From b90ea0bb111d4ca9629fad8d322b4cc561e1807d Mon Sep 17 00:00:00 2001 From: Laan Tungir Date: Fri, 17 Jul 2026 12:41:59 -0400 Subject: [PATCH] =?UTF-8?q?v0.0.41=20-=20Fix=20install.sh:=20FIPS=20prebui?= =?UTF-8?q?lt=20binary=20deleted=20before=20copy=20(RETURN=20trap)=20?= =?UTF-8?q?=E2=80=94=20use=20stable=20mktemp=20file?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- VERSION | 2 +- install.sh | 38 ++++++++++++++++++++++++++++---------- src/version.h | 4 ++-- 3 files changed, 31 insertions(+), 13 deletions(-) diff --git a/VERSION b/VERSION index 4fe2fe8..89a67e8 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.0.40 +0.0.41 diff --git a/install.sh b/install.sh index e77033d..ef16e36 100755 --- a/install.sh +++ b/install.sh @@ -185,11 +185,12 @@ install_deps() { # for the rustables/bindgen nftables bindings). # Download the prebuilt FIPS tarball from GitHub Releases and extract the -# `fips` binary. Outputs the binary path on stdout. Returns non-zero on -# failure so the caller can fall back to a source build. +# `fips` binary. Outputs a stable binary path on stdout (the file is copied +# to a caller-managed temp file so it survives after this function returns). +# Returns non-zero on failure so the caller can fall back to a source build. download_fips_prebuilt() { print_info "Querying GitHub for latest FIPS release..." - local api_json tag asset_url out tarball + local api_json tag asset_url if ! api_json="$(curl -fsSL "$FIPS_GITHUB_API" 2>/dev/null)"; then print_warning "Could not reach FIPS GitHub releases API." return 1 @@ -206,25 +207,38 @@ download_fips_prebuilt() { return 1 fi - out="$(mktemp -d -t fips_download.XXXXXX)" - trap "rm -rf '$out' 2>/dev/null || true" RETURN + # Use a temp dir for download + extraction. We do NOT use a RETURN trap + # here because the caller needs to copy the binary out after this + # function returns — a RETURN trap would delete the file first. Instead + # we copy the binary to a stable temp file and clean up the extraction + # dir ourselves before returning. + local tmp fips_bin stable + tmp="$(mktemp -d -t fips_dl.XXXXXX)" print_info "Downloading FIPS prebuilt binary: $asset_url" - if ! curl -fsSL -o "$out/fips.tar.gz" "$asset_url"; then + if ! curl -fsSL -o "$tmp/fips.tar.gz" "$asset_url"; then + rm -rf "$tmp" print_warning "FIPS tarball download failed." return 1 fi - if ! tar -xzf "$out/fips.tar.gz" -C "$out" 2>/dev/null; then + if ! tar -xzf "$tmp/fips.tar.gz" -C "$tmp" 2>/dev/null; then + rm -rf "$tmp" print_warning "FIPS tarball extraction failed." return 1 fi # The tarball extracts to fips--linux-x86_64/fips - local fips_bin - fips_bin="$(find "$out" -type f -name fips -executable 2>/dev/null | head -1 || true)" + fips_bin="$(find "$tmp" -type f -name fips 2>/dev/null | head -1 || true)" if [[ -z "$fips_bin" ]] || ! file "$fips_bin" 2>/dev/null | grep -qi ELF; then + rm -rf "$tmp" print_warning "FIPS tarball did not contain an ELF 'fips' binary." return 1 fi - printf '%s' "$fips_bin" + # Copy to a stable path so the caller can access it after we clean up + # the extraction dir. mktemp gives a file the caller can rm later. + stable="$(mktemp -t fips_binary.XXXXXX)" + cp -f "$fips_bin" "$stable" + chmod +x "$stable" + rm -rf "$tmp" + printf '%s' "$stable" } # --- Rust toolchain (only for --build-fips-from-source) ------------------ @@ -346,6 +360,10 @@ install_fips() { $SUDO cp -f "$fips_bin" "$prefix_bin/fips" $SUDO chmod +x "$prefix_bin/fips" print_success "FIPS binary installed to $prefix_bin/fips" + # Clean up the temp binary (download_fips_prebuilt copies to a stable + # mktemp file; build_fips_from_source uses a RETURN-trapped dir so its + # output is already gone, but rm -f is safe on either). + rm -f "$fips_bin" 2>/dev/null || true # setcap for CAP_NET_ADMIN (needed to create a TUN interface in managed mode). local setcap_cmd="" diff --git a/src/version.h b/src/version.h index b819839..045468a 100644 --- a/src/version.h +++ b/src/version.h @@ -11,9 +11,9 @@ #ifndef SOVEREIGN_BROWSER_VERSION_H #define SOVEREIGN_BROWSER_VERSION_H -#define SB_VERSION "v0.0.40" +#define SB_VERSION "v0.0.41" #define SB_VERSION_MAJOR 0 #define SB_VERSION_MINOR 0 -#define SB_VERSION_PATCH 40 +#define SB_VERSION_PATCH 41 #endif /* SOVEREIGN_BROWSER_VERSION_H */