install.sh

#!/bin/sh
# Code generated by insmith. DO NOT EDIT.
#
# The base and ideas of this installer come from godownloader.
# https://github.com/goreleaser/godownloader
set -eu

cat /dev/null <<EOF
------------------------------------------------------------------------
Selected functions based on client9/shlib v2026.08.30 (commit 3593994).
This excerpt includes the command, logging, platform, archive, download,
GitHub Release, and SHA-256 helpers used by generated installers.
Unselected functions and upstream explanatory comments are omitted.

https://github.com/client9/shlib
Public domain - http://unlicense.org
https://github.com/client9/shlib/blob/master/LICENSE.md

The only behavioral divergence from v2026.08.30 is in http_download_curl:
it adds curl --proto '=https' and --tlsv1.2 to reject plaintext or downgraded
transports.
------------------------------------------------------------------------
EOF
is_command() {
  command -v "$1" >/dev/null
}
echoerr() {
  echo "$@" 1>&2
}

_shlib_logp=6

log_set_priority() {
  _shlib_logp="$1"
}

log_priority() {
  if test -z "${1-}"; then
    echo "$_shlib_logp"
    return
  fi
  [ "$1" -le "$_shlib_logp" ]
}

log_tag() {
  case $1 in
    0) echo "emerg" ;;
    1) echo "alert" ;;
    2) echo "crit" ;;
    3) echo "err" ;;
    4) echo "warning" ;;
    5) echo "notice" ;;
    6) echo "info" ;;
    7) echo "debug" ;;
    *) echo "$1" ;;
  esac
}

log_debug() {
  log_priority 7 || return 0
  echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
}

log_info() {
  log_priority 6 || return 0
  echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
}

log_err() {
  log_priority 3 || return 0
  echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
}

log_crit() {
  log_priority 2 || return 0
  echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
}

uname_os() {
  _shlib_os=$(uname -s | tr '[:upper:]' '[:lower:]')

  case "$_shlib_os" in
    msys*) _shlib_os="windows" ;;
    mingw*) _shlib_os="windows" ;;
    cygwin*) _shlib_os="windows" ;;
    win*) _shlib_os="windows" ;;
  esac

  if [ "$_shlib_os" = "sunos" ]; then
    if [ "$(uname -o 2>/dev/null)" = "illumos" ]; then
      _shlib_os="illumos"
    else
      _shlib_os="solaris"
    fi
  fi

  echo "$_shlib_os"
}
uname_arch() {
  _shlib_arch=$(uname -m)
  case $_shlib_arch in
    x86_64) _shlib_arch="amd64" ;;
    i86pc) _shlib_arch="amd64" ;;
    x86) _shlib_arch="386" ;;
    i686) _shlib_arch="386" ;;
    i386) _shlib_arch="386" ;;
    aarch64) _shlib_arch="arm64" ;;
    armv5*) _shlib_arch="armv5" ;;
    armv6*) _shlib_arch="armv6" ;;
    armv7*) _shlib_arch="armv7" ;;
    loongarch64) _shlib_arch="loong64" ;;
  esac
  echo "${_shlib_arch}"
}
uname_os_check() {
  _shlib_os=$(uname_os)
  case "$_shlib_os" in
    aix) return 0 ;;
    darwin) return 0 ;;
    dragonfly) return 0 ;;
    freebsd) return 0 ;;
    linux) return 0 ;;
    android) return 0 ;;
    midnightbsd) return 0 ;;
    nacl) return 0 ;;
    netbsd) return 0 ;;
    openbsd) return 0 ;;
    plan9) return 0 ;;
    solaris) return 0 ;;
    illumos) return 0 ;;
    ios) return 0 ;;
    js) return 0 ;;
    wasip1) return 0 ;;
    windows) return 0 ;;
  esac
  log_crit "uname_os_check '$(uname -s)' got converted to '$_shlib_os' which is not a recognized OS name"
  return 1
}
uname_arch_check() {
  _shlib_arch=$(uname_arch)
  case "$_shlib_arch" in
    386) return 0 ;;
    amd64) return 0 ;;
    arm64) return 0 ;;
    armv5) return 0 ;;
    armv6) return 0 ;;
    armv7) return 0 ;;
    ppc64) return 0 ;;
    ppc64le) return 0 ;;
    mips) return 0 ;;
    mipsle) return 0 ;;
    mips64) return 0 ;;
    mips64le) return 0 ;;
    s390x) return 0 ;;
    riscv64) return 0 ;;
    loong64) return 0 ;;
    amd64p32) return 0 ;;
  esac
  log_crit "uname_arch_check '$(uname -m)' got converted to '$_shlib_arch' which is not a recognized architecture name"
  return 1
}
untar() {
  _shlib_tarball=$1
  case "${_shlib_tarball}" in
    *.tar.gz | *.tgz) tar -xzf "${_shlib_tarball}" ;;
    *.tar.bz2 | *.tbz | *.tbz2) tar -xjf "${_shlib_tarball}" ;;
    *.tar.xz | *.txz) tar -xJf "${_shlib_tarball}" ;;
    *.tar.zst | *.tzst)
      if ! is_command zstd; then
        log_err "untar zstd is required to unpack ${_shlib_tarball}"
        return 1
      fi
      zstd -dc "${_shlib_tarball}" | tar -xf -
      ;;
    *.tar) tar -xf "${_shlib_tarball}" ;;
    *.zip)
      if ! is_command unzip; then
        log_err "untar unzip is required to unpack ${_shlib_tarball}"
        return 1
      fi
      unzip "${_shlib_tarball}"
      ;;
    *)
      log_err "untar unknown archive format for ${_shlib_tarball}"
      return 1
      ;;
  esac
}
http_download_curl() {
  _shlib_local_file=$1
  _shlib_source_url=$2
  _shlib_header=${3-}
  # insmith divergence from shlib 2026.08.30: these options refuse
  # plaintext/downgraded transports.
  if [ -z "$_shlib_header" ]; then
    curl --proto '=https' --tlsv1.2 -fsSL -o "$_shlib_local_file" "$_shlib_source_url"
  else
    curl --proto '=https' --tlsv1.2 -fsSL -H "$_shlib_header" -o "$_shlib_local_file" "$_shlib_source_url"
  fi
}

