rbash-upgrade() {
  local target url tmp backup

  target="$__RBASH_SCRIPT"
  url="$(rbash_url "rbashrc")"

  echo "Updating $target"

  tmp="$(mktemp "${TMPDIR:-/tmp}/rbashrc.download.XXXXXX")" || return 1

  if ! rbash_download "$url" > "$tmp"; then
    echo "rbash: upgrade download failed: $url" >&2
    rm -f "$tmp"
    return 1
  fi

  if [ ! -s "$tmp" ]; then
    echo "rbash: downloaded rbashrc is empty; refusing to install" >&2
    rm -f "$tmp"
    return 1
  fi

  if ! grep -q 'RBASH_HOME' "$tmp"; then
    echo "rbash: downloaded file does not look like rbashrc; refusing to install" >&2
    rm -f "$tmp"
    return 1
  fi

  if ! bash -n "$tmp"; then
    echo "rbash: downloaded rbashrc has syntax errors; refusing to install" >&2
    rm -f "$tmp"
    return 1
  fi

  backup="$target.bak.$(date +%Y%m%d%H%M%S)"

  if [ -f "$target" ]; then
    cp "$target" "$backup" || {
      echo "rbash: failed to create backup: $backup" >&2
      rm -f "$tmp"
      return 1
    }
    echo "Backup: $backup"
  fi

  chmod 700 "$tmp"

  if ! mv "$tmp" "$target"; then
    echo "rbash: failed to replace $target" >&2
    echo "rbash: backup remains at $backup" >&2
    rm -f "$tmp"
    return 1
  fi

  rm -rf "$RBASH_CACHE_DIR"
  mkdir -p "$RBASH_CACHE_DIR"

  # shellcheck source=/dev/null
  source "$target"
}