#!/usr/bin/env bash
# Install ee1os on a phone from macOS or Linux.
#
#   curl -fLO https://ee1os.com/install.sh && bash install.sh
#
#   --check        check the computer, fastboot and the phone, then stop; changes nothing
#   --no-lock      flash but leave the bootloader unlocked
#   --lock-only    only lock the bootloader (after a flash where the lock was skipped)
#   --zip PATH     use a downloaded <codename>-install-<build>.zip instead of downloading
#   --send PATH    send an install.log to Ivan
#
# Steps: 1 computer, 2 fastboot, 3 phone, 4 download, 5 unlock, 6 flash, 7 lock.
# Everything goes to ~/ee1os-install/<time>/install.log. On failure the script shows
# what went wrong and offers to send the log. Works with bash 3.2 (macOS).
set -u -o pipefail

VERSION=4
SITE=${EE1OS_SITE:-https://ee1os.com}
RELEASES=${EE1OS_RELEASES:-https://github.com/ee1os/releases/releases/download}
# SHA-256 of avb_pkmd.bin, the public half of the verified boot key. Fetched from a different
# host than the zip, so a swapped zip is caught even if its checksum file was swapped too.
FINGERPRINT=70b98fe0d9925692af9afc29981d3a58ec076ca4a056d53ff4ca14d1f0d0669f
FASTBOOT_MIN=35.0.1
PT_VERSION=37.0.1
PT_SHA256_DARWIN=ee39ad5967e95c2a07f04dbcbde96b1a0c916ba376096db5d2f498b7727a5d1d
PT_SHA256_LINUX=d230f13842f60f782a8645f9c813f8f845bf36089ea7289f28c48f17979313f1
NEED_GB=${EE1OS_NEED_GB:-10}
WAIT=${EE1OS_WAIT:-180}
# Where answers come from; the tests point this at a file.
TTY=${EE1OS_TTY:-/dev/tty}
# One time limit in seconds for every fastboot call; only the tests set it.
FB_TIMEOUT=${EE1OS_FB_TIMEOUT:-}

BASE=${EE1OS_HOME:-$HOME/ee1os-install}
CACHE=$BASE/cache
# What the last flash from this computer put on which phone; see save_state.
STATE=$BASE/state
TOTAL=7

MODE=install
LOCK=1
ZIP=
SEND=
STEP=0
STEP_NAME="start"
LAST_CMD=
LAST_RC=
SERIAL=
FLASHING=0
LOCK_SKIPPED=0

usage() { sed -n '2,14p' "$0" | sed 's/^# \{0,1\}//'; }

while [ $# -gt 0 ]; do
    case $1 in
        --check) MODE=check ;;
        --no-lock) LOCK=0 ;;
        --lock-only) MODE=lock-only ;;
        --zip) ZIP=${2:-}; shift ;;
        --send) SEND=${2:-}; shift ;;
        -h|--help) usage; exit 0 ;;
        *) echo "Unknown option: $1"; usage; exit 2 ;;
    esac
    shift
done
if [ "$MODE" = lock-only ] && [ "$LOCK" = 0 ]; then echo "--lock-only and --no-lock don't go together."; exit 2; fi

# ---------------------------------------------------------------- output and log

if [ -t 1 ]; then B=$(printf '\033[1m'); R=$(printf '\033[31m'); N=$(printf '\033[0m'); else B=; R=; N=; fi

say() { printf '%s\n' "$*"; }
step() {
    STEP=$1; STEP_NAME=$2; LAST_CMD=
    printf '\n%s== Step %s of %s: %s%s\n' "$B" "$STEP" "$TOTAL" "$STEP_NAME" "$N"
}

# Run a command, log it and its output, remember its exit code.
run() {
    LAST_CMD="$*"
    say "\$ $*"
    "$@"
    LAST_RC=$?
    return $LAST_RC
}

