5 files changed, 32 insertions, 243 deletions

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index b18d462..63bd31c 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -95,6 +95,20 @@ origin=$(printf '%s' "$URL" | sed -E 's#^(https?://[^/]+).*#\1#')
 grep -oE '[0-9a-f]{64}  [A-Za-z0-9._-]+' "$tmp/page.html" > "$tmp/sums" || true
 [ -s "$tmp/sums" ] || die "no SHA-256 lines on the page (is index.php being served?)"
 
+for script in install.sh install.ps1; do
+  grep -qE "href=\"[^\"]*/$script\"" "$tmp/page.html" \
+    || die "$script is not linked from the page"
+  curl -fsSL --max-time 30 "$origin/$script" -o "$tmp/$script" \
+    || die "could not fetch $script"
+  cmp -s "web/$script" "$tmp/$script" \
+    || die "$script served from the site differs from the local file"
+done
+
+curl -fsSL --max-time 30 "$origin/latest.php" -o "$tmp/latest.txt" \
+  || die "could not fetch latest.php"
+newest=$(awk '$1 == "version" { print $2; exit }' "$tmp/latest.txt")
+[ -n "$newest" ] || die "latest.php has no version line"
+
 failed=0
 verified=0
 for local in "${artifacts[@]}"; do
@@ -132,6 +146,16 @@ for local in "${artifacts[@]}"; do
     continue
   fi
 
