#!/usr/bin/env bash set -eo pipefail cat<&2; exit $rc' ERR operating_system(){ uname -s | awk '{print tolower($0)}' } architecture(){ uname -m } print_eula() { local pager if command -v less >/dev/null; then pager=(less --prompt="Hit SPACE to move to next page" --quit-at-eof) elif command -v more >/dev/null; then pager=(more) else pager=(cat) fi "${pager[@]}" <> "$log" latest_version="$(echo "$api_response" | grep -oP '(?<="tag_name": ")[^"]+' | tr -d '\r\n' || true)" if [[ -z "$latest_version" ]]; then if echo "$api_response" | grep -qi "API rate limit exceeded"; then echo "GitHub API rate limit exceeded for your IP. Try again later." >&2 exit 1 fi under_maintenance fi # GitHub computes a per-asset digest server-side; we use it as the trust # anchor instead of uploading a separate hash file. Format: "sha256:". expected_digest="$(echo "$api_response" | grep -oP '(?<="digest": ")[^"]+' | head -1)" if [[ -z "$expected_digest" ]]; then echo "[ERROR] Release asset is missing a digest field; refusing to proceed without verification." >&2 exit 1 fi scnr_archive="spectre-scan-v$latest_version-$(operating_system)-$(architecture).tar.gz" scnr_url="https://github.com/ecsypno/spectre-scan/releases/download/$latest_version/$scnr_archive" scnr_dir="./spectre-scan-v$latest_version" scnr_package="./$scnr_archive" scnr_license_file="$HOME/.scnr/license.key" # Clear any partial state from a prior interrupted attempt so the next steps # don't mix old + new files. rm -rf "$scnr_dir" "$scnr_package" echo echo " * Downloading..." curl -fL -C - --retry 12 --retry-delay 1 --retry-all-errors \ "$scnr_url" -o "$scnr_package" echo " * Verifying..." expected_algo="${expected_digest%%:*}" expected_hash="${expected_digest#*:}" case "$expected_algo" in sha256) actual_hash="$(sha256sum "$scnr_package" | awk '{print $1}')" ;; sha512) actual_hash="$(sha512sum "$scnr_package" | awk '{print $1}')" ;; *) echo "[ERROR] Unsupported digest algorithm '$expected_algo'." >&2; exit 1 ;; esac echo "expected $expected_digest, got $expected_algo:$actual_hash" >> "$log" if [[ "$actual_hash" != "$expected_hash" ]]; then echo "[ERROR] Checksum verification failed — the downloaded archive does not match its published $expected_algo hash." >&2 echo " See $log for details. The download has been removed; do not run it." >&2 rm -f "$scnr_package" exit 1 fi echo -n " * Installing..." tar xf "$scnr_package" 2>>"$log" rm -f "$scnr_package" echo "done." if ! [ -f "$scnr_license_file" ]; then echo echo "Spectre Scan activation" echo "(If you don't have a license key, get one from https://ecsypno.com -- a free Trial edition is available too.)" key="" read -p "License key: " key if ! "$scnr_dir/bin/scnr_activate" "$key"; then echo "Activation was unsuccessful, contact support if you believe this to be a bug." exit 1 fi echo fi if [[ -x "$scnr_dir/bin/spectre_edition" ]]; then scnr_edition="$("$scnr_dir/bin/spectre_edition")" else scnr_edition="unknown" fi echo echo echo -n "Spectre Scan installed at: " echo $scnr_dir echo "Installation log at: $log" echo echo "* For a CLI scan you can run: $scnr_dir/bin/spectre URL" if [[ $scnr_edition == "trial" || $scnr_edition == "pro" || $scnr_edition == "enterprise" ]]; then echo "* To use Spectre Scan Pro you can run: $scnr_dir/bin/spectre_pro" fi echo echo "Documentation can be found at: https://documentation.ecsypno.com/scnr/" echo