# Like run, but a failure stops the install.
must() { run "$@" || fail "This command failed."; }

# Download to FILE.part (resuming a previous try when the server allows it), then rename.
fetch() {
    if ! run curl -fL --retry 3 --progress-bar -C - -o "$2.part" "$1" 2>&4; then
        rm -f "$2.part"
        must curl -fL --retry 3 --progress-bar -o "$2.part" "$1" 2>&4
    fi
    mv "$2.part" "$2"
}

ask() {
    # Prompts read the terminal, so the script also works when piped.
    local ans
    printf '%s ' "$1"
    [ -n "${TTY_OPEN:-}" ] || { exec 5< "$TTY" && TTY_OPEN=1; } 2>/dev/null
    if ! read -r ans <&5; then ans=; fi
    say "(answered: $ans)"
    REPLY=$ans
}

sha256() {
    if command -v sha256sum > /dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1
    else shasum -a 256 "$1" | cut -d' ' -f1; fi
}

grouped() { printf '%s\n' "$1" | sed 's/\(........\)/\1 /g; s/ $//'; }

# The phone's serial as a short hash; sent logs and the state file carry this, not the serial.
serial_tag() { printf 'serial-%s\n' "$(printf '%s' "$SERIAL" | sha256 /dev/stdin | cut -c1-8)"; }

# Write a copy of the log for sending: colour codes go, the phone's serial becomes a short
# hash, the home folder becomes ~.
redact() {
    local tag=
    if [ -n "$SERIAL" ]; then tag=$(serial_tag); fi
    awk -v s="$SERIAL" -v t="$tag" -v h="$HOME" '
        function swap(line, from, to,    out, i) {
            if (from == "") return line
            out = ""
            while ((i = index(line, from)) > 0) { out = out substr(line, 1, i - 1) to; line = substr(line, i + length(from)) }
            return out line
        }
        { gsub(/\033\[[0-9;]*m/, ""); print swap(swap($0, s, t), h, "~") }' "$1"
}

send_log() {
    local log=$1 out id
    [ -s "$log" ] || { say "No log at $log."; return 1; }
    out="${log%.log}.sent.log"
    # sending a saved log later: the serial comes from the log itself
    if [ -z "$SERIAL" ]; then
        SERIAL=$(sed -n 's/^.*Found phone \([^ ]*\).*$/\1/p' "$log" | head -n 1 | tr -d '\r')
    fi
    redact "$log" > "$out"
    # The endpoint takes up to 1 MB and wants the first line; keep the start and the end,
    # where the error is.
    if [ "$(wc -c < "$out")" -gt 1000000 ]; then
        { head -c 20000 "$out"; printf '\n[... cut ...]\n'; tail -c 950000 "$out"; } > "$out.tmp" \
            && mv "$out.tmp" "$out"
    fi
    say "Sending $out ..."
    if id=$(curl -fsS --max-time 60 -H 'Content-Type: text/plain; charset=utf-8' \
            -H "X-Install-Script: sh/$VERSION" --data-binary "@$out" "$SITE/api/report"); then
        say ""
        say "${B}Sent. Report ID: $id${N}"
        say "Give Ivan this ID: hello@ee1os.com, or see $SITE/report#contact"
    else
        say "Sending failed (no internet, or the site is down)."
        say "Send this file to Ivan yourself: $out"
    fi
}

offer_report() {
    say ""
    say "The full log is $LOG"
    if [ -r "$TTY" ]; then
        ask "Send this log to Ivan? It goes to ee1os with your phone's serial number and home folder removed. [y/N]"
        case $REPLY in [yY]*) send_log "$LOG" ;; *) say "Not sent." ;; esac
    fi
}

fail() {
    trap - INT
    # Read the log's end before adding the summary to it.
    sleep 1
    local last
    last=$(tail -n 20 "$LOG")
    say ""
    say "${R}${B}Install stopped in step $STEP of $TOTAL ($STEP_NAME).${N}"
    say "$1"
    if [ -n "$LAST_CMD" ]; then say "Last command: $LAST_CMD (exit code ${LAST_RC:-?})"; fi
    if [ "$FLASHING" = 1 ]; then
        say "The phone may be partly flashed. Don't lock the bootloader. Run this script again"
        say "to flash it again; nothing on the phone needs saving at this point."
    fi
    say ""
    say "Last lines of the log:"
    printf '%s\n' "$last" | sed 's/^/  | /'
    offer_report
    exit 1
}

