install.sh

#!/usr/bin/env bash
# Fail fast: no step after a failed download/clone/build/copy may run, and the
# success message must be unreachable on any failure path (#840).
set -euo pipefail

# Helper function for regex matching (Bash 3.0+ compatible)
function regex_match() {
  [[ $1 =~ $2 ]]
}

function is_git_installed() {
  command -v git >/dev/null 2>&1
}

function compute_sha256() {
  if command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" | awk '{print $1}'
  elif command -v sha256sum >/dev/null 2>&1; then
    sha256sum "$1" | awk '{print $1}'
  else
    echo ""
  fi
}

# Older releases may lack checksums; explicit verification must still fail.
function cannot_verify() {
  local reason=$1
  local download_file=$2
  if [ "${VERIFY_CHECKSUM_EXPLICIT:-false}" = "true" ]; then
    echo "Error: $reason" >&2
    rm -f "$download_file"
    exit 1
  fi
  echo "> Skipping checksum verification: $reason" >&2
}

function verify_checksum() {
  local url=$1
  local download_file=$2
  local checksum_url="${url%/bashunit}/checksum"

  local actual
  actual=$(compute_sha256 "$download_file")
  if [ -z "$actual" ]; then
    cannot_verify "no sha256 tool (shasum/sha256sum) available to verify checksum" "$download_file"
    return
  fi

  # `|| true`: a failed download must reach the cannot_verify fallback below,
  # not die on set -e / pipefail.
  local expected
  if command -v curl >/dev/null 2>&1; then
    expected=$(curl -fsSL --retry 3 --retry-delay 2 "$checksum_url" 2>/dev/null | awk '{print $1}') || true
  else
    expected=$(wget -qO- "$checksum_url" 2>/dev/null | awk '{print $1}') || true
  fi

  if [ -z "$expected" ]; then
    cannot_verify "could not download checksum from $checksum_url" "$download_file"
    return
  fi

  if [ "$actual" != "$expected" ]; then
    echo "Error: checksum mismatch for bashunit '$TAG'" >&2
    echo "  expected: $expected" >&2
    echo "  actual:   $actual" >&2
    rm -f "$download_file"
    exit 1
  fi

  echo "> Checksum verified ($actual)" >&2
}

function build_and_install_beta() {
  echo "> Downloading non-stable version: 'beta'"

  if ! is_git_installed; then
    echo "Error: git is not installed." >&2
    exit 1
  fi

  # Explicit guard even under set -e: a failed clone must never cascade into
  # `cd` failing and build.sh executing in the caller's directory (#840).
  if ! git clone --depth 1 --no-tags "$BASHUNIT_GIT_REPO" temp_bashunit 2>/dev/null; then
    echo "Error: failed to clone $BASHUNIT_GIT_REPO" >&2
    rm -rf temp_bashunit
    exit 1
  fi
  cd temp_bashunit
  ./build.sh bin >/dev/null
  local latest_commit
  latest_commit=$(git rev-parse --short=7 HEAD)
  cd ..

  local beta_version
  beta_version=$(printf "(non-stable) beta after %s [%s] 🐍 #%s" \
    "$LATEST_BASHUNIT_VERSION" \
    "$(date +'%Y-%m-%d')" \
    "$latest_commit")

  # Portable in-place edit: BSD sed treats the argument after -i as a backup
  # suffix, so `sed -i -e` leaves a stray `bashunit-e` file behind.
  sed -e 's/BASHUNIT_VERSION=".*"/BASHUNIT_VERSION="'"$beta_version"'"/g' \
    temp_bashunit/bin/bashunit >temp_bashunit/bin/bashunit.tmp
  mv temp_bashunit/bin/bashunit.tmp temp_bashunit/bin/bashunit
  cp temp_bashunit/bin/bashunit ./
  chmod u+x ./bashunit
  rm -rf temp_bashunit
}

function install() {
  if [[ $VERSION != 'latest' ]]; then
    TAG="$VERSION"
    echo "> Downloading a concrete version: '$TAG'"
  else
    echo "> Downloading the latest version: '$TAG'"
  fi

