#!/bin/bash
# install-cosign.sh [dir]: cosign, pinned, checked against its release checksum.
#
# Bump the version and both checksums together, from the release's
# cosign_checksums.txt.
set -euo pipefail
VERSION=v3.1.3
SHA256_AMD64=4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71
SHA256_ARM64=c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a
dir=${1:-/usr/local/bin}

case $(uname -m) in
  x86_64) arch=amd64 sha=$SHA256_AMD64 ;;
  aarch64) arch=arm64 sha=$SHA256_ARM64 ;;
  *) echo "no cosign checksum for $(uname -m)" >&2; exit 1 ;;
esac
if [ -x "$dir/cosign" ] && echo "$sha  $dir/cosign" | sha256sum -c - >/dev/null 2>&1; then
  exit 0
fi
tmp=$(mktemp)
curl -fsSLo "$tmp" "https://github.com/sigstore/cosign/releases/download/$VERSION/cosign-linux-$arch"
echo "$sha  $tmp" | sha256sum -c - >/dev/null
install -m 0755 "$tmp" "$dir/cosign"
rm -f "$tmp"
echo "cosign $VERSION ($arch) in $dir"