sbdl

#!/bin/zsh
# shellcheck shell=bash
# shellcheck disable=SC2164
# shellcheck disable=SC2317

# sbdl 0.7.0
# download Superbacked & auxiliary files
# shell script for LaunchAgent

export LANG=en_US.UTF-8
export PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/local/sbin:/opt/homebrew/bin:/opt/homebrew/sbin:/opt/local/bin:/opt/local/sbin:"$HOME"/.local/bin:"$HOME"/.local/sbin

sbdlversion="0.7.0"
process="sbdl"
uiprocess="Superbacked Downloader"
account=$(id -u)
accountname=$(id -un)
sbdlid="local.$accountname.$process"
sbdlpid=$$

appdlurl1="https://superbacked.com/api/downloads/superbacked-"
appdlurl2="-latest.dmg?license="
appdlurl3="-latest.AppImage?license="
gitdlurl="https://raw.githubusercontent.com/superbacked/superbacked/main/releases/v"
relurl="https://github.com/superbacked/superbacked/tree/main/releases"
devgpg="Primary key fingerprint: E786 274B C92B 47C2 3C1C  F44B 8C9C A674 C47C A060"
currentskid="0A3997912C165C0C15E2BBF4FB7BEB8D69B186E2"
currentteamid="4YAQ5SFA65"
currentsubject="Developer ID Application: Superbacked, Inc. (4YAQ5SFA65)"

disclaimersuccess="DON'T TRUST, VERIFY! You should not trust third parties for critical software: please verify the files manually to confirm that this release is not compromised!\n\nSUPERBACKED DOWNLOADER ('THE SOFTWARE') IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, ESPECIALLY LOST OR STOLEN SECRETS AND ASSOCIATED DATA OR VALUE, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."
disclaimererror="DON'T TRUST, VERIFY! You should not trust third parties for critical software: please verify the files manually to confirm that this release is compromised, notify the developer, and download again at a later date!\n\nSUPERBACKED DOWNLOADER ('THE SOFTWARE') IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, ESPECIALLY LOST OR STOLEN SECRETS AND ASSOCIATED DATA OR VALUE, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."

# log file
logloc="$HOME/Library/Logs/$sbdlid.log"
if command -v flog &>/dev/null ; then
	flogging=true
else
	flogging=false
	! [[ -e "$logloc" ]] && touch "$logloc" 2>/dev/null
fi
logmsgall=""
exec > >(tee -a "$logloc") 2>&1 ### delete eventually

# check for interactive mode
case $(ps -o stat= -p $$) in
	*+*) interactive=true ;;
	*) interactive=false ;;
esac

# for testing only
override=false
if [[ $1 == "--override" ]] ; then
	override=true
fi

# create configuration file/directory
configdir="$HOME/Library/Application Support/SuperbackedDownloader"
! [[ -d "$configdir" ]] && mkdir -p "$configdir" 2>/dev/null
configloc="$configdir/sbdl.cfg"
! [[ -f "$configloc" ]] && echo -e "# Mandatory: please enter your personal software license key\nLicense: <yourLicenseKey>\n# Optional: enter the full path to your preferred download folder\nDownloadPath: \n# Optional: replace with '1', 'y', 'yes', 'Y', 'YES' or 'Yes' for additional Linux AppImage download\nLinuxDownload: no\n# Optional: release label can be set to 'op' (special operator release for law firms)\nReleaseLabel: \n# Optional (Linux only): enter 'arm' or 'x64' to download a build for a specific architecture\n# Note (macOS/std): downloads will default to universal binaries (arm+intel/x64)\n# Note (macOS/op): downloads will default to Apple Silicon (arm64)\n# Note (Linux): downloads will default to x64 binaries\nPlatform: x64" > "$configloc" 2>/dev/null

# function: error beep
_beep () {
	osascript -e 'beep' -e 'delay 0.5' &>/dev/null
}

# function: success sound
_success () {
	afplay "/System/Library/Components/CoreAudio.component/Contents/SharedSupport/SystemSounds/system/burn complete.aif" &>/dev/null
}

# function: info sound
_info () {
	afplay "/System/Library/Components/CoreAudio.component/Contents/SharedSupport/SystemSounds/system/screen_sharing_started.caf" &>/dev/null
}

# function: notify user
_notify () {
	osascript &>/dev/null << EOT
tell application "System Events"
	display notification "$2" with title "$uiprocess [" & "$account" & "]" subtitle "$1"
end tell
EOT
}

# function: check for initial redirect
_redirect () {
	mainurl="$1"
	if ! [[ $(curl -sI --connect-timeout 10 "$mainurl" 2>/dev/null | grep -i "^location: " | tail -n 1 | awk -F"ocation: " '{print $NF}') ]] ; then
		return 0
	else
		return 1
	fi
}

### to be added later ###
# function: output & logging
_flog () {
	loglevel="$1" # default | error | fault | info || final | init || unused: debug
	shift
	logcat="$1" # only used for levels error, fault & final: critical (fault) | errors (final) | note (error) | warning (error)
	shift
	logmsg="$*"
	if [[ $loglevel =~ ^(error|fault)$ ]] ; then # stderr
		if $interactive ; then # in Terminal: only stderr
			echo -e "$logmsg" >&2
		else # agent mode: stdout & stderr (with id pid level category)
			errdate=$(date)
			echo -e "$errdate  $sbdlid [$sbdlpid] <$loglevel>: $$logcat\n$logmsg" >&2
			echo -e "$logmsg" 
		fi
	else # stdout only
		echo -e "$logmsg"
	fi
	if $flogging ; then # use flog for every logging action (also log into file as info log)
		if [[ $loglevel != "init" ]] ; then
			logmsg=$(echo -e "$logmsg")
		else
			logmsg=$(echo -e "\n$logmsg")
		fi
		flog -a "$logloc" -l "$loglevel" -s "$sbdlid" -c "$logcat" "$logmsg" &>/dev/null
	else # use built-in logger CLI
		logmsgall="$logmsgall\n$logmsg" # populate for final info logging to log file
		if [[ $loglevel != "final" ]] ; then # note: do not log default & info messages (only part of final info)
			if [[ $loglevel =~ ^(error|fault)$ ]] ; then # log only to Unified Log (not to log file)
				logmsg=$(echo -e "$logmsg")
				if [[ $logcat == "warning" ]] ; then # user.4 = Warning
					logger -p user.4 -t "$sbdlid" "$logmsg" &>/dev/null
				elif [[ $logcat == "note" ]] ; then # user.5 = Notice
					logger -p user.5 -t "$sbdlid" "$logmsg" &>/dev/null
				else
					if [[ $loglevel == "fault" ]] ; then
						priority="user.2" # user.2 = Critical
					else
						priority="user.3" # user.3 = Error
					fi
					logger -s -p "$priority" -t "$sbdlid" "$logmsg" &>/dev/null
				fi
			fi
		else # final info logging (also into log file)
			logmsgall=$(echo -e "$logmsgall")
			if [[ $logcat == "errors" ]] ; then # log as "Notice"
				logger -i -s -p user.5 -t "$sbdlid" "$logmsgall" 2>> "$logloc"
			else # log as "Info"
				logger -i -s -p user.6 -t "$sbdlid" "$logmsgall" 2>> "$logloc"
			fi
		fi
	fi
}
###