http_download_wget() {
  _shlib_local_file=$1
  _shlib_source_url=$2
  _shlib_header=${3-}
  if [ -z "$_shlib_header" ]; then
    wget -q -O "$_shlib_local_file" "$_shlib_source_url"
  else
    wget -q --header "$_shlib_header" -O "$_shlib_local_file" "$_shlib_source_url"
  fi
}
http_download_fetch() {
  _shlib_local_file=$1
  _shlib_source_url=$2
  _shlib_header=${3-}

  if [ -z "$_shlib_header" ]; then
    fetch -q -o "$_shlib_local_file" "$_shlib_source_url"
    return
  fi

  case "$_shlib_header" in
    [Aa]ccept:*)
      _shlib_accept=${_shlib_header#*:}
      _shlib_accept=${_shlib_accept# }
      HTTP_ACCEPT="$_shlib_accept" fetch -q -o "$_shlib_local_file" "$_shlib_source_url"
      return
      ;;
  esac

  log_crit "http_download fetch cannot send '${_shlib_header%%:*}' headers; install curl or wget"
  return 1
}

http_download_ftp() {
  _shlib_local_file=$1
  _shlib_source_url=$2
  _shlib_header=${3-}

  if [ -z "$_shlib_header" ]; then
    ftp -V -o "$_shlib_local_file" "$_shlib_source_url"
    return
  fi

  case "$_shlib_header" in
    [Aa]ccept:*)
      log_crit "http_download ftp cannot override the Accept header; install curl or wget"
      return 1
      ;;
  esac

  if ftp -Z </dev/null 2>&1 | grep '\[-H ' >/dev/null 2>&1; then
    ftp -V -H "$_shlib_header" -o "$_shlib_local_file" "$_shlib_source_url"
    return
  fi

  log_crit "http_download ftp cannot send '${_shlib_header%%:*}' headers; install curl or wget"
  return 1
}

http_download_python() {
  _shlib_local_file=$1
  _shlib_source_url=$2
  _shlib_header=${3-}

  python3 -c '
import sys, urllib.request

dest, url, hdr = sys.argv[1], sys.argv[2], sys.argv[3]
req = urllib.request.Request(url)
if hdr:
    name, _, value = hdr.partition(":")
    req.add_header(name.strip(), value.strip())
try:
    resp = urllib.request.urlopen(req, timeout=60)
    out = open(dest, "wb")
    while True:
        buf = resp.read(65536)
        if not buf:
            break
        out.write(buf)
    out.close()
except Exception as err:
    sys.stderr.write("python3: %s: %s\n" % (url, err))
    sys.exit(1)
' "$_shlib_local_file" "$_shlib_source_url" "$_shlib_header"
}

