@gizai/cli 2.1.2 → 2.2.0

package/bin/install.sh

@@ -1,260 +0,0 @@
-#!/bin/sh
-# Install Gizlang: curl -fsSL https://gizstack.com/install | sh
-# Install it for the GizDB server: curl -fsSL https://gizstack.com/install | sh -s -- --only gizdb
-# While gizstack.com is in private preview, the command on your signed-in page adds
-# -H "Authorization: Bearer TOKEN": the script served for it carries that access token
-# and stores it in ~/.config/gizstack/access-token, where the installer and
-# `giz upgrade` read it.
-#
-# This script downloads the official installer for your platform from its
-# content address, checks its SHA-256 against that address and runs it. The
-# installer verifies the release signature and every file hash before it
-# activates the version. Nothing needs root. Docs: https://gizstack.com/docs/start
-#
-# Options (sh -s -- OPTION...):
-#   --only gizdb           install it for the GizDB server, into ~/.gizdb: bin/gizdb
-#                          runs the server, which compiles its scan kernels with it
-#   --version VERSION      install this published version (default: the newest)
-#   --no-modify-path       do not add the bin directory to shell profiles
-#   --installer FILE       use this downloaded installer (the npm and Homebrew
-#                          packages carry it); its SHA-256 is checked the same way
-#   --if-missing           do nothing when this version is installed already
-#                          (the package wrappers run it before each command)
-# Environment: GIZ_INSTALL (default ~/.giz; with --only gizdb,
-#   GIZDB_INSTALL, default ~/.gizdb), NO_MODIFY_PATH=1.
-#
-# Everything runs inside main(), called on the last line, so a download that
-# is cut off does nothing.
-
-set -u
-
-SITE="https://gizstack.com"
-# The access token this script was served for (the server writes it here), or empty.
-ACCESS=''
-
-# Published installers: target, version, installer SHA-256.
-# Generated from $SITE/api/releases when this script was served.
-releases() {
-	cat <<'RELEASES'
-x86_64-unknown-linux-gnu 0.1.0-preview.20261023.8 69c0c897fa694c7e9b9fa8de9dec8d54b0479d5b451fa2a118c427300c111aac
-RELEASES
-}
-
-say() { printf '%s\n' "$*"; }
-fail() { printf 'giz-install: %s\n' "$*" >&2; exit 1; }
-
-detect_target() {
-	os=$(uname -s)
-	arch=$(uname -m)
-	case "$arch" in
-		x86_64 | amd64) arch=x86_64 ;;
-		aarch64 | arm64) arch=aarch64 ;;
-		*) fail "unsupported CPU architecture: $arch. Supported platforms: $SITE/download" ;;
-	esac
-	case "$os" in
-		Linux)
-			libc=gnu
-			if ls /lib/ld-musl-* >/dev/null 2>&1 || (ldd --version 2>&1 | grep -qi musl); then libc=musl; fi
-			target="$arch-unknown-linux-$libc" ;;
-		Darwin)
-			# No macOS release until a Mac builds and tests it: say so instead of naming a missing target.
-			printf '%s\n' "macOS is coming; use the Playground ($SITE/play) or a Linux machine meanwhile" >&2
-			exit 1 ;;
-		MINGW* | MSYS* | CYGWIN* | Windows_NT)
-			fail "on Windows, run in PowerShell: irm $SITE/install.ps1 | iex" ;;
-		*) fail "unsupported operating system: $os. Supported platforms: $SITE/download" ;;
-	esac
-}
-
-# Sets digest and version from the table, or explains what exists.
-select_release() {
-	digest=""
-	[ -n "$(releases)" ] || fail "no Gizlang release supports this install script yet. Download an installer: $SITE/download"
-	found=$(releases | while read -r t v d; do
-		if [ "$t" = "$target" ] && { [ -z "$wanted" ] || [ "$v" = "$wanted" ]; }; then say "$v $d"; break; fi
-	done)
-	if [ -n "$found" ]; then version=${found% *}; digest=${found#* }; return; fi
-	available=$(releases | while read -r t v d; do if [ "$t" = "$target" ]; then printf ' %s' "$v"; fi; done)
-	if [ -n "$available" ]; then fail "$name $wanted is not published for $target. Published:$available"; fi
-	platforms=$(releases | while read -r t v d; do printf '\n  %s' "$t"; done)
-	[ -n "$platforms" ] || fail "no $name release supports this install script yet. Release status: $SITE/download"
-	fail "no $name release for $target yet. Published platforms:$platforms
-Use the browser Playground meanwhile: $SITE/play. Release status: $SITE/download"
-}
-
-download() { # URL FILE
-	if command -v curl >/dev/null 2>&1; then
-		if [ -n "$KEY" ]; then curl --proto '=https' --tlsv1.2 -fsSL --retry 3 -H "Authorization: Bearer $KEY" -o "$2" "$1"
-		else curl --proto '=https' --tlsv1.2 -fsSL --retry 3 -o "$2" "$1"; fi
-	elif command -v wget >/dev/null 2>&1; then
-		if [ -n "$KEY" ]; then wget --https-only -q --header="Authorization: Bearer $KEY" -O "$2" "$1"
-		else wget --https-only -q -O "$2" "$1"; fi
-	elif command -v node >/dev/null 2>&1; then
-		# The npm package runs this script, so Node.js is there even where curl and wget are not (node:*-slim, a minimal WSL).
