From 5b949ec034329de2b2017779b562ab366306aabb Mon Sep 17 00:00:00 2001 From: Laan Tungir Date: Fri, 17 Jul 2026 12:39:22 -0400 Subject: [PATCH] v0.0.40 - install.sh: download FIPS prebuilt tarball from GitHub releases by default (source build via --build-fips-from-source) --- VERSION | 2 +- install.sh | 142 ++++++++++++++++++++++++++++++++++++++------------ src/version.h | 4 +- 3 files changed, 111 insertions(+), 37 deletions(-) diff --git a/VERSION b/VERSION index 12a74d7..4fe2fe8 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.0.39 +0.0.40 diff --git a/install.sh b/install.sh index fb3842b..e77033d 100755 --- a/install.sh +++ b/install.sh @@ -5,7 +5,8 @@ set -euo pipefail # # Installs: # * apt runtime deps (WebKitGTK 4.1, libsoup-3, tor, build toolchain) -# * FIPS (built from source from https://github.com/jmcorgan/fips) with CAP_NET_ADMIN +# * FIPS prebuilt binary from GitHub releases (source-build fallback via +# --build-fips-from-source) with CAP_NET_ADMIN # * sovereign_browser prebuilt binary from Gitea releases (source-build fallback) # * a `sovereign-browser` wrapper that detaches the GUI # @@ -20,8 +21,9 @@ set -euo pipefail GITEA_API="https://git.laantungir.net/api/v1/repos/laantungir/sovereign_browser" GITEA_DOWNLOAD_BASE="https://git.laantungir.net/laantungir/sovereign_browser/releases/download" -FIPS_REPO="https://github.com/jmcorgan/fips.git" SB_REPO="https://git.laantungir.net/laantungir/sovereign_browser.git" +FIPS_GITHUB_API="https://api.github.com/repos/jmcorgan/fips/releases/latest" +FIPS_REPO="https://github.com/jmcorgan/fips.git" INSTALL_PREFIX="${INSTALL_PREFIX:-/usr/local}" BIN_NAME="sovereign_browser" @@ -31,8 +33,10 @@ APT_PACKAGES=( libwebkit2gtk-4.1-0 libsoup-3.0-0 libqrencode4 libsqlite3-0 libsecp256k1-2 libssl3t64 libcurl4t64 zlib1g tor git build-essential pkg-config - libclang-dev libcap2-bin + libcap2-bin ) +# libclang-dev is only needed when building FIPS from source (bindgen). +APT_PACKAGES_FIPS_SOURCE=(libclang-dev) # --- Output helpers ------------------------------------------------------ @@ -76,21 +80,27 @@ Usage: curl -fsSL | bash or: ./install.sh [options] Options: - --build-from-source Build from source instead of downloading prebuilt binary - --prefix Install prefix (default: /usr/local) - --yes Skip confirmation prompts - -h, --help Show this help + --build-from-source Build sovereign_browser from source instead of + downloading the prebuilt binary + --build-fips-from-source Build FIPS from source (cargo) instead of + downloading the prebuilt binary. Slower; needs + libclang-dev (auto-installed). + --prefix Install prefix (default: /usr/local) + --yes Skip confirmation prompts + -h, --help Show this help EOF } # --- Args ---------------------------------------------------------------- BUILD_FROM_SOURCE=false +BUILD_FIPS_FROM_SOURCE=false ASSUME_YES=false while [[ $# -gt 0 ]]; do case "$1" in --build-from-source) BUILD_FROM_SOURCE=true; shift ;; + --build-fips-from-source) BUILD_FIPS_FROM_SOURCE=true; shift ;; --prefix) INSTALL_PREFIX="${2:-}"; shift 2 ;; --yes|-y) ASSUME_YES=true; shift ;; -h|--help) show_usage; exit 0 ;; @@ -163,12 +173,62 @@ install_deps() { print_success "Dependencies installed." } -# --- Rust toolchain (FIPS is a Rust project) ----------------------------- +# --- FIPS ---------------------------------------------------------------- +# +# FIPS is a Rust project (https://github.com/jmcorgan/fips). It publishes +# prebuilt release tarballs on GitHub Releases containing the `fips` binary +# plus tools (fipsctl, fipstop) and systemd units. We download the prebuilt +# x86_64 Linux tarball by default — much faster than a cargo build. +# +# With --build-fips-from-source, we instead clone the repo and run +# `cargo build --release` (requires