+  version=$(printf '%s' "$file" | sed -E 's/^zagan-bet-[a-z]+-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+  if [ "$version" = "$newest" ]; then
+    latest_hash=$(awk -v kind="$kind" -v name="$file" '$1 == kind && $5 == name { print $6 }' "$tmp/latest.txt")
+    if [ "$latest_hash" != "$local_hash" ]; then
+      echo "  $file: latest.php shows ${latest_hash:-nothing}, local is $local_hash"
+      failed=1
+      continue
+    fi
+  fi
+
   echo "  $file: ok"
   verified=$((verified + 1))
 done
diff --git a/scripts/installers/linux.sh.in b/scripts/installers/linux.sh.in
deleted file mode 100644
index 5b53c02..0000000
--- a/scripts/installers/linux.sh.in
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-# Zagan-Bet desktop installer for Linux.
-#
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a launcher. Put the downloaded app next to this script, or run
-# the script on its own and it will fetch the matching binary.
-set -euo pipefail
-
-VERSION="__VERSION__"
-BINARY="__BINARY__"
-SHA256="__SHA256__"
-URL="__URL__"
-
-say() { printf '%s\n' "$*"; }
-die() { printf 'install: %s\n' "$*" >&2; exit 1; }
-
-command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
-
-here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
-source_file=""
-for candidate in "$here/$BINARY" "./$BINARY" "$HOME/Downloads/$BINARY"; do
-  if [ -f "$candidate" ]; then
-    source_file=$candidate
-    break
-  fi
-done
-
-cleanup=""
-if [ -z "$source_file" ]; then
-  command -v curl >/dev/null 2>&1 || die "put $BINARY next to this installer, or install curl"
-  cleanup=$(mktemp) || die "cannot create a temporary file"
-  say "Downloading $BINARY..."
-  curl -fsSL --max-time 300 "$URL" -o "$cleanup" || die "download failed"
-  source_file=$cleanup
-fi
-trap 'if [ -n "$cleanup" ]; then rm -f "$cleanup"; fi' EXIT
-
-actual=$(sha256sum "$source_file" | awk '{print $1}')
-[ "$actual" = "$SHA256" ] || die "checksum mismatch: expected $SHA256, got $actual"
-
-bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
-data_dir="${XDG_DATA_HOME:-$HOME/.local/share}"
-app="$bin_dir/zagan-bet-gui"
-desktop_dir="$data_dir/applications"
-icon_dir="$data_dir/icons/hicolor/scalable/apps"
-
-mkdir -p "$bin_dir" "$desktop_dir" "$icon_dir"
-install -m 0755 "$source_file" "$app"
-
-cat > "$icon_dir/zagan-bet.svg" <<'ICON'
-__ICON__
-ICON
-
-cat > "$desktop_dir/zagan-bet.desktop" <<DESKTOP
-[Desktop Entry]
-Type=Application
-Name=Zagan-Bet
-Comment=Slots, roulette, blackjack and crash
-Exec=$app
-Icon=zagan-bet
-Terminal=false
-Categories=Game;
-DESKTOP
-chmod 0644 "$desktop_dir/zagan-bet.desktop" "$icon_dir/zagan-bet.svg"
-
-if command -v update-desktop-database >/dev/null 2>&1; then
-  update-desktop-database "$desktop_dir" >/dev/null 2>&1 || true
-fi
-if command -v gtk-update-icon-cache >/dev/null 2>&1; then
-  gtk-update-icon-cache -q "$data_dir/icons/hicolor" >/dev/null 2>&1 || true
-fi
-
-say "Installed Zagan-Bet $VERSION to $app"
-say "A launcher was added to your applications menu."
-case ":$PATH:" in
-  *":$bin_dir:"*) ;;
-  *) say "Add $bin_dir to PATH to start it as 'zagan-bet-gui'." ;;
-esac
diff --git a/scripts/installers/windows.ps1.in b/scripts/installers/windows.ps1.in
deleted file mode 100644
index 4b8e61d..0000000
--- a/scripts/installers/windows.ps1.in
+++ /dev/null
@@ -1,87 +0,0 @@
-# Zagan-Bet desktop installer for Windows.
-#
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a Start-menu shortcut. Put the downloaded app next to this
-# script, or run the script on its own and it will fetch the matching binary.
-#
-# Run it with:
-#   powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-install.ps1
-# Add -NoPause to run it unattended.
-param([switch]$NoPause)
-
-$ErrorActionPreference = "Stop"
-
-$Version = "__VERSION__"
-$Binary  = "__BINARY__"
-$Sha256  = "__SHA256__"
-$Url     = "__URL__"
-
-function Finish([int]$Code) {
-    if (-not $NoPause) {
-        Read-Host "Press Enter to close" | Out-Null
-    }
-    exit $Code
-}
-
-function Stop-Install([string]$Message) {
-    Write-Host "install: $Message" -ForegroundColor Red
-    Finish 1
-}
-
-$here = Split-Path -Parent $MyInvocation.MyCommand.Path
-$candidates = @(
-    (Join-Path $here $Binary),
-    (Join-Path (Get-Location) $Binary),
-    (Join-Path $env:USERPROFILE "Downloads\$Binary")
-)
-$sourceFile = $null
-foreach ($candidate in $candidates) {
-    if (Test-Path -LiteralPath $candidate) {
-        $sourceFile = $candidate
-        break
-    }
-}
-
-$temporary = $null
-if (-not $sourceFile) {
-    $temporary = Join-Path ([System.IO.Path]::GetTempPath()) $Binary
-    Write-Host "Downloading $Binary..."
-    try {
-        Invoke-WebRequest -Uri $Url -OutFile $temporary -UseBasicParsing
-    } catch {
-        Stop-Install "download failed: $_"
-    }
-    $sourceFile = $temporary
-}
-
-try {
-    $actual = (Get-FileHash -LiteralPath $sourceFile -Algorithm SHA256).Hash.ToLowerInvariant()
-    if ($actual -ne $Sha256.ToLowerInvariant()) {
-        Stop-Install "checksum mismatch: expected $Sha256, got $actual"
-    }
-
-    $installDir = Join-Path $env:LOCALAPPDATA "Programs\Zagan-Bet"
-    New-Item -ItemType Directory -Force -Path $installDir | Out-Null
-    $target = Join-Path $installDir "zagan-bet-gui.exe"
-    Copy-Item -LiteralPath $sourceFile -Destination $target -Force
-
-    $startMenu = Join-Path $env:APPDATA "Microsoft\Windows\Start Menu\Programs"
-    New-Item -ItemType Directory -Force -Path $startMenu | Out-Null
-    $shortcutPath = Join-Path $startMenu "Zagan-Bet.lnk"
-    $shell = New-Object -ComObject WScript.Shell
-    $shortcut = $shell.CreateShortcut($shortcutPath)
-    $shortcut.TargetPath = $target
-    $shortcut.WorkingDirectory = $installDir
-    $shortcut.IconLocation = "$target,0"
-    $shortcut.Description = "Slots, roulette, blackjack and crash"
-    $shortcut.Save()
-
-    Write-Host "Installed Zagan-Bet $Version to $target"
-    Write-Host "A Start-menu shortcut was created."
-} finally {
-    if ($temporary -and (Test-Path -LiteralPath $temporary)) {
-        Remove-Item -LiteralPath $temporary -Force
-    }
-}
-
-Finish 0
diff --git a/scripts/publish.sh b/scripts/publish.sh
index 3a04631..fbcd588 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -5,20 +5,19 @@
 #   zagan-bet-client-<version>-<platform>-<arch>[.exe]
 #   zagan-bet-server-<version>-<platform>-<arch>[.exe]
 #   zagan-bet-gui-<version>-<platform>-<arch>[.exe]
-#   zagan-bet-gui-<version>-<platform>-<arch>-install.sh
-#   zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 #
 # Cargo always writes target/<triple>/<profile>/<bin>, so the rename happens
 # here after each build. The version comes from Cargo.toml.
 #
 # The GUI uses the workspace's `gui-release` profile (small, stripped, LTO).
-# The public git repository is the GPL source for these binaries, so publish
-# from a clean tree (or set ALLOW_DIRTY=1 for a preview).
+# The installers are stable site files (web/install.sh and web/install.ps1):
+# they ask web/latest.php for the newest build, so they are not regenerated
+# here. The public git repository is the GPL source for these binaries, so
+# publish from a clean tree (or set ALLOW_DIRTY=1 for a preview).
 #
 # Usage:
 #   ./scripts/publish.sh
 #   DEST=/srv/www/bin ./scripts/publish.sh
-#   URL_BASE=https://staging.example/ ./scripts/publish.sh
 set -euo pipefail
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
@@ -31,22 +30,12 @@ if [ -z "${VERSION:-}" ]; then
 fi
 
