#!/usr/bin/env sh set -eu VERSION="1.0.0" DEFAULT_BASE_URL="https://sdk.foundation.xyz/v1.0.0" BASE_URL="${FOUNDATION_SDK_BASE_URL:-$DEFAULT_BASE_URL}" INSTALL_ROOT="${FOUNDATION_SDK_INSTALL_DIR:-$HOME/.foundation/sdk}" UPDATE_RC="${FOUNDATION_SDK_UPDATE_RC:-}" if [ -z "$UPDATE_RC" ]; then if [ -n "${FOUNDATION_SDK_INSTALL_DIR:-}" ]; then UPDATE_RC=0 else UPDATE_RC=1 fi fi SUPPORTED_TARGETS="aarch64-apple-darwin x86_64-apple-darwin x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu" EMBEDDED_GPG_PUBLIC_KEY_FINGERPRINT="5DBE7F185293935315E56E31CFE1890AB7FC8B64" EMBEDDED_GPG_PUBLIC_KEY_B64="LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgptUUlOQkdKVWM3c0JFQUMrZDY1SUVhSmxvdm9KQWt5T0xHNmNHTkY5MHdYb1Jua2x0TW5jenpxN1F6QmZYUU1nCnhXMnNyS0M5UmxlTHQrMDg3dGNSSU1RQ21hUEpLdUs1MmpTT09YRmFUcFU1WU5hcDQ1NCtGcVpRRUtQL3pJY2MKSkZ5ZkdUOTcvbHNPaEI1dEJKcXlNbEpTODd4YmdzZlBVdUJ2UkNSQ3M4YThHSDhMQ3RpOG1BMGhoMjVLK2phdgpPbFR2SW4vV0tjbi9PSUI0andhUnMzOEFNM1VBOUNCeEVMUExtWTcvaksrbmRmYk5LRlh2S1NZUVQzelZWUVRECnZYd0k3YUNXSFFPQWNTK0VWQkpQZmpmSDJxb3llcGZWckx2dXVtcVNDc0pDTDZ0ZVU1Zks4dWhrdlBOc2dHdmUKUmlTbFhLWVZvN1U0bFZzNU9HbHpacWtpN1NQWFFhNC9lMmdTc0dFT1JoZzJ0VTZqV2NrZnhjR1ZLUmNGVllSdwplRkowWUR2ZTJQYk1MRlVTUTNQeWtVbjJvMVAwM04vaU9rVWE2YWdKclVMTmVXNVp0Qi9JVUdwTGpnZERNTFcrCjc4UjVSbkpSQnI5b25HSTBrNDB4Y1hwaUZRQlduN0gwMXp4YmJsV3lyalA0R201cGVkdHVJbElXT3Zta3dPSi8KTEZkVkJERCtob0VUclo4aVYyUWxHS3luYWxwRmhobjNnekxiMGp0WlZTZ2tWZkIrWkMzYUJQRmM2RVBWS3BINgp1Y0hkNHBaSi9sR0h0ZjNyeXFDK0V5K3l6WDBsQk5iUTF0QVpBMjV4a1JXbGpVVWk3blp1eUp0cjBMNGJYY1JYCngzanRhR3JPL2V4TWVPTmcxeUVTQjFFbXg4eTRpMXFVeitRWitRbEtyREdTRU5TMVZPN2hVWDFBdXdBUkFRQUIKdEVsTFpXNGdRMkZ5Y0dWdWRHVnlJQ2hEVkU4c0lFWnZkVzVrWVhScGIyNGdSR1YyYVdObGN5d2dTVzVqTGlrZwpQR3RsYmtCbWIzVnVaR0YwYVc5dVpHVjJhV05sY3k1amIyMCtpUUpPQkJNQkNnQTRGaUVFWGI1L0dGS1RrMU1WCjVXNHh6K0dKQ3JmOGkyUUZBbUpVYzdzQ0d3TUZDd2tJQndJR0ZRb0pDQXNDQkJZQ0F3RUNIZ0VDRjRBQUNna1EKeitHSkNyZjhpMlREM1EvK01LVFZwRGUwK0MvOWhoT0EzWWlHZmgyRFBtVW14bHJCTjdyUmJwL1hJMnlmaEk3bApCS3pISjhNVXo0TnU1eEFFekZQb2FlQjd6c1lpalRBbVRlL3NXaUZxY1c1VFJubkNHdTBzSExzY1hMK1NsUmtXClRLRHk2cVJFNjBESkFmWVFiOVl5ckRuZkQvVDJuaklidEZCNVZuZW4raUNTRnhLWmVsbU5abTRQQjNINlpudVAKYXBNdnZqdXFHV0JYMUJTeUdJeFhseThEU2VjVWU2cHVXS3BDODFWSW92bzZUc0h5a1FuaTMwZHMwL1FTY0Nlcgp2VmNPT3BmblJ5TFRLSWI1cmJ4Rk1oYzUvRndDQzVNSENnQ1gweUxCakh1aTZLY3BUc2hoZjUwUWF3clpFYW9KCjgxc29SNUY2elFRRmdwRFdwZUJXSDJEMlE1OTAvSk9pOEVXcy95QmRKRkpsbTI3Q2RiUW1kS25aWW9WU1lsYnAKNy95VWR1Qlp2