bootstrap

#!/usr/bin/env bash
set -eu
test -z "${DEBUG:-}" || set -x

##
# parameters
opts="Dhm"
minimal=""
: "${GIT_ROOT:=$HOME/git/sbaxter}"
: "${UMBRELLA_REPO:=sbaxter/sbaxter}"
: "${CLI_REPO:=sbaxter/cli}"

os=$(uname -s)

function usage {
  cat << _usage_
  $(basename "$0"): bootstrap a new machine from scratch (macOS or Linux).

  usage:
    $(basename "$0") [-$opts]

    D - turn on debug mode.
    h - you are here.
    m - minimal mode for lightweight machines:
        skips gh auth, cli.private (clone/install/gitconfig/Brewfile), rust,
        gcloud, gpg; uses Brewfile.lite on macOS.

  env:
    GIT_ROOT      - umbrella checkout location. default: \$HOME/git/sbaxter
    UMBRELLA_REPO - multi-repo orchestrator (full mode). default: sbaxter/sbaxter
    CLI_REPO      - public cli repo (minimal mode only). default: sbaxter/cli

  os support:
    macOS  - Homebrew, macOS defaults, iTerm2, Netskope, gcloud.
    Linux  - apt/pacman/apk/dnf via cli/bin/pkg + cli/packages.tsv.
             Skips the macOS-only steps.

  idempotent: re-running skips steps already done.
_usage_
}

while getopts $opts opt; do
  case $opt in
    D)   DEBUG=true; set -x  ;;
    h)   usage; exit         ;;
    m)   minimal=1           ;;
    ?|*) echo; usage; exit 5 ;;
  esac
done
shift $((OPTIND-1))
##


##
# helpers
die() { echo "bootstrap: $1" >&2; exit 1; }

# run as root directly, otherwise via sudo.
_sudo() {
  if test "$(id -u)" -eq 0; then "$@"; else sudo "$@"; fi
}

# detect_pm: echo the Linux package manager. Duplicated (minimally) from
# cli/bin/pkg because gh must be installed before the cli repo — and thus
# pkg — is cloned.
detect_pm() {
  local m
  for m in apt-get dnf pacman apk zypper; do
    if command -v "$m" >/dev/null 2>&1; then
      test "$m" = apt-get && echo apt || echo "$m"
      return 0
    fi
  done
  return 1
}
##


##
# shared steps
##

# cache sudo credentials up front and keep them alive; Homebrew's installer
# and apt/dnf both need sudo mid-stream. no-op when already root.
function cache_sudo {
  test "$(id -u)" -eq 0 && return 0
  echo "==> caching sudo credentials (you may be prompted for your password)"
  sudo -v
  ( while true; do sudo -n true; sleep 60; kill -0 "$$" 2>/dev/null || exit; done ) &
  sudo_keepalive=$!
  trap 'kill "${sudo_keepalive:-}" 2>/dev/null || true' EXIT
}

# ensure gh is installed. macOS: Homebrew. Linux: native package, except
# apt/dnf where GitHub ships its own repo.
function ensure_gh {
  command -v gh >/dev/null 2>&1 && return 0
  echo "==> installing gh"
  case "$os" in
    Darwin) brew install gh ;;
    Linux)
      case "$(detect_pm)" in
        pacman) _sudo pacman -S --needed --noconfirm github-cli ;;
        apk)    _sudo apk add github-cli ;;
        dnf)    _sudo dnf install -y gh ;;
        apt)    linux_gh_apt_repo ;;
        *)      die "don't know how to install gh on this system" ;;
      esac ;;
  esac
}

# gh auth (interactive). request admin:public_key up front so ensure_ssh can
# upload a key via 'gh auth refresh' without a second browser dance.
function gh_auth {
  test -n "$minimal" && return 0
  if ! gh auth status 2>&1 | grep -q 'admin:public_key'; then
    echo "==> authenticating with GitHub (browser will open)"
    gh auth login --git-protocol ssh --web -s admin:public_key
  fi
}

# SSH plumbing for github.com: known_hosts seed, a local ed25519 key loaded
# into the agent (macOS keychain when available), and its public half on
# GitHub.
function ensure_ssh {
  test -n "$minimal" && return 0

  mkdir -p "$HOME/.ssh"; chmod 700 "$HOME/.ssh"
  touch "$HOME/.ssh/known_hosts"; chmod 600 "$HOME/.ssh/known_hosts"

  if ! ssh-keygen -F github.com -f "$HOME/.ssh/known_hosts" >/dev/null 2>&1; then
    echo "==> seeding github.com host keys into ~/.ssh/known_hosts"
    ssh-keyscan -t rsa,ecdsa,ed25519 github.com 2>/dev/null >> "$HOME/.ssh/known_hosts"
  fi