# ---------------------------------------------------------------- fastboot with a time limit

# fastboot can hang with the phone listed but not answering, and a hung fastboot keeps the USB
# connection busy, so every later call hangs too. Each call gets a time limit; macOS has no
# timeout command, so the call runs in the background and is killed when time runs out.
# fb <seconds> <fastboot args...>: output in $FB_OUT, returns fastboot's exit code. With
# FB_SOFT=1 a call that runs out of time returns 124 instead of stopping the install.
fb() {
    local limit=${FB_TIMEOUT:-$1} pid ticks=0 rc
    shift
    fastboot "$@" > "$RUN/fastboot.out" 2>&1 < /dev/null &
    pid=$!
    while kill -0 "$pid" 2>/dev/null; do
        if [ "$ticks" -ge $((limit * 10)) ]; then
            # No wait: a fastboot stuck in the USB driver can outlive even kill -9 for a while.
            kill "$pid" 2>/dev/null; sleep 1; kill -9 "$pid" 2>/dev/null
            LAST_CMD="fastboot $*"; LAST_RC="killed after ${limit}s"
            if [ "${FB_SOFT:-0}" = 1 ]; then FB_OUT=; return 124; fi
            say "fastboot $* didn't answer within ${limit}s; stopped it."
            fail "$(hung_message)"
        fi
        sleep 0.1; ticks=$((ticks + 1))
    done
    wait "$pid"; rc=$?
    FB_OUT=$(cat "$RUN/fastboot.out")
    return $rc
}

hung_message() {
    local m="The phone stopped answering fastboot. Unplug the cable; on the phone pick Restart bootloader with the volume keys and press power; plug it straight into the computer (no hub) and run the script again."
    case $STEP in
        7) say "$m The lock may or may not have happened; the next run will show which." ;;
        5) say "$m The unlock may or may not have happened; the next run will show which." ;;
        6) say "$m The flash itself had finished." ;;
        *) say "$m Nothing was changed on the phone." ;;
    esac
}

# Like run/must for fastboot calls: the command and its output go to the screen and the log.
fb_run() {
    local limit=$1; shift
    LAST_CMD="fastboot $*"
    say "\$ fastboot $*"
    fb "$limit" "$@"
    LAST_RC=$?
    [ -n "$FB_OUT" ] && say "$FB_OUT"
    return $LAST_RC
}
fb_must() { fb_run "$@" || fail "This command failed."; }

# getvar <name>: the value in $VAL. fastboot prints "name: value" on stderr.
getvar() {
    fb 15 -s "$SERIAL" getvar "$1"
    VAL=$(printf '%s\n' "$FB_OUT" | awk -v k="$1" '{sub(/^\(bootloader\) /, "")} index($0, k ": ") == 1 {print substr($0, length(k) + 3); exit}')
}

unlock_ability() {
    fb 15 -s "$SERIAL" flashing get_unlock_ability
    VAL=$(printf '%s\n' "$FB_OUT" | awk -F': ' '/get_unlock_ability/ {print $2; exit}')
}

# Wait until the bootloader reports unlocked = $1 (after the person confirms on the phone).
# While the phone shows its confirmation screen it doesn't answer fastboot and may drop off USB
# altogether, so a poll that runs out of time or fails only means "not yet".
wait_unlocked() {
    local start=$SECONDS
    while :; do
        VAL=
        FB_SOFT=1 getvar unlocked
        [ "$VAL" = "$1" ] && return 0
        [ $((SECONDS - start)) -ge 300 ] && fail "The bootloader still isn't $2 after 5 minutes. Was it confirmed on the phone?"
        sleep 3
    done
}

# ---------------------------------------------------------------- what was flashed

# The bootloader can't tell which build is installed, so after a flash the script notes what it
# put on which phone. It's only a hint for offering to lock later, never proof.
save_state() {
    {
        echo "phone=$(serial_tag)"
        echo "codename=$CODENAME"
        echo "build=$BUILD"
        echo "zip_sha256=$zsum"
        echo "flashed=$(date -u '+%Y-%m-%d %H:%M UTC')"
    } > "$STATE"
}

# state_for_phone: true if the record is for this phone; sets S_BUILD and S_FLASHED.
state_for_phone() {
    S_BUILD=; S_FLASHED=
    [ -f "$STATE" ] || return 1
    [ "$(awk -F= '$1 == "phone" {print $2}' "$STATE")" = "$(serial_tag)" ] || return 1
    [ "$(awk -F= '$1 == "codename" {print $2}' "$STATE")" = "$CODENAME" ] || return 1
    S_BUILD=$(awk -F= '$1 == "build" {print $2}' "$STATE")
    S_FLASHED=$(awk -F= '$1 == "flashed" {print $2}' "$STATE")
    [ -n "$S_BUILD" ]
}