-		node -e 'const [u, f, k] = process.argv.slice(1); if (!u.startsWith("https://")) { console.error("not https: " + u); process.exit(1); }
-require("https").get(u, { headers: k ? { Authorization: "Bearer " + k } : {} }, (r) => {
-	if (r.statusCode !== 200) { console.error("HTTP " + r.statusCode + " for " + u); process.exit(1); }
-	r.pipe(require("fs").createWriteStream(f)).on("error", (e) => { console.error(e.message); process.exit(1); });
-}).on("error", (e) => { console.error(e.message); process.exit(1); });' "$1" "$2" "$KEY"
-	else
-		fail "curl, wget or node is required"
-	fi
-}
-
-sha256() {
-	if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d ' ' -f 1
-	elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | cut -d ' ' -f 1
-	elif command -v openssl >/dev/null 2>&1; then openssl dgst -sha256 -r "$1" | cut -d ' ' -f 1
-	else fail "sha256sum, shasum or openssl is required to check the installer"
-	fi
-}
-
-add_line() { # FILE LINE: append LINE once
-	if [ -f "$1" ] && grep -qxF "$2" "$1"; then return; fi
-	printf '\n%s\n' "$2" >>"$1" && changed="$changed $1"
-}
-
-# One line in each profile sources $root/env, which adds bin to PATH once.
-modify_path() {
-	bin="$root/bin"
-	cat >"$root/env" <<ENV
-# Added by the $name installer.
-case ":\${PATH}:" in *":$bin:"*) ;; *) export PATH="$bin:\$PATH" ;; esac
-ENV
-	cat >"$root/env.fish" <<ENV
-# Added by the $name installer.
-if not contains -- "$bin" \$PATH; set -gx PATH "$bin" \$PATH; end
-ENV
-	line=". \"$root/env\""
-	zshrc="${ZDOTDIR:-$HOME}/.zshrc"
-	for profile in "$HOME/.profile" "$HOME/.bashrc" "$HOME/.bash_profile" "$zshrc"; do
-		case "$profile" in
-			"$HOME/.bash_profile") [ -f "$profile" ] || continue ;;
-			"$zshrc") [ -f "$profile" ] || command -v zsh >/dev/null 2>&1 || continue ;;
-		esac
-		add_line "$profile" "$line"
-	done
-	if command -v fish >/dev/null 2>&1 || [ -d "$HOME/.config/fish" ]; then
-		mkdir -p "$HOME/.config/fish/conf.d"
-		fishline="source \"$root/env.fish\""
-		fishrc="$HOME/.config/fish/conf.d/$command.fish"
-		add_line "$fishrc" "$fishline"
-	fi
-	# The profile this shell reads, for the line that tells the person what to source now.
-	case "${SHELL:-}" in
-		*/zsh) rc=$zshrc ;;
-		*/fish) rc=${fishrc:-$HOME/.bashrc} ;;
-		*) rc="$HOME/.bashrc" ;;
-	esac
-}
-
-# The installer, `giz upgrade` and package reads send this token to gizstack.com.
-store_access() {
-	[ -n "$ACCESS" ] || return 0
-	config="${XDG_CONFIG_HOME:-$HOME/.config}/gizstack"
-	(umask 077 && mkdir -p "$config" && printf '%s\n' "$ACCESS" >"$config/access-token.new" && mv "$config/access-token.new" "$config/access-token") || fail "cannot store the access token in $config"
-}
-
-# A script not served with a key (npm, or a rerun) takes the key the way access.giz does: GIZ_ACCESS_TOKEN, else the
-# file. Only the downloads below use it, and only from $SITE. A value outside the token alphabet is refused whole, as
-# access.giz refuses it, so a bad value is never sent.
-resolve_access() {
-	KEY=$ACCESS
-	if [ -z "$KEY" ]; then KEY=$(printf '%s' "${GIZ_ACCESS_TOKEN:-}" | tr -d ' \t\r\n'); fi
-	if [ -z "$KEY" ] && [ -n "${HOME:-}" ]; then
-		KEY=$(tr -d ' \t\r\n' 2>/dev/null <"${XDG_CONFIG_HOME:-$HOME/.config}/gizstack/access-token")
-	fi
-	case "$KEY" in *[!0-9a-z_]*) KEY='' ;; esac
-}
-
-main() {
-	wanted=""
-	local_installer=""
-	if_missing=0
-	only=""
-	path_changes=1
-	if [ -n "${NO_MODIFY_PATH:-}" ]; then path_changes=0; fi
-	while [ $# -gt 0 ]; do
-		case "$1" in
-			--only) [ $# -ge 2 ] || fail "--only needs a value"; [ "$2" = gizdb ] || fail "--only takes gizdb (the GizDB server), not $2"; only=gizdb; shift 2 ;;
-			--version) [ $# -ge 2 ] || fail "--version needs a value"; wanted=$2; shift 2 ;;
-			--no-modify-path) path_changes=0; shift ;;
-			--if-missing) if_missing=1; shift ;;
-			--installer) [ $# -ge 2 ] || fail "--installer needs a value"; local_installer=$2; shift 2 ;;
-			-h | --help) say "Usage: curl -fsSL $SITE/install | sh -s -- [--only gizdb] [--version VERSION] [--no-modify-path]"; say "Docs: $SITE/docs/start"; exit 0 ;;
-			*) fail "unknown option: $1 (see $SITE/docs/start)" ;;
-		esac
-	done
-	# For the GizDB server the toolchain goes to a folder of its own: its bin/gizdb runs the server, which compiles its
-	# scan kernels with that toolchain (a server without a compiler ran every query on the interpreter).
