#!/bin/bash
# Download the pinned upstream ttyd static binary and verify it against the
# vendored SHA256SUMS. Usage: scripts/fetch-ttyd.sh OUTPUT [ARCH]
set -euo pipefail

out=${1:?usage: fetch-ttyd.sh OUTPUT [ARCH]}
arch=${2:-x86_64}
here=$(cd "$(dirname "$0")/.." && pwd)
version=$(cat "$here/vendor/ttyd/VERSION")
asset="ttyd.$arch"
expected=$(awk -v a="$asset" '$2 == a { print $1 }' "$here/vendor/ttyd/SHA256SUMS")
[ -n "$expected" ] || { echo "fetch-ttyd: no checksum for $asset" >&2; exit 1; }

if [ -f "$out" ] && echo "$expected  $out" | sha256sum -c --status -; then
    exit 0
fi

mkdir -p "$(dirname "$out")"
tmp=$(mktemp "$out.XXXXXX")
trap 'rm -f "$tmp"' EXIT
curl -fsSL --retry 3 -o "$tmp" "https://github.com/tsl0922/ttyd/releases/download/$version/$asset"
echo "$expected  $tmp" | sha256sum -c --status - || { echo "fetch-ttyd: checksum mismatch for $asset $version" >&2; exit 1; }
chmod 0755 "$tmp"
mv -f "$tmp" "$out"
trap - EXIT
echo "fetch-ttyd: $asset $version verified"