U2FhcHgzOElPUDBuYnM4Y1N0dzkwS2Q0dGprZ3NvOGZ4c0R5VDlVaE1LWWxMbWI2aCt6NjF5cAprNFc4dW1nVXprVE5qUXl0L1ppbkpUT1M3S3RwY3ViemladWVqSkJyTzdyQXgzTFd0cVVodlRpTXI0UGJoNTlPCkRmKzQwWHc5VWtCdmZ5WDFTSDlIcjJCNXB3TWVkTm5pT2JYWU14QVYwckZmU1JhNEovdXhFOE5wVmZqcXBCbnoKd09GbFprVUtVaGROVzd0Y3pXVW9hUU9nSE1mM3RkMWNFSERFNVF0Tm0zMStveTRjWlBGbkR1VnMxN2VYSGt5RQpTaXRzZGhBeFJRUzA5TkJQOGlUcm5GK3loOHU1OExUeDRBMytRakJWbTBFSHdvSzhWNldMYlEvNlA4cTVBZzBFCllsUnp1d0VRQUxwM2J0M3hHR1liRnZxeGJnQk9FaWlvVENaY0xZSFh0cEc5TXRCYmFxKzczVnFWVGc3eCsrSEgKeEZzcXM2SDZ5QUZKQVVSTjVldG5HM2ZINW80UkpUMDFaS3JNdkpDN05FN1NrUnVJK1Bpby9pTjhSSHl1VGdTRgo5L2wyUFdZbjNQR1liNEVsNVp1bzB5QzV3bER4bTh2VVhvNkVQUWlzeDRkNXRQTTBqLy8vZUMwellDbmcyQlhHCmdVZElLZUovbnpHc1hweEMvUUxqTk41U2JrRVFlQjNmZTUwOXhlZ1ArcWFVNStrWmFOWkpudnBRb1Z1Qk9hWkIKOE10QnJ4RzhiL2U0UEpWUUdXZ003S2lQSlhKR2U5eVB3T0MrUFFpVE1KaWZ1d1RZQzA1MUNPeUdlUUJrcG1XSwp5L0hzZEh3ckR6KzkvOEFhYTM2YmJHRUpyY1k2VDZ1TVJQVDhFZk9LaFk5ZFhTdGQvbzNhUWpTQ3E3d2NWUWlpCkJLNExXWm9CUytDZi9NRStMdXMxRzV6RTBNM3U2RjZ6bE1rZWFOS2dzUlNwKzJYNElVZ0UreWFWeUM3dHVrUHAKNVhXU2ZROEh3QzJmWU1UdkZjUUtkdHBQc0RtNEJoem1TaFA3allQdldYV3l2ME5zS1FiUjJGNjdJOWFkWmU0bQpKTk5ObTM5QXpvZ3NTekFocnVmanVvOW05VzRwdEdhUjJTdjkwTUZjWmpSRm9maHVOZU0vcHp2QjFYQjAvckdCCjZrNDFtUHhqeEV3Q1JucFc0Mm0xODFKZVJka2xWd3RvQlFLWWc3WmhqdmtrVW92QmQ3YWdLdlFkVVRHNEZyUk8Kb3ZmTC8xalhxcFF6dFdLMUxvSDVVZHBFMjJpZ2Y1TFF3aDhBRGxuUW41VEd0SzRBajQzcEFCRUJBQUdKQWpZRQpHQUVLQUNBV0lRUmR2bjhZVXBPVFV4WGxiakhQNFlrS3QveUxaQVVDWWxSenV3SWJEQUFLQ1JEUDRZa0t0L3lMClpLN0xELzR6YnNVSWJSdytVaFpodFNLdlp2eTlFYmVtWDFQMWZBVnc0MXFraFViNFRoNXNoSDl2NE94Z2VSN3AKbzBLdmU5L2w3TTlGY3UxemJXZXBPTGluKzRLb25TMk1iVUhaa3p1Z3B3MGlDbVJyUU9VYkFBNDdkL0s1SUpIdApneXFYZ01JZ0NaMjV5Tm1jL0oyOENOaU5pTTliWTRXdHNiSkN4VUdwTjRPNGZHRW1HdFR2clN5RkduSmIvR245CjluYzRlaXpKbVhWaDNybTU5S0Z2WksyblFxY1hUeTRLYXRLUGxESlRRd2ttZEkzSXUxRHpHbmk2R0s1MVJOekkKVnlWTmRma0dmUE5yTDhVVlhDTkVHSjloa1VUMzNrSFFOMlI3SXhmUjgxQnQ0bkVGamdOSUxWZUltTFV3Tm5rUQptK3VEMTlLTGY3UTBiZERDZVhYZUV3NHBjcEVJWjNvNytlcHFuQmRkTkRFOW1qNHFnaHMyVXl3dEk0QnRHamFOCitsd2pZSUMvcTBJc2Q3MlJwT2grOWRYRmlIY1g1U3dBdE1IQVFEb0ptakVyRDRSQU1zblNKOC9YQURLNDRDVloKSFlKeUN2QWx6T0d1TFl3TktRNGJpRmVuZXNDbkJwVWE5Nld4NjYwVGdqOStRdmE2YTZ6WmNBU240MWR5dFhHeApXKzF6S2JLTkd0NlJRVjV4NDRsU0o4aEQxK0VLVnBHZGkxeXo0bFhVN0NNOGR6V1RqYnB6dmVIUi9GZkkvbkRjCmcrdjJPQ3JuYnNyOVVBTU9ERCtoaThwUzhiNjN4UGpHT0xkdEdCdEoyL0xlcFFJdVJJOTR1QTdobG9ML1JZclYKSWRuS2g3QkhmQmUvUDM5L3g4WnorQk1taTY4Y1l3RmlZOW9GdkFQc1NyZG5reGdFbEE9PQo9L2Z2OAotLS0tLUVORCBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0t" # Opt-out