dk1

#!/bin/sh
##########################################################################
# File: mlfront/dk1                                                      #
#                                                                        #
# Copyright 2025 Diskuv, Inc.                                            #
#                                                                        #
# Licensed under the Open Software License version 3.0                   #
# (the "License"); you may not use this file except in compliance        #
# with the License. You may obtain a copy of the License at              #
#                                                                        #
#     https://opensource.org/license/osl-3-0-php/                        #
#                                                                        #
##########################################################################

# Recommendation: Place this file in source control.
#
# Invoking: ./dk1
#   That works in Powershell on Windows, and in Unix. Copy-and-paste works!
#
# Purpose: Install dk1 if not present. Then invoke dk1.

set -euf

# ===== BAKED TRUST ROOT (rotates rarely; updated only on key/verifier rotation) =====
# The dk1 version is NOT baked here. It is pinned per project by a
#   %% actual_version("X.Y.Z.W")
# line in dk.u's `## workspace` section (or the latest signed manifest if absent).
# dk1 and its checksum come from a signify-signed manifest verified at runtime:
#   1. download the pinned mlfront-signify verifier from its GitLab package (by
#      the baked version below), check it against the SHA-256 baked below (the
#      anchor -- not the manifest, so no circularity);
#   2. verify the signify signature over the manifest (manifest.txt) with the
#      baked public key;
#   3. only then read the manifest's per-arch dk1 SHA-256.
# This file never rewrites itself (Windows batch/exe safety); `dk1 --self-update`
# edits only the dk.u actual_version line, and key rotation is followed at
# verify-time via the manifest's continuation chain.
SIGNIFY_PUBKEY_B64="RWTMq/GqeeJ06ACy7By/H05vvtpc3ZPEKlbnDm9fIQxpkgTV92is6YHD"
# The verifier is pinned by version+checksum and fetched from GitLab (a direct
# package download, not the throttled listing API); the site serves only the
# signed manifest and the wrappers.
signify_pkg_ver="2.4.2.271"
cksum_signify_linux_x86_64="9701ed5821ea57114890f2d54381ee29742b45292ea0c8a259b0d4187c728a4d"
cksum_signify_linux_x86="533ec71ef0c6081c57850c840d29df5ca8efd3c2722b54dc77c14224dda0c418"
cksum_signify_darwin_arm64="89513c94add01ef5e15fa4c3a171755cd3eb783f552b9d4a3dedd009fa89a062"
cksum_signify_darwin_x86_64="875ba2f6840bb705ed2346c9c3a165ee5fdfde559df4b9adfa0c6f915043eade"
cksum_signify_windows_x86_64="ebe1aa87a3eb87ed6769782a31916fab72bbdf0ced22d6ddd9a7a455e23e2c68"
# windows_x86 (32-bit) mlfront-signify is not published at signify_pkg_ver yet.
# Keep the slot maintained: the __ placeholder trips the not-provisioned guard
# in dk_verify_manifest until a real checksum is baked here (and dk1.cmd carries
# the matching x86 slot), so ./dk1 and .\dk1.cmd light up together.
cksum_signify_windows_x86="__CKSUM_SIGNIFY_WINDOWS_X86__"
DK_BASE_URL="${DK1_BASE_URL:-https://diskuv.com/dk}"
# ====================================================================================

dk_pwd=$PWD

# Get the dk project tree
DK_PROJECT_DIR=$(dirname "$0")
DK_PROJECT_DIR=$(cd "$DK_PROJECT_DIR" && pwd)

# --- Windows ---
# There is no shunt to dk1.cmd here. The block that used to live here required
# [ -x /usr/bin/cmd ], and no MSYS2, Cygwin, or Git Bash layout ships a `cmd` in
# /usr/bin, so it never fired on any host. This script handles Windows directly
# instead: autodetect_buildhost_arch resolves windows_x86_64 / windows_x86 via
# is_unixy_windows_build_machine, dk_extexe adds the .exe suffix, the data home
# below shares dk1.cmd's store, and MSYS converts POSIX paths in argv when
# exec'ing the native dk1.exe. A shunt could not be the whole answer anyway: a
# global install.sh install ships no dk1.cmd to shunt to.

# --- Quiet mode detection ---
DKCODER_QUIET=0
_DKEXE_OPTIONS=
run_maybe_quiet() {
  "$@" >&2 # Always redirect stdout to stderr in this script
}
printf_maybe_quiet() {
  # shellcheck disable=SC2059
  printf "$@" >&2
}

# --- Launcher helpers (not from crossplatform-functions.sh) ---

# [dk_prog_path NAME] prints the path to NAME, or nothing when it is not
# installed. Absolute locations first, so the hardened Linux/macOS behavior is
# unchanged, then PATH. Git Bash (Git for Windows) ships curl at
# /mingw64/bin/curl and has no /usr/bin/curl or /bin/curl, so without the PATH
# fallback the launcher finds no downloader at all and every fetch fails.
# ci/dist/install.sh already resolves curl/wget through PATH for the same reason.
# This does not weaken the trust model: the mlfront-signify verifier is pinned by
# the SHA-256 baked above, the manifest is signify-verified, and every binary is
# checked against a signed checksum, so a hostile PATH curl can deny service but
# cannot substitute an artifact.
# The `|| true` matters under `set -e`: `command -v` exits nonzero for a missing
# program, and a bare assignment would propagate that status and abort the script.
dk_prog_path() {
  if [ -x "/usr/bin/$1" ]; then printf '%s' "/usr/bin/$1"
  elif [ -x "/bin/$1" ]; then printf '%s' "/bin/$1"
  else command -v "$1" 2>/dev/null || true
  fi
}