# ---------------------------------------------------------------- send mode

if [ -n "$SEND" ]; then
    LOG=$SEND
    send_log "$SEND"
    exit $?
fi

# ---------------------------------------------------------------- run folder and log

RUN=$BASE/$(date +%Y%m%d-%H%M%S)
mkdir -p "$RUN" "$CACHE" || { echo "Can't create $RUN"; exit 1; }
LOG=$RUN/install.log
: > "$LOG"
exec 3>&1 4>&2
exec > >(tee -a "$LOG") 2>&1
trap 'fail "Stopped with Ctrl-C."' INT

say "${B}ee1os installer${N} (script version $VERSION, mode: $MODE$( [ $LOCK = 0 ] && echo ', no lock'))"
say "Started $(date -u '+%Y-%m-%d %H:%M UTC'). Log: $LOG"

# ---------------------------------------------------------------- 1. computer

step 1 "Check the computer"
OS=$(uname -s)
ARCH=$(uname -m)
case $OS in
    Darwin) say "macOS $(sw_vers -productVersion 2>/dev/null) on $ARCH"; PT_OS=darwin; PT_SHA=$PT_SHA256_DARWIN ;;
    Linux)
        # shellcheck disable=SC1091
        say "Linux: $( (. /etc/os-release 2>/dev/null && echo "$PRETTY_NAME") || echo unknown) on $ARCH, kernel $(uname -r)"
        PT_OS=linux; PT_SHA=$PT_SHA256_LINUX ;;
    *) fail "This script runs on macOS and Linux. On Windows use install.ps1 (see $SITE/install)." ;;
esac
say "bash $BASH_VERSION"

if [ "$(id -u)" = 0 ]; then
    fail "Don't run this as root or with sudo. Run it as your normal user."
fi

for t in curl unzip awk; do
    command -v "$t" > /dev/null 2>&1 || fail "$t is missing. Install it and run the script again."
done
command -v sha256sum > /dev/null 2>&1 || command -v shasum > /dev/null 2>&1 \
    || fail "Neither sha256sum nor shasum is installed."

free_kb=$(df -Pk "$BASE" | awk 'NR==2 {print $4}')
free_kb=${free_kb:-0}
say "Free space in $BASE: $((free_kb / 1024 / 1024)) GB"
if [ "$MODE" != lock-only ] && [ "$free_kb" -lt $((NEED_GB * 1024 * 1024)) ]; then
    fail "The install needs about $NEED_GB GB free in $BASE. Free some space and run the script again."
fi

vm=
if [ "$OS" = Darwin ]; then
    [ "$(sysctl -n kern.hv_vmm_present 2>/dev/null)" = 1 ] && vm="a virtual machine"
elif command -v systemd-detect-virt > /dev/null 2>&1; then
    v=$(systemd-detect-virt 2>/dev/null) && [ "$v" != none ] && vm="a virtual machine ($v)"
fi
if [ -n "$vm" ]; then
    say "Warning: this looks like $vm. USB pass-through often drops the phone halfway through"
    say "flashing. Use a real computer if you can."
fi

if ! curl -fsS --max-time 20 -o /dev/null "$SITE/"; then
    fail "Can't reach $SITE. Check the internet connection."
fi
say "Internet: OK"

# ---------------------------------------------------------------- 2. fastboot

step 2 "Find fastboot"

# 35.0.1 -> 350001 style number for comparing; drops a distro epoch ("1:34.0.4-debian").
vnum() { printf '%s\n' "$1" | sed 's/^[0-9]*://' | awk -F'[.-]' '{printf "%d%03d%03d\n", $1, $2, $3}'; }