# function: final success prompt
_finalsuccess () {
osascript &>/dev/null << EOL
tell application "System Events"
	activate
	set theUserChoice to button returned of (display alert "Verifications successful!" message "DON'T TRUST, VERIFY! You should not trust third parties for critical software: please verify the files manually to confirm that this release is not compromised!" & return & return & "SUPERBACKED DOWNLOADER ('THE SOFTWARE') IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, ESPECIALLY LOST OR STOLEN SECRETS AND ASSOCIATED DATA OR VALUE, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." as critical ¬
		buttons {"I Agree"})
end tell
EOL
}

# function: final error prompt
_finalerror () {
	osascript &>/dev/null << EOL
tell application "System Events"
	activate
	set theUserChoice to button returned of (display alert "WARNING: there were errors!" message "DON'T TRUST, VERIFY! You should not trust third parties for critical software: please verify the files manually to confirm that this release is compromised, notify the developer, and download again at a later date!" & return & return & "SUPERBACKED DOWNLOADER ('THE SOFTWARE') IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, ESPECIALLY LOST OR STOLEN SECRETS AND ASSOCIATED DATA OR VALUE, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." as critical ¬
		buttons {"I Agree"})
end tell
EOL
}

# initial info
currentdate=$(date)
echo -e "\n*** $uiprocess ($process $sbdlversion) launched: $currentdate ***" ### delete!
# _flog init - "*** $uiprocess ($process $sbdlversion) launched: $currentdate ***"
if $interactive ; then
	echo "INFO: $process running in interactive mode (PID: $sbdlpid)"
	# _flog default general "foo bar baz" ###
else
	echo "INFO: $process running in background (PID: $sbdlpid)"
fi
if $flogging ; then
	echo "INFO: flog installed"
else
	echo "NOTE: flog not installed! Using logger as fallback..."
fi

# configuration
config=$(cat "$configloc" 2>/dev/null)
if ! [[ $config ]] ; then
	echo "ERROR: configuration is empty!"
	_notify "❌ Error: configuration!" "Configuration is empty"
	_beep
	exit 1
fi
echo "INFO: configuration imported from $configloc"

# check configuration for software license key
license=$(echo "$config" | grep "^License:" | awk -F":" '{print $2}' | xargs | sed -e 's/^ *//' -e 's/ *$//')
if ! [[ $license ]] || echo "$license" | grep "yourLicenseKey" &>/dev/null ; then
	fileman=false
	filemanager=$(defaults read -g NSFileViewer 2>/dev/null)
	if [[ $filemanager ]] ; then
		[[ $filemanager != "com.apple.Finder" ]] && fileman=true
	fi
	if $fileman ; then
		fmapploc=$(mdfind "kMDItemCFBundleIdentifier == \"$filemanager\"" 2>/dev/null | LC_COLLATE=C sort | head -n 1)
		fminfoplistloc="$fmapploc/Contents/Info.plist"
		if ! [[ -f $fminfoplistloc ]] ; then
			fileman=false
		else
			fmname=$(/usr/libexec/PlistBuddy -c "Print :CFBundleName" "$fminfoplistloc" 2>/dev/null)
			! [[ $fmname ]] && fileman=false
		fi
	fi
	echo -e "NOTE: no software license key detected in configuration!\nNOTE: please edit configuration manually"
	_notify "ℹ️ Software license key missing!" "Please edit configuration sbdl.cfg manually"
	_info
	if $fileman ; then
		if pgrep -x "$fmname" &>/dev/null ; then
			echo "Revealing configuration folder in $fmname ($filemanager)..."
			open -a "$fmname" "$configdir" &>/dev/null
		else
			if pgrep -x "Finder" &>/dev/null ; then
				echo "Revealing configuration file in Finder (com.apple.Finder)..."
				osascript -e "tell application \"Finder\"" -e "activate" -e "reveal POSIX file \"$configloc\"" -e "end tell" &>/dev/null
			else
				echo "Revealing configuration folder in default file manager..."
				open "$configdir" &>/dev/null
			fi
		fi
	else
		if pgrep -x "Finder" &>/dev/null ; then
			echo "Revealing configuration file in Finder (com.apple.Finder)..."
			osascript -e "tell application \"Finder\"" -e "activate" -e "reveal POSIX file \"$configloc\"" -e "end tell" &>/dev/null
		else
			echo "Revealing configuration folder in default file manager..."
			open "$configdir" &>/dev/null
		fi
	fi
	exit 1
fi
echo "INFO: software license key detected in configuration"

# check configuration for software release label (default to std)
label=$(echo "$config" | grep "^ReleaseLabel:" | awk -F":" '{print $2}' | xargs | sed -e 's/^ *//' -e 's/ *$//')
if ! [[ $label ]] ; then
	label="std"
	bundleid="com.superbacked.$label"
	echo "INFO: auto-set to std release ($bundleid)"
else
	bundleid="com.superbacked.$label"
	echo "INFO: set to $label release ($bundleid)"
fi

