v0.0.39 - Fix install.sh: FIPS is a Rust project — use cargo build --release, install rustup if needed, add libclang-dev

VERSION

@@ -1 +1 @@
-0.0.38
+0.0.39

install.sh

@@ -31,6 +31,7 @@ APT_PACKAGES=(
     libwebkit2gtk-4.1-0 libsoup-3.0-0 libqrencode4 libsqlite3-0
     libsecp256k1-2 libssl3t64 libcurl4t64 zlib1g
     tor git build-essential pkg-config
+    libclang-dev libcap2-bin
 )
 
 # --- Output helpers ------------------------------------------------------
@@ -162,10 +163,73 @@ install_deps() {
     print_success "Dependencies installed."
 }
 
+# --- Rust toolchain (FIPS is a Rust project) -----------------------------
+
+# FIPS requires Rust 1.94.1+ (edition 2024). Debian 13's apt cargo/rustc
+# is 1.85, which is too old. We install rustup if no sufficiently new
+# cargo is present. rustup installs to ~/.cargo/bin and is user-local
+# (no sudo needed).
+FIPS_MIN_RUST_MAJOR=1
+FIPS_MIN_RUST_MINOR=94
+
+rust_version_ok() {
+    command -v cargo >/dev/null 2>&1 || return 1
+    local ver
+    ver="$(cargo --version 2>/dev/null | grep -oE 'cargo [0-9]+\.[0-9]+\.' | head -1 | sed 's/cargo //; s/\.$//')" || return 1
+    [[ -z "$ver" ]] && return 1
+    local major minor
+    major="${ver%%.*}"
+    minor="${ver#*.}"
+    [[ "$major" -gt "$FIPS_MIN_RUST_MAJOR" ]] && return 0
+    [[ "$major" -eq "$FIPS_MIN_RUST_MAJOR" && "$minor" -ge "$FIPS_MIN_RUST_MINOR" ]] && return 0
+    return 1
+}
+
+ensure_rust() {
+    if rust_version_ok; then
+        print_info "Rust toolchain OK ($(cargo --version))."
+        return 0
+    fi
+
+    if command -v cargo >/dev/null 2>&1; then
+        print_warning "Installed cargo ($(cargo --version)) is older than FIPS requires (1.94.1+). Installing a newer toolchain via rustup."
+    else
+        print_info "No cargo found. Installing Rust toolchain via rustup."
+    fi
+
+    # rustup installs to ~/.cargo/bin (user-local, no sudo).
+    local rustup_init
+    rustup_init="$(mktemp -t rustup-init.XXXXXX)"
+    if ! curl -fsSL --proto '=https' --tlsv1.2 -o "$rustup_init" https://sh.rustup.rs; then
+        rm -f "$rustup_init"
+        die "Failed to download rustup installer."
+    fi
+    # -y: default options, no prompts. --profile minimal: smaller install.
+    if ! sh "$rustup_init" -y --profile minimal >/dev/null 2>&1; then
+        rm -f "$rustup_init"
+        die "rustup installation failed."
+    fi
+    rm -f "$rustup_init"
+
+    # Source cargo env so this shell can use it.
+    # shellcheck disable=SC1091
+    . "$HOME/.cargo/env" 2>/dev/null || true
+    export PATH="$HOME/.cargo/bin:$PATH"
+
+    if ! rust_version_ok; then
+        die "Rust toolchain installed but cargo still reports an insufficient version. FIPS requires 1.94.1+."
+    fi
+    print_success "Rust toolchain installed: $(cargo --version)."
+}
+
 # --- FIPS ----------------------------------------------------------------
 
 install_fips() {
     print_info "Building and installing FIPS from $FIPS_REPO (required, not optional)..."
+
+    # FIPS is a Rust project — ensure a sufficiently new toolchain is present.
+    ensure_rust
+
     local tmp
     tmp="$(mktemp -d)"
     # Register cleanup for this temp dir (in addition to the global trap).
@@ -176,38 +240,30 @@ install_fips() {
     fi
 
     local fips_dir="$tmp/fips"
-    local built=false
 
-    if [[ -x "$fips_dir/build.sh" ]]; then
-        print_info "FIPS: running ./build.sh"
-        if ( cd "$fips_dir" && ./build.sh ); then built=true; fi
-    fi
-
-    if ! $built && [[ -f "$fips_dir/Makefile" ]]; then
-        print_info "FIPS: running make"
-        if ( cd "$fips_dir" && make ); then built=true; fi
-    fi
-
-    if ! $built && [[ -f "$fips_dir/CMakeLists.txt" ]]; then
-        print_info "FIPS: running cmake"
-        if ( cd "$fips_dir" && cmake -B build && cmake --build build ); then built=true; fi
-    fi
-
-    if ! $built; then
-        die "Could not build FIPS (no build.sh, Makefile, or CMakeLists.txt succeeded). FIPS is required."
+    # FIPS builds with `cargo build --release`. The binary lands at
+    # target/release/fips. libclang-dev (installed via apt deps) is required
+    # at build time for the rustables/bindgen nftables bindings.
+    print_info "FIPS: running cargo build --release (this can take several minutes)..."
+    if ! ( cd "$fips_dir" && cargo build --release ); then
+        die "cargo build --release failed for FIPS. FIPS is required."
     fi
 
     # Locate the built fips binary.
     local fips_bin=""
-    for cand in "$fips_dir/fips" "$fips_dir/build/fips" "$fips_dir/build/src/fips"; do
+    for cand in \
+        "$fips_dir/target/release/fips" \
+        "$fips_dir/target/x86_64-unknown-linux-gnu/release/fips" \
+        "$fips_dir/fips" \
+        "$fips_dir/build/fips"; do
         if [[ -x "$cand" ]] && file "$cand" 2>/dev/null | grep -qi ELF; then
             fips_bin="$cand"
             break
         fi
     done
     if [[ -z "$fips_bin" ]]; then
-        # Last resort: search for any executable named fips.
-        fips_bin="$(find "$fips_dir" -type f -name fips -executable 2>/dev/null | head -1 || true)"
+        # Last resort: search for any executable named fips under target/.
+        fips_bin="$(find "$fips_dir/target" -type f -name fips -executable 2>/dev/null | head -1 || true)"
     fi
     [[ -n "$fips_bin" ]] || die "FIPS build succeeded but no 'fips' binary was found."
 

src/version.h

@@ -11,9 +11,9 @@
 #ifndef SOVEREIGN_BROWSER_VERSION_H
 #define SOVEREIGN_BROWSER_VERSION_H
 
-#define SB_VERSION         "v0.0.38"
+#define SB_VERSION         "v0.0.39"
 #define SB_VERSION_MAJOR   0
 #define SB_VERSION_MINOR   0
-#define SB_VERSION_PATCH   38
+#define SB_VERSION_PATCH   39
 
 #endif /* SOVEREIGN_BROWSER_VERSION_H */