#!/bin/sh
# slowrock installer — https://www.googis.org/?page=slow-rock
#
#   wget -qO- https://www.googis.org/apt/install.sh | sudo sh
#
# What this does (and nothing else):
#   1. downloads the slowrock apt repository's public signing key and checks it
#      against the SHA-256 pinned below, refusing to continue on any mismatch;
#   2. installs it to /usr/share/keyrings/slowrock-archive-keyring.gpg and adds
#      /etc/apt/sources.list.d/slowrock.sources (the same entry the slowrock
#      .deb installs), so updates arrive through your normal system updater;
#   3. runs apt-get update and apt-get install slowrock.
# To undo: sudo apt purge slowrock (removes the source entry too).
#
# Signing key fingerprint: 95AB D1BD 7959 FCF7 90F4  CF6B CBA8 FAE3 C1FD D983
# This script is signed with that key: https://www.googis.org/apt/install.sh.asc
#
# Everything runs inside main(), called on the last line, so a download cut
# off part-way executes nothing.

set -eu

KEY_URL="https://www.googis.org/apt/slowrock-archive-keyring.gpg"
KEY_SHA256="1f0035122aa9e282d03afb251ee00fe0dd94aa742a1a643368ba25a985612d8f"
KEYRING="/usr/share/keyrings/slowrock-archive-keyring.gpg"
SOURCES="/etc/apt/sources.list.d/slowrock.sources"

die() { echo "slowrock installer: $*" >&2; exit 1; }

fetch() {   # fetch URL FILE — https only, fail on HTTP errors
    if command -v curl >/dev/null 2>&1; then
        curl --proto '=https' --tlsv1.2 -fsSL -o "$2" "$1"
    elif command -v wget >/dev/null 2>&1; then
        wget --https-only -q -O "$2" "$1"
    else
        die "needs curl or wget"
    fi
}

main() {
    [ "$(id -u)" -eq 0 ] || die "run it with sudo:  wget -qO- https://www.googis.org/apt/install.sh | sudo sh"
    if ! command -v apt-get >/dev/null 2>&1 || ! command -v dpkg >/dev/null 2>&1; then
        die "this installer is for Ubuntu, Linux Mint and other apt-based systems"
    fi
    [ "$(dpkg --print-architecture)" = "amd64" ] \
        || die "slowrock is only available for 64-bit PCs (amd64)"

    tmp="$(mktemp -d)"
    trap 'rm -rf "$tmp"' EXIT INT TERM

    echo "Downloading the slowrock repository key..."
    fetch "$KEY_URL" "$tmp/key.gpg"
    got="$(sha256sum "$tmp/key.gpg" | cut -d' ' -f1)"
    [ "$got" = "$KEY_SHA256" ] || die "repository key checksum mismatch — not installing (got $got)"
    install -D -m 0644 "$tmp/key.gpg" "$KEYRING"

    echo "Adding the googis.org software source..."
    cat > "$tmp/slowrock.sources" <<'EOF'
# slowrock updates from googis.org — installed by the slowrock package.
# To stop receiving updates, set "Enabled: no" (or remove slowrock).
Types: deb
URIs: https://www.googis.org/apt
Suites: stable
Components: main
Architectures: amd64
Signed-By: /usr/share/keyrings/slowrock-archive-keyring.gpg
EOF
    install -D -m 0644 "$tmp/slowrock.sources" "$SOURCES"

    echo "Installing slowrock..."
    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y slowrock

    echo
    echo "slowrock is installed. Start it from your applications menu, or run: slowrock"
    echo "Updates will arrive through your system updater."
}

main "$@"