signer/install_signer.sh

#!/usr/bin/env bash
set -euo pipefail

# User-only installer for Qubes AppVM persistence model.
# Nothing is written to /usr, /etc, or other root-owned paths.
#
# Installs into $HOME:
#   - signer         -> ~/.local/bin/signer
#   - signer-client  -> ~/.local/bin/signer-client
#   - startup helper -> ~/start_signer.sh
#
# Usage:
#   bash install_signer.sh
#   bash install_signer.sh --help
#
# Optional env vars:
#   SIGNER_VERSION=vX.Y.Z         # optional override; default is latest release tag
#   SIGNER_GITEA_TOKEN=<token>     # if signer release assets are private
#   SIGNER_BINARY_URL=<direct url to signer binary>
#   SIGNER_CLIENT_BINARY_URL=<direct url to signer-client binary>
#   SIGNER_BINARY_ASSET=<asset name> # optional release asset override
#   SIGNER_CLIENT_BINARY_ASSET=<asset name> # optional release asset override

SIGNER_VERSION="${SIGNER_VERSION:-}"
SIGNER_BINARY_ASSET="${SIGNER_BINARY_ASSET:-signer}"
SIGNER_CLIENT_BINARY_ASSET="${SIGNER_CLIENT_BINARY_ASSET:-signer_client}"

PREFIX_BIN="${HOME}/.local/bin"

log() { printf "\033[1;34m[INFO]\033[0m %s\n" "$*"; }
warn() { printf "\033[1;33m[WARN]\033[0m %s\n" "$*"; }
err() { printf "\033[1;31m[ERR ]\033[0m %s\n" "$*"; }

show_help() {
  cat <<EOF
Usage: bash install_signer.sh [options]

User-only install (Qubes AppVM friendly):
  - signer ${SIGNER_VERSION:-(latest)}
  - signer-client ${SIGNER_VERSION:-(latest)}
  - signer startup helper script

Options:
  -h, --help      Show this help and exit

Optional env vars:
  SIGNER_VERSION=vX.Y.Z         # optional override; default is latest release tag
  SIGNER_GITEA_TOKEN=<token>     # required if signer release assets are private
  SIGNER_BINARY_URL=<direct url to signer binary>
  SIGNER_CLIENT_BINARY_URL=<direct url to signer-client binary>
  SIGNER_BINARY_ASSET=<asset name> # defaults to signer-linux-x86_64-musl
  SIGNER_CLIENT_BINARY_ASSET=<asset name> # defaults to signer-client-linux-x86_64-musl

Install paths:
  ~/.local/bin/signer
  ~/.local/bin/signer-client
  ~/start_signer.sh
EOF
}

require_cmd() {
  command -v "$1" >/dev/null 2>&1 || {
    err "Missing command: $1"
    exit 1
  }
}

install_runtime_deps() {
  if command -v apt-get >/dev/null 2>&1; then
    log "Installing runtime dependencies via apt"
    sudo apt-get update
    sudo apt-get install -y ca-certificates curl jq
  elif command -v dnf >/dev/null 2>&1; then
    log "Installing runtime dependencies via dnf"
    sudo dnf install -y ca-certificates curl jq
  else
    err "Unsupported distro: need apt-get or dnf to install runtime dependencies"
    exit 1
  fi
}

prepare_dirs() {
  mkdir -p "${PREFIX_BIN}"
}

resolve_signer_version() {
  local headers=()
  local latest_tag=""

  if [[ -n "${SIGNER_VERSION}" ]]; then
    return 0
  fi

  if [[ -n "${SIGNER_GITEA_TOKEN:-}" ]]; then
    headers=(-H "Authorization: token ${SIGNER_GITEA_TOKEN}")
  fi

  latest_tag="$(curl -fsSL "${headers[@]}" "https://git.laantungir.net/api/v1/repos/laantungir/signer/releases" \
    | jq -r '.[0].tag_name // empty' || true)"

  if [[ -z "${latest_tag}" ]]; then
    err "Could not resolve latest signer release tag from API."
    err "Set SIGNER_VERSION explicitly (e.g. SIGNER_VERSION=v0.0.14)."
    exit 1
  fi

