v0.0.41 - Fix install.sh: FIPS prebuilt binary deleted before copy (RETURN trap) — use stable mktemp file

VERSION

@@ -1 +1 @@
-0.0.40
+0.0.41

install.sh

@@ -185,11 +185,12 @@ install_deps() {
 # for the rustables/bindgen nftables bindings).
 
 # Download the prebuilt FIPS tarball from GitHub Releases and extract the
-# `fips` binary. Outputs the binary path on stdout. Returns non-zero on
-# failure so the caller can fall back to a source build.
+# `fips` binary. Outputs a stable binary path on stdout (the file is copied
+# to a caller-managed temp file so it survives after this function returns).
+# Returns non-zero on failure so the caller can fall back to a source build.
 download_fips_prebuilt() {
     print_info "Querying GitHub for latest FIPS release..."
-    local api_json tag asset_url out tarball
+    local api_json tag asset_url
     if ! api_json="$(curl -fsSL "$FIPS_GITHUB_API" 2>/dev/null)"; then
         print_warning "Could not reach FIPS GitHub releases API."
         return 1
@@ -206,25 +207,38 @@ download_fips_prebuilt() {
         return 1
     fi
 
-    out="$(mktemp -d -t fips_download.XXXXXX)"
-    trap "rm -rf '$out' 2>/dev/null || true" RETURN
+    # Use a temp dir for download + extraction. We do NOT use a RETURN trap
+    # here because the caller needs to copy the binary out after this
+    # function returns — a RETURN trap would delete the file first. Instead
+    # we copy the binary to a stable temp file and clean up the extraction
+    # dir ourselves before returning.
+    local tmp fips_bin stable
+    tmp="$(mktemp -d -t fips_dl.XXXXXX)"
     print_info "Downloading FIPS prebuilt binary: $asset_url"
-    if ! curl -fsSL -o "$out/fips.tar.gz" "$asset_url"; then
+    if ! curl -fsSL -o "$tmp/fips.tar.gz" "$asset_url"; then
+        rm -rf "$tmp"
         print_warning "FIPS tarball download failed."
         return 1
     fi
-    if ! tar -xzf "$out/fips.tar.gz" -C "$out" 2>/dev/null; then
+    if ! tar -xzf "$tmp/fips.tar.gz" -C "$tmp" 2>/dev/null; then
+        rm -rf "$tmp"
         print_warning "FIPS tarball extraction failed."
         return 1
     fi
     # The tarball extracts to fips-<ver>-linux-x86_64/fips
-    local fips_bin
-    fips_bin="$(find "$out" -type f -name fips -executable 2>/dev/null | head -1 || true)"
+    fips_bin="$(find "$tmp" -type f -name fips 2>/dev/null | head -1 || true)"
     if [[ -z "$fips_bin" ]] || ! file "$fips_bin" 2>/dev/null | grep -qi ELF; then
+        rm -rf "$tmp"
         print_warning "FIPS tarball did not contain an ELF 'fips' binary."
         return 1
     fi
-    printf '%s' "$fips_bin"
+    # Copy to a stable path so the caller can access it after we clean up
+    # the extraction dir. mktemp gives a file the caller can rm later.
+    stable="$(mktemp -t fips_binary.XXXXXX)"
+    cp -f "$fips_bin" "$stable"
+    chmod +x "$stable"
+    rm -rf "$tmp"
+    printf '%s' "$stable"
 }
 
 # --- Rust toolchain (only for --build-fips-from-source) ------------------
@@ -346,6 +360,10 @@ install_fips() {
     $SUDO cp -f "$fips_bin" "$prefix_bin/fips"
     $SUDO chmod +x "$prefix_bin/fips"
     print_success "FIPS binary installed to $prefix_bin/fips"
+    # Clean up the temp binary (download_fips_prebuilt copies to a stable
+    # mktemp file; build_fips_from_source uses a RETURN-trapped dir so its
+    # output is already gone, but rm -f is safe on either).
+    rm -f "$fips_bin" 2>/dev/null || true
 
     # setcap for CAP_NET_ADMIN (needed to create a TUN interface in managed mode).
     local setcap_cmd=""

src/version.h

@@ -11,9 +11,9 @@
 #ifndef SOVEREIGN_BROWSER_VERSION_H
 #define SOVEREIGN_BROWSER_VERSION_H
 
-#define SB_VERSION         "v0.0.40"
+#define SB_VERSION         "v0.0.41"
 #define SB_VERSION_MAJOR   0
 #define SB_VERSION_MINOR   0
-#define SB_VERSION_PATCH   40
+#define SB_VERSION_PATCH   41
 
 #endif /* SOVEREIGN_BROWSER_VERSION_H */