of GPG signature verification for signed releases. UNSAFE: see # setup_gpg_verifier. Settable via FOUNDATION_SDK_NO_VERIFY=1 or --no-verify. NO_VERIFY="${FOUNDATION_SDK_NO_VERIFY:-0}" for arg in "$@"; do case "$arg" in --no-verify) NO_VERIFY=1 ;; *) echo "Unknown argument: $arg" >&2 echo "Usage: install.sh [--no-verify]" >&2 exit 1 ;; esac done detect_rc_file() { if [ -n "${FOUNDATION_SDK_RC_FILE:-}" ]; then echo "$FOUNDATION_SDK_RC_FILE" return fi case "${SHELL:-}" in */zsh|zsh) echo "$HOME/.zshrc" ;; */bash|bash) echo "$HOME/.bashrc" ;; *) echo "$HOME/.profile" ;; esac } detect_os() { case "$(uname -s)" in Darwin) echo "apple-darwin" ;; Linux) echo "unknown-linux-gnu" ;; *) echo "unsupported" ;; esac } detect_arch() { case "$(uname -m)" in arm64|aarch64) echo "aarch64" ;; x86_64|amd64) echo "x86_64" ;; *) echo "unsupported" ;; esac } make_absolute_path() { path="$1" case "$path" in /*) printf '%s\n' "$path" ;; *) printf '%s/%s\n' "$(pwd -P)" "$path" ;; esac } download_to() { url="$1" destination="$2" if command -v curl >/dev/null 2>&1; then curl -fL --progress-bar --show-error "$url" -o "$destination" return fi if command -v wget >/dev/null 2>&1; then wget -O "$destination" "$url" return fi echo "Either curl or wget is required to install the Foundation SDK." >&2 exit 1 } sha256_file() { file="$1" if command -v shasum >/dev/null 2>&1; then shasum -a 256 "$file" | awk '{print $1}' return fi if command -v sha256sum >/dev/null 2>&1; then sha256sum "$file" | awk '{print $1}' return fi echo "Either shasum or sha256sum is required to verify the Foundation SDK archive." >&2 exit 1 } detect_gpg() { if command -v gpg >/dev/null 2>&1; then echo "gpg" return fi if command -v gpg2 >/dev/null 2>&1; then echo "gpg2" return fi echo "" } detect_gpgv() { if command -v gpgv >/dev/null 2>&1; then echo "gpgv" return fi echo "" } if [ -t 1 ]; then COLOR_GREEN="$(printf '\033[32m')" COLOR_RED="$(printf '\033[31m')" COLOR_YELLOW="$(printf '\033[33m')" COLOR_RESET="$(printf '\033[0m')" else COLOR_GREEN="" COLOR_RED="" COLOR_YELLOW="" COLOR_RESET="" fi print_ok() { message="$1" printf '%s✓%s %s\n' "$COLOR_GREEN" "$COLOR_RESET" "$message" } print_warn() { message="$1" printf '%s!