#!/usr/bin/env bash
# opsign-agent.sh <hub-key NAME> <version> <sha256> <host_id>... — one signed agent_update job per box, queued at the hub.
# The hub key arrives through `sec run` under the NAME given; its value is never printed.
set -euo pipefail
KEYNAME=$1; VER=$2; SHA=$3; shift 3
HUBKEY=${!KEYNAME}
D=/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0b76c4d7-9b39-4e4e-869d-d0d2c6006331/scratchpad/d63
for H in "$@"; do
  echo "== $H"
  "$D/felhom-opsign" -op agent_update -host "$H" -key-id felhom-op-1 -key /mnt/5_hdd/felhom.eu/felhom-op-operational \
    -agent-version "$VER" -sha256 "$SHA" -ttl 45m -upload http://10.43.52.34:8080 -hub-key "$HUBKEY" 2>&1 | tail -3
done