get

#!/usr/bin/env bash
set -euo pipefail

BASE_URL=https://storage.googleapis.com/cri-o/conmon-rs
ARCH_AMD64=amd64
ARCH_ARM64=arm64
ARCH_PPC64LE=ppc64le
ARCH_S390X=s390x
ARCH=
COMMIT=
TAG=
NO_EXEC=
OUTPUT=conmonrs

usage() {
    printf "Usage: %s [ -t SHA ] [-l TAG ] [-a ARCH] [ -h ]\n\n" "$(basename "$0")"
    echo "Possible arguments:"
    printf "  -o\tOutput path for the downloaded binary (defaults to './conmonrs')\n"
    printf "  -t\tFull length SHA to be used (defaults to the latest available main)\n"
    printf "  -l\tTag to be used\n"
    printf "  -a\tArchitecture to retrieve (defaults to the local system)\n"
    printf "  -n\tDo not print the version after install, means don't execute the binary\n"
    printf "  -h\tShow this help message\n"
}

parse_args() {
    echo "Welcome to the conmon-rs install script!"

    while getopts 'a:l:no:t:h' OPTION; do
        case "$OPTION" in
        a)
            ARCH="$OPTARG"
            echo "Using architecture: $ARCH"
            ;;
        l)
            TAG="$OPTARG"
            echo "Using tag: $TAG"
            ;;
        n)
            NO_EXEC=1
            ;;
        o)
            OUTPUT="$OPTARG"
            echo "Using output path: $OUTPUT"
            ;;
        t)
            COMMIT="$OPTARG"
            echo "Using commit: $COMMIT"
            ;;
        h)
            usage
            exit 0
            ;;
        ?)
            usage
            exit 1
            ;;
        esac
    done

    if [[ $ARCH == "" ]]; then
        LOCAL_ARCH=$(uname -m)
        if [[ "$LOCAL_ARCH" == x86_64 ]]; then
            ARCH=$ARCH_AMD64
        elif [[ "$LOCAL_ARCH" == aarch64 ]]; then
            ARCH=$ARCH_ARM64
        elif [[ "$LOCAL_ARCH" == "$ARCH_PPC64LE" ]]; then
            ARCH=$ARCH_PPC64LE
        elif [[ "$LOCAL_ARCH" == "$ARCH_S390X" ]]; then
            ARCH=$ARCH_S390X
        else
            echo "Unsupported local architecture: $LOCAL_ARCH"
            exit 1
        fi
        echo "No architecture provided, using: $ARCH"
    fi
}

verify_requirements() {
    CMDS=(curl jq)
    echo "Checking if all commands are available: ${CMDS[*]}"
    for CMD in "${CMDS[@]}"; do
        if ! command -v "$CMD" >/dev/null; then
            echo "Command $CMD not available but required"
            exit 1
        fi
    done
}

curl_retry() {
    curl -sSfL --retry 5 --retry-delay 3 "$@"
}

download_binary() {
    GIT_REF=refs/heads/main

    if [[ $TAG != "" ]]; then
        echo "Getting commit from tag"
        TAG_JSON=$(curl_retry "https://api.github.com/repos/containers/conmon-rs/git/refs/tags/$TAG")
        COMMIT=$(echo "$TAG_JSON" | jq -r .object.sha)
        GIT_REF=$(echo "$TAG_JSON" | jq -r .ref)
    else
        if [[ $COMMIT == "" ]]; then
            echo "Getting latest commit on main"
            COMMIT=$(curl_retry $BASE_URL/latest-main.txt)
        fi

        # Latest commit can be a tag
        POSSIBLE_TAG_JSON=$(curl_retry "https://api.github.com/repos/containers/conmon-rs/git/refs/tags" | jq '.[] | select(.object.sha == "'"$COMMIT"'")')

        if [[ $POSSIBLE_TAG_JSON != "" ]]; then
            GIT_REF=$(echo "$POSSIBLE_TAG_JSON" | jq -r .ref)
            echo "Commit $COMMIT is tag ref $TAG"
        fi
    fi

    echo "Found commit: $COMMIT"
    echo "Using git ref: $GIT_REF"

    mkdir -p "$(dirname "$OUTPUT")"

    if command -v cosign >/dev/null; then
        echo "Found cosign, verifying binary signature"
        TMPDIR=$(mktemp -d)
        trap 'rm -rf $TMPDIR' EXIT
        pushd "$TMPDIR" >/dev/null

        FILES=(
            "conmonrs.$ARCH"
            "conmonrs.$ARCH.sig"
            "conmonrs.$ARCH.cert"
        )
        for FILE in "${FILES[@]}"; do
            curl_retry "$BASE_URL/$COMMIT/$FILE" -o "$FILE"
        done

        SLUG=containers/conmon-rs
        cosign verify-blob "${FILES[0]}" \
            --certificate-identity "https://github.com/$SLUG/.github/workflows/ci.yml@$GIT_REF" \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            --certificate-github-workflow-name ci \
            --certificate-github-workflow-repository "$SLUG" \
            --certificate-github-workflow-ref "$GIT_REF" \
            --signature "${FILES[1]}" \
            --certificate "${FILES[2]}"

        popd >/dev/null
        mv "$TMPDIR/${FILES[0]}" "$OUTPUT"
    else
        curl_retry "$BASE_URL/$COMMIT/conmonrs.$ARCH" -o "$OUTPUT"
    fi

    chmod +x "$OUTPUT"
    printf "Installed binary into: %s\n" "$OUTPUT"

    if [[ $NO_EXEC == "" ]]; then
        eval "$(realpath "$OUTPUT")" -v
    fi
}

parse_args "$@"
verify_requirements
download_binary