# Every download path funnels here when neither curl nor wget resolved. Name what
# was searched and the escape hatch; a bare "not available" leaves the reader with
# nothing to act on.
dk_no_downloader() {
  echo "FATAL: no curl or wget found (searched /usr/bin, /bin, then PATH)" >&2
  echo "  ...: install curl or wget, or set DKMLSYS_CURL=/full/path/to/curl" >&2
  exit 107
}

# --- Imports of dkml-runtime-common's crossplatform-functions.sh ---
# Changes:
# 1. In download_file() use [ "${DKCODER_QUIET:-}" -eq 1 ]
# 2. In log_trace() replace non-FATAL `printf ... >&2` with `printf_maybe_quiet ...`
# 3. In sha256check() all shasum/* use --quiet option (this should be upstreamed)
# 4. In autodetect_system_binaries() curl and wget resolve through dk_prog_path
#    (above), which falls back to PATH when the absolute locations miss

# Get standard locations of Unix system binaries like `/usr/bin/mv` (or `/bin/mv`).
#
# Will not return anything in `/usr/local/bin` or `/usr/sbin`. Use when you do not
# know whether the PATH has been set correctly, or when you do not know if the
# system binary exists.
#
# At some point in the future, this function will error out if the required system binaries
# do not exist. Most system binaries are common to all Unix/Linux/macOS installations but
# some (like `comm`) may need to be installed for proper functioning of DKML.
#
# Outputs:
# - env:DKMLSYS_MV - Location of `mv`
# - env:DKMLSYS_CHMOD - Location of `chmod`
# - env:DKMLSYS_UNAME - Location of `uname`
# - env:DKMLSYS_ENV - Location of `env`
# - env:DKMLSYS_AWK - Location of `awk`
# - env:DKMLSYS_SED - Location of `sed`
# - env:DKMLSYS_COMM - Location of `comm`
# - env:DKMLSYS_INSTALL - Location of `install`
# - env:DKMLSYS_RM - Location of `rm`
# - env:DKMLSYS_SORT - Location of `sort`
# - env:DKMLSYS_CAT - Location of `cat`
# - env:DKMLSYS_STAT - Location of `stat`
# - env:DKMLSYS_GREP - Location of `grep`
# - env:DKMLSYS_CURL - Location of `curl` (empty if not found)
# - env:DKMLSYS_WGET - Location of `wget` (empty if not found)
# - env:DKMLSYS_TR - Location of `tr`
autodetect_system_binaries() {
    if [ -z "${DKMLSYS_MV:-}" ]; then
        if [ -x /usr/bin/mv ]; then
            DKMLSYS_MV=/usr/bin/mv
        else
            DKMLSYS_MV=/bin/mv
        fi
    fi
    if [ -z "${DKMLSYS_CHMOD:-}" ]; then
        if [ -x /usr/bin/chmod ]; then
            DKMLSYS_CHMOD=/usr/bin/chmod
        else
            DKMLSYS_CHMOD=/bin/chmod
        fi
    fi
    if [ -z "${DKMLSYS_UNAME:-}" ]; then
        if [ -x /usr/bin/uname ]; then
            DKMLSYS_UNAME=/usr/bin/uname
        else
            DKMLSYS_UNAME=/bin/uname
        fi
    fi
    if [ -z "${DKMLSYS_ENV:-}" ]; then
        if [ -x /usr/bin/env ]; then
            DKMLSYS_ENV=/usr/bin/env
        else
            DKMLSYS_ENV=/bin/env
        fi
    fi
    if [ -z "${DKMLSYS_AWK:-}" ]; then
        if [ -x /usr/bin/awk ]; then
            DKMLSYS_AWK=/usr/bin/awk
        else
            DKMLSYS_AWK=/bin/awk
        fi
    fi
    if [ -z "${DKMLSYS_SED:-}" ]; then
        if [ -x /usr/bin/sed ]; then
            DKMLSYS_SED=/usr/bin/sed
        else
            DKMLSYS_SED=/bin/sed
        fi
    fi
    if [ -z "${DKMLSYS_COMM:-}" ]; then
        if [ -x /usr/bin/comm ]; then
            DKMLSYS_COMM=/usr/bin/comm
        else
            DKMLSYS_COMM=/bin/comm
        fi
    fi
    if [ -z "${DKMLSYS_INSTALL:-}" ]; then
        if [ -x /usr/bin/install ]; then
            DKMLSYS_INSTALL=/usr/bin/install
        else
            DKMLSYS_INSTALL=/bin/install
        fi
    fi
    if [ -z "${DKMLSYS_RM:-}" ]; then
        if [ -x /usr/bin/rm ]; then
            DKMLSYS_RM=/usr/bin/rm
        else
            DKMLSYS_RM=/bin/rm
        fi
    fi
    if [ -z "${DKMLSYS_SORT:-}" ]; then
        if [ -x /usr/bin/sort ]; then
            DKMLSYS_SORT=/usr/bin/sort
        else
            DKMLSYS_SORT=/bin/sort
        fi
    fi
    if [ -z "${DKMLSYS_CAT:-}" ]; then
        if [ -x /usr/bin/cat ]; then
            DKMLSYS_CAT=/usr/bin/cat
        else
            DKMLSYS_CAT=/bin/cat
        fi
    fi
    if [ -z "${DKMLSYS_STAT:-}" ]; then
        if [ -x /usr/bin/stat ]; then
            DKMLSYS_STAT=/usr/bin/stat
        else
            DKMLSYS_STAT=/bin/stat
        fi
    fi
    if [ -z "${DKMLSYS_GREP:-}" ]; then
        if [ -x /usr/bin/grep ]; then
            DKMLSYS_GREP=/usr/bin/grep
        else
            DKMLSYS_GREP=/bin/grep
        fi
    fi
    if [ -z "${DKMLSYS_CURL:-}" ]; then DKMLSYS_CURL=$(dk_prog_path curl); fi
    if [ -z "${DKMLSYS_WGET:-}" ]; then DKMLSYS_WGET=$(dk_prog_path wget); fi
    if [ -z "${DKMLSYS_TR:-}" ]; then
        if [ -x /usr/bin/tr ]; then
            DKMLSYS_TR=/usr/bin/tr
        else
            DKMLSYS_TR=/bin/tr
        fi
    fi
    export DKMLSYS_MV DKMLSYS_CHMOD DKMLSYS_UNAME DKMLSYS_ENV DKMLSYS_AWK DKMLSYS_SED DKMLSYS_COMM DKMLSYS_INSTALL
    export DKMLSYS_RM DKMLSYS_SORT DKMLSYS_CAT DKMLSYS_STAT DKMLSYS_GREP DKMLSYS_CURL DKMLSYS_WGET DKMLSYS_TR
}