  SIGNER_VERSION="${latest_tag}"
}

# Resolve a release asset URL by asset name suffix.
# $1 = asset name to match exactly (e.g. "signer-linux-x86_64-musl")
download_signer_asset_url() {
  local asset_name="$1"
  local headers=()
  local api_tag_url="https://git.laantungir.net/api/v1/repos/laantungir/signer/releases/tags/${SIGNER_VERSION}"

  if [[ -n "${SIGNER_GITEA_TOKEN:-}" ]]; then
    headers=(-H "Authorization: token ${SIGNER_GITEA_TOKEN}")
  fi

  curl -fsSL "${headers[@]}" "${api_tag_url}" \
    | jq -r '.assets[]?.browser_download_url // empty' \
    | grep -E "/${asset_name}$" \
    | head -n1 || true
}

verify_installed_version() {
  local expected="$1"
  local bin_path="$2"
  local got_line=""
  local got_ver=""

  if [[ ! -x "${bin_path}" ]]; then
    err "Installed binary missing: ${bin_path}"
    exit 1
  fi

  got_line="$("${bin_path}" --version 2>/dev/null || true)"
  got_ver="$(printf '%s\n' "${got_line}" | awk '{print $2}')"

  if [[ -z "${got_ver}" ]]; then
    err "Could not determine installed signer version from: ${got_line}"
    exit 1
  fi

  if [[ "${got_ver}" != "${expected}" ]]; then
    err "Downloaded binary version mismatch: expected ${expected}, got ${got_ver}"
    err "Release asset appears stale or mislabeled."
    err "Use SIGNER_BINARY_URL to pin a known-good binary, or wait for a rebuilt release artifact."
    exit 1
  fi
}

# Download a single binary asset.
# $1 = asset name (for URL resolution fallback)
# $2 = override URL env var name (e.g. SIGNER_BINARY_URL)
# $3 = output path
download_binary() {
  local asset_name="$1"
  local override_env="$2"
  local out_path="$3"
  local asset_url=""

  # Resolve override from env var
  eval "asset_url=\"\${${override_env}:-}\""

  if [[ -z "${asset_url}" ]]; then
    asset_url="$(download_signer_asset_url "${asset_name}")"
  fi

  # Older releases used unqualified asset names. Keep that fallback while
  # preferring explicit portable musl assets for new releases.
  if [[ -z "${asset_url}" && "${asset_name}" == *-linux-x86_64-musl ]]; then
    asset_url="$(download_signer_asset_url "${asset_name%-linux-x86_64-musl}")"
  fi

  if [[ -z "${asset_url}" ]]; then
    err "Could not find downloadable ${asset_name} release binary for ${SIGNER_VERSION}."
    err "Provide ${override_env} or SIGNER_GITEA_TOKEN so the release asset can be resolved."
    exit 1
  fi

  log "Using ${asset_name} binary URL: ${asset_url}"
  if [[ -n "${SIGNER_GITEA_TOKEN:-}" ]]; then
    curl -fL -H "Authorization: token ${SIGNER_GITEA_TOKEN}" -o "${out_path}" "${asset_url}"
  else
    curl -fL -o "${out_path}" "${asset_url}"
  fi
  chmod 0755 "${out_path}"
}

install_signer() {
  local release_page=""

  resolve_signer_version
  release_page="https://git.laantungir.net/laantungir/signer/releases/tag/${SIGNER_VERSION}"

  log "Installing signer ${SIGNER_VERSION}"
  log "Release page: ${release_page}"

  # Prefer the statically linked musl artifact; fall back to legacy names.
  download_binary "${SIGNER_BINARY_ASSET}" "SIGNER_BINARY_URL" "${PREFIX_BIN}/signer"
  verify_installed_version "${SIGNER_VERSION}" "${PREFIX_BIN}/signer"
  log "Installed ${PREFIX_BIN}/signer from release binary"