-	if [ "$only" = gizdb ]; then
-		name=GizDB; command=gizdb; variable=GIZDB_INSTALL; root="${GIZDB_INSTALL:-}"; home=.gizdb
-	else
-		name=Gizlang; command=giz; variable=GIZ_INSTALL; root="${GIZ_INSTALL:-}"; home=.giz
-	fi
-	if [ -z "$root" ]; then
-		[ -n "${HOME:-}" ] || fail "HOME is not set; set $variable to the installation directory"
-		root="$HOME/$home"
-		# An install from before the command was gizstack (~/.gizlang) is upgraded in place: the installer then removes
-		# its gizlang command, and no second command stays on PATH.
-		if [ "$only" != gizdb ] && [ ! -e "$root" ] && [ -f "$HOME/.gizlang/active-toolchain" ]; then root="$HOME/.gizlang"; fi
-	fi
-	if [ "$wanted" = latest ]; then wanted=""; fi
-	case "$root" in
-		/*) ;;
-		*) fail "$variable must be an absolute path: $root" ;;
-	esac
-	case "$root" in
-		*[\"\$\`\\]*) fail "$variable cannot contain quotes, \$, backquotes or backslashes: $root" ;;
-	esac
-
-	detect_target
-	select_release
-	if [ "$if_missing" = 1 ]; then
-		for installed in "$root/versions/toolchain-$target-$version-"*; do
-			if [ -f "$installed/release.json" ]; then exit 0; fi
-		done
-	fi
-
-	work=$(mktemp -d 2>/dev/null || mktemp -d -t giz) || fail "cannot create a temporary directory"
-	trap 'rm -rf "$work"' EXIT
-	installer="$work/$command-installer"
-	if [ -n "$local_installer" ]; then
-		cp "$local_installer" "$installer" || fail "cannot read the installer $local_installer"
-	else
-		resolve_access
-		if ! download "$SITE/objects/sha256/$digest" "$installer"; then
-			[ -n "$KEY" ] || fail "the installer download was refused: $name is in private preview. Signed in at $SITE, your install command on $SITE/download carries your access key (or set GIZ_ACCESS_TOKEN). No invitation yet: $SITE/access-request"
-			fail "the installer download failed: $SITE/objects/sha256/$digest"
-		fi
-	fi
-	actual=$(sha256 "$installer")
-	[ "$actual" = "$digest" ] || fail "the installer SHA-256 is $actual, not $digest; nothing was installed"
-	chmod u+x "$installer"
-
-	store_access
-	mkdir -p "$root" || fail "cannot create $root"
-	# The installer's own report is for a direct run; here the one summary line below says it.
-	report=$("$installer" --root "$root") || { printf '%s\n' "$report" >&2; fail "the installer failed; the previous version, if any, stays active"; }
-
-	changed=""
-	if [ "$path_changes" = 1 ]; then modify_path; fi
-	if [ "$only" = gizdb ]; then
-		# gizdb has no --version; its usage proves the installed server runs here.
-		"$root/bin/gizdb" --help >/dev/null || fail "$root/bin/gizdb does not run on this computer"
-		next="GIZDB_PASSWORD=... gizdb serve --dir ~/gizdb-data --port 5432"
-	else
-		"$root/bin/giz" --version >/dev/null || fail "$root/bin/giz does not run on this computer"
-		next="giz init hello && cd hello && giz run main.giz"
-	fi
-	shown=$root
-	case "$root" in "${HOME:-/nonexistent}"/*) shown="~${root#"$HOME"}" ;; esac
-	kb=$(du -sk "$root/versions" 2>/dev/null | cut -f 1)
-	say "$name $version installed ($(( (${kb:-0} + 512) / 1024 )) MB in $shown). Next: $next"
-	# PATH text only when a profile changed: under --no-modify-path (the npm package) the command is already found.
-	if [ -n "$changed" ]; then
-		say "Added $shown/bin to PATH in:$(printf %s "$changed" | sed "s#$HOME/#~/#g"). Open a new terminal, or run: source $(printf %s "$rc" | sed "s#^$HOME/#~/#")"
-	fi
-}
-
-main "$@"