FASTBOOT=
if command -v fastboot > /dev/null 2>&1; then
    have=$(fastboot --version 2>/dev/null | awk '/fastboot version/ {print $3; exit}')
    say "Installed fastboot: $(command -v fastboot), version ${have:-unknown}"
    if [ -n "$have" ] && [ "$(vnum "$have")" -ge "$(vnum $FASTBOOT_MIN)" ]; then
        FASTBOOT=$(command -v fastboot)
    else
        say "That's older than $FASTBOOT_MIN, so the script uses its own copy."
    fi
fi
if [ -z "$FASTBOOT" ]; then
    if [ "$OS" = Linux ] && [ "$ARCH" != x86_64 ]; then
        fail "Google's platform-tools are only built for x86_64 Linux. Install fastboot $FASTBOOT_MIN or newer from your distribution and run the script again."
    fi
    ptzip=$CACHE/platform-tools_r$PT_VERSION-$PT_OS.zip
    if [ ! -f "$ptzip" ] || [ "$(sha256 "$ptzip")" != "$PT_SHA" ]; then
        must curl -fL --retry 3 --progress-bar -o "$ptzip" \
            "https://dl.google.com/android/repository/platform-tools_r$PT_VERSION-$PT_OS.zip" 2>&4
    fi
    got=$(sha256 "$ptzip")
    if [ "$got" != "$PT_SHA" ]; then
        rm -f "$ptzip"
        fail "platform-tools download doesn't match its expected SHA-256 (got $got). Run the script again."
    fi
    say "platform-tools $PT_VERSION: SHA-256 OK"
    rm -rf "$CACHE/platform-tools"
    must unzip -q -o "$ptzip" -d "$CACHE"
    FASTBOOT=$CACHE/platform-tools/fastboot
fi
# Only for this script and the flash script it runs; nothing changes system-wide.
PATH=$(dirname "$FASTBOOT"):$PATH
export PATH
say "Using $FASTBOOT ($("$FASTBOOT" --version 2>/dev/null | awk '/fastboot version/ {print $3; exit}'))"

# ---------------------------------------------------------------- 3. phone

step 3 "Find the phone"

# A fastboot left running (a hung one from an earlier try, say) keeps the phone's USB
# connection busy, and then nothing else can talk to the phone.
others=$(pgrep -u "$(id -u)" '^fastboot$' 2>/dev/null | tr '\n' ' ')
if [ -n "$others" ]; then
    say "Another fastboot is already running (process $others). It keeps the phone busy, so this"
    say "script can't talk to the phone while it runs."
    ask "Close it? [Y/n]"
    case $REPLY in
        [nN]*) fail "Close the other fastboot (or restart the computer) and run the script again." ;;
    esac
    # shellcheck disable=SC2086
    kill $others 2>/dev/null; sleep 1
    # shellcheck disable=SC2086
    kill -9 $others 2>/dev/null
    say "Closed."
fi

hint_shown=0
waited=0
while :; do
    fb 10 devices
    list=$(printf '%s\n' "$FB_OUT" | grep -v '^$')
    # A phone is a "<serial><tab>fastboot" line (fastboot 37 adds a space after the tab);
    # anything else is a message from fastboot.
    n=$(printf '%s\n' "$list" | awk -F'\t *' '$2 == "fastboot"' | grep -vc 'no permissions')
    if printf '%s\n' "$list" | grep -q 'no permissions'; then
        say "$list"
        fail "The phone is there but this user may not talk to it. Install the udev rules (Debian/Ubuntu: sudo apt install android-sdk-platform-tools-common; Arch: android-udev), unplug and reconnect the phone, and run the script again."
    fi
    [ "$n" -ge 1 ] && break
    if [ $hint_shown = 0 ]; then
        say "Waiting for a phone in fastboot mode."
        say "  Turn the phone off, then hold volume down and press power until the bootloader"
        say "  screen shows. Connect it with a USB cable that carries data (not a charge-only"
        say "  cable), straight to the computer, not through a hub."
        hint_shown=1
    fi
    if [ $waited -ge "$WAIT" ]; then
        fail "No phone in fastboot mode after $((WAIT / 60)) minutes."
    fi
    sleep 3; waited=$((waited + 3))
done
if [ "$n" -gt 1 ]; then
    say "$list"
    fail "More than one phone is connected. Leave only the one you want to install on."
fi
SERIAL=$(printf '%s\n' "$list" | awk -F'\t *' '$2 == "fastboot" {print $1; exit}')
say "Found phone $SERIAL"

getvar is-userspace
if [ "$VAL" = yes ]; then
    fail "The phone is in fastbootd (the recovery's fastboot), not the bootloader. Run: fastboot reboot bootloader, then run the script again."
fi
getvar product; CODENAME=$VAL
getvar unlocked; UNLOCKED=$VAL
say "Phone: $CODENAME, bootloader unlocked: ${UNLOCKED:-unknown}"
getvar version-bootloader; v1=$VAL
getvar version-baseband; v2=$VAL
getvar current-slot; v3=$VAL
say "Bootloader $v1, radio $v2, slot $v3"
[ -n "$CODENAME" ] || fail "fastboot found the phone but couldn't read its codename."

