#!/usr/bin/env bash
# Ore Compute worker installer.
# Downloads the signed worker package from the Ore Compute website, verifies the
# release signature and checksums before installing anything, then prepares a
# native or Docker GPU runtime. Needs no GitHub access and no account token.
# It never asks for a wallet private key or seed phrase.
set -euo pipefail

ORE_VERSION="1.0.0"
ORE_SITE="https://ore-compute.vercel.app"
BASE="${ORE_SITE}/downloads/worker/${ORE_VERSION}"
PACKAGE="ore-worker-${ORE_VERSION}-linux-x86_64.tar.gz"
ORE_HOME="${ORE_HOME:-$HOME/.ore}"
BIN_DIR="${ORE_BIN_DIR:-$HOME/.local/bin}"
RUNTIME="auto"

# Release signing public key (Ed25519). Also published at ${ORE_SITE}/downloads/worker/release-key.pem
read -r -d '' RELEASE_KEY <<'KEY' || true
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAq+NTeYWNEyaqfltCurH18SfhN0J2DII0Df2qNVng2BE=
-----END PUBLIC KEY-----
KEY

while [ $# -gt 0 ]; do
  case "$1" in
    --version) ORE_VERSION="$2"; BASE="${ORE_SITE}/downloads/worker/${ORE_VERSION}"; PACKAGE="ore-worker-${ORE_VERSION}-linux-x86_64.tar.gz"; shift 2 ;;
    --runtime) RUNTIME="$2"; shift 2 ;;
    -h|--help) echo "Usage: install.sh [--runtime auto|native|docker]"; exit 0 ;;
    *) echo "Unknown option: $1" >&2; exit 2 ;;
  esac
done

say() { printf '%s\n' "$*"; }
fail() { printf 'ore install: %s\n' "$*" >&2; exit 1; }

[ "$(uname -s)" = "Linux" ] || fail "Linux is required."
[ "$(uname -m)" = "x86_64" ] || fail "An x86-64 machine is required."
for tool in curl tar sha256sum openssl; do
  command -v "$tool" >/dev/null 2>&1 || fail "Missing $tool. On Ubuntu: sudo apt-get install -y curl tar coreutils openssl"
done
openssl version | grep -Eq '^OpenSSL (3|[4-9])\.' || fail "OpenSSL 3 or newer is required to verify the release signature."

WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT
cd "$WORK"

say "Downloading Ore Compute worker ${ORE_VERSION}…"
for f in "$PACKAGE" SHA256SUMS SHA256SUMS.sig; do
  curl --proto '=https' --tlsv1.2 -fsSL --retry 3 -o "$f" "${BASE}/${f}" || fail "Could not download ${f}."
done

printf '%s\n' "$RELEASE_KEY" > release-key.pem
openssl pkeyutl -verify -pubin -inkey release-key.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig >/dev/null 2>&1 \
  || fail "The release signature is not valid. Nothing was installed."
grep -E "  ${PACKAGE}\$" SHA256SUMS | sha256sum -c --status - || fail "The package checksum does not match. Nothing was installed."
say "Signature and checksum verified."

DEST="${ORE_HOME}/versions/${ORE_VERSION}"
mkdir -p "$DEST" "$BIN_DIR"
chmod 700 "$ORE_HOME"
tar -xzf "$PACKAGE" -C "$DEST" --no-same-owner --no-same-permissions
[ -f "$DEST/ore_worker/cli.py" ] || fail "Unexpected package layout."

python_ok() { "$1" -c 'import sys; sys.exit(0 if sys.version_info >= (3, 12) else 1)' 2>/dev/null; }
PY=""
for candidate in python3.13 python3.12 python3; do
  if command -v "$candidate" >/dev/null 2>&1 && python_ok "$candidate"; then PY="$(command -v "$candidate")"; break; fi
done

native_ready=false
if [ "$RUNTIME" != "docker" ] && [ -n "$PY" ] && command -v nvidia-smi >/dev/null 2>&1; then
  say "Preparing the native runtime…"
  if "$PY" -m venv "$DEST/venv" >/dev/null 2>&1; then
    "$DEST/venv/bin/pip" install --quiet --no-input --disable-pip-version-check "$DEST"/wheels/*.whl numpy==2.5.3 blake3==1.0.11 && native_ready=true
  else
    say "Python venv support is missing (on Ubuntu: sudo apt-get install -y python3-venv)."
  fi
fi

docker_ready=false
if [ "$native_ready" = false ] && [ "$RUNTIME" != "native" ]; then
  if command -v docker >/dev/null 2>&1 && docker info --format '{{json .Runtimes}}' 2>/dev/null | grep -q nvidia; then
    say "Preparing the Docker runtime…"
    docker build --quiet -t "ore-compute/worker:${ORE_VERSION}" "$DEST" >/dev/null && docker_ready=true
  fi
fi

if [ "$native_ready" = false ] && [ "$docker_ready" = false ]; then
  fail "No GPU runtime could be prepared. Install the NVIDIA driver, and Python 3.12+ with venv or Docker with the NVIDIA Container Toolkit, then run this installer again."
fi

if [ "$native_ready" = true ]; then
  PYRUN="$DEST/venv/bin/python"
else
  PYRUN="${PY:-python3}"
fi
cat > "$BIN_DIR/ore" <<EOF
#!/usr/bin/env bash
# Isolated mode (-I) ignores PYTHONPATH, so the package directory is passed explicitly.
exec "$PYRUN" -I -c 'import sys; sys.path.insert(0, sys.argv.pop(1)); from ore_worker.cli import main; raise SystemExit(main())' "$DEST" "\$@"
EOF
chmod 755 "$BIN_DIR/ore"
ln -sfn "$DEST" "${ORE_HOME}/current"

say ""
say "Installed ore ${ORE_VERSION} (runtime: $([ "$native_ready" = true ] && echo native || echo docker))."
case ":$PATH:" in *":$BIN_DIR:"*) ;; *) say "Add ${BIN_DIR} to your PATH, for example: export PATH=\"${BIN_DIR}:\$PATH\"";; esac
say "Next: ore start --wallet 0xYOUR_PUBLIC_ADDRESS --worker rig01 --device 0"