From 43ee97bc38ab66d28f843533103d7c6a46c9e4c8 Mon Sep 17 00:00:00 2001 From: Laan Tungir Date: Fri, 17 Jul 2026 12:33:02 -0400 Subject: [PATCH] =?UTF-8?q?v0.0.39=20-=20Fix=20install.sh:=20FIPS=20is=20a?= =?UTF-8?q?=20Rust=20project=20=E2=80=94=20use=20cargo=20build=20--release?= =?UTF-8?q?,=20install=20rustup=20if=20needed,=20add=20libclang-dev?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- VERSION | 2 +- install.sh | 98 ++++++++++++++++++++++++++++++++++++++++----------- src/version.h | 4 +-- 3 files changed, 80 insertions(+), 24 deletions(-) diff --git a/VERSION b/VERSION index e4a35e8..12a74d7 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.0.38 +0.0.39 diff --git a/install.sh b/install.sh index 991ba59..fb3842b 100755 --- a/install.sh +++ b/install.sh @@ -31,6 +31,7 @@ APT_PACKAGES=( libwebkit2gtk-4.1-0 libsoup-3.0-0 libqrencode4 libsqlite3-0 libsecp256k1-2 libssl3t64 libcurl4t64 zlib1g tor git build-essential pkg-config + libclang-dev libcap2-bin ) # --- Output helpers ------------------------------------------------------ @@ -162,10 +163,73 @@ install_deps() { print_success "Dependencies installed." } +# --- Rust toolchain (FIPS is a Rust project) ----------------------------- + +# FIPS requires Rust 1.94.1+ (edition 2024). Debian 13's apt cargo/rustc +# is 1.85, which is too old. We install rustup if no sufficiently new +# cargo is present. rustup installs to ~/.cargo/bin and is user-local +# (no sudo needed). +FIPS_MIN_RUST_MAJOR=1 +FIPS_MIN_RUST_MINOR=94 + +rust_version_ok() { + command -v cargo >/dev/null 2>&1 || return 1 + local ver + ver="$(cargo --version 2>/dev/null | grep -oE 'cargo [0-9]+\.[0-9]+\.' | head -1 | sed 's/cargo //; s/\.$//')" || return 1 + [[ -z "$ver" ]] && return 1 + local major minor + major="${ver%%.*}" + minor="${ver#*.}" + [[ "$major" -gt "$FIPS_MIN_RUST_MAJOR" ]] && return 0 + [[ "$major" -eq "$FIPS_MIN_RUST_MAJOR" && "$minor" -ge "$FIPS_MIN_RUST_MINOR" ]] && return 0 + return 1 +} + +ensure_rust() { + if rust_version_ok; then + print_info "Rust toolchain OK ($(cargo --version))." + return 0 + fi + + if command -v cargo >/dev/null 2>&1; then + print_warning "Installed cargo ($(cargo --version)) is older than FIPS requires (1.94.1+). Installing a newer toolchain via rustup." + else + print_info "No cargo found. Installing Rust toolchain via rustup." + fi + + # rustup installs to ~/.cargo/bin (user-local, no sudo). + local rustup_init + rustup_init="$(mktemp -t rustup-init.XXXXXX)" + if ! curl -fsSL --proto '=https' --tlsv1.2 -o "$rustup_init" https://sh.rustup.rs; then + rm -f "$rustup_init" + die "Failed to download rustup installer." + fi + # -y: default options, no prompts. --profile minimal: smaller install. + if ! sh "$rustup_init" -y --profile minimal >/dev/null 2>&1; then + rm -f "$rustup_init" + die "rustup installation failed." + fi + rm -f "$rustup_init" + + # Source cargo env so this shell can use it. + # shellcheck disable=SC1091 + . "$HOME/.cargo/env" 2>/dev/null || true + export PATH="$HOME/.cargo/bin:$PATH" + + if ! rust_version_ok; then + die "Rust toolchain installed but cargo still reports an insufficient version. FIPS requires 1.94.1+." + fi + print_success "Rust toolchain installed: $(cargo --version)." +} + # --- FIPS ---------------------------------------------------------------- install_fips() { print_info "Building and installing FIPS from $FIPS_REPO (required, not optional)..." + + # FIPS is a Rust project — ensure a sufficiently new toolchain is present. + ensure_rust + local tmp tmp="$(mktemp -d)" # Register cleanup for this temp dir (in addition to the global trap). @@ -176,38 +240,30 @@ install_fips() { fi local fips_dir="$tmp/fips" - local built=false - if [[ -x "$fips_dir/build.sh" ]]; then - print_info "FIPS: running ./build.sh" - if ( cd "$fips_dir" && ./build.sh ); then built=true; fi - fi - - if ! $built && [[ -f "$fips_dir/Makefile" ]]; then - print_info "FIPS: running make" - if ( cd "$fips_dir" && make ); then built=true; fi - fi - - if ! $built && [[ -f "$fips_dir/CMakeLists.txt" ]]; then - print_info "FIPS: running cmake" - if ( cd "$fips_dir" && cmake -B build && cmake --build build ); then built=true; fi - fi - - if ! $built; then - die "Could not build FIPS (no build.sh, Makefile, or CMakeLists.txt succeeded). FIPS is required." + # FIPS builds with `cargo build --release`. The binary lands at + # target/release/fips. libclang-dev (installed via apt deps) is required + # at build time for the rustables/bindgen nftables bindings. + print_info "FIPS: running cargo build --release (this can take several minutes)..." + if ! ( cd "$fips_dir" && cargo build --release ); then + die "cargo build --release failed for FIPS. FIPS is required." fi # Locate the built fips binary. local fips_bin="" - for cand in "$fips_dir/fips" "$fips_dir/build/fips" "$fips_dir/build/src/fips"; do + for cand in \ + "$fips_dir/target/release/fips" \ + "$fips_dir/target/x86_64-unknown-linux-gnu/release/fips" \ + "$fips_dir/fips" \ + "$fips_dir/build/fips"; do if [[ -x "$cand" ]] && file "$cand" 2>/dev/null | grep -qi ELF; then fips_bin="$cand" break fi done if [[ -z "$fips_bin" ]]; then - # Last resort: search for any executable named fips. - fips_bin="$(find "$fips_dir" -type f -name fips -executable 2>/dev/null | head -1 || true)" + # Last resort: search for any executable named fips under target/. + fips_bin="$(find "$fips_dir/target" -type f -name fips -executable 2>/dev/null | head -1 || true)" fi [[ -n "$fips_bin" ]] || die "FIPS build succeeded but no 'fips' binary was found." diff --git a/src/version.h b/src/version.h index 74fc6da..3abe238 100644 --- a/src/version.h +++ b/src/version.h @@ -11,9 +11,9 @@ #ifndef SOVEREIGN_BROWSER_VERSION_H #define SOVEREIGN_BROWSER_VERSION_H -#define SB_VERSION "v0.0.38" +#define SB_VERSION "v0.0.39" #define SB_VERSION_MAJOR 0 #define SB_VERSION_MINOR 0 -#define SB_VERSION_PATCH 38 +#define SB_VERSION_PATCH 39 #endif /* SOVEREIGN_BROWSER_VERSION_H */