http_download_node() {
  _shlib_local_file=$1
  _shlib_source_url=$2
  _shlib_header=${3-}

  if is_command node; then
    _shlib_node=node
  else
    _shlib_node=nodejs
  fi

  "$_shlib_node" -e '
const fs = require("fs");
const { Readable } = require("stream");

const dest = process.argv[1], url = process.argv[2], hdr = process.argv[3];
if (typeof fetch !== "function") {
  process.stderr.write("node: fetch() requires node 18 or newer\n");
  process.exit(1);
}
const opts = {};
if (hdr) {
  const i = hdr.indexOf(":");
  opts.headers = { [hdr.slice(0, i).trim()]: hdr.slice(i + 1).trim() };
}
fetch(url, opts).then(function (r) {
  if (!r.ok) throw new Error("HTTP " + r.status + " " + r.statusText);
  return new Promise(function (resolve, reject) {
    const out = fs.createWriteStream(dest);
    out.on("finish", resolve);
    out.on("error", reject);
    Readable.fromWeb(r.body).pipe(out);
  });
}).catch(function (e) {
  process.stderr.write("node: " + url + ": " + e.message + "\n");
  process.exit(1);
});
' "$_shlib_local_file" "$_shlib_source_url" "$_shlib_header"
}

http_download() {
  log_debug "http_download $2"
  if is_command curl; then
    http_download_curl "$@"
    return
  elif is_command wget; then
    http_download_wget "$@"
    return
  elif is_command fetch; then
    http_download_fetch "$@"
    return
  elif is_command ftp; then
    http_download_ftp "$@"
    return
  elif is_command python3; then
    http_download_python "$@"
    return
  elif is_command node || is_command nodejs; then
    http_download_node "$@"
    return
  fi
  log_crit "http_download unable to find curl, wget, fetch, ftp, python3 or node"
  return 1
}

http_copy() {
  _shlib_http_copy_dir=${TMPDIR:-/tmp}
  _shlib_tmp=$(mktemp "${_shlib_http_copy_dir%/}/shlib.XXXXXXXXXX") || return 1
  if ! http_download "${_shlib_tmp}" "$1" "${2-}"; then
    rm -f "${_shlib_tmp}"
    return 1
  fi
  cat "${_shlib_tmp}"
  _shlib_rc=$?
  rm -f "${_shlib_tmp}"
  return $_shlib_rc
}

github_release() {
  _shlib_owner_repo=$1
  _shlib_version=${2-}
  test -z "$_shlib_version" && _shlib_version="latest"
  _shlib_giturl="https://github.com/${_shlib_owner_repo}/releases/${_shlib_version}"
  _shlib_json=$(http_copy "$_shlib_giturl" "Accept:application/json")
  test -z "$_shlib_json" && return 1
  _shlib_flat=$(echo "$_shlib_json" | tr -s '\n' ' ')
  _shlib_version=$(printf '%s\n' "$_shlib_flat" | sed 's/.*"tag_name":"//' | sed 's/".*//')
  test -z "$_shlib_version" && return 1

  case "$_shlib_version" in
    *[!A-Za-z0-9._+-]* | "")
      log_err "github_release did not find a tag at ${_shlib_giturl} (got '$(echo "$_shlib_version" | cut -c1-40)')"
      return 1
      ;;
  esac

  echo "$_shlib_version"
}
hash_sha256() {
  if [ -z "${1-}" ]; then
    set --
  else
    set -- "$1"
  fi
  if is_command gsha256sum; then
    _shlib_hash=$(gsha256sum "$@") || return 1
    echo "$_shlib_hash" | cut -d ' ' -f 1
  elif is_command sha256sum; then
    _shlib_hash=$(sha256sum "$@") || return 1
    echo "$_shlib_hash" | cut -d ' ' -f 1
  elif is_command shasum; then
    _shlib_hash=$(shasum -a 256 "$@" 2>/dev/null) || return 1
    echo "$_shlib_hash" | cut -d ' ' -f 1
  elif is_command openssl; then
    _shlib_hash=$(openssl dgst -sha256 "$@") || return 1
    echo "$_shlib_hash" | awk '{print $NF}'
  else
    log_crit "hash_sha256 unable to find command to compute sha-256 hash"
    return 1
  fi
}

hash_sha256_verify() {
  _shlib_target=$1
  _shlib_checksums=${2-}

  if [ -z "$_shlib_checksums" ]; then
    log_err "hash_sha256_verify checksum file not specified in arg2"
    return 1
  fi

