set -eu

repository="purefunctor/purescript-iris"

binary="iris"

install_directory="${IRIS_INSTALL_DIR:-$HOME/.local/bin}"

version="${IRIS_VERSION:-latest}"

fail() {

printf 'error: %s\n' "$1" >&2

exit 1

}

command -v curl >/dev/null 2>&1 || fail "curl is required to install $binary"

command -v tar >/dev/null 2>&1 || fail "tar is required to install $binary"

case "$(uname -s):$(uname -m)" in

Linux:x86_64 | Linux:amd64)

target="x86_64-unknown-linux-musl"

;;

Linux:aarch64 | Linux:arm64)

target="aarch64-unknown-linux-musl"

;;

Darwin:x86_64 | Darwin:arm64)

target="universal-apple-darwin"

;;

*)

fail "unsupported platform: $(uname -s) $(uname -m)"

;;

if [ "$version" = "latest" ]; then

release_url=$(curl --proto '=https' --tlsv1.2 -LsSf -o /dev/null \

version=${release_url##*/}

case "$version" in

v0.0.*) fail "this installer requires v0.1.0 or later; use the installer from the requested release tag for v0.0.x" ;;

v[0-9]*) ;;

*) fail "invalid release version: $version" ;;

archive_name="$binary-$target.tar.gz"

archive_url="https://github.com/$repository/releases/download/$version/$archive_name"

temporary_directory=$(mktemp -d "${TMPDIR:-/tmp}/iris-install.XXXXXXXX")

trap 'rm -rf "$temporary_directory"' EXIT HUP INT TERM

archive="$temporary_directory/$archive_name"

printf 'Downloading %s %s for %s\n' "$binary" "$version" "$target"

curl --proto '=https' --tlsv1.2 -LsSf --retry 3 --output "$archive" "$archive_url"

if [ "${IRIS_SKIP_ATTESTATION:-}" = 1 ]; then

printf '%s\n' 'warning: GitHub release attestation verification skipped (IRIS_SKIP_ATTESTATION=1).' >&2

elif command -v gh >/dev/null 2>&1 && gh attestation verify --help >/dev/null 2>&1; then

printf 'Verifying GitHub release attestation\n'

gh attestation verify "$archive" --repo "$repository" >/dev/null || \

fail "GitHub release attestation verification failed"

printf '%s\n' \

'warning: A GitHub CLI with attestation support is not installed; release provenance was not verified.' \

'warning: Install or update gh from https://cli.github.com/ to verify future installations.' >&2

archive_directory="$binary-$target"

archive_binary="$archive_directory/$binary"

entry_count=$(tar -tzf "$archive" | grep -c "^$archive_binary$" || true)

[ "$entry_count" -eq 1 ] || fail "release archive does not contain exactly one $binary executable"

tar -xzf "$archive" -C "$temporary_directory" "$archive_binary"

extracted_binary="$temporary_directory/$archive_binary"

[ -f "$extracted_binary" ] && [ ! -L "$extracted_binary" ] || \

fail "release archive contains an invalid $binary executable"

mkdir -p "$install_directory"

destination="$install_directory/$binary"

[ ! -L "$destination" ] || fail "refusing to replace symbolic link: $destination"

installation_file=$(mktemp "$install_directory/.iris-install.XXXXXXXX")

trap 'rm -rf "$temporary_directory"; rm -f "$installation_file"' EXIT HUP INT TERM

cp "$extracted_binary" "$installation_file"

chmod 755 "$installation_file"

mv -f "$installation_file" "$destination"

printf 'Installed %s to %s\n' "$version" "$destination"

case ":$PATH:" in

*":$install_directory:"*) ;;

*) printf 'Add %s to PATH to run %s.\n' "$install_directory" "$binary" ;;