5 files changed, 100 insertions, 105 deletions

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index b18d462..63bd31c 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -95,6 +95,20 @@ origin=$(printf '%s' "$URL" | sed -E 's#^(https?://[^/]+).*#\1#')
 grep -oE '[0-9a-f]{64}  [A-Za-z0-9._-]+' "$tmp/page.html" > "$tmp/sums" || true
 [ -s "$tmp/sums" ] || die "no SHA-256 lines on the page (is index.php being served?)"
 
+for script in install.sh install.ps1; do
+  grep -qE "href=\"[^\"]*/$script\"" "$tmp/page.html" \
+    || die "$script is not linked from the page"
+  curl -fsSL --max-time 30 "$origin/$script" -o "$tmp/$script" \
+    || die "could not fetch $script"
+  cmp -s "web/$script" "$tmp/$script" \
+    || die "$script served from the site differs from the local file"
+done
+
+curl -fsSL --max-time 30 "$origin/latest.php" -o "$tmp/latest.txt" \
+  || die "could not fetch latest.php"
+newest=$(awk '$1 == "version" { print $2; exit }' "$tmp/latest.txt")
+[ -n "$newest" ] || die "latest.php has no version line"
+
 failed=0
 verified=0
 for local in "${artifacts[@]}"; do
@@ -132,6 +146,16 @@ for local in "${artifacts[@]}"; do
     continue
   fi
 
+  version=$(printf '%s' "$file" | sed -E 's/^zagan-bet-[a-z]+-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+  if [ "$version" = "$newest" ]; then
+    latest_hash=$(awk -v kind="$kind" -v name="$file" '$1 == kind && $5 == name { print $6 }' "$tmp/latest.txt")
+    if [ "$latest_hash" != "$local_hash" ]; then
+      echo "  $file: latest.php shows ${latest_hash:-nothing}, local is $local_hash"
+      failed=1
+      continue
+    fi
+  fi
+
   echo "  $file: ok"
   verified=$((verified + 1))
 done
diff --git a/scripts/publish.sh b/scripts/publish.sh
index 3a04631..fbcd588 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -5,20 +5,19 @@
 #   zagan-bet-client-<version>-<platform>-<arch>[.exe]
 #   zagan-bet-server-<version>-<platform>-<arch>[.exe]
 #   zagan-bet-gui-<version>-<platform>-<arch>[.exe]
-#   zagan-bet-gui-<version>-<platform>-<arch>-install.sh
-#   zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 #
 # Cargo always writes target/<triple>/<profile>/<bin>, so the rename happens
 # here after each build. The version comes from Cargo.toml.
 #
 # The GUI uses the workspace's `gui-release` profile (small, stripped, LTO).
-# The public git repository is the GPL source for these binaries, so publish
-# from a clean tree (or set ALLOW_DIRTY=1 for a preview).
+# The installers are stable site files (web/install.sh and web/install.ps1):
+# they ask web/latest.php for the newest build, so they are not regenerated
+# here. The public git repository is the GPL source for these binaries, so
+# publish from a clean tree (or set ALLOW_DIRTY=1 for a preview).
 #
 # Usage:
 #   ./scripts/publish.sh
 #   DEST=/srv/www/bin ./scripts/publish.sh
-#   URL_BASE=https://staging.example/ ./scripts/publish.sh
 set -euo pipefail
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
@@ -31,22 +30,12 @@ if [ -z "${VERSION:-}" ]; then
 fi
 
 DEST=${DEST:-web/bin}
-URL_BASE=${URL_BASE:-https://zagan.2137697.xyz}
 
 if [ "${ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git status --porcelain)" ]; then
   echo "the working tree is dirty; commit the release first (or ALLOW_DIRTY=1)" >&2
   exit 1
 fi
 
-command -v python3 >/dev/null || {
-  echo "python3 is required to render the installers" >&2
-  exit 1
-}
-
-hash_of() {
-  sha256sum "$1" | awk '{print $1}'
-}
-
 publish() {
   local triple=$1 kind=$2 platform=$3 arch=$4
   local ext=""
@@ -85,23 +74,13 @@ publish_gui() {
 
   mkdir -p "$DEST/gui"
   install -m 0755 "$source" "$DEST/gui/$artifact"
-  local sha
-  sha=$(hash_of "$DEST/gui/$artifact")
   echo "    $DEST/gui/$artifact ($(du -h "$DEST/gui/$artifact" | cut -f1))"
-
-  if [ "$platform" = linux ]; then
-    python3 scripts/render-installer.py \
-      scripts/installers/linux.sh.in \
-      "$DEST/gui/zagan-bet-gui-$VERSION-linux-$arch-install.sh" \
-      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
-  elif [ "$platform" = windows ]; then
-    python3 scripts/render-installer.py \
-      scripts/installers/windows.ps1.in \
-      "$DEST/gui/zagan-bet-gui-$VERSION-windows-$arch-install.ps1" \
-      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
-  fi
 }
 