# Which build to install: the newest on the stable channel, or the one in --zip.
if [ -n "$ZIP" ]; then
    [ -f "$ZIP" ] || fail "No file at $ZIP."
    zname=$(basename "$ZIP")
    case $zname in
        *-install-*.zip) ;;
        *) fail "$zname isn't an install zip (expected <codename>-install-<build>.zip)." ;;
    esac
    ZCODE=${zname%%-install-*}
    BUILD=${zname##*-install-}; BUILD=${BUILD%.zip}
    [ "$ZCODE" = "$CODENAME" ] || fail "$zname is for $ZCODE, but the phone is a $CODENAME."
else
    chan=$(curl -fsSL --max-time 30 "$RELEASES/updates/$CODENAME-stable" 2>/dev/null)
    BUILD=$(printf '%s\n' "$chan" | awk 'NR==1 {print $1}')
    if [ -z "$BUILD" ]; then
        fail "There is no ee1os build for $CODENAME yet. The list is at $SITE/devices."
    fi
fi
say "Newest build: $BUILD"

if [ "$MODE" = check ]; then
    say ""
    say "${B}Check passed.${N} The computer, fastboot and the phone are ready for build $BUILD."
    if [ "$UNLOCKED" = no ]; then
        unlock_ability
        [ "$VAL" = 1 ] || say "But OEM unlocking is off: turn it on in Developer options before installing."
    fi
    say "Run the script without --check to install. Log: $LOG"
    exit 0
fi

# ---------------------------------------------------------------- 7. lock

# Shared by the normal run, --lock-only, and the offer to lock a phone flashed earlier.
lock_phone() {
    say "Locking turns on full verified boot. The phone then only boots software signed with"
    say "this key:"
    say ""
    grouped "$FINGERPRINT" | awk '{print "    " $1 " " $2 " " $3 " " $4; print "    " $5 " " $6 " " $7 " " $8}'
    say ""
    say "Locking ${B}erases the phone again${N}. Confirm on the phone with the volume keys and power."
    if [ "${1:-}" != confirmed ]; then
        # An Enter pressed by accident shouldn't decide this either way, so ask again.
        local tries=0
        while :; do
            ask "Type LOCK to lock, or SKIP to leave it unlocked:"
            case $REPLY in LOCK|SKIP) break ;; esac
            tries=$((tries + 1))
            if [ $tries -ge 3 ]; then REPLY=SKIP; say "No answer; leaving it unlocked."; break; fi
        done
        if [ "$REPLY" = SKIP ]; then LOCK_SKIPPED=1; say "Left unlocked."; return; fi
    fi
    fb_must 30 -s "$SERIAL" flashing lock
    say "Confirm on the phone. Waiting for the bootloader to report locked ..."
    wait_unlocked no locked
    say "Locked."
}

finish() {
    trap - INT
    say ""
    say "${B}Done.${N} With Start selected in the bootloader, press power."
    say "A locked phone shows a yellow notice on every boot, \"Your device is loading a different"
    say "operating system\", with the key's fingerprint; compare it with the one above. An orange"
    say "warning means the bootloader is unlocked. Once the phone has booted and you've checked it,"
    say "turn OEM unlocking off in Developer options."
    if [ "$LOCK_SKIPPED" = 1 ]; then
        say ""
        say "${B}The bootloader is still unlocked.${N} To lock without flashing again: bash install.sh --lock-only"
    fi
    say ""
    say "Log: $LOG"
    exit 0
}

if [ "$MODE" = lock-only ]; then
    step 7 "Lock the bootloader"
    if [ "$UNLOCKED" = no ]; then
        say "Already locked. Nothing to do."
        exit 0
    fi
    if state_for_phone; then
        say "Build $S_BUILD was flashed on this phone from this computer at $S_FLASHED."
    else
        say "${B}This computer didn't flash this phone.${N} Only lock if the phone runs ee1os build"
        say "$BUILD. Locking with any other system on it leaves a phone that won't boot."
    fi
    lock_phone
    finish
fi