  _shlib_basename=${_shlib_target##*/}

  _shlib_want=$(awk -v name="$_shlib_basename" '
    {
      f = $2
      sub(/^\*/, "", f)
      sub(/.*\//, "", f)
      if (f == name) print $1
    }' "$_shlib_checksums" 2>/dev/null)

  if [ -z "$_shlib_want" ]; then
    log_err "hash_sha256_verify unable to find checksum for '${_shlib_target}' in '${_shlib_checksums}'"
    return 1
  fi

  _shlib_nwant=$(printf '%s\n' "$_shlib_want" | wc -l | tr -d ' ')
  if [ "$_shlib_nwant" != "1" ]; then
    log_err "hash_sha256_verify multiple checksums for '${_shlib_basename}' in '${_shlib_checksums}'"
    return 1
  fi

  _shlib_got=$(hash_sha256 "$_shlib_target")
  if [ "$_shlib_want" != "$_shlib_got" ]; then
    log_err "hash_sha256_verify checksum for '$_shlib_target' did not verify ${_shlib_want} vs $_shlib_got"
    return 1
  fi
}
cat /dev/null <<EOF
------------------------------------------------------------------------
End of selected shlib functions based on client9/shlib v2026.08.30
------------------------------------------------------------------------
EOF

REPOSITORY='Songmu/tagpr'
NAME='tagpr'
BINARIES='tagpr'
WORKFLOW='Songmu/tagpr/.github/workflows/release-build.yaml'
ASSET_PATTERN='{name}_{version}_{os}_{arch}'
CHECKSUM_PATTERN='SHA256SUMS'

log_prefix() {
	printf '%s\n' "$REPOSITORY"
}

fail() {
	log_crit "$*"
	exit 1
}

usage() {
	status=${1:-2}
	cat >&2 <<EOF
Usage: $0 [-b bindir] [tag]

  -b bindir  installation directory (default: BINDIR or ./bin)
  -d         enable debug logging
  -h         show this help
  -x         enable shell execution tracing
EOF
	exit "$status"
}

need() {
	is_command "$1" || fail "required command not found: $1"
}

cleanup() {
	if [ -n "${install_manifest:-}" ] && [ -f "$install_manifest" ]; then
		tab=$(printf '\t')
		while IFS="$tab" read -r install_tmp install_destination; do
			[ -z "$install_tmp" ] || rm -f "$install_tmp"
		done < "$install_manifest"
	fi
	if [ -n "${tmpdir:-}" ]; then
		rm -rf "$tmpdir"
		tmpdir=
	fi
}

parse_args() {
	BINDIR=${BINDIR:-./bin}
	while getopts "b:dhx" arg; do
		case "$arg" in
			b) BINDIR=$OPTARG ;;
			d) log_set_priority 10 ;;
			h) usage 0 ;;
			x) set -x ;;
			*) usage 2 ;;
		esac
	done
	shift $((OPTIND - 1))
	[ "$#" -le 1 ] || usage 2
	[ -n "$BINDIR" ] || fail "installation directory must not be empty"
	requested_tag=${1:-}
}

line_count() {
	sed '/^$/d' | wc -l | tr -d ' '
}

verify_checksum() {
	checksum_name=$(printf '%s' "$CHECKSUM_PATTERN" |
		sed -e "s/{version}/$TAG/g" -e "s/{name}/$NAME/g" -e "s/{os}/$OS/g" -e "s/{arch}/$ARCH/g")
	checksum_url="$GITHUB_DOWNLOAD/$TAG/$checksum_name"
	checksums="$tmpdir/$checksum_name"
	http_download "$checksums" "$checksum_url" || fail "could not download checksums"
	hash_sha256_verify "$artifact" "$checksums" ||
		fail "checksum verification failed for $asset_name"
	log_info "verified SHA-256 checksum for $asset_name"
}

