#!/usr/bin/env bash
# Kumo bootstrap installer - https://kumovps.xyz
#
#   curl -fsSL https://kumovps.xyz/install -o install && sudo bash install
#
# This small script downloads Kumo 1.0.4, verifies its SHA-256 checksum,
# then runs the real installer (install.sh) from the release archive.
# Read it before running: it is short on purpose.
set -euo pipefail

KUMO_RELEASE="1.0.4"
KUMO_SHA256="838d132cc417864af2156c3e3553896fbcca6b6505769368ef299222f0fc76c9"
KUMO_URL="https://kumovps.xyz/releases/kumo-${KUMO_RELEASE}.tar.gz"

fail() { printf '\e[31m[Kumo]\e[0m %s\n' "$*" >&2; exit 1; }

[[ $EUID -eq 0 ]] || fail "Please run as root:  sudo bash install"
for c in curl tar sha256sum mktemp; do
    command -v "$c" >/dev/null 2>&1 || fail "Missing command: $c"
done

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT

printf '\e[36m==>\e[0m Downloading Kumo %s...\n' "$KUMO_RELEASE"
curl -fsSL --proto '=https' --tlsv1.2 --retry 3 -o "$tmp/kumo.tar.gz" "$KUMO_URL" \
    || fail "Download failed: $KUMO_URL"

printf '%s  %s\n' "$KUMO_SHA256" "$tmp/kumo.tar.gz" | sha256sum -c --quiet - \
    || fail "Checksum mismatch! The file may have been tampered with. Aborting."

tar -xzf "$tmp/kumo.tar.gz" -C "$tmp" --no-same-owner --no-same-permissions
[[ -f "$tmp/kumo-$KUMO_RELEASE/install.sh" ]] || fail "Invalid release archive."

# When piped (curl ... | bash), read answers from the terminal instead of the pipe.
if [[ ! -t 0 && -r /dev/tty ]]; then
    bash "$tmp/kumo-$KUMO_RELEASE/install.sh" "$@" < /dev/tty
else
    bash "$tmp/kumo-$KUMO_RELEASE/install.sh" "$@"
fi