%s %s\n' "$COLOR_YELLOW" "$COLOR_RESET" "$message" >&2 } print_fail() { message="$1" printf '%s✗%s %s\n' "$COLOR_RED" "$COLOR_RESET" "$message" >&2 exit 1 } directory_owner_id() { ls -ldn "$1" | awk '{ print $3 }' } directory_mode() { ls -ld "$1" | awk '{ print $1 }' } is_group_or_world_writable() { mode="$(directory_mode "$1")" group_write="$(printf '%s' "$mode" | cut -c6)" world_write="$(printf '%s' "$mode" | cut -c9)" [ "$group_write" = "w" ] || [ "$world_write" = "w" ] } ensure_secure_directory() { path="$1" label="$2" if [ ! -d "$path" ]; then print_fail "$label does not exist: $path" fi if [ -L "$path" ]; then print_fail "$label must be a real directory, not a symlink: $path" fi owner_id="$(directory_owner_id "$path")" if [ "$owner_id" != "$(id -u)" ]; then print_fail "$label is not owned by the current user: $path" fi chmod go-w "$path" 2>/dev/null || true if is_group_or_world_writable "$path"; then print_fail "$label is writable by group or others: $path" fi } ensure_secure_launcher_dir() { install_root="$1" bin_dir="$2" ensure_secure_directory "$install_root" "Foundation SDK install root" ensure_secure_directory "$bin_dir" "Foundation SDK launcher directory" launcher="$bin_dir/foundation" if [ ! -f "$launcher" ] || [ ! -x "$launcher" ]; then print_fail "Foundation SDK launcher was not installed correctly: $launcher" fi } update_rc_enabled() { case "$UPDATE_RC" in 1|true|TRUE|yes|YES) return 0 ;; 0|false|FALSE|no|NO) return 1 ;; *) print_fail "FOUNDATION_SDK_UPDATE_RC must be 1/true/yes or 0/false/no" ;; esac } no_verify_enabled() { case "$NO_VERIFY" in 1|true|TRUE|yes|YES) return 0 ;; 0|false|FALSE|no|NO) return 1 ;; *) print_fail "FOUNDATION_SDK_NO_VERIFY must be 1/true/yes or 0/false/no" ;; esac } refresh_installed_mtimes() { root="$1" # Release archives use normalized mtimes for reproducibility. Refresh the # installed source tree so Cargo invalidates app-side path dependency caches # when a same-version SDK is reinstalled locally. find "$root" -type f -exec touch {} + find "$root" -type d -exec touch {} + } setup_gpg_verifier() { if [ -z "$EMBEDDED_GPG_PUBLIC_KEY_B64" ]; then return fi if [ -z "$EMBEDDED_GPG_PUBLIC_KEY_FINGERPRINT" ]; then print_fail "Embedded Foundation release key is missing a pinned fingerprint" fi # This is a signed release. Require a working gpg by default so the signature # is actually checked: checksums.sha256 is downloaded from the same BASE_URL # as the archives, so checksum-only verification gives NO protection against a # compromised download