  local ssh_key="$HOME/.ssh/id_ed25519"
  if ! test -f "$ssh_key"; then
    echo "==> generating ed25519 SSH key at $ssh_key"
    ssh-keygen -t ed25519 -f "$ssh_key" -N "" -C "$(whoami)@$(hostname -s 2>/dev/null || hostname)"
  fi

  echo "==> loading $ssh_key into ssh-agent"
  if test "$os" = Darwin; then
    ssh-add --apple-use-keychain "$ssh_key" 2>/dev/null \
      || ssh-add -K "$ssh_key" 2>/dev/null \
      || ssh-add "$ssh_key" 2>/dev/null \
      || echo "warning: ssh-add failed; key generated but not loaded into agent" >&2
  else
    # start an agent for this session if none is reachable
    ssh-add -l >/dev/null 2>&1 || eval "$(ssh-agent -s)" >/dev/null
    ssh-add "$ssh_key" 2>/dev/null \
      || echo "warning: ssh-add failed; key generated but not loaded into agent" >&2
  fi

  local key_body
  key_body=$(cut -d' ' -f2 "$ssh_key.pub")
  if ! gh ssh-key list 2>/dev/null | grep -qF "$key_body"; then
    echo "==> uploading $ssh_key.pub to GitHub"
    gh ssh-key add "$ssh_key.pub" --title "$(whoami)@$(hostname -s 2>/dev/null || hostname) (bootstrap)"
  fi
}

# python with tomllib — the umbrella's make needs it (Python 3.11+).
function ensure_python {
  test -n "$minimal" && return 0
  python3 -c 'import tomllib' 2>/dev/null && return 0
  echo "==> installing python3 (needed by umbrella's make)"
  case "$os" in
    Darwin) brew install python3 ;;
    Linux)
      case "$(detect_pm)" in
        apt)    _sudo apt-get install -y python3 ;;
        pacman) _sudo pacman -S --needed --noconfirm python ;;
        apk)    _sudo apk add python3 ;;
        dnf)    _sudo dnf install -y python3 ;;
        *)      die "don't know how to install python3 on this system" ;;
      esac ;;
  esac
  hash -r
}

# clone repos. minimal: plain public clone of cli. full: umbrella + its own
# tooling (make clone/group/home) pulls cli, cli.private, memory.
function clone_repos {
  mkdir -p "$(dirname "$GIT_ROOT")"
  if test -n "$minimal"; then
    if ! test -d "$GIT_ROOT/cli/.git"; then
      echo "==> cloning $CLI_REPO into $GIT_ROOT/cli"
      mkdir -p "$GIT_ROOT"
      git clone "https://github.com/$CLI_REPO" "$GIT_ROOT/cli"
    fi
  else
    if ! test -d "$GIT_ROOT/.git"; then
      echo "==> cloning $UMBRELLA_REPO into $GIT_ROOT"
      gh repo clone "$UMBRELLA_REPO" "$GIT_ROOT"
    fi
    echo "==> make -C $GIT_ROOT clone/group/home"
    make -C "$GIT_ROOT" clone/group/home
  fi
}

# link dotfiles.
function link_dotfiles {
  echo "==> cli/install"
  "$GIT_ROOT/cli/install" -b .bak
  if test -z "$minimal"; then
    echo "==> cli.private/install"
    "$GIT_ROOT/cli.private/install" -b .bak
  fi
}

# seed ~/.gitconfig from cli.private only if it doesn't already exist.
function seed_gitconfig {
  test -n "$minimal" && return 0
  if ! test -e "$HOME/.gitconfig"; then
    echo "==> copying cli.private/gitconfig → ~/.gitconfig"
    cp "$GIT_ROOT/cli.private/gitconfig" "$HOME/.gitconfig"
  fi
}

# install packages. macOS: brew bundle. Linux: the whole manifest via pkg.
function install_packages {
  case "$os" in
    Darwin)
      if test -n "$minimal"; then
        echo "==> brew bundle: cli/Brewfile.lite"
        brew bundle --file="$GIT_ROOT/cli/Brewfile.lite"
      else
        echo "==> brew bundle: cli/Brewfile"
        brew bundle --file="$GIT_ROOT/cli/Brewfile"
        echo "==> brew bundle: cli.private/Brewfile"
        brew bundle --file="$GIT_ROOT/cli.private/Brewfile"
      fi ;;
    Linux)
      local pkg="$GIT_ROOT/cli/bin/pkg"
      echo "==> pkg refresh + install (cli/packages.tsv)"
      "$pkg" refresh
      # shellcheck disable=SC2046
      "$pkg" install $("$pkg" logicals)
      linux_fd_fixup ;;
  esac
}

