$1" | awk '{print $1}'; fi; }
resolve_public_release() {
  releases_root=https://github.com/Logan9312/GameRail-releases/releases
  resolved="$(curl -fsSLI --connect-timeout 10 --max-time 60 --proto '=https' --proto-redir '=https' -o /dev/null -w '%{url_effective}' "$releases_root/latest")" || die "cannot resolve the public Go release"
  case "$resolved" in "$releases_root/tag/"*) tag="${resolved#"$releases_root/tag/"}" ;; *) die "unexpected public release redirect" ;; esac
  printf '%s\n' "$tag" | grep -Eq '^v([2-9]|[1-9][0-9]+)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$' || die "a stable Go proxy release is not published; no changes made"
  printf '%s\n' "$releases_root/download/$tag"
}
command -v curl >/dev/null 2>&1 || die "curl is required"
command -v sha256sum >/dev/null 2>&1 || command -v shasum >/dev/null 2>&1 || die "SHA-256 verification is required"
GAMERAIL_V2_CANDIDATE_BASE_URL="$(resolve_public_release)"
export GAMERAIL_V2_CANDIDATE_BASE_URL
GAMERAIL_V2_RELEASE_CHANNEL=stable
export GAMERAIL_V2_RELEASE_CHANNEL
work="$(mktemp -d)"
cleanup() { rm -f "$work/SHA256SUMS" "$work/install-candidate.sh"; rmdir "$work"; }
trap cleanup EXIT
trap 'exit 1' HUP INT TERM
for asset in SHA256SUMS install-candidate.sh; do
  curl -fsSL --connect-timeout 10 --max-time 120 --proto '=https' --proto-redir '=https' "$GAMERAIL_V2_CANDIDATE_BASE_URL/$asset" -o "$work/$asset" || die "download $asset"
done
expected="$(awk '$2 == "install-candidate.sh" {print $1}' "$work/SHA256SUMS")"
[ -n "$expected" ] && [ "$(sha256_file "$work/install-candidate.sh")" = "$expected" ] || die "installer checksum mismatch"
/bin/sh "$work/install-candidate.sh"