# Copyright 2026 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2

EAPI=8

MY_P=cli

DESCRIPTION=""
HOMEPAGE=""
SRC_URI="https://github.com/smallstep/${MY_P}/releases/download/v${PVR}/step_linux_amd64.tar.gz -> ${P}.tar.gz
	verify-sig? ( https://github.com/smallstep/${MY_P}/releases/download/v${PVR}/step_linux_amd64.tar.gz.sigstore.json -> ${P}.tar.gz.sigstore.json )"

LICENSE=""
SLOT="0"
KEYWORDS="amd64"

DEPEND=""
RDEPEND="${DEPEND}"
BDEPEND="verify-sig? ( app-containers/cosign )"

IUSE="-verify-sig"

S="${WORKDIR}/step_linux_amd64"

src_unpack() {
	if use verify-sig ; then
		# Call cosign here to verify the sig
		cosign verify-blob \
			--bundle "${P}.sigstore.json" \
			--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
			--certificate-oidc-issuer https://token.actions.githubusercontent.com \
			"${P}.tar.gz" || die "Signature verification failed"
	fi

	unpack "${P}.tar.gz"
}

src_install() {
	dobin bin/step
}