123set -euo pipefail4umask 07756readonly repository="FelineStateMachine/goq"7readonly publisher_key="RWS0Lc9GR1BHMg1qTBKX3mQTxSkIEafny6ueBDQ0p04N2XWagpE8fV6f"8readonly release_tag="v0.1.0"9readonly minisign_version="0.12"10readonly minisign_url="https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz"11readonly minisign_sha256="9a599b48ba6eb7b1e80f12f36b94ceca7c00b7a5173c95c3efc88d9822957e73"12readonly asset_target_contract="linux-glibc2.17-x86_64"1314die() {15 printf 'Sigil setup failed: %s\n' "$*" >&216 exit 117}1819if [[ "$publisher_key" == unconfigured || "$release_tag" == unconfigured ]]; then20 die "the signed Sigil release channel is not open yet"21fi2223[[ "$(uname -s)" == Linux ]] || die "Sigil requires Linux"24[[ "$(uname -m)" == x86_64 ]] || die "Sigil currently requires x86_64"25[[ "$(id -u)" -ne 0 ]] || die "run this command as the dedicated gaming user, not root"26grep -Eq '^ID="?bazzite"?$' /etc/os-release || die "Sigil currently supports Bazzite"2728for command_name in awk curl find grep install mktemp rm sha256sum tar tr wc; do29 command -v "$command_name" >/dev/null 2>&1 \30 || die "$command_name is required"31done3233[[ "$release_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z][0-9A-Za-z.-]*)?$ ]] \34 || die "the release tag is malformed"3536asset_name="sigil-$release_tag-$asset_target_contract.tar.gz"37asset_base="https://github.com/$repository/releases/download/$release_tag/$asset_name"38temp_parent="${TMPDIR:-/tmp}"39temp_parent="${temp_parent%/}"40[[ "$temp_parent" == /* && -d "$temp_parent" && ! -L "$temp_parent" ]] \41 || die "the temporary directory is unsafe"42temp_root="$(mktemp -d "$temp_parent/goq-sigil-install.XXXXXX")"43archive_path="$temp_root/$asset_name"44checksum_path="$archive_path.sha256"45signature_path="$archive_path.minisig"46unpack_path="$temp_root/unpack"47minisign_archive="$temp_root/minisign-$minisign_version-linux.tar.gz"48minisign_unpack_path="$temp_root/minisign-unpack"49minisign_binary="$minisign_unpack_path/minisign-linux/x86_64/minisign"5051cleanup() {52 local status=$?53 trap - EXIT INT TERM HUP54 case "$temp_root" in55 "$temp_parent"/goq-sigil-install.??????) rm -rf -- "$temp_root" ;;56 esac57 exit "$status"58}59trap cleanup EXIT INT TERM HUP6061curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \62 --retry 3 --retry-all-errors --output "$minisign_archive" "$minisign_url" \63 || die "the Minisign verifier download failed"64[[ -s "$minisign_archive" ]] || die "the Minisign verifier download is empty"65actual_minisign_hash="$(sha256sum "$minisign_archive" | awk '{ print $1 }')"66[[ "$actual_minisign_hash" == "$minisign_sha256" ]] \67 || die "the Minisign verifier checksum does not match"6869minisign_entries="$(tar --list --gzip --file "$minisign_archive" 2>/dev/null)" \70 || die "the Minisign verifier archive is unreadable"71if ! printf '%s\n' "$minisign_entries" | awk '72 BEGIN {73 required["minisign-linux/"] = 174 required["minisign-linux/aarch64/"] = 175 required["minisign-linux/x86_64/"] = 176 required["minisign-linux/aarch64/minisign"] = 177 required["minisign-linux/x86_64/minisign"] = 178 metadata["._minisign-linux"] = 179 metadata["minisign-linux/._aarch64"] = 180 metadata["minisign-linux/._x86_64"] = 181 metadata["minisign-linux/aarch64/._minisign"] = 182 metadata["minisign-linux/x86_64/._minisign"] = 183 }84 {85 if ($0 in required) {86 if (seen[$0]++) exit 187 required_count++88 } else if ($0 in metadata) {89 if (seen[$0]++) exit 