run_once_after_install_cli.sh.tmpl

#!/usr/bin/env bash

set -eo pipefail

# setup path for not login shell
test -f /home/linuxbrew/.linuxbrew/bin/brew &&
    eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"

# install by brew
install_by_brew=(
    # not managed by aqua or for some reasons.
    # for vscode-neovim
    "nvim"
    "kcov"
)
for inst in "${install_by_brew[@]}"; do
    brew install $inst
done

while read -r line; do
    [[ -z "$line" ]] && continue
    [[ "$line" =~ ^# ]] && continue
    brew rm "$line" --force
done < <(cat <<EOF
aqua
EOF
)

# install aqua
if ! command -v aqua &>/dev/null; then
    curl -sSfL -O https://raw.githubusercontent.com/aquaproj/aqua-installer/v3.0.1/aqua-installer
    echo "fb4b3b7d026e5aba1fc478c268e8fbd653e01404c8a8c6284fdba88ae62eda6a  aqua-installer" | sha256sum -c
    chmod +x aqua-installer
    ./aqua-installer
    rm -f ./aqua-installer
fi
export PATH=~/.local/share/aquaproj-aqua/bin:$PATH

{{ if not .is_in_container -}}
{{/* install cli globally except for a dev-container. -*/}}
# install cli globally by aqua. aqua.yaml hash: {{ include "dot_config/aquaproj-aqua/aqua.yaml" | sha256sum }}
export AQUA_GLOBAL_CONFIG=$HOME/.config/aquaproj-aqua/aqua.yaml
aqua install --all

# install cli globally by mise. mise/config-global.toml hash: {{ include "dot_config/mise/config-global.toml" | sha256sum }}
# change default env to avoid using in dev-containers as it may conflict with container tools.
MISE_JOBS=$(fgrep 'processor' /proc/cpuinfo | wc -l) MISE_CONFIG_FILE=$HOME/.config/mise/config-global.toml mise install
{{ end }}

# misc
cd /tmp
curl -fsSL "https://s3.amazonaws.com/session-manager-downloads/plugin/latest/ubuntu_64bit/session-manager-plugin.deb" -o "session-manager-plugin.deb"
sudo dpkg -i session-manager-plugin.deb
session-manager-plugin

AWS_SAM_CLI_PRIMARY_FINGERPRINT=$(gpg --import {{ joinPath .chezmoi.sourceDir "files/gpg-keys/aws-sam-cli-primary-public-key.txt" | quote }} 2>&1 | grep "gpg: key " | sed -r "s/gpg: key ([0-9A-F]+):.*/\1/")
AWS_SAM_CLI_SIGNER_FINGERPRINT=$(gpg --import {{ joinPath .chezmoi.sourceDir "files/gpg-keys/aws-sam-cli-signer-public-key.txt" | quote }} 2>&1 | grep "gpg: key " | sed -r "s/gpg: key ([0-9A-F]+):.*/\1/")
gpg --fingerprint ${AWS_SAM_CLI_SIGNER_FINGERPRINT} | grep "37D8 BE16 0355 2DA7 BD6A  04D8 C7A0 5F43 FE0A DDFA" || exit 1

gpg --check-sigs ${AWS_SAM_CLI_PRIMARY_FINGERPRINT} && gpg --check-sigs ${AWS_SAM_CLI_SIGNER_FINGERPRINT}

curl -fsSLO https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-x86_64.zip.sig
curl -fsSLO https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-x86_64.zip

gpg --verify aws-sam-cli-linux-x86_64.zip.sig aws-sam-cli-linux-x86_64.zip | grep "Bad signature" && exit 1
unzip -o aws-sam-cli-linux-x86_64.zip -d ./aws-sam-cli
sudo ./aws-sam-cli/install --update
sam --version
cd - &>/dev/null