# Is a Windows build machine if we are in a MSYS2 or Cygwin environment.
#
# Better alternatives
# -------------------
#
# 1. If you are checking to see if you should do a cygpath, then just guard it
#    like so:
#       if [ -x /usr/bin/cygpath ]; then
#           do_something $(/usr/bin/cygpath ...) ...
#       fi
#    This clearly guards what you are about to do (cygpath) with what you will
#    need (cygpath).
# 2. is_arg_windows_platform
is_unixy_windows_build_machine() {
    if is_msys2_msys_build_machine || is_cygwin_build_machine; then
        return 0
    fi
    return 1
}

# Is a MSYS2 environment with the MSYS or MINGW64 subsystem?
# * MSYS2 can also do MinGW 32-bit and 64-bit subsystems. Used by Diskuv OCaml
# * MINGW64 used by Git Bash (aka. GitHub Actions `shell: bash`)
# https://www.msys2.org/docs/environments/
is_msys2_msys_build_machine() {
    if [ -e /usr/bin/msys-2.0.dll ] && {
        [ "${MSYSTEM:-}" = "MSYS" ] || [ "${MSYSTEM:-}" = "MINGW64" ] || [ "${MSYSTEM:-}" = "UCRT64" ] || [ "${MSYSTEM:-}" = "CLANG64" ] || [ "${MSYSTEM:-}" = "MINGW32" ] || [ "${MSYSTEM:-}" = "CLANG32" ] || [ "${MSYSTEM:-}" = "CLANGARM64" ]
    }; then
        return 0
    fi
    return 1
}

is_cygwin_build_machine() {
    if [ -e /usr/bin/cygwin1.dll ]; then
        return 0
    fi
    return 1
}

# Tries to find the host ABI.
#
# Beware: This function uses `uname` probing may be inaccurate for dual-arch
# CPUs like Apple Silicon with Rosetta.
#
# Inputs:
# - env:DKML_HOST_ABI - Optional but recommended. If set, then BUILDHOST_ARCH will be set to the same.
#
# Outputs:
# - env:BUILDHOST_ARCH will contain the host ABI.
autodetect_buildhost_arch() {
    if [ -n "${DKML_HOST_ABI:-}" ]; then
        BUILDHOST_ARCH=$DKML_HOST_ABI
    else
        # Set DKMLSYS_*
        autodetect_system_binaries

