#!/usr/bin/env bash
# Deterministic cosign installer for CI deploy jobs.

set -euo pipefail

COSIGN_VERSION="${COSIGN_VERSION:-v3.0.6}"
COSIGN_SHA256="${COSIGN_SHA256:-c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74}"
COSIGN_URL="${COSIGN_URL:-https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64}"
COSIGN_INSTALL_PATH="${COSIGN_INSTALL_PATH:-/usr/local/bin/cosign}"

if command -v cosign >/dev/null 2>&1; then
  cosign version
  exit 0
fi

tmp_file="$(mktemp)"
cleanup() {
  rm -f "$tmp_file"
}
trap cleanup EXIT

curl --fail --silent --show-error --location "$COSIGN_URL" --output "$tmp_file"
printf '%s  %s\n' "$COSIGN_SHA256" "$tmp_file" | sha256sum --check --status
install -m 0755 "$tmp_file" "$COSIGN_INSTALL_PATH"
cosign version