#!/usr/bin/env bash
# Install a pinned Trivy release into a directory, verifying its sha256.
#
# Usage: scripts/ci/install_trivy.sh <dest-dir>
#
# The binary ends up at <dest-dir>/trivy. To upgrade, bump TRIVY_VERSION and both
# digests from the release's trivy_<version>_checksums.txt.
set -euo pipefail

TRIVY_VERSION="0.76.0"
SHA256_X64="e24b1c51293c1b15e4ba8d45bbc7891ba053f90278ec2698f3562c993e145fe7"
SHA256_ARM64="aab21e677a7b7071fc79f1711480840754c18a1b9d9cefa7ccd06af63a0e8f4c"

dest="${1:?usage: install_trivy.sh <dest-dir>}"

case "$(uname -m)" in
  x86_64 | amd64)
    arch="64bit"
    expected="${SHA256_X64}"
    ;;
  aarch64 | arm64)
    arch="ARM64"
    expected="${SHA256_ARM64}"
    ;;
  *)
    echo "unsupported architecture: $(uname -m)" >&2
    exit 1
    ;;
esac

archive="trivy_${TRIVY_VERSION}_Linux-${arch}.tar.gz"
url="https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"

work="$(mktemp -d)"
trap 'rm -rf "${work}"' EXIT

curl --fail --silent --show-error --location --retry 3 --output "${work}/${archive}" "${url}"
echo "${expected}  ${work}/${archive}" | sha256sum --check --status || {
  echo "sha256 mismatch for ${archive}" >&2
  exit 1
}

mkdir -p "${dest}"
tar -xzf "${work}/${archive}" -C "${dest}" trivy
chmod 0755 "${dest}/trivy"
"${dest}/trivy" version