# read remote version number
if ! _redirect "$relurl" ; then
	echo "ERROR: redirect in place at $relurl"
	_notify "❌ Error: redirect!" "$relurl"
	_beep
	exit 1
else
	versionfound=false
	if command -v lynx &>/dev/null ; then
		echo "INFO: lynx installed"
		version=$(lynx -dump "$relurl" 2>/dev/null | grep "\. $relurl/v" | awk -F"/v" '{print $NF}' | sort -rV | head -n 1 | xargs)
		[[ $version ]] && versionfound=true
	else
		echo "NOTE: lynx is not installed! Using cURL as fallback..."
	fi
	if ! $versionfound ; then
		version=$(curl -s --connect-timeout 10 "$relurl" | grep "href=\"/superbacked/superbacked/tree/main/releases/" | rev | awk -F"[<>]" '{print $5}' | rev | sed 's/^v//' | sort -rV | head -n 1 | xargs)
	fi
	if ! [[ $version ]] ; then
		echo "ERROR: new version information missing!"
		_notify "❌ Error: new version!" "Information missing"
		_beep
		exit 1
	fi
fi

# search for installed Superbacked app
initialdl=false
apploc=$(mdfind "kMDItemCFBundleIdentifier == '""$bundleid""'" 2>/dev/null | awk 'NR==1')
if ! [[ $apploc ]] ; then
	echo -e "INFO: Superbacked not installed\nINITIAL DOWNLOAD: $version"
	_notify "ℹ️ Superbacked not installed" "Downloading: $version"
	_info
	initialdl=true
else
	echo "INFO: software installed at $apploc"
	# read local version numbers
	plistloc="$apploc/Contents/Info.plist"
	localversion=$(defaults read "$plistloc" CFBundleVersion 2>/dev/null)
	if ! [[ $localversion ]] ; then
		echo "ERROR: unable to read local version number"
		_notify "⚠️ Error: version number!" "Unable to read local version number"
		_beep
		exit 1
	fi
	
	# for testing only
	if $override ; then
		localversion="1.0.0"
	fi
	
	echo -e "Installed version: $localversion\nRemote version: $version"

	# compare version numbers
	newestversion=$(echo -e "$version\n$localversion" | sort -rV | head -n 1)
	echo "Newest version: $newestversion"
	if [[ $localversion == "$newestversion" ]] ; then
		echo "Newest version already installed: exiting..."
		exit
	else
		echo "Newer version available: downloading..."
		_notify "ℹ️ Newer version available" "$version <- $localversion"
		_info
	fi
fi

# determine download path
dlpath=$(echo "$config" | grep "^DownloadPath:" | awk -F":" '{print $2}' | xargs | sed -e 's/^ *//' -e 's/ *$//')
if ! [[ $dlpath ]] || ! [[ -d "$dlpath" ]] ; then
	dlpath="$HOME/Downloads"
	echo "INFO: using default target folder $dlpath"
else
	echo "INFO: using target folder $dlpath"
fi
disclaimerloc="$dlpath/SBDL_DISCLAIMER.txt"
rm -f "$disclaimerloc" 2>/dev/null

# check configuration for Linux download
linuxinfo=$(echo "$config" | grep "^LinuxDownload:" | awk -F":" '{print $2}' | xargs | sed -e 's/^ *//' -e 's/ *$//')
if [[ $linuxinfo =~ ^(1|y|Y|yes|YES|Yes)$ ]] ; then
	linuxdl=true
	echo "INFO: Linux AppImage download enabled"
else
	linuxdl=false
	echo "INFO: Linux AppImage download disabled"
fi

# check architecture setting
platform=$(echo "$config" | grep "^Platform:" | awk -F":" '{print $2}' | xargs | sed -e 's/^ *//' -e 's/ *$//')
if ! [[ $platform ]] ; then
	if [[ $label == "op" ]] ; then
		macosarch="arm64"
		linuxarch="x64"
	else
		macosarch="universal"
		linuxarch="x64"
	fi
	echo "INFO: auto-set to architectures $macosarch (macOS) & $linuxarch (Linux)"
else
	if [[ $label == "op" ]] ; then
		macosarch="arm64"
	else
		macosarch="universal"
	fi
	echo "INFO: auto-set macOS architecture to $macosarch ($label)"
	if $linuxdl ; then
		if [[ $platform =~ ^(arm|arm64|Arm|ARM|Arm64|ARM64)$ ]] ; then
			linuxarch="arm64"
			echo "INFO: set Linux architecture to arm64"
		elif [[ $platform =~ ^(x64|intel|amd|amd64|AMD|AMD64|Intel|X64)$ ]] ; then
			linuxarch="x64"
			echo "INFO: set Linux architecture to x64"
		else
			linuxarch="x64"
			echo "INFO: auto-set Linux architecture to x64"
		fi
	else
		echo "NOTE: not setting Linux architecture (Linux download disabled)"
	fi
fi

# populate download URLs
finalappdlurl="$appdlurl1$label-$macosarch$appdlurl2$license"
wherefromurl="https://superbacked.com/api/downloads/superbacked-$label-$macosarch-latest.dmg"
if $linuxdl ; then
	finalappdlurl_linux="$appdlurl1$label-$linuxarch$appdlurl3$license"
	wherefromurl_linux="https://superbacked.com/api/downloads/superbacked-$label-$linuxarch-latest.AppImage"
fi

# download auxiliary files from GitHub first
sleep 1
echo "Downloading auxiliary files from GitHub..."
errors=false
cd "$dlpath"

