#!/bin/bash
# Installs Centhead on a Mac. Run it with:   curl -fsSL https://centhead.com/get/install-mac.sh | bash
# What it does, nothing else: downloads the app for this Mac from centhead.com/get, checks its SHA-256 against centhead.com/get/latest.json,
# unpacks it into ~/Applications, removes the "downloaded from the internet" flag, signs the app "ad hoc" on THIS Mac (the app is not signed by Apple or by a
# developer certificate, and Apple silicon will not start an edited, unsigned bundle), and opens it. Read it before you run it; it is short.
set -euo pipefail
BASE="https://centhead.com/get"
case "$(uname -m)" in arm64) FILE="Centhead-mac-arm64.zip" ;; *) FILE="Centhead-mac-x64.zip" ;; esac
TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
echo "Centhead for macOS: looking up the newest version..."
curl -fsSL "$BASE/latest.json" -o "$TMP/latest.json"
WANT="$(tr -d ' \n\r\t' < "$TMP/latest.json" | sed -n "s/.*\"$FILE\":{\"sha256\":\"\([0-9a-f]\{64\}\)\".*/\1/p")"
[ -n "$WANT" ] || { echo "No $FILE in the newest release yet. See https://centhead.com/download"; exit 1; }
echo "Downloading $FILE ..."
curl -fL --progress-bar "$BASE/$FILE" -o "$TMP/$FILE"
GOT="$(shasum -a 256 "$TMP/$FILE" | cut -d' ' -f1)"
if [ "$GOT" != "$WANT" ]; then echo "The download does not match its published fingerprint. Nothing was installed."; exit 1; fi
DEST="$HOME/Applications"; mkdir -p "$DEST"
rm -rf "$DEST/Centhead.app"
ditto -x -k "$TMP/$FILE" "$DEST"
xattr -cr "$DEST/Centhead.app" 2>/dev/null || true
codesign --force --deep --sign - "$DEST/Centhead.app" >/dev/null 2>&1 || echo "(could not sign the app; if macOS refuses to open it, run: codesign --force --deep --sign - \"$DEST/Centhead.app\")"
echo "Installed to $DEST/Centhead.app"
open "$DEST/Centhead.app"