set -eu
release_version='@HF2Q_VERSION@'
release_sha256='@HF2Q_SHA256@'
release_size='@HF2Q_SIZE@'
release_team_id='@HF2Q_TEAM_ID@'
release_identifier='@HF2Q_IDENTIFIER@'
asset_name='hf2q-aarch64-apple-darwin'
default_base_url='https://github.com/robertelee78/hf2q/releases/download/v@HF2Q_VERSION@'
fail() {
printf 'hf2q installer: %s\n' "$1" >&2
exit 1
}
[ "$(uname -s)" = Darwin ] || fail 'only macOS is supported by this release'
[ "$(uname -m)" = arm64 ] || fail 'this release requires Apple Silicon (arm64)'
macos_version=$(/usr/bin/sw_vers -productVersion 2>/dev/null) \
|| fail 'macOS version could not be determined'
macos_major=${macos_version%%.*}
case "$macos_major" in
''|*[!0-9]*) fail 'macOS version is not canonical' ;;
esac
[ "$macos_major" -ge 14 ] || fail 'this release requires macOS 14 or newer'
[ -n "${HOME:-}" ] || fail 'HOME is unavailable; set HF2Q_INSTALL_DIR explicitly'
install_dir=${HF2Q_INSTALL_DIR:-"$HOME/.local/bin"}
case "$install_dir" in
/*) ;;
*) fail 'HF2Q_INSTALL_DIR must be an absolute path' ;;
esac
umask 077
mkdir -p "$install_dir"
install_dir=$(cd "$install_dir" && pwd -P)
base_url=${HF2Q_RELEASE_BASE_URL:-$default_base_url}
asset_url="$base_url/$asset_name"
candidate=$(mktemp "$install_dir/.hf2q-download.XXXXXX")
cleanup() {
rm -f "$candidate"
}
trap cleanup EXIT HUP INT TERM
curl -fsSL --proto '=https,file' --proto-redir '=https' --tlsv1.2 "$asset_url" -o "$candidate" \
|| fail 'download failed; the existing installation was not changed'
actual_size=$(stat -f '%z' "$candidate")
[ "$actual_size" = "$release_size" ] \
|| fail 'downloaded byte length does not match the immutable release'
actual_sha256=$(shasum -a 256 "$candidate" | awk '{print $1}')
[ "$actual_sha256" = "$release_sha256" ] \
|| fail 'downloaded SHA-256 does not match the immutable release'
if [ "${HF2Q_INSTALL_TEST_MODE:-0}" = 1 ]; then
case "$asset_url" in
file://*) ;;
*) fail 'test mode is restricted to an exact local file:// fixture' ;;
esac
else
[ "$(/usr/bin/lipo -archs "$candidate" 2>/dev/null)" = arm64 ] \
|| fail 'release is not an exact thin Apple-Silicon executable'
/usr/bin/codesign --verify --strict --all-architectures --verbose=2 \
"$candidate" >/dev/null 2>&1 \
|| fail 'Apple code-signature verification failed'
signing_info=$(/usr/bin/codesign --display --verbose=4 "$candidate" 2>&1) \
|| fail 'Apple signing identity could not be read'
printf '%s\n' "$signing_info" | grep -qx "TeamIdentifier=$release_team_id" \
|| fail 'Apple Developer ID team does not match this hf2q release'
printf '%s\n' "$signing_info" | grep -qx "Identifier=$release_identifier" \
|| fail 'Apple signing identifier does not match this hf2q release'
[ "$(printf '%s\n' "$signing_info" | grep -c '^Authority=')" = 3 ] \
|| fail 'Apple Developer ID authority chain is incomplete or ambiguous'
application_authority=$(printf '%s\n' "$signing_info" | \
sed -n 's/^Authority=//p' | sed -n '1p')
case "$application_authority" in
"Developer ID Application: "*" ($release_team_id)") ;;
*) fail 'Apple Developer ID application authority does not match this release' ;;
esac
[ "$(printf '%s\n' "$signing_info" | \
grep -c '^Authority=Developer ID Certification Authority$')" = 1 ] \
|| fail 'Apple Developer ID intermediate authority is missing'
[ "$(printf '%s\n' "$signing_info" | \
grep -c '^Authority=Apple Root CA$')" = 1 ] \
|| fail 'Apple root authority is missing'
printf '%s\n' "$signing_info" | \
grep -Eq '^CodeDirectory .* flags=0x[0-9a-f]+\(runtime\)( |$)' \
|| fail 'hf2q release does not enable the hardened runtime'
printf '%s\n' "$signing_info" | grep -Eq '^Timestamp=.+$' \
|| fail 'hf2q release does not have a secure signing timestamp'
/usr/bin/codesign --verify --strict --all-architectures \
--check-notarization --test-requirement '=notarized' "$candidate" \
>/dev/null 2>&1 \
|| fail 'Apple did not verify the online notarization ticket for this hf2q release'
fi
chmod 0555 "$candidate"
[ "$("$candidate" --version)" = "hf2q $release_version" ] \
|| fail 'candidate version does not match the immutable release'
"$candidate" __standalone-install \
--install-dir "$install_dir" \
--candidate "$candidate" \
--size "$release_size" \
--sha256 "$release_sha256"
case ":${PATH:-}:" in
*:"$install_dir":*) ;;
*)
printf '\nAdd hf2q to this shell with:\n export PATH="%s:$PATH"\n' "$install_dir"
;;
esac
printf '\nNext: hf2q setup\n'