# GPG signature file
if ! _redirect "$gpgdlurl" ; then
	echo "ERROR: redirect in place at $gpgdlurl"
	_notify "❌ Error: redirect!" "$gpgdlurl"
	_beep
	exit 1
fi
gpgdownloaded=false
rm -f ./"SHA256SUMS.asc" 2>/dev/null
gpgdlurl="$gitdlurl$version/SHA256SUMS.asc"
echo "Download URL: $gpgdlurl"
if ! curl -s --connect-timeout 10 --xattr -o ./SHA256SUMS.asc "$gpgdlurl" 2>/dev/null ; then
	echo "ERROR: downloading SHA256SUMS.asc!"
	_notify "❌ Download error!" "SHA256SUMS.asc"
	_beep
	errors=true
else
	curlxa=$(xattr -p user.xdg.origin.url ./SHA256SUMS.asc 2>/dev/null)
	if [[ $curlxa == "$gpgdlurl" ]] ; then
		echo "SUCCESS: downloaded SHA256SUMS.asc"
		_notify "☑️ Download successful" "SHA256SUMS.asc"
		gpgdownloaded=true
		hexdate=$(echo "obase=16; $(date +%s)" | bc | tr '[:upper:]' '[:lower:]')
		qxattr="0081;$hexdate;sbdl;"
		if xattr -w com.apple.quarantine "$qxattr" ./SHA256SUMS.asc &>/dev/null ; then
			echo "SUCCESS: added XA $qxattr to SHA256SUMS.asc"
		else
			echo "ERROR: unable to add XA $qxattr to SHA256SUMS.asc"
		fi
	else
		rm -f ./"SHA256SUMS.asc" 2>/dev/null
		echo "ERROR: SHA256SUMS.asc download was redirected!"
		_notify "❌ Error: download redirected!" "SHA256SUMS.asc"
		_beep
		exit 1
	fi
fi
sleep 1

# sha256 checksums file
if ! _redirect "$shadlurl" ; then
	echo "ERROR: redirect in place at $shadlurl"
	_notify "❌ Error: redirect!" "$shadlurl"
	_beep
	exit 1
fi
shasumdownloaded=false
rm -f ./"SHA256SUMS" 2>/dev/null
shadlurl="$gitdlurl$version/SHA256SUMS"
echo "Download URL: $shadlurl"
if ! curl -s --connect-timeout 10 --xattr -o ./SHA256SUMS "$shadlurl" 2>/dev/null ; then
	echo "ERROR: downloading SHA256SUMS!"
	_notify "❌ Download error!" "SHA256SUMS"
	_beep
	errors=true
else
	curlxa=$(xattr -p user.xdg.origin.url ./SHA256SUMS 2>/dev/null)
	if [[ $curlxa == "$shadlurl" ]] ; then
		echo "SUCCESS: downloaded SHA256SUMS"
		shasumdownloaded=true
		hexdate=$(echo "obase=16; $(date +%s)" | bc | tr '[:upper:]' '[:lower:]')
		qxattr="0081;$hexdate;sbdl;"
		if xattr -w com.apple.quarantine "$qxattr" ./SHA256SUMS &>/dev/null ; then
			echo "SUCCESS: added XA $qxattr to SHA256SUMS"
		else
			echo "ERROR: unable to add XA $qxattr to SHA256SUMS"
		fi
	else
		rm -f ./"SHA256SUMS" 2>/dev/null
		echo "ERROR: SHA256SUMS download was redirected!"
		_notify "❌ Error: download redirected!" "SHA256SUMS"
		_beep
		exit 1
	fi
fi

# verify sha256 checksums file
gpgverified=false
if $shasumdownloaded ; then
	if $gpgdownloaded ; then
		if command -v gpg &>/dev/null ; then
			echo "INFO: gpg installed"
			gpgout=$(gpg --verify ./SHA256SUMS.asc 2>&1)
			if echo "$gpgout" | grep "^gpg: Good signature " &>/dev/null && echo "$gpgout" | grep "^$devgpg$" &>/dev/null ; then
				gpgverified=true
				echo "SUCCESS: verified SHA256SUMS (GPG)"
				_notify "☑️ Download verified" "GPG: SHA256SUMS"
			else
				echo "ERROR: GPG verification failed!"
				_notify "❌ Verification failed!" "GPG: SHA256SUMS"
				_beep
				errors=true
				chmod -x ./SHA256SUMS ./SHA256SUMS.asc 2>/dev/null
			fi
		else
			echo "WARNING: GPG not installed - unable to verify!"
			_notify "⚠️ GPG not installed!" "Unable to verify SHA256SUMS"
			_beep
			errors=true
			chmod -x ./SHA256SUMS
			sleep 1
		fi
	else
		echo "WARNING: unable to verify due to SHA256SUMS.asc download error!"
		errors=true
		sleep 1
	fi
else
	echo "WARNING: unable to verify due to SHA256SUMS download error!"
	errors=true
	sleep 1
fi

# release notes file
if ! _redirect "$rndlurl" ; then
	echo "ERROR: redirect in place at $rndlurl"
	_notify "❌ Error: redirect!" "$rndlurl"
	_beep
	exit 1
fi
rndownloaded=false
rnfilename="superbacked-$label-$version-release-notes.txt"
rm -f ./"$rnfilename" 2>/dev/null
rndlurl="$gitdlurl$version/$rnfilename"
echo "Download URL: $rndlurl"
if ! curl -s --connect-timeout 10 --xattr -o ./"$rnfilename" "$rndlurl" 2>/dev/null ; then
	echo "ERROR: downloading release notes!"
	_notify "❌ Download error!" "$rnfilename"
	_beep
	errors=true
else
	curlxa=$(xattr -p user.xdg.origin.url ./"$rnfilename" 2>/dev/null)
	if [[ $curlxa == "$rndlurl" ]] ; then
		rndownloaded=true
		echo "SUCCESS: downloaded $rnfilename"
		hexdate=$(echo "obase=16; $(date +%s)" | bc | tr '[:upper:]' '[:lower:]')
		qxattr="0081;$hexdate;sbdl;"
		if xattr -w com.apple.quarantine "$qxattr" ./"$rnfilename" &>/dev/null ; then
			echo "SUCCESS: added XA $qxattr to $rnfilename"
		else
			echo "ERROR: unable to add XA $qxattr to $rnfilename"
		fi
		if $shasumdownloaded ; then
			if shasum -a 256 -c --ignore-missing SHA256SUMS 2>/dev/null | grep "\-release\-notes\.txt: OK$" &>/dev/null ; then
				if $gpgverified ; then
					echo "SUCCESS: verified $rnfilename (shasum)"
					_notify "☑️ Download verified" "shasum: $rnfilename"
				else
					echo "WARNING: insecure verification (shasum without GPG)"
					_notify "⚠️ Insecure download verification!" "GPG: $rnfilename"
					_beep
					errors=true
				fi
			else
				echo "ERROR: $rnfilename verification failed (shasum)!"
				_notify "❌ Verification failed!" "shasum: $rnfilename"
				_beep
				errors=true
				chmod -x ./"$rnfilename" 2>/dev/null
			fi
		else
			echo -e "SUCCESS downloaded $rnfilename\nWARNING: unable to verify with shasum due to SHA256SUMS download error"
			_notify "⚠️ Unverified download!" "shasum: $rnfilename"
			_beep
			errors=true
		fi
	else
		rm -f ./"$rnfilename" 2>/dev/null
		echo "ERROR: $rnfilename download was redirected!"
		_notify "❌ Error: download redirected!" "$rnfilename"
		_beep
		exit 1
	fi
fi