        autodetect_buildhost_arch_SYSTEM=$("$DKMLSYS_UNAME" -s)
        autodetect_buildhost_arch_MACHINE=$("$DKMLSYS_UNAME" -m)
        # list from https://en.wikipedia.org/wiki/Uname and https://stackoverflow.com/questions/45125516/possible-values-for-uname-m
        case "${autodetect_buildhost_arch_SYSTEM}-${autodetect_buildhost_arch_MACHINE}" in
            Linux-armv7*)
                BUILDHOST_ARCH=linux_arm32v7;;
            Linux-armv6* | Linux-arm)
                BUILDHOST_ARCH=linux_arm32v6;;
            Linux-aarch64 | Linux-arm64 | Linux-armv8*)
                BUILDHOST_ARCH=linux_arm64;;
            Linux-i386 | Linux-i686)
                BUILDHOST_ARCH=linux_x86;;
            Linux-x86_64)
                BUILDHOST_ARCH=linux_x86_64
                # uname -m reports the KERNEL machine, so a 32-bit userland on
                # a 64-bit kernel (ex. an i386 container on an amd64 host)
                # still says x86_64 -- but a 64-bit dk1 cannot run there. The
                # userland's own ELF class is the truth: byte 5 of /bin/sh is
                # 1 for ELFCLASS32. od(1) is POSIX but not guaranteed present;
                # without it, or on a 64-bit userland, the kernel's answer
                # stands. test's numeric -eq tolerates od's leading
                # whitespace; the redirected test guards non-numeric output.
                autodetect_buildhost_arch_ELFCLASS=
                if command -v od >/dev/null 2>&1; then
                    autodetect_buildhost_arch_ELFCLASS=$(od -An -td1 -j4 -N1 /bin/sh 2>/dev/null)
                fi
                if [ "${autodetect_buildhost_arch_ELFCLASS:-2}" -eq 1 ] 2>/dev/null; then
                    BUILDHOST_ARCH=linux_x86
                # musl-based Linux (ex. alpine) is not a supported dk1 ABI yet;
                # there is no musl dk1 build. Fail fast with a clear message
                # instead of reaching a confusing "not provisioned" error later.
                # A user who knows better can still force DKML_HOST_ABI. The musl
                # dynamic loader path is the reliable marker; musl's ldd
                # identifying itself is the fallback.
                elif [ -e /lib/ld-musl-x86_64.so.1 ] \
                  || { ldd --version 2>&1 | grep -qi musl; } 2>/dev/null; then
                    printf "%s\n" "FATAL: musl-based Linux (e.g. Alpine) is not supported yet; dk1 needs a glibc-based distro" >&2
                    exit 1
                fi
                ;;
            Darwin-arm64)
                BUILDHOST_ARCH=darwin_arm64;;
            Darwin-x86_64)
                BUILDHOST_ARCH=darwin_x86_64;;
            *-i386 | *-i686)
                if is_unixy_windows_build_machine; then
                    BUILDHOST_ARCH=windows_x86
                else
                    printf "%s\n" "FATAL: Unsupported build machine type obtained from 'uname -s' and 'uname -m': $autodetect_buildhost_arch_SYSTEM and $autodetect_buildhost_arch_MACHINE" >&2
                    exit 1
                fi
                ;;
            *-x86_64)
                if is_unixy_windows_build_machine; then
                    BUILDHOST_ARCH=windows_x86_64
                else
                    printf "%s\n" "FATAL: Unsupported build machine type obtained from 'uname -s' and 'uname -m': $autodetect_buildhost_arch_SYSTEM and $autodetect_buildhost_arch_MACHINE" >&2
                    exit 1
                fi
                ;;
            *)
                # Since:
                # 1) MSYS2 does not run on ARM/ARM64 (https://www.msys2.org/docs/environments/)
                # 2) MSVC does not use ARM/ARM64 as host machine (https://docs.microsoft.com/en-us/cpp/build/building-on-the-command-line?view=msvc-160)
                # we do not support Windows ARM/ARM64 as a build machine
                printf "%s\n" "FATAL: Unsupported build machine type obtained from 'uname -s' and 'uname -m': $autodetect_buildhost_arch_SYSTEM and $autodetect_buildhost_arch_MACHINE" >&2
                exit 1
                ;;
        esac
    fi
}

# A function that will try to print an ISO8601 timestamp, but will fallback to
# the system default. Always uses UTC timezone.
try_iso8601_timestamp() {
    date -u -Iseconds 2>/dev/null || TZ=UTC date
}

# A function that will print the command and possibly time it (if and only if it uses a full path to
# an executable, so that 'time' does not fail on internal shell functions).
# If --return-error-code is the first argument or LOG_TRACE_RETURN_ERROR_CODE=ON, then instead of exiting the
# function will return the error code.
log_trace() {
    log_trace_RETURN=${LOG_TRACE_RETURN_ERROR_CODE:-OFF}

    log_trace_1="$1"
    if [ "$log_trace_1" = "--return-error-code" ]; then
        shift
        log_trace_RETURN=ON
    fi

    if [ "${DKML_BUILD_TRACE:-OFF}" = ON ]; then
        printf_maybe_quiet "[%s] %s\n" "$(try_iso8601_timestamp)" "+ $*"
        if [ -x "$1" ]; then
            time "$@"
        else
            "$@"
        fi
    else
        # use judgement so we essentially have log at an INFO level
        case "$1" in
        rm|cp)
            # debug level. only show when DKML_BUILD_TRACE=ON
            ;;
        git|make|ocaml_configure|ocaml_make|make_host|make_target)
            # info level. and can show entire command without polluting the screen
            printf_maybe_quiet "[%s] %s\n" "$(try_iso8601_timestamp)" "$*"
            ;;
        *)  printf_maybe_quiet "[%s] %s\n" "$(try_iso8601_timestamp)" "$1"
        esac
        "$@"
    fi
    log_trace_ec="$?"
    if [ "$log_trace_ec" -ne 0 ]; then
        if [ "$log_trace_RETURN" = ON ]; then
            return "$log_trace_ec"
        else
            printf "FATAL: Command failed with exit code %s: %s\n" "$log_trace_ec" "$*" >&2
            exit "$log_trace_ec"
        fi
    fi
}

# [sha256compute FILE] writes the SHA256 checksum (hex encoded) of file FILE to the standard output.
sha256compute() {
    sha256compute_FILE="$1"
    shift
    # For reasons unclear doing the following in MSYS2:
    #   sha256sum 'Z:\source\README.md'
    # will produce a backslash like:
    #   \5518c76ed7234a153941fb7bc94b6e91d9cb8f1c4e22daf169a59b5878c3fc8a *Z:\\source\\README.md
    # So always cygpath the filename if available
    if [ -x /usr/bin/cygpath ]; then
        sha256compute_FILE=$(/usr/bin/cygpath -a "$sha256compute_FILE")
    fi

    autodetect_system_binaries
    if [ -x /usr/bin/shasum ]; then # macOS, OpenBSD, Debian
        # CODESITE #1 (duplicates elsewhere).
        # On Debian shasum is a perl script, and perl needs locale settings or it will complain.
        # Confer: https://www.thomas-krenn.com/en/wiki/Perl_warning_Setting_locale_failed_in_Debian
        # Confer: https://stackoverflow.com/a/52004330/21513816
        #   shellcheck disable=SC2016
        LC_ALL=C /usr/bin/shasum -a 256 "$sha256compute_FILE" | "$DKMLSYS_AWK" '{print $1}'
    elif [ -x /usr/bin/sha256sum ]; then # Linux, MSYS2
        #   shellcheck disable=SC2016
        /usr/bin/sha256sum "$sha256compute_FILE" | "$DKMLSYS_AWK" '{print $1}'
    elif [ -x /sbin/sha256 ]; then # FreeBSD
        #   shellcheck disable=SC2016
        /sbin/sha256 -r "$sha256compute_FILE" | "$DKMLSYS_AWK" '{print $1}'
    else
        printf "FATAL: %s\n" "No sha256 checksum utility found" >&2
        exit 107
    fi
}

