# Ubuntu / Debian Setup Manager A collection of hardened install and maintenance scripts for a fresh Ubuntu / Debian desktop, driven by an interactive `menu.sh`. Each installer auto-detects the distro, uses `signed-by` APT keyrings where applicable (no `apt-key`), and is idempotent (safe to re-run). ## Quick start — run the menu One-liner — fetches `menu.sh` and runs it. You'll see a numeric picker and can select one option, several, or all: ```bash bash -c "$(curl -fsSL https://tinyurl.com/bdddmxc4)" ``` How to use the picker: - Enter one or more numbers separated by spaces, e.g. `1 6 11` - `0` runs setup options 1-23 in order - `26` updates installed software from options 1-7 and 9-20; software that is not installed is skipped - `-1` exits The menu caches `sudo` credentials up-front so multi-task runs don't keep re-prompting, and falls back to per-user execution for scripts that must not run as root (JetBrains Toolbox, IBus Pinyin, Nerd Fonts, screenshots cleanup, and Thunderbird backup). ## Available scripts | # | Category | Script | Runs as | What it does | |---|---|---|---|---| | 1 | Browsers & Mail | [`install-chrome.sh`](install-chrome.sh) | sudo | Installs Google Chrome Stable from Google's official APT repo using a `signed-by` keyring. | | 2 | Browsers & Mail | [`install-firefox.sh`](install-firefox.sh) | sudo | Removes the Firefox Snap and installs Firefox from Mozilla's official APT repo, with APT pinning so it stays on the Mozilla build. Verifies the Mozilla signing-key fingerprint and best-effort pins Firefox at GNOME Dock position 2. | | 3 | Browsers & Mail | [`install-thunderbird.sh`](install-thunderbird.sh) | sudo | Ubuntu: removes the Snap, adds the Mozilla Team PPA, and pins it. Debian: installs from the standard repos. | | 4 | Communication | [`install-telegram.sh`](install-telegram.sh) | sudo | Installs the latest official Telegram Desktop Linux build from Telegram's latest download endpoint. Adds launcher and `tg:` URL handler. | | 5 | Communication | [`install-discord.sh`](install-discord.sh) | sudo | Installs the latest official Discord Linux `.deb` from Discord's latest download endpoint. | | 6 | Files, Downloads & Storage | [`install-localsend.sh`](install-localsend.sh) | sudo | Installs the latest official LocalSend `.deb` from `localsend/localsend`. SHA-256 verified against the GitHub release asset digest when available. | | 7 | Files, Downloads & Storage | [`install-qbittorrent.sh`](install-qbittorrent.sh) | sudo | Installs the latest official qBittorrent x86_64 AppImage from `qbittorrent/qBittorrent`. SHA-256 verified against the GitHub release asset digest when available. Installs launcher, icons, and torrent/magnet handlers. | | 8 | Files, Downloads & Storage | [`install-network_drive.sh`](install-network_drive.sh) | sudo | Discovers SMB shares on a Synology NAS and adds them to `/etc/fstab` under `/mnt/Synology` with `x-systemd.automount`. fstab block is managed via begin/end markers so re-runs replace rather than duplicate. Credentials file is `0600`. Best-effort GNOME Dock pin. | | 9 | Productivity & Security | [`install-libreoffice.sh`](install-libreoffice.sh) | sudo | Detects the latest stable release on documentfoundation.org, downloads the matching `.deb` tarball, verifies the published MD5, and installs. Purges the distro's `libreoffice*` first to avoid library conflicts (opt-out with `--keep-distro-libreoffice`). | | 10 | Productivity & Security | [`install-obsidian.sh`](install-obsidian.sh) | sudo | Installs the latest official Obsidian amd64 `.deb` from `obsidianmd/obsidian-releases`. SHA-256 verified against the GitHub release asset digest when available. Honors `$GITHUB_TOKEN` to avoid API rate limits. | | 11 | Productivity & Security | [`install-marktext.sh`](install-marktext.sh) | sudo | Installs the latest official MarkText amd64 `.deb` from `marktext/marktext`. SHA-256 verified against the GitHub release asset digest when available. Honors `$GITHUB_TOKEN` to avoid API rate limits. | | 12 | Productivity & Security | [`install-drawio.sh`](install-drawio.sh) | sudo | Installs the latest official draw.io Desktop `.deb` from `jgraph/drawio-desktop`. SHA-256 verified against the GitHub release asset digest when available. Honors `$GITHUB_TOKEN` to avoid API rate limits. | | 13 | Productivity & Security | [`install-espanso.sh`](install-espanso.sh) | sudo | Installs Espanso. Auto-detects Wayland vs X11 from `$XDG_SESSION_TYPE` and registers the systemd-user service as the invoking desktop user (not root). | | 14 | Productivity & Security | [`install-1password.sh`](install-1password.sh) | sudo | Configures the 1Password APT repo with `debsig` signature policy. Arch-aware (amd64 / arm64). | | 15 | Development Tools | [`install-vscode.sh`](install-vscode.sh) | sudo | Microsoft's official `code` APT repo, signed-by keyring. `--insiders` flag installs `code-insiders` instead. | | 16 | Development Tools | [`install-jetbrains-toolbox.sh`](install-jetbrains-toolbox.sh) | **user** | Per-user install into `~/.local/share/JetBrains/Toolbox`. SHA-256 verified against JetBrains' release feed. x86_64 + aarch64. Drops a `.desktop` launcher. | | 17 | Development Tools | [`install-bruno.sh`](install-bruno.sh) | sudo | Bruno API client from the official APT repo. Keyserver fetch is wrapped in a 5-attempt retry/backoff because `keyserver.ubuntu.com` is occasionally flaky. | | 18 | Development Tools | [`install-ipatool.sh`](install-ipatool.sh) | sudo | Installs the latest release of `majd/ipatool` from GitHub. SHA-256 verified against the