# rust toolchain via rustup (cross-platform installer).
function ensure_rust {
  test -n "$minimal" && return 0
  if ! test -x "$HOME/.cargo/bin/rustc"; then
    echo "==> initializing rust toolchain"
    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
      | sh -s -- -y --default-toolchain stable --profile default --no-modify-path
  fi
  # shellcheck disable=SC1091
  test -f "$HOME/.cargo/env" && . "$HOME/.cargo/env"

  if command -v cargo >/dev/null 2>&1; then
    local crate sub
    for crate in cargo-deny cargo-release cargo-cyclonedx; do
      sub="${crate#cargo-}"
      if ! cargo --list 2>/dev/null | grep -qE "^[[:space:]]+${sub}([[:space:]]|$)"; then
        echo "==> cargo install $crate"
        cargo install --locked "$crate"
      fi
    done
  fi
}

# Claude Code (native binary). installer is idempotent and self-updating.
function ensure_claude {
  if ! test -x "$HOME/.local/bin/claude"; then
    echo "==> installing Claude Code"
    curl -fsSL https://claude.ai/install.sh | bash
  fi
}

# import GPG signing key if missing (interactive: passphrase).
function restore_gpg {
  test -n "$minimal" && return 0
  local signingkey
  signingkey=$(git config --global user.signingkey 2>/dev/null || true)
  if test -n "$signingkey" && ! gpg --list-secret-keys "$signingkey" >/dev/null 2>&1; then
    echo
    echo "==> GPG signing key $signingkey missing — running gpg-restore"
    "$GIT_ROOT/cli.private/bin/gpg-restore" || true
  fi
}
##


##
# macOS-only steps
##

# Homebrew (its installer handles Xcode command line tools).
function mac_homebrew {
  if ! command -v brew >/dev/null 2>&1; then
    echo "==> installing Homebrew"
    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
  fi
  if test -x /opt/homebrew/bin/brew; then
    eval "$(/opt/homebrew/bin/brew shellenv)"
  elif test -x /usr/local/bin/brew; then
    eval "$(/usr/local/bin/brew shellenv)"
  fi
}

function mac_defaults {
  echo "==> cli/bin/macos-defaults"
  "$GIT_ROOT/cli/bin/macos-defaults"
}

# restart iTerm2 (or open it) so custom prefs take effect. bootstrap runs
# from Terminal.app, so killing iTerm2 won't kill our shell.
function mac_iterm {
  if pgrep -q iTerm2; then
    echo "==> restarting iTerm2 to pick up custom prefs"
    osascript -e 'tell application "iTerm" to quit' >/dev/null 2>&1 || true
    sleep 1
  else
    echo "==> opening iTerm2"
  fi
  open -a iTerm
}

# Netskope CA bundle (corporate MITM trust). gated on STAgent being present.
function mac_nsca {
  test -n "$minimal" && return 0
  if test -d "/Library/Application Support/Netskope/STAgent" \
     && test -x "$GIT_ROOT/cli.private/bin/nsca"; then
    echo
    echo "==> cli.private/bin/nsca"
    "$GIT_ROOT/cli.private/bin/nsca"
    local ns="$HOME/.config/netskope/ca-bundle.pem"
    if test -f "$ns"; then
      export REQUESTS_CA_BUNDLE="$ns"
      export CURL_CA_BUNDLE="$ns"
      export NODE_EXTRA_CA_CERTS="$ns"
    fi
  fi
}

# gcloud setup (interactive; non-fatal).
function mac_gcs {
  test -n "$minimal" && return 0
  if test -x "$GIT_ROOT/cli.private/bin/gcs"; then
    echo
    echo "==> cli.private/bin/gcs"
    "$GIT_ROOT/cli.private/bin/gcs" || true
  fi
}
##


##
# Linux-only steps
##

# add GitHub's apt repo and install gh (canonical cli.github.com recipe).
function linux_gh_apt_repo {
  _sudo mkdir -p -m 755 /etc/apt/keyrings
  curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
    | _sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null
  _sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
    | _sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null
  _sudo apt-get update
  _sudo apt-get install -y gh
}

# Debian/Fedora ship fd as `fdfind` to avoid a name clash; symlink `fd` into
# ~/.local/bin (already on PATH via bash_profile) so muscle memory works.
function linux_fd_fixup {
  if command -v fdfind >/dev/null 2>&1 && ! command -v fd >/dev/null 2>&1; then
    mkdir -p "$HOME/.local/bin"
    ln -sf "$(command -v fdfind)" "$HOME/.local/bin/fd"
    echo "  link: ~/.local/bin/fd → $(command -v fdfind)"
  fi
}
##


##
# main
case "$os" in
  Darwin|Linux) ;;
  *) die "unsupported OS: $os (macOS and Linux only)" ;;
esac

cache_sudo
test "$os" = Darwin && mac_homebrew

ensure_gh
gh_auth
ensure_ssh
ensure_python
clone_repos
link_dotfiles
seed_gitconfig
install_packages
ensure_rust
ensure_claude

if test "$os" = Darwin; then
  mac_defaults
  mac_iterm
  mac_nsca
  mac_gcs
fi

restore_gpg

echo
echo "==> bootstrap done."
echo
echo "next step: open a new shell session (or 'source ~/.bash_profile')"
##