attestation_capability() {
	is_command gh || return 2
	is_command git || return 2
	is_command grep || return 2
	# gh <= 2.92.0 may expose credentials to untrusted TUF mirrors during
	# attestation verification (GHSA-8xvp-7hj6-mcj9).
	gh --version 2>/dev/null | awk '
		NR == 1 {
			if ($3 !~ /^[0-9]+\.[0-9]+\.[0-9]+$/) exit 1
			split($3, version, ".")
			exit !(version[1] > 2 || (version[1] == 2 && version[2] >= 93))
		}
		END { if (NR == 0) exit 1 }
	' || return 2
	gh attestation verify --help 2>/dev/null | grep -q -- '--signer-digest' || return 2
}

resolve_tag_commit() {
	refs=$(git ls-remote "https://github.com/$REPOSITORY.git" \
		"refs/tags/$TAG" "refs/tags/$TAG^{}") || return 1
	printf '%s\n' "$refs" | awk '
		$2 ~ /\^\{\}$/ { peeled = $1 }
		$2 !~ /\^\{\}$/ { direct = $1 }
		END {
			if (peeled != "") print peeled
			else if (direct != "") print direct
		}
	'
}

verify_attestation() {
	attestation_capability || return 2
	commit=$(resolve_tag_commit) || return 3
	[ -n "$commit" ] || return 3
	log_info "verifying build provenance for $asset_name"
	gh attestation verify "$artifact" \
		--hostname github.com \
		--repo "$REPOSITORY" \
		--source-digest "$commit" \
		--signer-digest "$commit" \
		--signer-workflow "$WORKFLOW" || return 1
}

verify_artifact() {
	if verify_attestation; then
		:
	else
		status=$?
		case "$status" in
			2)
				log_info "build provenance verification unavailable; falling back to SHA-256"
				verify_checksum
				;;
			3) fail "could not resolve release tag $TAG to a commit" ;;
			*) fail "attestation verification failed" ;;
		esac
	fi
}

check_archive_member() {
	member=$1
	case "$member" in
		/*) fail "archive contains an absolute path: $member" ;;
	esac
	case "/$member/" in
		*/../*) fail "archive contains a path traversal entry: $member" ;;
	esac
}

check_zip_member() {
	member=$1
	check_archive_member "$member"
	case "$member" in
		*\\*) fail "archive contains a Windows path separator: $member" ;;
		[A-Za-z]:*) fail "archive contains a drive-qualified path: $member" ;;
	esac
}

check_tar_types() {
	while IFS= read -r line; do
		case "$line" in
			-*|d*) ;;
			l*) fail "archive contains a symlink entry which is not supported" ;;
			h*) fail "archive contains a hard link entry which is not supported" ;;
			*) fail "archive contains an unsupported entry type" ;;
		esac
	done <<-EOF
	$1
	EOF
}

check_zip_types() {
	listing=$1
	expected=$2
	attributes=$(printf '%s\n' "$listing" |
		awk '$2 ~ /^[0-9]+\.[0-9]+$/ { print $1 }')
	[ "$(printf '%s\n' "$attributes" | line_count)" -eq "$expected" ] ||
		fail "could not validate all zip entry types"
	while IFS= read -r attribute; do
		case "$attribute" in
			-*) ;;
			d*) ;;
			l*) fail "archive contains a symlink entry which is not supported" ;;
			h*) fail "archive contains a hard link entry which is not supported" ;;
			b*|c*|p*|s*) fail "archive contains an unsupported entry type" ;;
			*) fail "archive contains an unknown entry type" ;;
		esac
	done <<-EOF
	$attributes
	EOF
}

download_artifact() {
	asset_base=$(printf '%s' "$ASSET_PATTERN" |
		sed -e "s/{name}/$NAME/g" -e "s/{version}/$TAG/g" -e "s/{os}/$OS/g" -e "s/{arch}/$ARCH/g")
	case "$OS" in
		darwin|windows) extensions='.zip .tar.gz .exe raw' ;;
		*) extensions='.tar.gz .zip .exe raw' ;;
	esac
	for extension in $extensions; do
		if [ "$extension" = ".exe" ] && [ "$OS" != "windows" ]; then
			continue
		fi
		if [ "$extension" = "raw" ]; then
			extension=
		fi
		candidate=$asset_base$extension
		candidate_url="$GITHUB_DOWNLOAD/$TAG/$candidate"
		candidate_artifact="$tmpdir/$candidate"
		if http_download "$candidate_artifact" "$candidate_url" 2>/dev/null; then
			artifact=$candidate_artifact
			asset_name=$candidate
			return
		else
			rm -f "$candidate_artifact"
		fi
	done
	fail "could not download an asset matching $asset_base (.tar.gz, .zip, .exe, or raw binary)"
}