# download main application DMG
appcheck=true
dmgcheck=true
filename=$(curl -sI --connect-timeout 10 "$finalappdlurl" 2>&1 | grep "filename=" | awk -F"filename=" '{print $2}' | xargs | tr -cd '\40-\176')
! [[ $filename ]] && filename="superbacked-$label-$macosarch-$version.dmg"
if [[ -f ./"$filename" ]] ; then
	echo "NOTE: $filename already exists at download path - checking..."
	if $shasumdownloaded ; then
		if shasum -a 256 -c --ignore-missing ./SHA256SUMS 2>&1 | grep "\.dmg: OK$" &>/dev/null ; then
			if $gpgverified ; then
				echo "INFO: DMG file OK (shasum)"
				_notify "✅ File exists & verified" "$filename"
				_success
				dmgdl=false
			else
				echo -e "INFO: DMG file OK (shasum)\nWARNING: insecure verification (shasum without GPG)"
				_notify "⚠️ File exists | insecure!" "GPG: $filename"
				_beep
				dmgdl=false
				errors=true
				chmod -x ./"$filename" 2>/dev/null
			fi
		else
			echo "NOTE: DMG file corrupted or out-of-date (shasum) - will unlink..."
			dmgdl=true
		fi
	else
		if hdiutil verify ./"$filename" &>/dev/null ; then
			echo -e "INFO: DMG file OK (hdiutil)\nWARNING: insecure (without any verification)!"
			_notify "⚠️ File exists intact | unable to verify" "$filename"
			_beep
			dmgdl=false
			dmgcheck=false
			errors=true
			chmod -x ./"$filename" 2>/dev/null
		else
			echo "NOTE: DMG file corrupted (hdiutil) - will unlink..."
			dmgdl=true
		fi
	fi
else
	dmgdl=true
	sleep 1
fi
if $dmgdl ; then
	if ! _redirect "$finalappdlurl" ; then
		echo "ERROR: redirect in place at $finalappdlurl"
		_notify "❌ Error: redirect!" "$finalappdlurl"
		_beep
		exit 1
	fi
	_notify "⏳ Please wait: downloading…" "$filename" &
	echo "Downloading: $filename"
	rm -f ./"$filename" 2>/dev/null
	echo "Download URL: $wherefromurl"
	if ! curl -s --connect-timeout 10 --xattr -o ./"$filename" "$finalappdlurl" 2>/dev/null ; then
		echo "ERROR: download failed!"
		_notify "❌ Error: download!" "$filename"
		_beep
		errors=true
		dmgcheck=false
		appcheck=false
	else
		curlxa=$(xattr -p user.xdg.origin.url ./"$filename" 2>/dev/null | awk -F"?" '{print $1}')
		if [[ $curlxa == "$wherefromurl" ]] ; then
			echo "SUCCESS: downloaded $filename"
			if xattr -w user.xdg.origin.url "$wherefromurl?license=<redacted>" ./"$filename" &>/dev/null ; then
				echo "SUCCESS: obscured software license code in XA user.xdg.origin.url"
			else
				echo "ERROR: failed to obscure software license code in XA user.xdg.origin.url"
				if xattr -d user.xdg.origin.url ./"$filename" &>/dev/null ; then
					echo "NOTE: deleted XA user.xdg.origin.url instead"
				else
					echo "ERROR: failed to delete XA user.xdg.origin.url!"
				fi
			fi
			hexdate=$(echo "obase=16; $(date +%s)" | bc | tr '[:upper:]' '[:lower:]')
			qxattr="0081;$hexdate;sbdl;"
			if xattr -w com.apple.quarantine "$qxattr" ./"$filename" &>/dev/null ; then
				echo "SUCCESS: added XA $qxattr to $filename"
			else
				echo "ERROR: unable to add XA $qxattr to $filename"
			fi
			if shasum -a 256 -c --ignore-missing ./SHA256SUMS 2>&1 | grep "\.dmg: OK$" &>/dev/null ; then
				if $gpgverified ; then
					echo "SUCCESS: $filename verified (shasum)"
					_notify "✅ Downloaded & verified" "Superbacked v$version (macOS)"
					_success
				else
					echo -e "SUCCESS: $filename verified (shasum)\nWARNING: insecure verification (shasum without GPG)!"
					_notify "⚠️ Downloaded & verified | insecure" "GPG: $filename"
					_beep
					errors=true
					chmod -x ./"$filename" 2>/dev/null
				fi
				appcheck=true
			else
				echo "ERROR: $filename verification failed (shasum)!"
				_notify "❌ Download: verification failed!" "shasum: $filename"
				_beep
				errors=true
				chmod -x ./"$filename" 2>/dev/null
			fi
		else
			rm -f ./"$filename" 2>/dev/null
			echo "ERROR: $filename download was redirected!"
			_notify "❌ Error: download redirected!" "$filename"
			_beep
			exit 1
		fi
	fi
fi