# [sha256check FILE SUM] checks that the file FILE has a SHA256 checksum (hex encoded) of SUM.
# The function will return nonzero (and exit with failure if `set -e` is enabled) if the checksum does not match.
sha256check() {
    sha256check_FILE="$1"
    shift
    sha256check_SUM="$1"
    shift

    if [ -x /usr/bin/shasum ]; then # macOS, OpenBSD, Debian
        # CODESITE #1 (duplicates elsewhere).
        # On Debian shasum is a perl script, and perl needs locale settings or it will complain.
        # Confer: https://www.thomas-krenn.com/en/wiki/Perl_warning_Setting_locale_failed_in_Debian
        # Confer: https://stackoverflow.com/a/52004330/21513816
        # Note: shasum 5.96 (ex. conanio/gcc7:1.64.1) has no --quiet option.
        #   shellcheck disable=SC2016
        printf "%s  %s" "$sha256check_SUM" "$sha256check_FILE" | LC_ALL=C /usr/bin/shasum -a 256 -c >&2
    elif [ -x /usr/bin/sha256sum ]; then # Linux, MSYS2
        # Note: BusyBox v1.35.0 sha256sum has no --quiet option.
        printf "%s  %s" "$sha256check_SUM" "$sha256check_FILE" | /usr/bin/sha256sum -c >&2
    elif [ -x /sbin/sha256 ]; then # FreeBSD
        /sbin/sha256 --quiet -c "$sha256check_SUM" "$sha256check_FILE" >&2
    else
        printf "FATAL: %s\n" "No sha256 checksum utility found" >&2

        # REMOVEME!
        if [ -d /sbin ]; then printf "/sbin:\n" >&2; ls /sbin >&2; fi
        if [ -d /usr/sbin ]; then printf "/usr/sbin:\n" >&2; ls /usr/sbin >&2; fi
        if [ -d /bin ]; then printf "/bin:\n" >&2; ls /bin >&2; fi
        if [ -d /usr/bin ]; then printf "/usr/bin:\n" >&2; ls /usr/bin >&2; fi

        exit 107
    fi
}

# Echo --https-only if this wget supports it (BusyBox wget does not), so a
# redirect cannot downgrade the transfer off HTTPS wherever the option exists.
dk_wget_https_only() {
  if "$DKMLSYS_WGET" --help 2>&1 | grep -q -- --https-only; then printf '%s' '--https-only'; fi
}

# [downloadfile URL FILE SUM] downloads from URL into FILE and verifies the SHA256 checksum of SUM.
# If the FILE already exists with the correct checksum it is not redownloaded.
# The function will exit with failure if the checksum does not match.
# curl pins HTTPS end to end (--proto '=https' + --proto-redir '=https') with a
# TLS 1.2 floor, and -f fails on an HTTP error page instead of saving it.
downloadfile() {
    downloadfile_URL="$1"
    shift
    downloadfile_FILE="$1"
    shift
    downloadfile_SUM="$1"
    shift

    # Set DKMLSYS_*
    autodetect_system_binaries

    # Quick exit if exists and checksum verified. Do not display
    # anything (even the checksum output) since this is the normal scenario
    # that can run a billion times. The checksum verification for the
    # download (if this fails) will not be silenced.
    if [ -e "$downloadfile_FILE" ]; then
        if sha256check "$downloadfile_FILE" "$downloadfile_SUM" > /dev/null 2>&1; then
            return 0
        else
            $DKMLSYS_RM -f "$downloadfile_FILE"
        fi
    fi

    printf_maybe_quiet "... %s %s\n" "Downloading" "$downloadfile_URL"
    if [ "${CI:-}" = true ] || [ "${DKCODER_QUIET:-}" -eq 1 ]; then
        if [ -n "$DKMLSYS_CURL" ]; then
            log_trace "$DKMLSYS_CURL" --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL "$downloadfile_URL" -o "$downloadfile_FILE".tmp
        elif [ -n "$DKMLSYS_WGET" ]; then
            log_trace "$DKMLSYS_WGET" $(dk_wget_https_only) -q -O "$downloadfile_FILE".tmp "$downloadfile_URL"
        else
            dk_no_downloader
        fi
    else
        if [ -n "$DKMLSYS_CURL" ]; then
            log_trace "$DKMLSYS_CURL" --proto '=https' --proto-redir '=https' --tlsv1.2 -fL "$downloadfile_URL" -o "$downloadfile_FILE".tmp
        elif [ -n "$DKMLSYS_WGET" ]; then
            log_trace "$DKMLSYS_WGET" $(dk_wget_https_only) -O "$downloadfile_FILE".tmp "$downloadfile_URL"
        else
            dk_no_downloader
        fi
    fi
    printf_maybe_quiet "\n... %s %s\n" "Verifying" "$downloadfile_URL"
    if ! sha256check "$downloadfile_FILE".tmp "$downloadfile_SUM"; then
        printf "%s\n" "FATAL: Encountered a corrupted or compromised download from $downloadfile_URL" >&2
        exit 1
    fi
    printf_maybe_quiet "\n"
    $DKMLSYS_MV "$downloadfile_FILE".tmp "$downloadfile_FILE"
}

