#!/bin/sh
# Raven installer  -  https://chamberdoorsecurity.com
#
#   curl -fsSL https://chamberdoorsecurity.com/install.sh | sh
#
# What this does:
#   Debian / Ubuntu / Kali : add the signed Raven apt repo and install
#                            raven-server, so it upgrades with `apt upgrade`
#                            like any other package.
#   macOS / other          : point you at the download page (native binaries
#                            and the Docker image live there).
#
# It uses sudo only for the system-level package steps. This file is the whole
# script; read it before you run it if you like.
set -eu

REPO_HOST="apt.chamberdoorsecurity.com"
SITE="https://chamberdoorsecurity.com"

say() { printf '%s\n' "$*"; }
err() { printf 'raven-install: %s\n' "$*" >&2; }

# Pick a privilege-escalation command (root already, or sudo).
if [ "$(id -u)" -eq 0 ]; then
  SUDO=""
elif command -v sudo >/dev/null 2>&1; then
  SUDO="sudo"
else
  err "this installer needs to run as root or with sudo available."
  exit 1
fi

OS="$(uname -s)"

case "$OS" in
  Linux)
    if ! command -v apt-get >/dev/null 2>&1; then
      say "No apt on this Linux. Grab a native binary or the Docker image at:"
      say "  $SITE/#download"
      exit 0
    fi

    # The prebuilt package needs glibc >= 2.35 (Kali, Debian 12+, Ubuntu 22.04+).
    # Keep this in step with the binaries: they are linked bare on the release
    # runner, so the floor is that runner's glibc (release.yml RAVEN_GLIBC_FLOOR,
    # 2.35 since v0.1.0-beta73 moved the Linux legs to ubuntu-22.04). A floor set
    # HIGHER than reality is not a safe default -- it turns away systems the
    # package installs on perfectly well, which is what 2.39 did to every
    # Debian 12 and Ubuntu 22.04 user.
    # Fail gracefully on anything genuinely older instead of letting apt bail
    # out with a cryptic "held broken packages".
    GLIBC="$(ldd --version 2>/dev/null | head -1 | grep -oE '[0-9]+\.[0-9]+$' || true)"
    if [ -n "$GLIBC" ]; then
      GMAJ="${GLIBC%.*}"; GMIN="${GLIBC#*.}"
      if [ "$GMAJ" -lt 2 ] || { [ "$GMAJ" -eq 2 ] && [ "$GMIN" -lt 35 ]; }; then
        say "This system's glibc ($GLIBC) is older than the prebuilt Raven package needs (2.35+)."
        say "Use the Docker image (works on any glibc), or a newer distro"
        say "(Kali, Debian 12+, Ubuntu 22.04+). All options:"
        say "  $SITE/#download"
        exit 0
      fi
    fi

    say "Installing Raven from the apt repository ($REPO_HOST) ..."

    # 1. prerequisites
    $SUDO apt-get update -qq
    $SUDO apt-get install -y -qq ca-certificates curl gnupg

    # 2. signing key (dedicated keyring, not the global trust store)
    $SUDO install -m 0755 -d /etc/apt/keyrings
    curl -fsSL "https://$REPO_HOST/raven-archive-keyring.asc" \
      | $SUDO gpg --dearmor --yes -o /etc/apt/keyrings/raven-archive-keyring.gpg
    $SUDO chmod 0644 /etc/apt/keyrings/raven-archive-keyring.gpg

    # 3. repository
    echo "deb [signed-by=/etc/apt/keyrings/raven-archive-keyring.gpg] https://$REPO_HOST stable main" \
      | $SUDO tee /etc/apt/sources.list.d/raven.list >/dev/null

    # 4. install
    $SUDO apt-get update -qq
    $SUDO apt-get install -y raven-server

    say ""
    say "Installed. Next:"
    say "  raven-server start        # web UI on http://localhost:8080"
    say "  raven-server auth login   # one-time: pair to enable AI features"
    say ""
    say "Operator CLI (optional):    $SUDO apt-get install -y raven-cli"
    ;;
  Darwin)
    say "macOS detected. Raven ships a native macOS binary and a Docker image."
    say "Grab either from:"
    say "  $SITE/#download"
    ;;
  *)
    say "Unsupported platform: $OS"
    say "See all install options at:"
    say "  $SITE/#download"
    ;;
esac