# check DMG with hdiutil
if $dmgcheck ; then
	sleep 1
	echo "Verifying DMG internal checksum with hdiutil..."
	if hdiutil verify ./"$filename" &>/dev/null ; then
		echo "SUCCESS: DMG internal checksum verified (hdiutil)"
		_notify "✅ Internal checksum verified" "hdiutil: $filename"
	else
		echo -e "ERROR: DMG internal checksum failed (hdiutil)!\nNOTE: skipping application verification"
		_notify "❌ Internal checksum failed!" "hdiutil: $filename"
		_beep
		errors=true
		appcheck=false
	fi
fi

# mount DMG volume & check app
if $appcheck ; then
	sleep 1
	mountraw=$(hdiutil attach -nobrowse ./"$filename" 2>&1 | grep "^/dev/")
	sleep 1
	echo "Verifying Superbacked application..."
	_notify "⏳ Please wait: verifying…" "Superbacked application" &
	appcheckerror=false
	certcheckwarning=false
	verifyinfo="Errors:"
	volume=$(echo "$mountraw" | tail -n 1 | awk '{print substr($0, index($0,$3))}')
	device=$(echo "$mountraw" | tail -n 1 | awk '{print $1}')
	parentdevice=$(echo "$mountraw" | head -n 1 | awk '{print $1}')
	csraw=$(codesign --verify --deep --strict --verbose=4 "$volume/Superbacked.app" 2>&1 | grep -v -e "^\-\-prepared" -e "^\-\-validated" -e "^In subcomponent:" -e "^In architecture:")
	if ! echo "$csraw" | grep "valid on disk$" &>/dev/null || ! echo "$csraw" | grep "satisfies its Designated Requirement$" &>/dev/null ; then
		echo "INVALID: application bundle integrity!"
		appcheckerror=true
		if [[ $verifyinfo == "Errors:" ]] ; then
			verifyinfo="$verifyinfo invalid"
		else
			verifyinfo="$verifyinfo | invalid"
		fi
	else
		echo "VALID: application bundle integrity"
	fi
	if echo "$csraw" | grep "^file missing:" &>/dev/null ; then
		echo "ERROR: file(s) missing from application bundle!"
		appcheckerror=true
		if [[ $verifyinfo == "Errors:" ]] ; then
			verifyinfo="$verifyinfo missing files"
		else
			verifyinfo="$verifyinfo | missing files"
		fi
	else
		echo "INFO: no missing files"
	fi
	if echo "$csraw" | grep "^file added:" &>/dev/null ; then
		echo "ERROR: file(s) added to application bundle!"
		appcheckerror=true
		if [[ $verifyinfo == "Errors:" ]] ; then
			verifyinfo="$verifyinfo added files"
		else
			verifyinfo="$verifyinfo | added files"
		fi
	else
		echo "INFO: no added files"
	fi
	if echo "$csraw" | grep "^file modified:" &>/dev/null ; then
		echo "ERROR: file(s) in application bundle modified!"
		appcheckerror=true
		if [[ $verifyinfo == "Errors:" ]] ; then
			verifyinfo="$verifyinfo modified"
		else
			verifyinfo="$verifyinfo | modified"
		fi
	else
		echo "INFO: no modified files"
	fi
	spctlraw=$(spctl -a -vvv -t install "$volume/Superbacked.app" 2>&1)
	if ! echo "$spctlraw" | grep "\.app: accepted$" &>/dev/null ; then
		echo "ERROR: application not accepted by macOS Gatekeeper"
		appcheckerror=true
		if [[ $verifyinfo == "Errors:" ]] ; then
			verifyinfo="$verifyinfo Gatekeeper"
		else
			verifyinfo="$verifyinfo | Gatekeeper"
		fi
	else
		echo "ACCEPTED: macOS Gatekeeper"
	fi
	if ! echo "$spctlraw" | grep "^source=Notarized Developer ID$" &>/dev/null ; then
		echo "ERROR: application not notarized!"
		appcheckerror=true
		if [[ $verifyinfo == "Errors:" ]] ; then
			verifyinfo="$verifyinfo unnotarized"
		else
			verifyinfo="$verifyinfo | unnotarized"
		fi
	else
		echo "INFO: signed & notarized"
	fi
	xcraw=$(xcrun stapler validate "$volume/Superbacked.app" 2>&1)
	if ! echo "$xcraw" | grep "^The validate action worked!$" &>/dev/null ; then
		echo "ERROR: application not properly stapled!"
		appcheckerror=true
		if [[ $verifyinfo == "Errors:" ]] ; then
			verifyinfo="$verifyinfo unstapled"
		else
			verifyinfo="$verifyinfo | unstapled"
		fi
	else
		echo "INFO: properly stapled"
	fi
	if ! $initialdl ; then # certificate info for installed app
		rm -f /tmp/codesign0 /tmp/codesign1 /tmp/codesign2 &>/dev/null
		cd /tmp