# End import
# ---------------------------------------------------------------------------

# --- Environment detection ---

# Set DKMLSYS_*
autodetect_system_binaries

# Find host ABI. Set in BUILDHOST_ARCH
autodetect_buildhost_arch

# --- data home ---

tools_dir=
tools_name=dk1
#   1. Check DKCODER_DATA_HOME environment variable.
if [ -z "$tools_dir" ] && [ -n "${DKCODER_DATA_HOME:-}" ]; then
  install -d "$DKCODER_DATA_HOME"
  tools_dir="$DKCODER_DATA_HOME"
fi
#   2. Check if CI since many CI providers can only cache content in a subdirectory
#      of the project.
if [ -z "$tools_dir" ] && [ "${CI:-}" = true ]; then
  install -d "$DK_PROJECT_DIR/.z-dk/tools"
  tools_dir="$DK_PROJECT_DIR/.z-dk/tools"
fi
#   2b. On Windows (Git Bash / MSYS2 / Cygwin) use the SAME store as dk1.cmd,
#      %LOCALAPPDATA%\Programs\dk1, so a project driven from both PowerShell and
#      a POSIX shell shares one cache instead of downloading every build twice.
#      This sits after the CI check on purpose: dk1.cmd has no CI branch, but a
#      Windows CI job driving ./dk1 from bash still wants the in-project cache.
#      LOCALAPPDATA holds a native Windows path (MSYS does not convert
#      environment variables), so cygpath it; needing cygpath also scopes this
#      to MSYS/Cygwin.
if [ -z "$tools_dir" ] && [ -n "${COMSPEC:-}" ] && [ -n "${LOCALAPPDATA:-}" ] && [ -x /usr/bin/cygpath ]; then
  tools_dir_LOCALAPPDATA=$(/usr/bin/cygpath -au "$LOCALAPPDATA")
  if [ -w "$tools_dir_LOCALAPPDATA" ]; then
    install -d "$tools_dir_LOCALAPPDATA/Programs/$tools_name"
    tools_dir="$tools_dir_LOCALAPPDATA/Programs/$tools_name"
  fi
fi
#   3. Check in locations rooted under /opt/diskuv
#      We look under a /opt/diskuv early because
#      - Especially important for WSL2 to use a pure Linux filesystem (ext4) for
#        best performance.
#      - Using a canonical location (especially /opt/diskuv/usr/share) makes
#        it easy to use CMake presets for non-Windows hosts.
if [ -z "$tools_dir" ] && [ -n "${XDG_DATA_HOME:-}" ] && [ -w "/opt/diskuv/$XDG_DATA_HOME" ]; then
  install -d "/opt/diskuv/$XDG_DATA_HOME/$tools_name"
  tools_dir="/opt/diskuv/$XDG_DATA_HOME/$tools_name"
fi
if [ -z "$tools_dir" ] && [ -n "${HOME:-}" ] && [ -w "/opt/diskuv/$HOME" ]; then
  install -d "/opt/diskuv/$HOME/.local/share/$tools_name"
  tools_dir="/opt/diskuv/$HOME/.local/share/$tools_name"
fi
if [ -z "$tools_dir" ] && [ -w "/opt/diskuv/usr/share" ]; then
  install -d "/opt/diskuv/usr/share/$tools_name"
  tools_dir="/opt/diskuv/usr/share/$tools_name"
fi
#   4. Check in the conventional locations rooted under /
if [ -z "$tools_dir" ] && [ -n "${XDG_DATA_HOME:-}" ] && [ -w "$XDG_DATA_HOME" ]; then
  install -d "$XDG_DATA_HOME/$tools_name"
  tools_dir="$XDG_DATA_HOME/$tools_name"
fi
if [ -z "$tools_dir" ] && [ -n "${HOME:-}" ] && [ -w "$HOME" ]; then
  install -d "$HOME/.local/share/$tools_name"
  tools_dir="$HOME/.local/share/$tools_name"
fi
#   5. Validate
if [ -z "$tools_dir" ]; then
  echo "FATAL: Could not find a location to install DkCoder." >&2
  echo "  ...: Make sure you have a home directory and that it is write-able, or define" >&2
  echo "  ...: the environment variable XDG_DATA_HOME in a shell profile script after" >&2
  echo "  ...: creating the \$XDG_DATA_HOME directory." >&2
  exit 2
fi

# --- Tool downloads and installs ---

# PREREQS
# -------

install_linux_prog() {
  install_linux_prog_NAME=$1
  shift
  install_linux_prog_PKG=$1
  shift
  install_linux_prog_ALPINE_PKG=$1
  shift
  if [ -x "/usr/bin/$install_linux_prog_NAME" ]; then
    export DK_PROG_INSTALLED_LOCATION="/usr/bin/$install_linux_prog_NAME"
  elif [ -x "/bin/$install_linux_prog_NAME" ]; then
    export DK_PROG_INSTALLED_LOCATION="/bin/$install_linux_prog_NAME"
  else
    if [ -x /sbin/apk ]; then
      if [ "$(id -u)" -eq 0 ]; then
        run_maybe_quiet /sbin/apk add --quiet --no-progress "$install_linux_prog_ALPINE_PKG"
      else
        echo "Running: sudo /sbin/apk add --quiet --no-progress  $install_linux_prog_ALPINE_PKG" >&2
        sudo /sbin/apk add --quiet --no-progress "$install_linux_prog_ALPINE_PKG"
      fi
    elif command -v yum > /dev/null 2> /dev/null; then
      if [ "$(id -u)" -eq 0 ]; then
        run_maybe_quiet yum install -q -y "$install_linux_prog_PKG"
      else
        echo "Running: sudo yum install -q -y $install_linux_prog_PKG" >&2
        sudo yum install -q -y "$install_linux_prog_PKG"
      fi
    else
      if [ "$(id -u)" -eq 0 ]; then
        run_maybe_quiet apt-get -qq install -y --no-install-suggests "$install_linux_prog_PKG"
      else
        echo "Running: sudo apt-get -qq install -y --no-install-suggests $install_linux_prog_PKG" >&2
        sudo apt-get -qq install -y --no-install-suggests "$install_linux_prog_PKG"
      fi
    fi
    DK_PROG_INSTALLED_LOCATION=$(command -v "$install_linux_prog_NAME")
    export DK_PROG_INSTALLED_LOCATION
  fi
}