source (an attacker who can replace the bucket can ship # a malicious archive plus a matching checksums file). --no-verify explicitly # opts out of signature verification (unsafe). if no_verify_enabled; then print_warn "--no-verify: skipping Foundation SDK signature verification (UNSAFE). Continuing with checksum-only verification, which does NOT protect against a compromised download source." return fi GPG="$(detect_gpg)" if [ -z "$GPG" ]; then print_fail "This Foundation SDK release is signed, but gpg is not installed so the signature cannot be verified. Install gpg and re-run, or pass --no-verify to skip signature verification (UNSAFE: continues with checksum-only verification, which does NOT protect against a compromised download source)." fi GNUPGHOME="$TMPDIR/gnupg" mkdir -p "$GNUPGHOME" chmod 700 "$GNUPGHOME" key_file="$GNUPGHOME/foundation-sdk-release.asc" # Base64 was used to embed the armored key safely; decode on disk before import. if ! printf '%s' "$EMBEDDED_GPG_PUBLIC_KEY_B64" | base64 -d > "$key_file" 2>/dev/null; then print_fail "Could not decode embedded Foundation release key (base64)" fi if "$GPG" --batch --homedir "$GNUPGHOME" --import "$key_file" >/dev/null 2>&1; then actual_fingerprint="$("$GPG" --batch --homedir "$GNUPGHOME" --with-colons --fingerprint | awk -F: '$1 == "fpr" { print $10; exit }')" if [ "$actual_fingerprint" != "$EMBEDDED_GPG_PUBLIC_KEY_FINGERPRINT" ]; then print_fail "Embedded Foundation release key fingerprint mismatch" fi GPG_KEYRING="$GNUPGHOME/foundation-sdk-release.gpg" "$GPG" --batch --homedir "$GNUPGHOME" --export "$EMBEDDED_GPG_PUBLIC_KEY_FINGERPRINT" > "$GPG_KEYRING" GPGV="$(detect_gpgv)" SIGNATURE_VERIFICATION_ENABLED=1 print_ok "Foundation release key imported ($actual_fingerprint)" else print_fail "Could not import embedded Foundation release key" fi } verify_signature() { file="$1" signature="$2" label="$3" if [ -n "$GPGV" ] && "$GPGV" --keyring "$GPG_KEYRING" "$signature" "$file" >/dev/null 2>&1; then print_ok "$label signature verified" elif "$GPG" --batch --homedir "$GNUPGHOME" --trust-model always --verify "$signature" "$file" >/dev/null 2>&1; then print_ok "$label signature verified" else print_fail "$label signature verification failed" fi } verify_checksum() { file="$1" checksums_file="$2" label="$3" expected="$(awk -v name="$label" '$2 == name { print $1 }' "$checksums_file")" if [ -z "$expected" ]; then