  local url="$BASHUNIT_GIT_REPO/releases/download/$TAG/bashunit"
  local download_file download_status=0
  download_file=$(mktemp './bashunit.download.XXXXXX')
  if command -v curl >/dev/null 2>&1; then
    curl -fL --retry 3 --retry-delay 2 -o "$download_file" "$url" 2>/dev/null || download_status=$?
  elif command -v wget >/dev/null 2>&1; then
    wget --tries=3 -O "$download_file" "$url" 2>/dev/null ||
      wget -O "$download_file" "$url" 2>/dev/null || download_status=$?
  else
    echo "Cannot download bashunit: curl or wget not found." >&2
    rm -f "$download_file"
    exit 1
  fi

  if [ "$download_status" -ne 0 ] || [ ! -s "$download_file" ]; then
    rm -f "$download_file"
    echo "Error: failed to download bashunit '$TAG' from $url" >&2
    exit 1
  fi

  if [ "$VERIFY_CHECKSUM" = "true" ]; then
    verify_checksum "$url" "$download_file"
  fi

  if ! chmod +rw,u+x "$download_file" || ! mv -f "$download_file" bashunit; then
    rm -f "$download_file"
    exit 1
  fi
}

#########################
######### MAIN ##########
#########################

# Defaults
DIR="lib"
VERSION="latest"
LATEST_BASHUNIT_VERSION="0.52.0"

# Checksum verification is on by default. Track whether the user set it
# explicitly so we can be strict on opt-in and lenient on the default.
if [ -n "${BASHUNIT_VERIFY_CHECKSUM+x}" ]; then
  VERIFY_CHECKSUM_EXPLICIT="true"
else
  VERIFY_CHECKSUM_EXPLICIT="false"
fi
VERIFY_CHECKSUM="${BASHUNIT_VERIFY_CHECKSUM:-true}"

function is_version() {
  regex_match "$1" '^[0-9]+\.[0-9]+\.[0-9]+$' || [[ "$1" == "latest" || "$1" == "beta" ]]
}

function looks_like_version() {
  regex_match "$1" '^v?[0-9]+(\.[0-9]+){0,2}$'
}

for argument in "$@"; do
  if looks_like_version "$argument" && ! is_version "$argument"; then
    echo "Error: unknown version '$argument'. Use a release such as $LATEST_BASHUNIT_VERSION, 'latest' or 'beta'." >&2
    exit 1
  fi
done

# Parse arguments flexibly
if [[ $# -eq 1 ]]; then
  if is_version "$1"; then
    VERSION="$1"
  else
    DIR="$1"
  fi
elif [[ $# -eq 2 ]]; then
  if is_version "$1"; then
    VERSION="$1"
    DIR="$2"
  elif is_version "$2"; then
    DIR="$1"
    VERSION="$2"
  else
    echo "Invalid arguments. Expected version or directory." >&2
    exit 1
  fi
fi

BASHUNIT_GIT_REPO="https://github.com/TypedDevs/bashunit"
TAG="$LATEST_BASHUNIT_VERSION"

# Validate the destination before touching the network. curl writes the binary
# into this directory with its stderr silenced, so the download check further
# down owned every failure: an unwritable target reported "failed to download",
# which sends the reader to their network or the version when the fix is a
# writable path. A path that is a regular file leaked a raw `rm: Not a
# directory` with no mention of bashunit at all (#1197).
if [ -e "$DIR" ] && [ ! -d "$DIR" ]; then
  echo "Error: '$DIR' exists and is not a directory." >&2
  echo "Choose another destination by passing it as an argument, or remove that file." >&2
  exit 1
fi

if [ ! -d "$DIR" ] && ! mkdir -p "$DIR" 2>/dev/null; then
  echo "Error: cannot create the '$DIR' folder." >&2
  echo "Choose another destination by passing it as an argument, or re-run with sufficient permissions." >&2
  exit 1
fi

if [ ! -w "$DIR" ]; then
  echo "Error: cannot write to the '$DIR' folder." >&2
  echo "Choose another destination by passing it as an argument, or re-run with sufficient permissions." >&2
  exit 1
fi

if [ -d "$DIR/bashunit" ]; then
  echo "Error: '$DIR/bashunit' exists and is not a file." >&2
  exit 1
fi

cd "$DIR"

if [[ $VERSION == 'beta' ]]; then
  build_and_install_beta
else
  install
fi

echo "> bashunit has been installed in the '$(pwd)' folder"