		localcsinfo=$(codesign -dvvvv --requirements - --entitlements - --extract-certificates "$apploc" 2>&1)
		teamid=$(echo "$localcsinfo" | grep "^TeamIdentifier=" | awk -F"=" '{print $2}')
		! [[ $teamid ]] && teamid="NULL"
		subject=$(echo "$localcsinfo" | grep "^Authority=" | head -n 1 | awk -F"=" '{print substr($0, index($0,$2))}')
		! [[ $subject ]] && subject="NULL"
		skid=$(openssl x509 -in /tmp/codesign0 -inform DER -noout -text -fingerprint | grep -A1 "Subject Key Identifier" | tail -1 | xargs | sed s/://g)
		! [[ $skid ]] && skid="NULL"
		cd "$dlpath"
	else # certificate info from current release
		teamid="$currentteamid"
		subject="$currentsubject"
		skid="$currentskid"
	fi
	# certificate info for updated app
	rm -f /tmp/codesign0 /tmp/codesign1 /tmp/codesign2 &>/dev/null
	cd /tmp
	csinfo=$(codesign -dvvvv --requirements - --entitlements - --extract-certificates "$volume/Superbacked.app" 2>&1)
	newteamid=$(echo "$csinfo" | grep "^TeamIdentifier=" | awk -F"=" '{print $2}')
	! [[ $newteamid ]] && newteamid="NULL"
	newsubject=$(echo "$csinfo" | grep "^Authority=" | head -n 1 | awk -F"=" '{print substr($0, index($0,$2))}')
	! [[ $newsubject ]] && newsubject="NULL"
	newskid=$(openssl x509 -in /tmp/codesign0 -inform DER -noout -text -fingerprint | grep -A1 "Subject Key Identifier" | tail -1 | xargs | sed s/://g)
	! [[ $newskid ]] && newskid="NULL"
	cd "$dlpath"
	certraw=$(security verify-cert -c /tmp/codesign0 2>&1)
	sleep .5
	rm -f /tmp/codesign0 /tmp/codesign1 /tmp/codesign2 &>/dev/null
	if [[ $certraw != "...certificate verification successful." ]] ; then
		echo "ERROR (certificate): $certraw"
		appcheckerror=true
		if [[ $newskid != "$skid" ]] ; then
			if [[ $newteamid != "$teamid" ]] || [[ $newsubject != "$subject" ]] ; then
				echo -e "WARNING: SKID & TeamID or Subject have changed!\nSKID: $newskid <- $skid\nTeamID: $newteamid <- $teamid\nSubject: $newsubject <- $subject"
				if [[ $verifyinfo == "Errors:" ]] ; then
					verifyinfo="$verifyinfo SKID & developer change | $certraw"
				else
					verifyinfo="$verifyinfo | SKID & developer change | $certraw"
				fi
			else
				echo -e "NOTE: SKID has changed (unverified certificate update)!\nSKID: $newskid <- $skid"
				if [[ $verifyinfo == "Errors:" ]] ; then
					verifyinfo="$verifyinfo SKID change | $certraw"
				else
					verifyinfo="$verifyinfo | SKID change | $certraw"
				fi
			fi
		else
			echo "INFO: SKID unchanged"
			if [[ $verifyinfo == "Errors:" ]] ; then
				verifyinfo="$verifyinfo $certraw"
			else
				verifyinfo="$verifyinfo | $certraw"
			fi
		fi
	else
		echo "VERIFIED: code-signing certificate"
		if [[ $newskid == "$skid" ]] ; then
			echo "INFO: SKID unchanged"
		else
			if [[ $newteamid != "$teamid" ]] || [[ $newsubject != "$subject" ]] ; then
				echo -e "WARNING: SKID & TeamID or Subject have changed!\nSKID: $newskid <- $skid\nTeamID: $newteamid <- $teamid\nSubject: $newsubject <- $subject"
				if [[ $verifyinfo == "Errors:" ]] ; then
					verifyinfo="$verifyinfo SKID & developer change"
				else
					verifyinfo="$verifyinfo | SKID & developer change"
				fi
				certcheckwarning=true
			else
				echo "INFO: SKID changed, but developer unchanged (verified certificate update)"
			fi
		fi
	fi
	hdiutil unmount -force "$volume" &>/dev/null
	sleep .3
	hdiutil detach -force "$device" &>/dev/null
	sleep .3
	hdiutil detach -force "$parentdevice" &>/dev/null
	if ! $appcheckerror ; then
		if ! $certcheckwarning ; then
			echo "SUCCESS: application bundle OK"
			_notify "✅ Application verified" "Superbacked.app"
			_success
		else
			echo "WARNING: application bundle OK, but with developer changes"
			_notify "⚠️ Superbacked.app has changed!" "$verifyinfo"
			_beep
		fi
	else
		errors=true
		echo "ERROR: application bundle has been corrupted!"
		_notify "❌ Superbacked.app corrupted!" "$verifyinfo"
		_success
	fi
fi