case "$BUILDHOST_ARCH" in
  linux_*)
    #   Need either [wget] or [curl] for [downloadfile]
    if [ ! -x /usr/bin/wget ] && [ ! -x /bin/wget ] && [ ! -x /usr/bin/curl ] && [ ! -x /bin/curl ]; then
      install_linux_prog wget wget wget || install_linux_prog curl curl curl
    fi
    ;;
esac

# -----
# resolve version + verify the signed manifest
# -----

# A checksum-less fetch (the manifest is trusted by SIGNATURE, not a pre-known
# checksum). curl or wget, matching downloadfile's tool detection.
dk_fetch() {
  if [ -n "$DKMLSYS_CURL" ]; then "$DKMLSYS_CURL" --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL "$1" -o "$2"
  elif [ -n "$DKMLSYS_WGET" ]; then "$DKMLSYS_WGET" $(dk_wget_https_only) -q -O "$2" "$1"
  else dk_no_downloader; fi
}

# Read `%% actual_version("X.Y.Z.W")` from dk.u's workspace section (the pin).
# The `[(]?` tolerates the parenthesized call form dk1 writes (the workspace Lua
# grammar rejects the bare `actual_version "X"` string-call sugar); the version
# is the first double-quoted field either way.
dk_read_actual_version() {
  [ -f "$DK_PROJECT_DIR/dk.u" ] || return 0
  "$DKMLSYS_GREP" -oE '%%[[:space:]]*actual_version[[:space:]]*[(]?[[:space:]]*"[^"]+"' "$DK_PROJECT_DIR/dk.u" 2>/dev/null \
    | head -1 | "$DKMLSYS_SED" 's/.*"\([^"]*\)".*/\1/'
}

# Read a plain key=value field from a verified manifest.
dk_manifest_str() {
  "$DKMLSYS_GREP" "^$2=" "$1" | head -1 | cut -d= -f2
}

# Defense-in-depth: the dk1 download URL comes from the signify-verified manifest,
# but still restrict it to known hosts so a signed-but-malicious manifest cannot
# redirect the fetch off github.com/dkpkg or the legacy GitLab package host.
dk_allow_host() {
  case "$1" in
    https://github.com/dkpkg/*) return 0 ;;
    https://gitlab.com/api/v4/projects/60486861/*) return 0 ;;
    *) return 1 ;;
  esac
}

# On Windows the published dk1 + mlfront-signify binaries carry a `.exe`
# extension; other platforms have none. Mirrors gen-manifest.sh's extexe.
dk_extexe() { case "$BUILDHOST_ARCH" in windows_*) printf '.exe' ;; esac; }

# Fetch + signify-verify the manifest into $1. $2 is the pinned version ("" =
# latest). Aborts on any verification failure. Trust anchor = the baked
# mlfront-signify SHA-256, then the baked public key over the manifest.
dk_verify_manifest() {
  dvm_out=$1; dvm_ver=$2
  dvm_sigarch=$BUILDHOST_ARCH
  eval "dvm_pin=\${cksum_signify_${dvm_sigarch}:-}"
  # Empty = the arch was never provisioned; a value still starting with `__` is
  # a maintained-but-unbaked placeholder (e.g. windows_x86 until its signify job
  # ships). Both are "not provisioned" -- refuse rather than fetch and trust an
  # unverifiable verifier.
  case "$dvm_pin" in
    '' | __*) echo "FATAL: no pinned mlfront-signify checksum for $BUILDHOST_ARCH (launcher not provisioned)" >&2; exit 3 ;;
  esac
  install -d "$tools_dir/verifier"
  dvm_exe=$(dk_extexe)
  dvm_signify="$tools_dir/verifier/mlfront-signify-$dvm_pin$dvm_exe"
  downloadfile "https://gitlab.com/api/v4/projects/60486861/packages/generic/mlfront-signify/$signify_pkg_ver/mlfront-signify-$dvm_sigarch$dvm_exe" "$dvm_signify" "$dvm_pin"
  chmod +x "$dvm_signify"
  if [ -n "$dvm_ver" ]; then dvm_url="$DK_BASE_URL/manifest-$dvm_ver.txt"; else dvm_url="$DK_BASE_URL/manifest.txt"; fi
  dk_fetch "$dvm_url" "$dvm_out"
  dk_fetch "$dvm_url.sig" "$dvm_out.sig"
  printf 'untrusted comment: dk1 signify public key\n%s\n' "$SIGNIFY_PUBKEY_B64" > "$tools_dir/verifier/dk1.pub"
  "$dvm_signify" -V -q -p "$tools_dir/verifier/dk1.pub" -m "$dvm_out" -x "$dvm_out.sig" \
    || { echo "FATAL: manifest signature INVALID for $dvm_url -- refusing to continue" >&2; exit 1; }
}

