#!/usr/bin/env bash
# spoofcheck — script distribusi TRANSPARAN untuk scheck.zerostress.st
#
# Baca dulu sebelum dijalankan: tidak ada yang di-base64/disamarkan.
#   1. unduh biner spoofcheck dari server distribusi
#   2. verifikasi sha256 (GAGAL KERAS bila berbeda — file tidak dijalankan)
#   3. jalankan mode check
#
# Cara pakai:
#   ./check.sh <IP-server>          contoh: ./check.sh 203.0.113.10
#   SPOOF_SERVER=... ./check.sh     atau pakai env
#
# Update host biner (setelah build ulang), edit SHA256 di bawah!
#   GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "-s -w" -o spoofcheck_arm64
set -euo pipefail

DIST="${SPOOF_DIST:-https://scheck.zerostress.st}"   # server distribusi milikmu
SHA256_AMD64="f0d19a0588bcaee67a453f0888fec0593c65bf31dae2a8730be58cd0a5720cb0"
# SHA256_ARM64="<isi setelah build arm64>"

case "$(uname -m)" in
  x86_64)          ARCH=amd64; SHA256="$SHA256_AMD64" ;;
  aarch64|arm64)   echo "[!] build arm64 sendiri lalu isi SHA256_ARM64 di script ini"; exit 2 ;;
  *)               echo "[!] arsitektur $(uname -m) tidak didukung"; exit 2 ;;
esac

URL="$DIST/spoofcheck_$ARCH"
tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT

echo "[*] unduh $URL"
if command -v curl >/dev/null; then
  curl -fsSL "$URL" -o "$tmp/spoofcheck"
elif command -v wget >/dev/null; then
  wget -qO "$tmp/spoofcheck" "$URL"
else
  echo "[!] butuh curl atau wget"; exit 2
fi

echo "[*] verifikasi checksum..."
if ! echo "$SHA256  $tmp/spoofcheck" | sha256sum -c - >/dev/null 2>&1; then
  echo "[!] CHECKSUM GAGAL — file di server berbeda dari yang di-build."
  echo "[!] File TIDAK dijalankan. Build ulang biner, perbarui SHA256, atau cek server."
  sha256sum "$tmp/spoofcheck" 2>/dev/null || true
  exit 1
fi
echo "[+] checksum cocok"

chmod +x "$tmp/spoofcheck"

# argumen posisional pertama (IP server) diterjemahkan jadi -server
if [ $# -gt 0 ] && [ "${1#-}" = "$1" ]; then
  set -- -server "$@"
fi
exec "$tmp/spoofcheck" check "$@"