#!/bin/bash
set -e
DIR=/opt/pg_comb
BIN=pg_comb                      # nome local (sempre pg_comb dentro de $DIR)

# ── Mirrors (ordem = preferencia; primeiro que entregar binario VALIDO vence) ──
# O binario e IDENTICO + assinado GPG em todos os mirrors, entao baixar de
# qualquer um e seguro. AU primeiro (fleet atual em Sydney); resto e fallback.
# So aborta se NENHUM dos mirrors entregar um binario com assinatura valida.
MIRRORS=(
    "https://download-au.odilatech.com/pg_comb/latest"
    "https://download.odilatech.com.br/pg_comb/latest"
    "https://download-eu.odilatech.com/pg_comb/latest"
    "https://download-ca.odilatech.com/pg_comb/latest"
)

# ── Detector de arquitetura ─────────────────────────────────────────────
case "$(uname -m)" in
    x86_64|amd64)   ARCH=amd64 ;;
    aarch64|arm64)  ARCH=arm64 ;;
    *)
        echo "[ERRO] Arquitetura $(uname -m) nao suportada."
        echo "         Suportadas: x86_64 (amd64) e aarch64 (arm64)."
        exit 1
        ;;
esac
REMOTE_BIN=pg_comb_linux_${ARCH}

# ── Detector de downloader ──────────────────────────────────────────────
if command -v curl &>/dev/null; then
    fetch() { curl -fsSL --max-time 120 "$1" -o "$2"; }
elif command -v wget &>/dev/null; then
    fetch() { wget -q --timeout=120 -O "$2" "$1"; }
else
    echo "[ERRO] Nem curl nem wget encontrados."
    command -v apt-get &>/dev/null && echo "  apt-get install -y curl" || true
    command -v yum     &>/dev/null && echo "  yum install -y curl"     || true
    exit 1
fi

# ── GPG obrigatorio (tenta auto-instalar se faltar) ──────────────────────
ensure_gpg() {
    command -v gpg &>/dev/null && return 0

    echo "[setup] gpg nao encontrado — tentando instalar automaticamente..."
    if command -v apt-get &>/dev/null; then
        apt-get update -qq && apt-get install -y gnupg2 >/dev/null 2>&1
    elif command -v dnf &>/dev/null; then
        dnf install -y gnupg2 >/dev/null 2>&1
    elif command -v yum &>/dev/null; then
        yum install -y gnupg2 >/dev/null 2>&1
    elif command -v apk &>/dev/null; then
        apk add --no-cache gnupg >/dev/null 2>&1
    elif command -v pacman &>/dev/null; then
        pacman -Sy --noconfirm gnupg >/dev/null 2>&1
    fi

    if ! command -v gpg &>/dev/null; then
        echo "[ERRO] gpg eh OBRIGATORIO pra verificar a autenticidade do binario."
        echo "        Instale e tente de novo:"
        command -v apt-get  &>/dev/null && echo "          apt-get install -y gnupg2"
        command -v dnf      &>/dev/null && echo "          dnf install -y gnupg2"
        command -v yum      &>/dev/null && echo "          yum install -y gnupg2"
        command -v apk      &>/dev/null && echo "          apk add --no-cache gnupg"
        command -v pacman   &>/dev/null && echo "          pacman -Sy gnupg"
        exit 1
    fi
}
ensure_gpg

echo "[pre] OK — arch detectada: $ARCH"
echo ""

# ── Diretorio + keyring GPG (importa a pubkey UMA vez) ───────────────────
echo "[1/4] Criando diretorio $DIR..."
mkdir -p $DIR
cd $DIR

