getsops.sh

#!/usr/bin/env bash
# Setup script for sops on Linux

set -euo pipefail

# ----------------------------
# Config (can be overridden)
# ----------------------------
SOPS_VER="${SOPS_VER:-}"                 # e.g. v3.9.0; empty means "latest"
DEST_DEFAULT="/usr/local/bin/sops"
DEST="${DEST:-$DEST_DEFAULT}"
ARCH="${ARCH:-}"                         # auto-detected if empty
OS="${OS:-linux}"                        # only linux supported in this script
COLOR="${COLOR:-auto}"                   # auto|always|never

# ----------------------------
# Styling helpers
# ----------------------------
supports_color() {
  [ -t 1 ] || return 1
  command -v tput >/dev/null 2>&1 || return 1
  tput colors >/dev/null 2>&1 && [ "$(tput colors)" -ge 8 ]
}

if { [ "$COLOR" = "always" ] || { [ "$COLOR" = "auto" ] && supports_color; }; }; then
  BOLD="$(printf '\033[1m')"
  DIM="$(printf '\033[2m')"
  RED="$(printf '\033[31m')"
  GREEN="$(printf '\033[32m')"
  YELLOW="$(printf '\033[33m')"
  BLUE="$(printf '\033[34m')"
  RESET="$(printf '\033[0m')"
else
  BOLD=""; DIM=""; RED=""; GREEN=""; YELLOW=""; BLUE=""; RESET=""
fi

info() { printf "%s[info]%s %s\n" "$BLUE" "$RESET" "$*"; }
ok() { printf "%s[ ok ]%s %s\n" "$GREEN" "$RESET" "$*"; }
warn() { printf "%s[warn]%s %s\n" "$YELLOW" "$RESET" "$*"; }
err() { printf "%s[fail]%s %s\n" "$RED" "$RESET" "$*"; }

# ----------------------------
# Helpers
# ----------------------------
need_cmd() {
  command -v "$1" >/dev/null 2>&1 || { err "Missing required command: $1"; exit 1; }
}

have_cmd() { command -v "$1" >/dev/null 2>&1; }

# Detect arch -> sops naming scheme uses: linux.amd64, linux.arm64
detect_arch() {
  local u
  u="$(uname -m)"
  case "$u" in
    x86_64|amd64) echo "amd64" ;;
    aarch64|arm64) echo "arm64" ;;
    armv7l|armv6l) echo "arm" ;;
    *) err "Unsupported architecture: $u"; exit 1 ;;
  esac
}

# Check writability of destination
can_write() {
  local path="$1"
  if [ -e "$path" ]; then
    [ -w "$path" ] && return 0 || return 1
  else
    # Check if directory is writable
    local dir
    dir="$(dirname "$path")"
    [ -w "$dir" ] && return 0 || return 1
  fi
}

require_sudo() {
  if can_write "$DEST"; then
    SUDO=""
  else
    if [ "$(id -u)" -ne 0 ]; then
      if have_cmd sudo; then
        SUDO="sudo"
        info "Will use sudo for writing to $DEST"
      else
        err "No write permission for $DEST and sudo not found."
        exit 1
      fi
    else
      SUDO=""
    fi
  fi
}

# Get latest tag from GitHub API (no auth)
fetch_latest_tag() {
  need_cmd curl
  local api="https://api.github.com/repos/getsops/sops/releases/latest"
  local tag
  tag="$(curl -fsSL "$api" | sed -n 's/.*"tag_name": *"\([^"]*\)".*/\1/p' | head -n1)"
  if [ -z "$tag" ]; then
    warn "Could not resolve latest version via API; falling back to v3.11.0"
    tag="v3.11.0"
  fi
  echo "$tag"
}

# Download to temp and move atomically
install_file() {
  local url="$1"
  local dest="$2"
  local tmp
  tmp="$(mktemp)"
  trap 'rm -f "$tmp"' EXIT

  info "Downloading: $url"
  curl -fL --retry 3 --retry-delay 1 -o "$tmp" "$url"