# Resolve the version. `--self-update` ignores the pin and uses the LATEST dk1,
# which rewrites the dk.u actual_version to its own version -- dk1.exe edits dk.u
# safely, so this launcher never does file surgery (and stays batch-safe on the
# Windows side too). Otherwise use the dk.u pin, else the latest.
dk_selfupdate=0
[ "${1:-}" = "--self-update" ] && dk_selfupdate=1
if [ "$dk_selfupdate" = 1 ]; then
  majminpat_ver=
else
  majminpat_ver=$(dk_read_actual_version)
fi
dk_manifest="$tools_dir/verifier/manifest"
dk_verify_manifest "$dk_manifest" "$majminpat_ver"
if [ -z "$majminpat_ver" ]; then
  majminpat_ver=$(dk_manifest_str "$dk_manifest" version)
  [ "$dk_selfupdate" = 0 ] && echo "dk1: no '%% actual_version' pin in dk.u; using latest $majminpat_ver (run './dk1 --self-update' to pin)" >&2
fi
[ -n "$majminpat_ver" ] || { echo "FATAL: could not resolve a dk1 version" >&2; exit 1; }
dk1_cksum=$(dk_manifest_str "$dk_manifest" "dk1_${BUILDHOST_ARCH}")
[ -n "$dk1_cksum" ] || { echo "FATAL: manifest has no dk1 build for $BUILDHOST_ARCH (version $majminpat_ver)" >&2; exit 3; }
dk1_url_template=$(dk_manifest_str "$dk_manifest" "dk1_url_template")
[ -n "$dk1_url_template" ] || { echo "FATAL: manifest has no dk1_url_template (version $majminpat_ver)" >&2; exit 1; }

# -----
# single binary executable
# -----

DK_EXE=

destdir=$tools_dir/dk1exe-$majminpat_ver-$BUILDHOST_ARCH
install -d "$destdir"
dk1_exe="$destdir/dk1$(dk_extexe)"
download_helper() {
  download_helper_CKSUM=$1; shift
  # Resolve {version}/{arch}/{exe} in the verified manifest's dk1_url_template,
  # then allowlist the host before fetching.
  download_helper_URL=$(printf '%s' "$dk1_url_template" | "$DKMLSYS_SED" \
    -e "s|{version}|$majminpat_ver|g" -e "s|{arch}|$BUILDHOST_ARCH|g" -e "s|{exe}|$(dk_extexe)|g")
  dk_allow_host "$download_helper_URL" \
    || { echo "FATAL: dk1 download host not allowlisted: $download_helper_URL" >&2; exit 1; }
  downloadfile "$download_helper_URL" "$dk1_exe" "$download_helper_CKSUM"
}
download_dk() {
  # dk1 checksum comes from the signify-verified manifest, not a baked value.
  download_helper "$dk1_cksum"
}
# downloadfile skips the download when the cached dk1 already matches the manifest
# checksum, so this is a no-op on the common (already-cached) path. (A `--version`
# comparison would not work: dk1 prints "X.Y.Z+rev-W" but the pin is "X.Y.Z.W".)
download_dk
chmod +x "$dk1_exe"

# Set DK_EXE
DK_EXE="$dk1_exe"

# -----
# launcher store GC
# -----

# Every dk1 version installs into its own $tools_dir/dk1exe-* directory and
# old versions accumulate forever. Mark the pinned version as used, then
# remove version directories (and superseded verifier binaries) that no
# launcher has used in 30 days. Everything here re-downloads on demand from
# its signed manifest, so deletion is always safe; pruning must never break
# the launch, hence the blanket error suppression and the [find] guard
# (skip pruning entirely on systems without [find]).
touch "$destdir" "$dvm_signify" 2>/dev/null || true
if command -v find >/dev/null 2>&1; then
  find "$tools_dir" -maxdepth 1 -type d -name 'dk1exe-*' -mtime +30 \
    -exec "$DKMLSYS_RM" -rf {} + 2>/dev/null || true
  find "$tools_dir/verifier" -maxdepth 1 -type f -name 'mlfront-signify-*' \
    -mtime +30 -exec "$DKMLSYS_RM" -f {} + 2>/dev/null || true
fi

# --- Run executable ---

#   We already changed to DK_PROJECT_DIR earlier. Change back.
cd "$dk_pwd"

export DKCODER_ARG0="$0"
export DKCODER_PWD="$dk_pwd"
export DK_PROJECT_DIR
#   Tell the dk1 binary the real execution host. dkml-c-probe bakes the ABI of
#   the C compiler that built the binary, so a musl dk1 cross-built on glibc
#   would otherwise self-identify as linux_x86_64 and resolve the glibc
#   toolchain on a musl host. BUILDHOST_ARCH is the launcher's own host
#   detection (honors a pre-set DKML_HOST_ABI, else uname + the musl loader
#   probe above), so propagate it as DKML_HOST_ABI which the binary honors.
export DKML_HOST_ABI="$BUILDHOST_ARCH"
#   shellcheck disable=SC2086
if [ "$dk_selfupdate" = 1 ]; then
  # dk1.exe repins the dk.u actual_version line to the resolved (latest) version.
  exec "$DK_EXE" -isystem "$DK_PROJECT_DIR/etc/dk/i" $_DKEXE_OPTIONS self-update "$majminpat_ver"
else
  exec "$DK_EXE" -isystem "$DK_PROJECT_DIR/etc/dk/i" $_DKEXE_OPTIONS "$@"
fi