  # Install the signer-client CLI binary (best-effort: older releases may not have it)
  if [[ -z "${SIGNER_CLIENT_BINARY_URL:-}" ]] && ! download_signer_asset_url "${SIGNER_CLIENT_BINARY_ASSET}" >/dev/null 2>&1 && ! download_signer_asset_url "signer-client" >/dev/null 2>&1; then
    warn "No signer-client asset found for ${SIGNER_VERSION}; skipping client install."
  else
    download_binary "${SIGNER_CLIENT_BINARY_ASSET}" "SIGNER_CLIENT_BINARY_URL" "${PREFIX_BIN}/signer-client"
    log "Installed ${PREFIX_BIN}/signer-client from release binary"
  fi
}

write_signer_start_script() {
  local script_path="${HOME}/start_signer.sh"

  cat >"${script_path}" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail

export PATH="$HOME/.local/bin:$PATH"
LISTEN_TARGET="${SIGNER_LISTEN_TARGET:-tcp:[::]:8080}"

echo "=== signer startup ==="
echo "listen target: ${LISTEN_TARGET}"

# Optional: print current FIPS identity info if fipsctl is available.
if command -v fipsctl >/dev/null 2>&1; then
  if fipsctl show status >/dev/null 2>&1; then
    STATUS_JSON="$(fipsctl show status)"
  elif sudo -n fipsctl show status >/dev/null 2>&1; then
    STATUS_JSON="$(sudo -n fipsctl show status)"
  else
    STATUS_JSON=""
  fi

  if [[ -n "${STATUS_JSON}" ]]; then
    FIPS_IPV6="$(printf '%s\n' "${STATUS_JSON}" | sed -n 's/.*"ipv6_addr": "\([^"]*\)".*/\1/p')"
    FIPS_NPUB="$(printf '%s\n' "${STATUS_JSON}" | sed -n 's/.*"npub": "\([^"]*\)".*/\1/p')"
    LISTEN_PORT="$(printf '%s\n' "${LISTEN_TARGET}" | sed -n 's/.*:\([0-9][0-9]*\)$/\1/p')"
    [[ -n "${FIPS_IPV6}" ]] && echo "fips ipv6: ${FIPS_IPV6}"
    [[ -n "${FIPS_NPUB}" ]] && echo "fips npub: ${FIPS_NPUB}"
    if [[ -n "${FIPS_NPUB}" && -n "${LISTEN_PORT}" ]]; then
      echo "fips address: http://${FIPS_NPUB}.fips:${LISTEN_PORT}"
    fi
  else
    echo "fips status: unavailable (run as user in fips group or with sudo)"
  fi
fi

echo
echo "Starting signer..."
echo "On first remote request, approve in prompt with [y] or [a]."
exec "$HOME/.local/bin/signer" --listen "${LISTEN_TARGET}"
EOF

  chmod 0755 "${script_path}"
  log "Wrote ${script_path}"
}

post_checks() {
  export PATH="${PREFIX_BIN}:${PATH}"

  log "Running post-install checks"
  require_cmd signer
  signer --version || true

  if [[ -x "${PREFIX_BIN}/signer-client" ]]; then
    signer-client --version || true
  fi

  log "User binaries installed in: ${PREFIX_BIN}"
  log "If needed, add to shell PATH: export PATH=\"${PREFIX_BIN}:\$PATH\""
}

main() {
  if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
    show_help
    exit 0
  fi

  if [[ $# -gt 0 ]]; then
    err "Unknown option: $1"
    show_help
    exit 1
  fi

  install_runtime_deps
  prepare_dirs
  install_signer
  write_signer_start_script
  post_checks

  log "Completed user-only install of signer"
  log "Start signer with: ~/start_signer.sh"
}

main "$@"