GNUPGHOME_TMP=$(mktemp -d)
chmod 700 "$GNUPGHOME_TMP"
# Public key embedded — fingerprint 4B58 E595 97CC 3E93 D926  0CB8 EBD2 7822 271F 143F
cat > "$GNUPGHOME_TMP/pub.asc" <<'PGP_PUBKEY_EOF'
-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaiPsMhYJKwYBBAHaRw8BAQdAHg5gBi+qYfTP6S2fZxkbT47pv9URXxb1I8ns
yJ0jIsa0Nk9kaWxhLlRlY2ggUmVsZWFzZSBTaWduaW5nIEtleSA8cmVsZWFzZUBv
ZGlsYXRlY2guY29tPoiQBBMWCgA4FiEES1jllZfMPpPZJgy469J4IicfFD8FAmoj
7DICGwEFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ69J4IicfFD/tdQD9FcWI
kIRJyksHKhIT3df0weU7YAo+jtT/Si3szCjcgmQA/04iGONFn1WCJ281+pecE6vW
GcRxs2mysmwdmmbLeXMPuDMEaiPsrRYJKwYBBAHaRw8BAQdARRYjJnVDmIiiFg3C
tO4/CInh1ZqqmWjU9ZY7Sp/QRmKI7wQYFgoAIBYhBEtY5ZWXzD6T2SYMuOvSeCIn
HxQ/BQJqI+ytAhsCAIEJEOvSeCInHxQ/diAEGRYKAB0WIQTqdOKXuaj95kKTPVkY
ZjILGzrdmQUCaiPsrQAKCRAYZjILGzrdmXH7AQDd0/gZvkar012oiDjgZ5PyWFdM
TgGhJu+Cny2fPYyupAEAqqS8mrxfYAoWDO8rUVlvLzTbw2HFQ1Jtpial8hwP6QkN
VQEA7HICRCUGrctiVGqmCCy8eevfobZUrU1HJ7AjVcuKqw4A/RYHMtOqDxLCauLb
n/WMEEa3DfeGgIZQlo2+Hh6IBuwEuDgEaiPsyRIKKwYBBAGXVQEFAQEHQH6E3dJm
3x9yDk2b0I9vJBgVGpkDME3C/SqxMVNPxGN0AwEIB4h4BBgWCgAgFiEES1jllZfM
PpPZJgy469J4IicfFD8FAmoj7MkCGwwACgkQ69J4IicfFD8IzwD/TwZ9Q0GK+w1L
ptgo6Tq9h0y46dJ8k1Sfwu/JpnEuvfEBALIXi76A45VysVIgdKNmQa3cwkTauC6H
bOXhVqMvN8wIuDMEaiPs5BYJKwYBBAHaRw8BAQdA8SNVAUQThePiaeCDcxhBTjvJ
FvWdk4Si+oHsX+xjBGuIeAQYFgoAIBYhBEtY5ZWXzD6T2SYMuOvSeCInHxQ/BQJq
I+zkAhsgAAoJEOvSeCInHxQ/2GwA/2n+Mep8cOrG34QD5KENH3xWoA9d7puLvfZl
f9157+39AP0Vor2E6+AA8h10v6sjpw4j93IPLFRwEiaFR9hjTd8HBQ==
=73cq
-----END PGP PUBLIC KEY BLOCK-----
PGP_PUBKEY_EOF
gpg --homedir "$GNUPGHOME_TMP" --import "$GNUPGHOME_TMP/pub.asc" 2>/dev/null
RELEASE_FPR="4B58E59597CC3E93D9260CB8EBD27822271F143F"

# ── Baixa + verifica, tentando cada mirror ate um entregar binario VALIDO ──
echo "[2/4] Baixando $REMOTE_BIN (tenta os mirrors ate um valido)..."
OK=0
USED=""
for URL in "${MIRRORS[@]}"; do
    echo "  → $URL"
    if ! fetch "$URL/$REMOTE_BIN" "$BIN.new"; then
        echo "    download do binario falhou — proximo mirror"; rm -f "$BIN.new"; continue
    fi
    if ! fetch "$URL/$REMOTE_BIN.asc" "$BIN.new.asc"; then
        echo "    download do .asc falhou — proximo mirror"; rm -f "$BIN.new" "$BIN.new.asc"; continue
    fi
    # Verificacao locale-proof: exige VALIDSIG com a fingerprint da chave de release.
    if LC_ALL=C gpg --homedir "$GNUPGHOME_TMP" --status-fd=1 --verify "$BIN.new.asc" "$BIN.new" 2>/dev/null \
         | awk -v fpr="$RELEASE_FPR" '$2=="VALIDSIG" && $NF==fpr {ok=1} END{exit !ok}'; then
        OK=1; USED="$URL"; break
    else
        echo "    ✗ GPG invalido (binario adulterado/incompleto?) — proximo mirror"
        rm -f "$BIN.new" "$BIN.new.asc"
    fi
done
rm -rf "$GNUPGHOME_TMP"

if [ "$OK" != 1 ]; then
    echo ""
    echo "[ERRO] Nenhum dos ${#MIRRORS[@]} mirrors entregou um binario valido. Abortando."
    echo "        (rede toda fora, ou release inconsistente — nada foi instalado)"
    rm -f "$BIN.new" "$BIN.new.asc"
    exit 1
fi

echo "[3/4] Assinatura valida (Odilatech Release Signing) — de $USED"
rm -f "$BIN.new.asc"
mv -f "$BIN.new" "$BIN"

echo "[4/4] Ajustando permissoes..."
chmod +x "$BIN"

echo ""
echo "[OK] $BIN ($ARCH) instalado em $DIR"
echo ""
echo "Adicione ao crontab (crontab -e):"
echo "* * * * * timeout 55 $DIR/$BIN > $DIR/pg_comb.log 2>&1"
echo ""
echo "Para reinstalar/atualizar:"
echo "  curl -fsSL $USED/install.sh | bash"
echo "  wget -qO-  $USED/install.sh | bash"