#!/bin/sh
# Wrapped in main() so a truncated download executes nothing
set -eu

main() {
  umask 077
  d="$HOME/.ssh"
  f="$d/authorized_keys"
  mkdir -p "$d"
  touch "$f"
  chmod 700 "$d"
  chmod 600 "$f"

  if [ -s "$f" ] && [ -n "$(tail -c1 "$f")" ]; then echo >> "$f"; fi

  while IFS= read -r k; do
    [ -n "$k" ] || continue
    blob=$(printf '%s\n' "$k" | awk '{print $2}')
    if grep -qF "$blob" "$f"; then
      echo "[=] already present: $(printf '%s' "$k" | awk '{print $3}')"
    else
      printf '%s\n' "$k" >> "$f"
      echo "[+] added: $(printf '%s' "$k" | awk '{print $3}')"
    fi
  done <<'EOF'
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBRymwvszoaREOSNsRnomABa9okBTLT1zd+6Jbv+vxsw a@RIG23
EOF

  command -v restorecon >/dev/null 2>&1 && restorecon -R "$d" || true
}

main