Rust 1.94.1+ via rustup, and libclang-dev +# for the rustables/bindgen nftables bindings). + +# Download the prebuilt FIPS tarball from GitHub Releases and extract the +# `fips` binary. Outputs the binary path on stdout. Returns non-zero on +# failure so the caller can fall back to a source build. +download_fips_prebuilt() { + print_info "Querying GitHub for latest FIPS release..." + local api_json tag asset_url out tarball + if ! api_json="$(curl -fsSL "$FIPS_GITHUB_API" 2>/dev/null)"; then + print_warning "Could not reach FIPS GitHub releases API." + return 1 + fi + tag="$(printf '%s' "$api_json" | grep -oE '"tag_name"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]*)".*/\1/')" + if [[ -z "$tag" ]]; then + print_warning "Could not parse tag_name from FIPS GitHub release JSON." + return 1 + fi + # Find the linux-x86_64 tarball asset URL. + asset_url="$(printf '%s' "$api_json" | grep -oE '"browser_download_url"[[:space:]]*:[[:space:]]*"[^"]*linux-x86_64\.tar\.gz"' | head -1 | sed -E 's/.*"browser_download_url"[[:space:]]*:[[:space:]]*"([^"]*)".*/\1/')" + if [[ -z "$asset_url" ]]; then + print_warning "No linux-x86_64 tarball found in FIPS release $tag." + return 1 + fi + + out="$(mktemp -d -t fips_download.XXXXXX)" + trap "rm -rf '$out' 2>/dev/null || true" RETURN + print_info "Downloading FIPS prebuilt binary: $asset_url" + if ! curl -fsSL -o "$out/fips.tar.gz" "$asset_url"; then + print_warning "FIPS tarball download failed." + return 1 + fi + if ! tar -xzf "$out/fips.tar.gz" -C "$out" 2>/dev/null; then + print_warning "FIPS tarball extraction failed." + return 1 + fi + # The tarball extracts to fips--linux-x86_64/fips + local fips_bin + fips_bin="$(find "$out" -type f -name fips -executable 2>/dev/null | head -1 || true)" + if [[ -z "$fips_bin" ]] || ! file "$fips_bin" 2>/dev/null | grep -qi ELF; then + print_warning "FIPS tarball did not contain an ELF 'fips' binary." + return 1 + fi + printf '%s' "$fips_bin" +} + +# --- Rust toolchain (only for --build-fips-from-source) ------------------ -# FIPS requires Rust 1.94.1+ (edition 2024). Debian 13's apt cargo/rustc -# is 1.85, which is too old. We install rustup if no sufficiently new -# cargo is present. rustup installs to ~/.cargo/bin and is user-local -# (no sudo needed). FIPS_MIN_RUST_MAJOR=1 FIPS_MIN_RUST_MINOR=94 @@ -197,21 +257,17 @@ ensure_rust() { print_info "No cargo found. Installing Rust toolchain via rustup." fi - # rustup installs to ~/.cargo/bin (user-local, no sudo). local rustup_init rustup_init="$(mktemp -t rustup-init.XXXXXX)" if ! curl -fsSL --proto '=https' --tlsv1.2 -o "$rustup_init" https://sh.rustup.rs; then rm -f "$rustup_init" die "Failed to download rustup installer." fi - # -y: default options, no prompts. --profile minimal: smaller install. if ! sh "$rustup_init" -y --profile minimal >/dev/null 2>&1; then rm -f "$rustup_init" die "rustup installation failed." fi rm -f "$rustup_init" - - # Source cargo env so this shell can use it. # shellcheck disable=SC1091 . "$HOME/.cargo/env" 2>/dev/null || true export PATH="$HOME/.cargo/bin:$PATH" @@ -222,17 +278,13 @@ ensure_rust() { print_success "Rust toolchain installed: $(cargo --version)." } -# --- FIPS ---------------------------------------------------------------- - -install_fips() { - print_info "Building and installing FIPS from $FIPS_REPO (required, not optional)..." - - # FIPS is a Rust project — ensure a sufficiently new toolchain is present. +# Build FIPS from source via cargo. Outputs the binary path on stdout. +build_fips_from_source() { + print_info "Building FIPS from source ($FIPS_REPO)..." ensure_rust local tmp tmp="$(mktemp -d)" - # Register cleanup for this temp dir (in addition to the global trap). trap "rm -rf '$tmp' 2>/dev/null || true" RETURN if ! git clone --depth 1 "$FIPS_REPO" "$tmp/fips"; then @@ -240,32 +292,52 @@ install_fips() { fi local fips_dir="$tmp/fips" - - # FIPS builds with `cargo build --release`. The binary lands at - # target/release/fips. libclang-dev (installed via apt deps) is required - # at build time for the rustables/bindgen nftables bindings. print_info "FIPS: running cargo build --release (this can take several minutes)..." if ! ( cd "$fips_dir" && cargo build --release ); then die "cargo build --release failed for FIPS. FIPS is required." fi - # Locate the built fips binary. local fips_bin="" for cand in \ "$fips_dir/target/release/fips" \ - "$fips_dir/target/x86_64-unknown-linux-gnu/release/fips" \ - "$fips_dir/fips" \ - "$fips_dir/build/fips"; do + "$fips_dir/target/x86_64-unknown-linux-gnu/release/fips"; do if [[ -x "$cand" ]] && file "$cand" 2>/dev/null | grep -qi ELF; then fips_bin="$cand" break fi done if [[ -z "$fips_bin" ]]; then - # Last resort: search for any executable named fips under target/. fips_bin="$(find "$fips_dir/target" -type f -name fips -executable 2>/dev/null | head -1 || true)" fi [[ -n "$fips_bin" ]] || die "FIPS build succeeded but no 'fips' binary was found." + printf '%s' "$fips_bin" +} + +install_fips() { + print_info "Installing FIPS (required, not optional)..." + + # If source build was requested, install the extra build-time apt deps. + if $BUILD_FIPS_FROM_SOURCE; then + print_info "Installing FIPS source-build deps (libclang-dev for bindgen)..." + local sudo_cmd="" + if [[ $EUID -ne 0 ]]; then sudo_cmd="sudo"; fi + $sudo_cmd apt-get install -y "${APT_PACKAGES_FIPS_SOURCE[@]}" >/dev/null 2>&1 || true + fi + + local fips_bin="" + if $BUILD_FIPS_FROM_SOURCE; then + fips_bin="$(build_fips_from_source)" + else + if ! fips_bin="$(download_fips_prebuilt)"; then + print_warning "Prebuilt FIPS unavailable — falling back to source build." + # Install source-build deps on the fallback path too. + local sudo_cmd="" + if [[ $EUID -ne 0 ]]; then sudo_cmd="sudo"; fi + $sudo_cmd apt-get install -y "${APT_PACKAGES_FIPS_SOURCE[@]}" >/dev/null 2>&1 || true + fips_bin="$(build_fips_from_source)" + fi + fi + [[ -n "$fips_bin" && -x "$fips_bin" ]] || die "FIPS binary not available." local prefix_bin="$INSTALL_PREFIX/bin" local SUDO @@ -287,7 +359,6 @@ install_fips() { if $setcap_cmd cap_net_admin+ep "$prefix_bin/fips" 2>/dev/null; then print_success "FIPS granted CAP_NET_ADMIN." else - # setcap exists but failed — try with sudo explicitly. if $SUDO setcap cap_net_admin+ep "$prefix_bin/fips" 2>/dev/null; then print_success "FIPS granted CAP_NET_ADMIN." else @@ -469,12 +540,15 @@ main() { local method="prebuilt binary from Gitea" $BUILD_FROM_SOURCE && method="source build from $SB_REPO" + local fips_method="prebuilt binary from GitHub releases" + $BUILD_FIPS_FROM_SOURCE && fips_method="source build ($FIPS_REPO, cargo)" + # Use print_info so colors render via `echo -e` (a plain `cat` heredoc # would print the literal \033 escape sequences). print_info "sovereign_browser will be installed:" print_info " Install prefix : $INSTALL_PREFIX" print_info " Binary method : $method" - print_info " FIPS : built from source ($FIPS_REPO), CAP_NET_ADMIN set" + print_info " FIPS : $fips_method, CAP_NET_ADMIN set" print_info " Tor : apt package 'tor'" print_info " apt deps : ${APT_PACKAGES[*]}" diff --git a/src/version.h b/src/version.h index 3abe238..b819839 100644 --- a/src/version.h +++ b/src/version.h @@ -11,9 +11,9 @@ #ifndef SOVEREIGN_BROWSER_VERSION_H #define SOVEREIGN_BROWSER_VERSION_H -#define SB_VERSION "v0.0.39" +#define SB_VERSION "v0.0.40" #define SB_VERSION_MAJOR 0 #define SB_VERSION_MINOR 0 -#define SB_VERSION_PATCH 39 +#define SB_VERSION_PATCH 40 #endif /* SOVEREIGN_BROWSER_VERSION_H */