#!/bin/sh
# quorum. the house, for 20 minutes, on your machine and no other.
#
# what this does, in order:
#   1. checks you have a working python3
#   2. makes a temporary directory
#   3. fetches https://1908.sh/house.tgz into it
#   4. checks that tarball against a sha256 fixed when this file was written,
#      and stops if it does not match
#   5. serves it to 127.0.0.1 only, for 20 minutes
#   6. deletes the directory and stops, on the timer or on ctrl-c
#
# nothing is written outside the temporary directory. nothing is sent anywhere.
# no part of it is left behind. this file is the whole of what runs.
set -eu

SUM=b945a02c8225d8df77746ecfd4748e988315d81a31243b49a0edb565082ab71f
URL=https://1908.sh/house.tgz

say() { printf '  %s\n' "$1" >&2; }

python3 -c "import sys" >/dev/null 2>&1 || {
  say ""; say "this needs python3 and cannot find a working one."; say ""
  say "on a mac:    xcode-select --install"
  say "on debian:   sudo apt install python3"; say ""
  exit 1
}

if command -v curl >/dev/null 2>&1; then
  GET="curl -fsSL"
elif command -v wget >/dev/null 2>&1; then
  GET="wget -qO-"
else
  say "this needs curl or wget and has neither."; exit 1
fi

if command -v shasum >/dev/null 2>&1; then
  SUMCMD="shasum -a 256"
elif command -v sha256sum >/dev/null 2>&1; then
  SUMCMD="sha256sum"
else
  say "this needs shasum or sha256sum to check what it fetched."; exit 1
fi

D=$(mktemp -d "${TMPDIR:-/tmp}/quorum.XXXXXXXX")
cleanup() { rm -rf "$D"; }
trap cleanup EXIT INT TERM

$GET "$URL" > "$D/house.tgz" || { say "could not reach $URL"; exit 1; }

GOT=$($SUMCMD "$D/house.tgz" | cut -d' ' -f1)
if [ "$GOT" != "$SUM" ]; then
  say ""
  say "the house does not match its seal and has not been opened."
  say ""
  say "  expected  $SUM"
  say "  found     $GOT"
  say ""
  exit 1
fi

tar xzf "$D/house.tgz" -C "$D"
exec python3 "$D/sit" --root "$D/site" --minutes 20