if ! $linuxdl ; then
	if $errors ; then
		echo "NOTE: there were errors!"
		echo -e "$disclaimererror" > "$disclaimerloc" 2>/dev/null
		open -a Console.app "$logloc" &>/dev/null
		_finalerror
		exit 1
	else
		echo "INFO: executed without errors"
		echo -e "$disclaimersuccess" > "$disclaimerloc" 2>/dev/null
		if $certcheckwarning ; then
			open -a Console.app "$logloc" &>/dev/null
		fi
		_finalsuccess
		if $rndownloaded ; then
			qlmanage -p "$dlpath/$rnfilename" &>/dev/null
		fi
		exit
	fi
fi

# download main application (AppImage/Linux)
filename_linux=$(curl -sI --connect-timeout 10 "$finalappdlurl_linux" 2>&1 | grep "filename=" | awk -F"filename=" '{print $2}' | xargs | tr -cd '\40-\176')
! [[ $filename_linux ]] && filename_linux="superbacked-$label-$linuxarch-$version.AppImage"
aidl=true
if [[ -f ./"$filename_linux" ]] ; then
	echo "NOTE: $filename_linux already exists at download path - checking..."
	if $shasumdownloaded ; then
		if shasum -a 256 -c --ignore-missing ./SHA256SUMS 2>&1 | grep "\.AppImage: OK$" &>/dev/null ; then
			if $gpgverified ; then
				echo "INFO: AppImage file verified (shasum)"
			else
				echo -e "INFO: AppImage file verified (shasum)\nWARNING: insecure verification (shasum without GPG)"
			fi
			if ! command -v 7z &>/dev/null ; then
				echo -e "NOTE: 7z is not installed!\nINFO: skipping coarse AppImage integrity check!"
				if $gpgverified ; then
					_notify "✅ File exists & verified" "$filename_linux"
					_success
					aidl=false
				else
					_notify "⚠️ File exists | insecure!" "GPG: $filename_linux"
					_beep
					aidl=false
					errors=true
					chmod -x ./"$filename_linux" 2>/dev/null
				fi
			else
				echo "INFO: 7z installed"
				if 7z t ./"$filename_linux" 2>&1 | grep "^Can not open the file as archive$" &>/dev/null ; then
					echo "NOTE: AppImage file might be corrupted (7z) - will unlink..."
				else
					echo -e "SUCCESS: AppImage file coarsely verified (7z)"
					if $gpgverified ; then
						_notify "✅ File exists & verified" "$filename_linux"
						_success
						aidl=false
					else
						_notify "⚠️ File exists | insecure" "GPG: $filename_linux"
						_beep
						aidl=false
						errors=true
						chmod -x ./"$filename_linux" 2>/dev/null
					fi
				fi
			fi
		else
			echo "NOTE: AppImage file corrupted or out-of-date (shasum) - will unlink..."
		fi
	else
		if ! command -v 7z &>/dev/null ; then
			echo -e "NOTE: 7z is not installed!\nWARNING: unable to verify or check integrity!"
			_notify "❌ File exists | unable to verify" "$filename_linux"
			_beep
			aidl=false
			errors=true
			chmod -x ./"$filename_linux" 2>/dev/null
		else
			echo "INFO: 7z installed"
			if 7z t ./"$filename_linux" 2>&1 | grep "^Can not open the file as archive$" &>/dev/null ; then
				echo "NOTE: AppImage file corrupted (7z) - will unlink..."
			else
				echo -e "INFO: AppImage file integrity OK (7z)\nWARNING: insecure (without verification)!"
				_notify "⚠️ File exists intact | unable to verify" "$filename_linux"
				_beep
				aidl=false
				errors=true
				chmod -x ./"$filename_linux" 2>/dev/null
			fi
		fi
	fi
fi
if $aidl ; then
	if ! _redirect "$finalappdlurl_linux" ; then
		echo "ERROR: redirect in place at $finalappdlurl_linux"
		_notify "❌ Error: redirect!" "$finalappdlurl_linux"
		_beep
		exit 1
	fi
	_notify "⏳ Please wait: downloading…" "$filename_linux" &
	echo "Downloading: $filename_linux"
	rm -f ./"$filename_linux" 2>/dev/null
	echo "Download URL: $wherefromurl_linux"
	if ! curl -s --connect-timeout 10 --xattr -o ./"$filename_linux" "$finalappdlurl_linux" 2>/dev/null ; then
		echo "ERROR: download failed!"
		_notify "❌ Error: download!" "$filename_linux"
		_beep
		errors=true
	else
		curlxa=$(xattr -p user.xdg.origin.url ./"$filename_linux" 2>/dev/null | awk -F"?" '{print $1}')
		if [[ $curlxa == "$wherefromurl_linux" ]] ; then
			echo "SUCCESS: downloaded $filename_linux"
			if xattr -w user.xdg.origin.url "$wherefromurl_linux?license=<redacted>" ./"$filename_linux" &>/dev/null ; then
				echo "SUCCESS: obscured software license code in XA user.xdg.origin.url"
			else
				echo "ERROR: failed to obscure software license code in XA user.xdg.origin.url"
				if xattr -d user.xdg.origin.url ./"$filename_linux" &>/dev/null ; then
					echo "NOTE: deleted XA user.xdg.origin.url instead"
				else
					echo "ERROR: failed to delete XA user.xdg.origin.url!"
				fi
			fi
			echo "INFO: skipping addition of XA com.apple.quarantine (AppImage)"
			if shasum -a 256 -c --ignore-missing ./SHA256SUMS 2>&1 | grep "\.AppImage: OK$" &>/dev/null ; then
				if $gpgverified ; then
					echo "SUCCESS: $filename_linux verified (shasum)"
				else
					echo -e "SUCCESS: $filename_linux verified (shasum)\nWARNING: insecure verification (shasum without GPG)!"
				fi
				if ! command -v 7z &>/dev/null ; then
					echo -e "NOTE: 7z is not installed!\nINFO: skipping coarse AppImage integrity check!"
					if $gpgverified ; then
						_notify "✅ Downloaded & verified" "Superbacked v$version (Linux)"
						_success
					else
						_notify "⚠️ Downloaded & verified | insecure" "GPG: $filename_linux"
						_beep
						errors=true
						chmod -x ./"$filename_linux" 2>/dev/null
					fi
				else
					echo "INFO: 7z installed"
					if 7z t ./"$filename_linux" 2>&1 | grep "^Can not open the file as archive$" &>/dev/null ; then
						echo "WARNING: AppImage file might be corrupted (7z)!"
						_notify "⚠️ AppImage might be corrupted!" "7z: $filename_linux"
						_beep
						errors=true
						chmod -x ./"$filename_linux" 2>/dev/null
					else
						echo -e "SUCCESS: AppImage file integrity coarsely verified (7z)"
						if $gpgverified ; then
							_notify "✅ Downloaded & verified" "Superbacked v$version (Linux)"
							_success
						else
							_notify "⚠️ Downloaded & verified | insecure" "GPG: $filename_linux"
							_beep
							errors=true
							chmod -x ./"$filename_linux" 2>/dev/null
						fi
					fi
				fi
			else
				echo "ERROR: $filename_linux verification failed (shasum)!"
				_notify "❌ Download: verification failed!" "shasum: $filename_linux"
				_beep
				errors=true
				chmod -x ./"$filename_linux" 2>/dev/null
			fi
		else
			rm -f ./"$filename_linux" 2>/dev/null
			echo "ERROR: $filename_linux download was redirected!"
			_notify "❌ Error: download redirected!" "$filename_linux"
			_beep
			exit 1
		fi
	fi
fi

if $errors ; then
	echo "NOTE: there were errors!"
	echo -e "$disclaimererror" > "$disclaimerloc" 2>/dev/null
	open -a Console.app "$logloc" &>/dev/null
	_finalerror
	exit 1
else
	echo "INFO: executed without errors"
	echo -e "$disclaimersuccess" > "$disclaimerloc" 2>/dev/null
	if $certcheckwarning ; then
		open -a Console.app "$logloc" &>/dev/null
	fi
	_finalsuccess
	if $rndownloaded ; then
		qlmanage -p "$dlpath/$rnfilename" &>/dev/null
	fi
	exit
fi