  # Make executable
  chmod +x "$tmp"

  # Ensure destination dir exists
  local d
  d="$(dirname "$dest")"
  if [ ! -d "$d" ]; then
    require_sudo
    $SUDO mkdir -p "$d"
  fi

  require_sudo
  $SUDO mv "$tmp" "$dest"
  trap - EXIT
}

verify_checksum_if_available() {
  local ver="$1"
  local asset="sops-${ver}.${OS}.${ARCH}"
  local base="https://github.com/getsops/sops/releases/download/${ver}"
  local sum_url="${base}/checksums.txt"
  local sig_url="${base}/checksums.txt.sig"
  local sum_tmp sig_tmp
  sum_tmp="$(mktemp)"
  sig_tmp="$(mktemp)"
  trap 'rm -f "$sum_tmp" "$sig_tmp"' RETURN

  if ! curl -fsSL -o "$sum_tmp" "$sum_url"; then
    warn "No checksums file found for ${ver}; skipping checksum verification."
    return 0
  fi

  # If gpg and the signing key are available, verify signature; otherwise skip
  if have_cmd gpg && curl -fsSL -o "$sig_tmp" "$sig_url"; then
    info "Verifying checksum signature (gpg)..."
    if ! gpg --verify "$sig_tmp" "$sum_tmp" 2>/dev/null; then
      warn "GPG verification failed or key missing; continuing with SHA256 check only."
    fi
  fi

  # Extract expected checksum and compare
  local expected
  expected="$(grep " ${asset}$" "$sum_tmp" | awk '{print $1}' || true)"
  if [ -z "$expected" ]; then
    warn "Could not find checksum line for ${asset}; skipping checksum verification."
    return 0
  fi

  if have_cmd sha256sum; then
    local actual
    actual="$(sha256sum "$DEST" | awk '{print $1}')"
    if [ "$expected" != "$actual" ]; then
      err "Checksum mismatch for ${asset} (expected ${expected}, got ${actual})"
      exit 1
    fi
    ok "Checksum verified."
  else
    warn "sha256sum not available; skipping checksum verification."
  fi
}

# ----------------------------
# Parse simple flags
# ----------------------------
usage() {
  cat <<EOF
${BOLD}sops install helper${RESET}
Usage: SOPS_VER=vX.Y.Z DEST=/path/to/sops ARCH=amd64 ./install-sops.sh
Flags:
  --version vX.Y.Z   Install specific version (overrides SOPS_VER env)
  --dest PATH        Install path (default: ${DEST_DEFAULT})
  --arch ARCH        Override detected arch (amd64|arm64)
  --no-checksum      Skip checksum verification
  -h, --help         Show this help
Environment:
  SOPS_VER, DEST, ARCH, COLOR
EOF
}

SKIP_CHECKSUM=0
while [ "${1:-}" != "" ]; do
  case "$1" in
    --version)
      shift; SOPS_VER="${1:-}";;
    --dest)
      shift; DEST="${1:-}";;
    --arch)
      shift; ARCH="${1:-}";;
    --no-checksum)
      SKIP_CHECKSUM=1;;
    -h|--help)
      usage; exit 0;;
    *)
      err "Unknown argument: $1"; usage; exit 1;;
  esac
  shift || true
done

# ----------------------------
# Main
# ----------------------------
need_cmd curl
need_cmd uname

[ -n "$ARCH" ] || ARCH="$(detect_arch)"

if [ -z "${SOPS_VER}" ]; then
  info "Resolving latest sops release version..."
  SOPS_VER="$(fetch_latest_tag)"
fi

info "Preparing to install sops ${BOLD}${SOPS_VER}${RESET} for ${OS}.${ARCH}"
info "Destination: ${DEST}"

ASSET="sops-${SOPS_VER}.${OS}.${ARCH}"
URL="https://github.com/getsops/sops/releases/download/${SOPS_VER}/${ASSET}"

# If existing binary, show current version
if [ -x "$DEST" ]; then
  CURR_VER="$("$DEST" --version 2>/dev/null || echo "")"
  if [ -n "$CURR_VER" ]; then
    info "Existing sops detected: $CURR_VER"
  fi
fi

install_file "$URL" "$DEST"

# Verify checksum if possible
if [ "$SKIP_CHECKSUM" -eq 0 ]; then
  verify_checksum_if_available "$SOPS_VER"
else
  warn "Checksum verification disabled by --no-checksum"
fi

# Verify execution
if "$DEST" --version >/dev/null 2>&1; then
  ok "sops installed successfully: $("$DEST" --version)"
else
  err "sops did not execute as expected after install."
  exit 1
fi