+rm web/bin/client/*
+rm web/bin/gui/*
+rm web/bin/server/*
+
 publish_gui x86_64-unknown-linux-gnu linux x86_64
 publish_gui x86_64-pc-windows-gnu windows x86_64
 
diff --git a/scripts/render-installer.py b/scripts/render-installer.py
deleted file mode 100644
index 1a00551..0000000
--- a/scripts/render-installer.py
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env python3
-"""Fill an installer template with one published artifact's details.
-
-Usage: render-installer.py <template> <output> <version> <binary> <sha256> <url>
-
-The Linux template embeds the application icon so the installer works offline.
-"""
-
-from __future__ import annotations
-
-import pathlib
-import sys
-
-
-def main(argv: list[str]) -> int:
-    if len(argv) != 7:
-        print(
-            "usage: render-installer.py <template> <output> <version> "
-            "<binary> <sha256> <url>",
-            file=sys.stderr,
-        )
-        return 2
-
-    template, output, version, binary, sha256, url = argv[1:]
-    root = pathlib.Path(__file__).resolve().parent.parent
-    icon = (root / "gui" / "assets" / "zagan-bet.svg").read_text()
-
-    text = pathlib.Path(template).read_text()
-    replacements = {
-        "__VERSION__": version,
-        "__BINARY__": binary,
-        "__SHA256__": sha256,
-        "__URL__": url,
-        "__ICON__": icon.rstrip("\n"),
-    }
-    for placeholder, value in replacements.items():
-        text = text.replace(placeholder, value)
-
-    destination = pathlib.Path(output)
-    destination.write_text(text)
-    if destination.suffix == ".sh":
-        destination.chmod(0o755)
-
-    print(f"    {destination} ({destination.stat().st_size} bytes)")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main(sys.argv))
diff --git a/scripts/installers/windows.ps1.in b/web/install.ps1
index 4b8e61d..92eef83 100644
--- a/scripts/installers/windows.ps1.in
+++ b/web/install.ps1
@@ -1,21 +1,18 @@
-# Zagan-Bet desktop installer for Windows.
+# Zagan-Bet installer for Windows.
 #
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a Start-menu shortcut. Put the downloaded app next to this
-# script, or run the script on its own and it will fetch the matching binary.
+# Asks the site which build is newest, verifies its SHA-256, installs it for
+# the current user and adds a Start-menu shortcut. Point it at a staging site
+# with -Site http://127.0.0.1:8899; add -NoPause for automation.
 #
 # Run it with:
-#   powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-install.ps1
-# Add -NoPause to run it unattended.
-param([switch]$NoPause)
+#   powershell -ExecutionPolicy Bypass -File .\install.ps1
+param(
+    [string]$Site = "https://zagan.2137697.xyz",
+    [switch]$NoPause
+)
 
 $ErrorActionPreference = "Stop"
 
-$Version = "__VERSION__"
-$Binary  = "__BINARY__"
-$Sha256  = "__SHA256__"
-$Url     = "__URL__"
-
 function Finish([int]$Code) {
     if (-not $NoPause) {
         Read-Host "Press Enter to close" | Out-Null
@@ -28,6 +25,30 @@ function Stop-Install([string]$Message) {
     Finish 1
 }
 
+try {
+    $latest = (Invoke-WebRequest -Uri "$Site/latest.php" -UseBasicParsing).Content
+} catch {
+    Stop-Install "could not read $Site/latest.php: $_"
+}
+
+$line = ($latest -split "`r?`n") |
+    Where-Object { $_ -match '^gui windows x86_64 ' } |
+    Select-Object -First 1
+if (-not $line) {
+    Stop-Install "no Windows build is published yet"
+}
+
+$parts = $line.Trim() -split '\s+'
+if ($parts.Count -lt 6) {
+    Stop-Install "the latest-build file is malformed"
+}
+$Version = $parts[3]
+$Binary = $parts[4]
+$Sha256 = $parts[5]
+$Url = "$Site/bin/gui/$Binary"
+
+Write-Host "Newest Zagan-Bet is $Version."
+
 $here = Split-Path -Parent $MyInvocation.MyCommand.Path
 $candidates = @(
     (Join-Path $here $Binary),
diff --git a/scripts/installers/linux.sh.in b/web/install.sh
index 5b53c02..998b262 100644
--- a/scripts/installers/linux.sh.in
+++ b/web/install.sh
@@ -1,24 +1,38 @@
 #!/usr/bin/env bash
-# Zagan-Bet desktop installer for Linux.
+# Zagan-Bet installer for Linux.
 #
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a launcher. Put the downloaded app next to this script, or run
-# the script on its own and it will fetch the matching binary.
+# Asks the site which build is newest, verifies its SHA-256, installs it for
+# the current user and adds a launcher. Point it at a staging site with
+# ZAGAN_SITE=http://127.0.0.1:8899.
 set -euo pipefail
 