# A phone this computer already flashed with this build, still unlocked (the lock was skipped
# or interrupted): offer to lock it without downloading and flashing again.
FLASH_CONFIRMED=0
if [ "$UNLOCKED" = yes ] && state_for_phone && [ "$S_BUILD" = "$BUILD" ]; then
    say ""
    say "Build $BUILD was flashed on this phone from this computer at $S_FLASHED, and the"
    say "bootloader is still unlocked."
    ask "Type LOCK to lock it now, FLASH to flash it again, anything else to stop:"
    case $REPLY in
        LOCK)
            step 7 "Lock the bootloader"
            lock_phone confirmed
            finish ;;
        FLASH) FLASH_CONFIRMED=1 ;;
        *) say "Stopped. Nothing was changed on the phone."; exit 0 ;;
    esac
fi

# ---------------------------------------------------------------- 4. download

step 4 "Download and check build $BUILD"
NAME=$CODENAME-install-$BUILD
if [ -z "$ZIP" ]; then
    ZIP=$CACHE/$NAME.zip
    sums=$CACHE/SHA256SUMS-$BUILD
    must curl -fsSL --retry 3 -o "$sums" "$RELEASES/$BUILD/SHA256SUMS-$BUILD"
    want=$(awk -v f="$NAME.zip" '$2 == f {print $1}' "$sums")
    [ -n "$want" ] || fail "SHA256SUMS-$BUILD doesn't list $NAME.zip."
    if [ -f "$ZIP" ] && [ "$(sha256 "$ZIP")" = "$want" ]; then
        say "Already downloaded: $ZIP"
    else
        # Older builds in the cache are no longer needed; parts of this one are kept.
        for f in "$CACHE"/*-install-*; do
            case $f in "$CACHE/$NAME.zip.part"[0-9]*) ;; *) rm -rf "$f" ;; esac
        done
        # A zip over GitHub's 2 GiB file limit is published in parts (.zip.part1, .part2, ...),
        # each listed in SHA256SUMS in order, and joined here.
        parts=()
        while read -r p; do parts+=("$p"); done < <(awk -v f="$NAME.zip.part" 'index($2, f) == 1 {print $2}' "$sums")
        if [ ${#parts[@]} -gt 0 ]; then
            for p in "${parts[@]}"; do
                pw=$(awk -v f="$p" '$2 == f {print $1}' "$sums")
                [ -f "$CACHE/$p" ] && [ "$(sha256 "$CACHE/$p")" = "$pw" ] && continue
                say "Downloading $p."
                fetch "$RELEASES/$BUILD/$p" "$CACHE/$p"
                if [ "$(sha256 "$CACHE/$p")" != "$pw" ]; then
                    rm -f "$CACHE/$p"
                    fail "$p doesn't match SHA256SUMS-$BUILD. It was deleted; run the script again."
                fi
            done
            say "Joining the parts."
            (cd "$CACHE" && cat "${parts[@]}") > "$ZIP.part" || fail "Couldn't join the parts (disk full?)."
            mv "$ZIP.part" "$ZIP"
            (cd "$CACHE" && rm -f "${parts[@]}")
        else
            say "Downloading $NAME.zip (about 2 GB)."
            fetch "$RELEASES/$BUILD/$NAME.zip" "$ZIP"
        fi
    fi
    got=$(sha256 "$ZIP")
    say "SHA-256 $got"
    if [ "$got" != "$want" ]; then
        rm -f "$ZIP"
        fail "The download doesn't match SHA256SUMS-$BUILD. It was deleted; run the script again."
    fi
    say "Matches SHA256SUMS-$BUILD."
else
    sums=$(dirname "$ZIP")/SHA256SUMS-$BUILD
    if [ -f "$sums" ]; then
        want=$(awk -v f="$NAME.zip" '$2 == f {print $1}' "$sums")
        [ "$(sha256 "$ZIP")" = "$want" ] || fail "$ZIP doesn't match $sums."
        say "Matches $sums."
    else
        say "No SHA256SUMS-$BUILD next to the zip; relying on the key check below."
    fi
fi