190 } else {91 exit 192 }93 }94 END {95 if (required_count != 5) exit 196 for (name in required) if (!seen[name]) exit 197 }98'; then99 die "the Minisign verifier archive has unexpected contents"100fi101if ! LC_ALL=C tar --list --verbose --gzip --file "$minisign_archive" 2>/dev/null \102 | awk '{ type = substr($1, 1, 1); if (type != "-" && type != "d") exit 1 }'103then104 die "the Minisign verifier archive contains a special file or link"105fi106107install -d -m 0700 "$minisign_unpack_path"108tar --extract --gzip --file "$minisign_archive" \109 --directory "$minisign_unpack_path" --no-same-owner --no-same-permissions \110 minisign-linux/x86_64/minisign 2>/dev/null \111 || die "the Minisign verifier could not be extracted"112[[ -f "$minisign_binary" && ! -L "$minisign_binary" && -x "$minisign_binary" ]] \113 || die "the Minisign verifier is missing or unsafe"114115for suffix in '' .sha256 .minisig; do116 curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \117 --retry 3 --retry-all-errors --output "$archive_path$suffix" "$asset_base$suffix" \118 || die "a signed release asset download failed"119 [[ -s "$archive_path$suffix" ]] || die "a signed release asset download is empty"120done121122"$minisign_binary" -Vm "$archive_path" -x "$signature_path" -P "$publisher_key" \123 >/dev/null 2>&1 \124 || die "the publisher signature is invalid"125126[[ "$(wc -l <"$checksum_path" | tr -d ' ')" == 1 ]] \127 || die "the release checksum file is malformed"128expected_hash="$(awk 'NF == 2 { print $1 }' "$checksum_path")"129expected_name="$(awk 'NF == 2 { print $2 }' "$checksum_path")"130[[ "$expected_hash" =~ ^[0-9a-f]{64}$ && "$expected_name" == "$asset_name" ]] \131 || die "the release checksum declaration is malformed"132actual_hash="$(sha256sum "$archive_path" | awk '{ print $1 }')"133[[ "$actual_hash" == "$expected_hash" ]] || die "the release checksum does not match"134135archive_entries="$(tar --list --gzip --file "$archive_path")" \136 || die "the signed release archive is unreadable"137[[ -n "$archive_entries" ]] || die "the signed release archive is empty"138while IFS= read -r archive_entry; do139 case "$archive_entry" in140 payload|payload/|payload/*) ;;141 *) die "the signed release archive escapes its payload root" ;;142 esac143 case "/$archive_entry/" in144 */../*|*/./*) die "the signed release archive contains an unsafe path" ;;145 esac146done <<<"$archive_entries"147if ! LC_ALL=C tar --list --verbose --gzip --file "$archive_path" \148 | awk '{ type = substr($1, 1, 1); if (type != "-" && type != "d") exit 1 }'149then150 die "the signed release archive contains a special file or link"151fi152153install -d -m 0700 "$unpack_path"154tar --extract --gzip --file "$archive_path" --directory "$unpack_path" \155 --no-same-owner --no-same-permissions156payload_path="$unpack_path/payload"157[[ -d "$payload_path" && ! -L "$payload_path" ]] || die "the package payload is missing"158[[ -x "$payload_path/stage-this-release.sh" \159 && ! -L "$payload_path/stage-this-release.sh" ]] || die "the package installer is missing"160[[ -z "$(find "$payload_path" -type l -print -quit)" ]] \161 || die "the package payload contains a symbolic link"162163"$payload_path/stage-this-release.sh"164printf '%s\n' \165 "Sigil runtime $release_tag is installed." \166 "Continue with $HOME/.local/libexec/sigil-spark/current/docs/sigil-host-activation.md." \167 "The installer did not start or restart the active Sigil service."