extract_artifact() {
	raw_artifact=false
	extractdir="$tmpdir/extract"
	mkdir -p "$extractdir" || fail "could not create extraction directory"
	case "$asset_name" in
		*.tar.gz)
			need tar
			tar_listing=$(tar -tvzf "$artifact") || fail "could not list $asset_name contents"
			check_tar_types "$tar_listing"
			tar_names=$(tar -tzf "$artifact") || fail "could not list $asset_name contents"
			while IFS= read -r member; do
				[ -n "$member" ] || continue
				check_archive_member "$member"
			done <<-EOF
			$tar_names
			EOF
			tar -xzf "$artifact" -C "$extractdir" || fail "could not extract $asset_name"
			;;
		*.zip)
			need unzip
			zip_names=$(unzip -Z1 "$artifact") || fail "could not list $asset_name contents"
			while IFS= read -r member; do
				[ -n "$member" ] || continue
				check_zip_member "$member"
			done <<-EOF
			$zip_names
			EOF
			zip_types=$(unzip -Z -s "$artifact") || fail "could not list $asset_name contents"
			zip_count=$(printf '%s\n' "$zip_names" | line_count)
			check_zip_types "$zip_types" "$zip_count"
			unzip -q "$artifact" -d "$extractdir" || fail "could not extract $asset_name"
			;;
		*)
			raw_artifact=true
			;;
	esac
}

platform_binary_name() {
	binary=$1
	if [ "$OS" = "windows" ]; then
		case "$binary" in
			*.exe) printf '%s\n' "$binary" ;;
			*) printf '%s.exe\n' "$binary" ;;
		esac
	else
		printf '%s\n' "$binary"
	fi
}

prepare_install() {
	executable=$1
	executable_name=$2
	install_tmp=$(mktemp "${BINDIR%/}/.${executable_name}.XXXXXX") ||
		fail "could not create temporary file in $BINDIR"
	printf '%s\t%s\n' "$install_tmp" "$BINDIR/$executable_name" >> "$install_manifest" ||
		fail "could not record temporary install for $executable_name"
	install -m 0755 "$executable" "$install_tmp" ||
		fail "could not prepare $executable_name"
}

prepare_binaries() {
	need install
	need mv
	set -- $BINARIES
	if [ "$raw_artifact" = "true" ] && [ "$#" -ne 1 ]; then
		fail "raw artifacts can install exactly one binary"
	fi
	install -d "$BINDIR" || fail "could not create $BINDIR"
	for binary do
		executable_name=$(platform_binary_name "$binary")
		if [ "$raw_artifact" = "true" ]; then
			executable=$artifact
		else
			executables=$(find "$extractdir" -type f -name "$executable_name" -print)
			[ "$(printf '%s\n' "$executables" | line_count)" -eq 1 ] ||
				fail "archive must contain exactly one executable named $executable_name"
			executable=$executables
		fi
		prepare_install "$executable" "$executable_name"
	done
}

commit_installs() {
	tab=$(printf '\t')
	while IFS="$tab" read -r install_tmp install_destination; do
		mv -f "$install_tmp" "$install_destination" ||
			fail "could not install ${install_destination##*/}"
		printf 'Installed %s to %s\n' "${install_destination##*/}" "$install_destination"
	done < "$install_manifest"
}

main() {
	parse_args "$@"
	for command in awk cat cut find mkdir mktemp rm sed tr wc; do
		need "$command"
	done

	TAG=$(github_release "$REPOSITORY" "$requested_tag") ||
		fail "could not determine release tag ${requested_tag:-latest}"
	OS=$(uname_os)
	ARCH=$(uname_arch)
	case "$OS/$ARCH" in
		linux/amd64|linux/arm64|darwin/amd64|darwin/arm64|windows/amd64|windows/arm64) ;;
		*) fail "unsupported platform: $OS/$ARCH" ;;
	esac
	GITHUB_DOWNLOAD="https://github.com/$REPOSITORY/releases/download"

	tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/insmith.XXXXXX") ||
		fail "could not create temporary directory"
	install_manifest="$tmpdir/install-manifest"
	: > "$install_manifest"
	trap cleanup 0
	trap 'exit 1' HUP INT TERM

	log_info "found version: $TAG for $OS/$ARCH"
	download_artifact
	verify_artifact
	extract_artifact
	prepare_binaries
	commit_installs

	cleanup
	trap - 0 HUP INT TERM
}

main "$@"