# The unpacked folder is reused only if it came from this exact zip.
DIR=$CACHE/$NAME
zsum=$(sha256 "$ZIP")
if [ "$(cat "$DIR/.unpacked" 2>/dev/null)" != "$zsum" ]; then
    rm -rf "$DIR"
    say "Unpacking (about 4.5 GB)."
    must unzip -q -o "$ZIP" -d "$CACHE"
    [ -d "$DIR" ] || fail "The zip didn't contain a $NAME folder."
    echo "$zsum" > "$DIR/.unpacked"
fi
[ -f "$DIR/avb_pkmd.bin" ] || fail "The zip has no avb_pkmd.bin."
[ -f "$DIR/flash-all.sh" ] || fail "The zip has no flash-all.sh."
key=$(sha256 "$DIR/avb_pkmd.bin")
say "Key fingerprint in the zip: $(grouped "$key")"
if [ "$key" != "$FINGERPRINT" ]; then
    rm -rf "$DIR"
    fail "This zip is not signed with ee1os's key. Expected $(grouped "$FINGERPRINT"). Don't flash it."
fi
say "Matches ee1os's key."

# ---------------------------------------------------------------- 5. unlock

step 5 "Unlock the bootloader"
if [ "$UNLOCKED" = yes ]; then
    say "Already unlocked."
    if [ "$FLASH_CONFIRMED" = 0 ]; then
        say ""
        say "${B}Flashing erases everything on the phone.${N}"
        ask "Type FLASH to continue, anything else to stop:"
        [ "$REPLY" = FLASH ] || { say "Stopped. Nothing was changed on the phone."; exit 0; }
    fi
else
    unlock_ability
    say "OEM unlocking allowed: ${VAL:-unknown}"
    if [ "$VAL" = 0 ]; then
        fail "OEM unlocking is off. Start the phone, turn it on in Settings > System > Developer options, then come back to the bootloader and run the script again."
    fi
    say "Unlocking ${B}erases everything on the phone${N}: apps, photos, accounts, all of it."
    say "The phone then asks you to confirm: use the volume keys to pick Unlock, press power."
    ask "Type UNLOCK to continue, anything else to stop:"
    [ "$REPLY" = UNLOCK ] || { say "Stopped. Nothing was changed on the phone."; exit 0; }
    fb_must 30 -s "$SERIAL" flashing unlock
    say "Confirm on the phone. Waiting for the bootloader to report unlocked ..."
    wait_unlocked yes unlocked
    say "Unlocked."
fi

# ---------------------------------------------------------------- 6. flash

step 6 "Flash build $BUILD"
say "This takes a few minutes. Don't touch the cable or the phone until it's done."
# From here until the flash succeeds, the phone holds no known build.
rm -f "$STATE"
FLASHING=1
LAST_CMD="sh flash-all.sh (in $DIR)"
say "\$ $LAST_CMD"
# Fastboot warns about the sparse super images on every flash; that line goes to the log only.
(cd "$DIR" && ANDROID_SERIAL=$SERIAL sh flash-all.sh) 2>&1 | while IFS= read -r line; do
    case $line in
        *"skip copying super image avb footer"*) printf '%s\n' "$line" >> "$LOG" ;;
        *) printf '%s\n' "$line" ;;
    esac
done
LAST_RC=$?
[ "$LAST_RC" = 0 ] || fail "The flash script failed."
# The flash script installs the key itself; older zips didn't.
if ! grep -q 'flash avb_custom_key' "$DIR/flash-all.sh"; then
    fb_must 60 -s "$SERIAL" erase avb_custom_key
    fb_must 60 -s "$SERIAL" flash avb_custom_key "$DIR/avb_pkmd.bin"
fi
FLASHING=0
getvar product
[ "$VAL" = "$CODENAME" ] || fail "The phone didn't come back to the bootloader after flashing."
save_state
say "Flashed."

# ---------------------------------------------------------------- 7. lock

step 7 "Lock the bootloader"
if [ "$LOCK" = 0 ]; then
    say "Skipped (--no-lock). The bootloader stays unlocked and the phone shows an orange warning"
    say "on every boot. To lock later without flashing again: bash install.sh --lock-only"
else
    lock_phone
fi
finish