#!/usr/bin/env bash
#
# One-time setup to install stoke via apt on Debian/Ubuntu.
#
# Adds the heavy-duty Forgejo Debian registry as an APT source (with its
# signing key) and installs the stoke package. Safe to re-run; afterwards
# stoke upgrades through regular `apt-get upgrade`.
#
# Usage:
#   ./scripts/install-apt.sh
#   FORGE_URL=... OWNER=... ./scripts/install-apt.sh   # non-default instance
#
# Run as root or as a user with sudo.

set -euo pipefail

FORGE_URL="${FORGE_URL:-https://forgejo.heavyduty.builders}"
OWNER="${OWNER:-heavy-duty}"
DISTRIBUTION="${DISTRIBUTION:-stable}"
COMPONENT="${COMPONENT:-main}"

KEYRING="/etc/apt/keyrings/forgejo-$OWNER.asc"
LIST="/etc/apt/sources.list.d/forgejo-$OWNER.list"

SUDO=""
if [ "$(id -u)" -ne 0 ]; then
  command -v sudo >/dev/null 2>&1 || { echo "error: run as root or install sudo" >&2; exit 1; }
  SUDO="sudo"
fi

update_only_this_source() {
  $SUDO apt-get update \
    -o Dir::Etc::sourcelist="$LIST" \
    -o Dir::Etc::sourceparts=/dev/null \
    -o APT::Get::List-Cleanup=0
}

echo "Adding APT source for $FORGE_URL/$OWNER ..."
$SUDO install -d -m 0755 /etc/apt/keyrings
curl -fsSL "$FORGE_URL/api/packages/$OWNER/debian/repository.key" | $SUDO tee "$KEYRING" >/dev/null
echo "deb [signed-by=$KEYRING] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTION $COMPONENT" \
  | $SUDO tee "$LIST" >/dev/null

# Newer apt verifies with sqv (Sequoia), which rejects the signature Forgejo
# currently produces for its Debian registry (malformed Ed25519 MPI encoding
# in the upstream signing library). Try the properly signed source first so
# this heals automatically once the forge is fixed; otherwise fall back to
# [trusted=yes] — package integrity then relies on HTTPS to our own forge.
if ! update_only_this_source; then
  echo
  echo "WARNING: signature verification failed (known Forgejo registry issue" >&2
  echo "with sqv-based apt). Falling back to [trusted=yes]; transport" >&2
  echo "security is provided by HTTPS to $FORGE_URL." >&2
  echo
  echo "deb [trusted=yes] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTION $COMPONENT" \
    | $SUDO tee "$LIST" >/dev/null
  update_only_this_source
fi

$SUDO apt-get install -y stoke

echo
stoke --version >/dev/null && echo "stoke $(stoke --version) installed. Run: stoke auth login"