#!/bin/sh
# Install the pinned ARM64 operator toolchain on the persistent owner volume.
set -eu

tools=${HERMES_AGENT_TOOLS_DIR:-/opt/data/tools}
python=${HERMES_AGENT_PYTHON:-/opt/hermes/.venv/bin/python}
bin=${tools}/bin
stamp=${tools}/.operator-cli-versions-2.7.0-3.18.6-5.7.1-1.8.1-4.47.1-2.78.0-2.0.4-3.13.3-1.3.1-0.51.0-1.15.8
mkdir -p "${bin}"

if [ -f "${stamp}" ]; then
  exit 0
fi

work=$(mktemp -d "${tools}/.operator-tools.XXXXXX")
trap 'rm -rf "${work}"' 0 HUP INT TERM

fetch() {
  url=$1
  checksum=$2
  destination=$3
  curl -fsSL -o "${destination}" "${url}"
  printf '%s  %s\n' "${checksum}" "${destination}" | sha256sum -c -
}

publish() {
  source=$1
  name=$2
  chmod 0755 "${source}"
  mv "${source}" "${bin}/${name}"
}

fetch \
  https://github.com/fluxcd/flux2/releases/download/v2.7.0/flux_2.7.0_linux_arm64.tar.gz \
  758703b8cd96be98f1ea23b7bd3ff2ae13d90a23467d8aba8b83adbe335c6854 \
  "${work}/flux.tar.gz"
mkdir "${work}/flux"
tar -xzf "${work}/flux.tar.gz" -C "${work}/flux"
publish "${work}/flux/flux" flux

fetch \
  https://get.helm.sh/helm-v3.18.6-linux-arm64.tar.gz \
  5b8e00b6709caab466cbbb0bc29ee09059b8dc9417991dd04b497530e49b1737 \
  "${work}/helm.tar.gz"
mkdir "${work}/helm"
tar -xzf "${work}/helm.tar.gz" -C "${work}/helm"
publish "${work}/helm/linux-arm64/helm" helm

fetch \
  https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.7.1/kustomize_v5.7.1_linux_arm64.tar.gz \
  4261a040217df3bd6896597c3986d1465925726e4f22a945304b5233a4dcdbda \
  "${work}/kustomize.tar.gz"
mkdir "${work}/kustomize"
tar -xzf "${work}/kustomize.tar.gz" -C "${work}/kustomize"
publish "${work}/kustomize/kustomize" kustomize

fetch \
  https://github.com/jqlang/jq/releases/download/jq-1.8.1/jq-linux-arm64 \
  6bc62f25981328edd3cfcfe6fe51b073f2d7e7710d7ef7fcdac28d4e384fc3d4 \
  "${work}/jq"
publish "${work}/jq" jq

fetch \
  https://github.com/mikefarah/yq/releases/download/v4.47.1/yq_linux_arm64 \
  b7f7c991abe262b0c6f96bbcb362f8b35429cefd59c8b4c2daa4811f1e9df599 \
  "${work}/yq"
publish "${work}/yq" yq

fetch \
  https://github.com/cli/cli/releases/download/v2.78.0/gh_2.78.0_linux_arm64.tar.gz \
  9e3ca75b227a5503f6ef92c4b8b6dbf94e34bfdd8069ac0f16b8739856ebba7b \
  "${work}/gh.tar.gz"
mkdir "${work}/gh"
tar -xzf "${work}/gh.tar.gz" -C "${work}/gh"
publish "${work}/gh/gh_2.78.0_linux_arm64/bin/gh" gh

fetch \
  https://releases.hashicorp.com/vault/2.0.4/vault_2.0.4_linux_arm64.zip \
  87bb68fdd04ca90cd4cf54f8cd783a037fbf860b73d85e6697f6129dac49c683 \
  "${work}/vault.zip"
mkdir "${work}/vault"
"${python}" -m zipfile -e "${work}/vault.zip" "${work}/vault"
publish "${work}/vault/vault" vault

fetch \
  https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.linux.arm64 \
  53b0abacd38ef1b12a66d6c100956691b9cefce018d91f81e73ddf7438b94d77 \
  "${work}/sops"
publish "${work}/sops" sops

fetch \
  https://github.com/FiloSottile/age/releases/download/v1.3.1/age-v1.3.1-linux-arm64.tar.gz \
  c6878a324421b69e3e20b00ba17c04bc5c6dab0030cfe55bf8f68fa8d9e9093a \
  "${work}/age.tar.gz"
mkdir "${work}/age"
tar -xzf "${work}/age.tar.gz" -C "${work}/age"
for name in age age-inspect age-keygen age-plugin-batchpass; do
  publish "${work}/age/age/${name}" "${name}"
done

fetch \
  https://github.com/derailed/k9s/releases/download/v0.51.0/k9s_Linux_arm64.tar.gz \
  3ee05c82e5f9198928a4e86133608ba6a2c10a2244d6a7789e820f78319d640c \
  "${work}/k9s.tar.gz"
mkdir "${work}/k9s"
tar -xzf "${work}/k9s.tar.gz" -C "${work}/k9s"
publish "${work}/k9s/k9s" k9s

fetch \
  https://releases.hashicorp.com/terraform/1.15.8/terraform_1.15.8_linux_arm64.zip \
  8891e9dcedc9e3b8950bc6af9d4d8af1f4cfade3062f53b9dc403a89f6ce8c9c \
  "${work}/terraform.zip"
mkdir "${work}/terraform"
"${python}" -m zipfile -e "${work}/terraform.zip" "${work}/terraform"
publish "${work}/terraform/terraform" terraform

touch "${stamp}"