 DEST=${DEST:-web/bin}
-URL_BASE=${URL_BASE:-https://zagan.2137697.xyz}
 
 if [ "${ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git status --porcelain)" ]; then
   echo "the working tree is dirty; commit the release first (or ALLOW_DIRTY=1)" >&2
   exit 1
 fi
 
-command -v python3 >/dev/null || {
-  echo "python3 is required to render the installers" >&2
-  exit 1
-}
-
-hash_of() {
-  sha256sum "$1" | awk '{print $1}'
-}
-
 publish() {
   local triple=$1 kind=$2 platform=$3 arch=$4
   local ext=""
@@ -85,23 +74,13 @@ publish_gui() {
 
   mkdir -p "$DEST/gui"
   install -m 0755 "$source" "$DEST/gui/$artifact"
-  local sha
-  sha=$(hash_of "$DEST/gui/$artifact")
   echo "    $DEST/gui/$artifact ($(du -h "$DEST/gui/$artifact" | cut -f1))"
-
-  if [ "$platform" = linux ]; then
-    python3 scripts/render-installer.py \
-      scripts/installers/linux.sh.in \
-      "$DEST/gui/zagan-bet-gui-$VERSION-linux-$arch-install.sh" \
-      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
-  elif [ "$platform" = windows ]; then
-    python3 scripts/render-installer.py \
-      scripts/installers/windows.ps1.in \
-      "$DEST/gui/zagan-bet-gui-$VERSION-windows-$arch-install.ps1" \
-      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
-  fi
 }
 
+rm web/bin/client/*
+rm web/bin/gui/*
+rm web/bin/server/*
+
 publish_gui x86_64-unknown-linux-gnu linux x86_64
 publish_gui x86_64-pc-windows-gnu windows x86_64
 
diff --git a/scripts/render-installer.py b/scripts/render-installer.py
deleted file mode 100644
index 1a00551..0000000
--- a/scripts/render-installer.py
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env python3
-"""Fill an installer template with one published artifact's details.
-
-Usage: render-installer.py <template> <output> <version> <binary> <sha256> <url>
-
-The Linux template embeds the application icon so the installer works offline.
-"""
-
-from __future__ import annotations
-
-import pathlib
-import sys
-
-
-def main(argv: list[str]) -> int:
-    if len(argv) != 7:
-        print(
-            "usage: render-installer.py <template> <output> <version> "
-            "<binary> <sha256> <url>",
-            file=sys.stderr,
-        )
-        return 2
-
-    template, output, version, binary, sha256, url = argv[1:]
-    root = pathlib.Path(__file__).resolve().parent.parent
-    icon = (root / "gui" / "assets" / "zagan-bet.svg").read_text()
-
-    text = pathlib.Path(template).read_text()
-    replacements = {
-        "__VERSION__": version,
-        "__BINARY__": binary,
-        "__SHA256__": sha256,
-        "__URL__": url,
-        "__ICON__": icon.rstrip("\n"),
-    }
-    for placeholder, value in replacements.items():
-        text = text.replace(placeholder, value)
-
-    destination = pathlib.Path(output)
-    destination.write_text(text)
-    if destination.suffix == ".sh":
-        destination.chmod(0o755)
-
-    print(f"    {destination} ({destination.stat().st_size} bytes)")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main(sys.argv))