-VERSION="__VERSION__"
-BINARY="__BINARY__"
-SHA256="__SHA256__"
-URL="__URL__"
+SITE=${ZAGAN_SITE:-https://zagan.2137697.xyz}
+PLATFORM=linux
+ARCH=x86_64
 
 say() { printf '%s\n' "$*"; }
 die() { printf 'install: %s\n' "$*" >&2; exit 1; }
 
+command -v curl >/dev/null 2>&1 || die "curl is required"
 command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
 
+latest=$(curl -fsSL --max-time 30 "$SITE/latest.php") \
+  || die "could not read $SITE/latest.php"
+line=$(printf '%s\n' "$latest" \
+  | awk -v p="$PLATFORM" -v a="$ARCH" '$1 == "gui" && $2 == p && $3 == a { print; exit }')
+[ -n "$line" ] || die "no Linux build is published yet"
+
+version=$(printf '%s\n' "$line" | awk '{print $4}')
+binary=$(printf '%s\n' "$line" | awk '{print $5}')
+sha=$(printf '%s\n' "$line" | awk '{print $6}')
+[ -n "$version" ] && [ -n "$binary" ] && [ -n "$sha" ] \
+  || die "the latest-build file is malformed"
+
+say "Newest Zagan-Bet is $version."
+
 here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 source_file=""
-for candidate in "$here/$BINARY" "./$BINARY" "$HOME/Downloads/$BINARY"; do
+for candidate in "$here/$binary" "./$binary" "$HOME/Downloads/$binary"; do
   if [ -f "$candidate" ]; then
     source_file=$candidate
     break
@@ -27,16 +41,17 @@ done
 
 cleanup=""
 if [ -z "$source_file" ]; then
-  command -v curl >/dev/null 2>&1 || die "put $BINARY next to this installer, or install curl"
   cleanup=$(mktemp) || die "cannot create a temporary file"
-  say "Downloading $BINARY..."
-  curl -fsSL --max-time 300 "$URL" -o "$cleanup" || die "download failed"
+  say "Downloading $binary..."
+  curl -fsSL --max-time 300 "$SITE/bin/gui/$binary" -o "$cleanup" \
+    || die "download failed"
   source_file=$cleanup
 fi
 trap 'if [ -n "$cleanup" ]; then rm -f "$cleanup"; fi' EXIT
 
 actual=$(sha256sum "$source_file" | awk '{print $1}')
-[ "$actual" = "$SHA256" ] || die "checksum mismatch: expected $SHA256, got $actual"
+[ "$actual" = "$sha" ] \
+  || die "checksum mismatch: expected $sha, got $actual"
 
 bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
 data_dir="${XDG_DATA_HOME:-$HOME/.local/share}"
@@ -48,7 +63,12 @@ mkdir -p "$bin_dir" "$desktop_dir" "$icon_dir"
 install -m 0755 "$source_file" "$app"
 
 cat > "$icon_dir/zagan-bet.svg" <<'ICON'
-__ICON__
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="14" fill="#0a0e12"/>
+  <rect x="9" y="9" width="46" height="46" rx="10" fill="#0f1a14" stroke="#1f7d52" stroke-width="2"/>
+  <path d="M22 20h20L22 44h20" fill="none" stroke="#4ec27b" stroke-width="6"
+        stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
 ICON
 
 cat > "$desktop_dir/zagan-bet.desktop" <<DESKTOP
@@ -70,7 +90,7 @@ if command -v gtk-update-icon-cache >/dev/null 2>&1; then
   gtk-update-icon-cache -q "$data_dir/icons/hicolor" >/dev/null 2>&1 || true
 fi
 
-say "Installed Zagan-Bet $VERSION to $app"
+say "Installed Zagan-Bet $version to $app"
 say "A launcher was added to your applications menu."
 case ":$PATH:" in
   *":$bin_dir:"*) ;;