print_fail "Could not find a checksum for $label in $(basename "$checksums_file")" fi actual="$(sha256_file "$file")" if [ "$expected" = "$actual" ]; then print_ok "$label checksum verified" else print_fail "$label checksum mismatch" fi } rewrite_rc_path_block() { rc_file="$1" bin_dir="$2" marker_begin="# >>> foundation-sdk >>>" marker_end="# <<< foundation-sdk <<<" tmp_rc="$TMPDIR/rc.$$.tmp" mkdir -p "$(dirname "$rc_file")" || return 1 if [ -f "$rc_file" ]; then awk -v begin="$marker_begin" -v end="$marker_end" ' $0 == begin { skip = 1; next } $0 == end { skip = 0; next } skip != 1 { print } ' "$rc_file" > "$tmp_rc" || return 1 else : > "$tmp_rc" || return 1 fi { cat "$tmp_rc" if [ -s "$tmp_rc" ]; then printf '\n' fi printf '%s\n' "$marker_begin" printf '%s\n' "export PATH=\"$bin_dir:\$PATH\"" printf '%s\n' "$marker_end" } > "$rc_file" || return 1 } install_launchers() { install_root="$1" sdk_root="$2" current_root="$3" bin_dir="$install_root/bin" rm -rf "$bin_dir" mkdir -p "$bin_dir" cat > "$bin_dir/foundation" <&2 exit 1 fi TARGET="$ARCH-$OS" case " $SUPPORTED_TARGETS " in *" $TARGET "*) ;; *) echo "No packaged Foundation SDK archive is available for $TARGET." >&2 echo "Supported targets: $SUPPORTED_TARGETS" >&2 exit 1 ;; esac COMMON_ARCHIVE="foundation-sdk-$VERSION-common.tar.gz" TARGET_ARCHIVE="foundation-sdk-$VERSION-$TARGET.tar.gz" CHECKSUMS="checksums.sha256" COMMON_ARCHIVE_SIG="$COMMON_ARCHIVE.sig" TARGET_ARCHIVE_SIG="$TARGET_ARCHIVE.sig" CHECKSUMS_SIG="$CHECKSUMS.sig" TMPDIR="$(mktemp -d "${TMPDIR:-/tmp}/foundation-sdk.XXXXXX")" trap 'rm -rf "$TMPDIR"' EXIT INT TERM SIGNATURE_VERIFICATION_ENABLED=0 GPG="" GPGV="" GNUPGHOME="" GPG_KEYRING="" setup_gpg_verifier download_to "$BASE_URL/$COMMON_ARCHIVE" "$TMPDIR/$COMMON_ARCHIVE" download_to "$BASE_URL/$TARGET_ARCHIVE" "$TMPDIR/$TARGET_ARCHIVE" download_to "$BASE_URL/$CHECKSUMS" "$TMPDIR/$CHECKSUMS" if [ "$SIGNATURE_VERIFICATION_ENABLED" -eq 1 ]; then download_to "$BASE_URL/$CHECKSUMS_SIG" "$TMPDIR/$CHECKSUMS_SIG" download_to "$BASE_URL/$COMMON_ARCHIVE_SIG" "$TMPDIR/$COMMON_ARCHIVE_SIG" download_to "$BASE_URL/$TARGET_ARCHIVE_SIG" "$TMPDIR/$TARGET_ARCHIVE_SIG" verify_signature "$TMPDIR/$CHECKSUMS" "$TMPDIR/$CHECKSUMS_SIG" "$CHECKSUMS" verify_signature "$TMPDIR/$COMMON_ARCHIVE" "$TMPDIR/$COMMON_ARCHIVE_SIG" "$COMMON_ARCHIVE" verify_signature "$TMPDIR/$TARGET_ARCHIVE" "$TMPDIR/$TARGET_ARCHIVE_SIG" "$TARGET_ARCHIVE" fi