fix: use latest manifest in installer

1 files changed, 22 insertions, 9 deletions

diff --git a/website/install.sh b/website/install.sh
index a07d55e7..579f8325 100755
--- a/website/install.sh
+++ b/website/install.sh
@@ -1,8 +1,8 @@
 #!/bin/sh
 set -eu
 
-REPO="ogulcancelik/herdr"
 BIN="herdr"
+MANIFEST_URL="https://herdr.dev/latest.json"
 INSTALL_DIR="${HERDR_INSTALL_DIR:-$HOME/.local/bin}"
 
 main() {
@@ -32,18 +32,31 @@ main() {
 
     # check dependencies
     need curl
+    need sed
+
+    # use the same manifest as `herdr update` so installs and updates agree
+    # on the public latest release.
+    TARGET="${os}-${arch}"
+    log "fetching latest release manifest..."
+    MANIFEST="$(curl -fsSL --retry 3 --connect-timeout 10 --max-time 20 "$MANIFEST_URL")" \
+        || err "can't reach ${MANIFEST_URL}. Please try again later; herdr.dev might be down. Who let the sheeps out? baaa."
+    URL="$(printf '%s\n' "$MANIFEST" | sed -n "s/.*\"${TARGET}\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/p")"
+    VERSION="$(printf '%s\n' "$MANIFEST" | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
+
+    if [ -z "$URL" ]; then
+        err "release manifest does not include a binary for ${TARGET}"
+    fi
 
-    # download the latest binary directly via GitHub's stable redirect.
-    # this avoids the releases API, which can return transient 403s.
-    ASSET="${BIN}-${os}-${arch}"
-    URL="https://github.com/${REPO}/releases/latest/download/${ASSET}"
-
-    log "downloading latest release..."
+    if [ -n "$VERSION" ]; then
+        log "downloading v${VERSION}..."
+    else
+        log "downloading latest release..."
+    fi
     TMP="$(mktemp -d)"
     trap 'rm -rf "$TMP"' EXIT
 
     if ! curl -fsSL --retry 3 --connect-timeout 10 --max-time 120 "$URL" -o "${TMP}/${BIN}"; then
-        err "download failed. check https://github.com/${REPO}/releases"
+        err "download failed from ${URL}"
     fi
 
     # install
@@ -81,7 +94,7 @@ err()  { printf '  \033[31m✗\033[0m %s\n' "$1" >&2; exit 1; }
 
 need() {
     if ! command -v "$1" >/dev/null 2>&1; then
-        err "requires '$1' — please install it first"
+        err "requires '$1' — install it first, or download a binary manually from https://herdr.dev/docs/install/"
     fi
 }