verify_checksum "$TMPDIR/$COMMON_ARCHIVE" "$TMPDIR/$CHECKSUMS" "$COMMON_ARCHIVE" verify_checksum "$TMPDIR/$TARGET_ARCHIVE" "$TMPDIR/$CHECKSUMS" "$TARGET_ARCHIVE" INSTALL_ROOT="$(make_absolute_path "$INSTALL_ROOT")" mkdir -p "$INSTALL_ROOT" INSTALL_ROOT="$(CDPATH= cd -- "$INSTALL_ROOT" && pwd -P)" DESTINATION="$INSTALL_ROOT/foundation-sdk-$VERSION-$TARGET" CURRENT_LINK="$INSTALL_ROOT/current" CACHED_BASE_THEME="$HOME/.foundation/themes/json/base_theme.json" CURRENT_BASE_THEME="$CURRENT_LINK/lib/keyos/sdk/crates/foundation-themes/themes/base_theme.json" REFRESH_CACHED_BASE_THEME=0 if [ -f "$CACHED_BASE_THEME" ] && [ ! -L "$CACHED_BASE_THEME" ] && \ [ -f "$CURRENT_BASE_THEME" ] && cmp -s "$CACHED_BASE_THEME" "$CURRENT_BASE_THEME"; then # The cache is still the exact Base Theme shipped by the installed SDK, so # it is safe to advance it with the SDK. A designer-edited cache is left # untouched and remains subject to the compiler's completeness check. REFRESH_CACHED_BASE_THEME=1 fi rm -rf "$DESTINATION" mkdir -p "$DESTINATION" tar -xzf "$TMPDIR/$COMMON_ARCHIVE" -C "$DESTINATION" tar -xzf "$TMPDIR/$TARGET_ARCHIVE" -C "$DESTINATION" refresh_installed_mtimes "$DESTINATION" rm -f "$CURRENT_LINK" ln -s "$DESTINATION" "$CURRENT_LINK" if [ "$REFRESH_CACHED_BASE_THEME" -eq 1 ]; then NEW_BASE_THEME="$DESTINATION/lib/keyos/sdk/crates/foundation-themes/themes/base_theme.json" if [ -f "$NEW_BASE_THEME" ]; then cp "$NEW_BASE_THEME" "$CACHED_BASE_THEME" print_ok "Updated unmodified Base Theme cache" fi fi install_launchers "$INSTALL_ROOT" "$DESTINATION" "$CURRENT_LINK" ensure_secure_launcher_dir "$INSTALL_ROOT" "$INSTALL_ROOT/bin" echo "Foundation SDK installed to: $DESTINATION" echo echo "Next steps:" if update_rc_enabled; then RC_FILE="$(detect_rc_file)" if rewrite_rc_path_block "$RC_FILE" "$INSTALL_ROOT/bin"; then echo " source \"$RC_FILE\"" else print_warn "Could not update shell rc file: $RC_FILE" echo " export PATH=\"$INSTALL_ROOT/bin:\$PATH\"" fi else echo " export PATH=\"$INSTALL_ROOT/bin:\$PATH\"" fi echo " foundation develop" if [ "$OS" = "unknown-linux-gnu" ] && [ ! -f /etc/udev/rules.d/99-passport.rules ]; then echo echo "To access Passport Prime over USB (sideload, logs, passport-drive), install the udev rules:" echo " sudo cp \"$CURRENT_LINK/share/99-passport.rules\" /etc/udev/rules.d/" echo " sudo udevadm control --reload && sudo udevadm trigger" fi