release `checksums.txt`. Honors `$GITHUB_TOKEN` to avoid API rate limits. | | 19 | Desktop & Localization | [`install-ibus-pinyin.sh`](install-ibus-pinyin.sh) | **user** | Installs `ibus-libpinyin` and Simplified Chinese language packs, restarts the IBus daemon, and idempotently adds `('ibus', 'libpinyin')` to GNOME's input sources via `gsettings`. | | 20 | Desktop & Localization | [`install-font.sh`](install-font.sh) | **user** | Installs the latest Ubuntu Sans Nerd Font and JetBrains Mono Nerd Font to `~/.local/share/fonts`, then refreshes the font cache. No sudo needed. | | 21 | System & Maintenance | [`install-screenshot-cleanup-cron.sh`](install-screenshot-cleanup-cron.sh) | **user** | Installs an idempotent per-user cron job that clears `$HOME/Pictures/Screenshots` every 5 minutes while preserving the directory itself. | | 22 | System & Maintenance | [`timedatectl-fix.sh`](timedatectl-fix.sh) | sudo | Sets the hardware clock to UTC to avoid time drift when dual-booting Linux and Windows. | | 23 | System & Maintenance | [`disable-grub-countdown.sh`](disable-grub-countdown.sh) | sudo | Configures GRUB to show the dual-boot menu with no countdown by setting `GRUB_TIMEOUT_STYLE=menu` and `GRUB_TIMEOUT=-1`, then regenerates the GRUB config. | | 24 | Backup | [`install-thunderbird-backup-cron.sh`](install-thunderbird-backup-cron.sh) | **user** | Installs an hourly cron job that fetches and runs the hosted Thunderbird-to-Synology backup script without storing it locally. Not included in menu option `0`; select it explicitly. | | 26 | System & Maintenance | Built into [`menu.sh`](menu.sh) | mixed | Detects and updates installed software from options 1-7 and 9-20. Software that is not installed is logged and skipped. Excludes network-drive, cron, system configuration, backup, and sync tasks. | "Runs as **user**" entries must be invoked as your normal desktop user, not via `sudo`. The other entries elevate via `sudo` internally and the menu primes `sudo -v` up-front, so you'll only be prompted once. ## Running a single script directly If you'd rather skip the menu, each script can be run on its own. Use the right invocation pattern for that script's privilege mode: ```bash # sudo scripts (1-15, 17-18, 22-23) — pipe through sudo bash curl -fsSL https://opengist.resetrix.work/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install-firefox.sh | sudo bash # user scripts (16, 19-21, 24) — DO NOT use sudo; they install or run per-user bash -c "$(curl -fsSL https://opengist.resetrix.work/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install-font.sh)" ``` Most installers and utilities accept `--help` and `--dry-run` (the latter prints what would happen without executing). For example: ```bash curl -fsSL https://opengist.resetrix.work/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install-libreoffice.sh \ | bash -s -- --help ``` ## Thunderbird to Synology Backup The Thunderbird backup utility reads its default config from this gist: ```bash https://opengist.resetrix.work/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/thunderbird-backup.conf ``` Run a backup manually: ```bash bash -c "$(curl -fsSL https://opengist.resetrix.work/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/backup-thunderbird-to-synology.sh)" ``` Preview changes without writing files: ```bash curl -fsSL https://opengist.resetrix.work/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/backup-thunderbird-to-synology.sh \ | bash -s -- --dry-run ``` To change the backup location for every machine using the hosted config, edit `thunderbird-backup.conf` in this gist and update `DESTINATION`; if the backup location is on a different mounted drive or NAS share, update `MOUNTPOINT` too. The script parses only `SOURCE`, `DESTINATION`, `MOUNTPOINT`, `LOG_FILE`, and `LOCK_FILE`; unsupported keys or invalid lines stop the run. Menu option `24` installs this hourly user cron job idempotently and removes legacy entries that invoke a locally stored backup script: ```cron 0 * * * * /usr/bin/bash -o pipefail -c '/usr/bin/curl --proto "=https" --tlsv1.2 -fsSL --max-time 60 "https://opengist.resetrix.work/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/backup-thunderbird-to-synology.sh" | /usr/bin/bash' >> "$HOME/.local/state/thunderbird-cron.log" 2>&1 # thunderbird-synology-backup ``` The current hosted script is downloaded on every run and executes locally because the Thunderbird profile and Synology mount are local. Changes pushed to the hosted script therefore take effect on the next hourly run. ## What "hardened" means here The hardened installers generally share this robustness baseline: - `set -euo pipefail` + IFS hygiene + `ERR` trap reporting the failing line number - `/etc/os-release` distro auto-detection (no hardcoded codenames) - `dpkg --print-architecture` / `uname -m` for architecture (amd64 / arm64 / armhf / x86_64 / aarch64 as applicable to each upstream) - Idempotent — re-running a script does not duplicate APT sources, fstab entries, gsettings entries, or `.desktop` files - `signed-by` keyrings in `/etc/apt/keyrings` (no deprecated `apt-key add`) - Checksum verification where the upstream publishes one (JetBrains SHA-256, LibreOffice MD5, Obsidian SHA-256, MarkText SHA-256, ipatool SHA-256, draw.io SHA-256, qBittorrent SHA-256, LocalSend SHA-256) - Per-user installers refuse to run as root; system installers refuse to run as non-root ## Hide Drive from the Dock ```bash gsettings set org.gnome.shell.extensions.dash-to-dock show-mounts false ``` ## Supported distros - Ubuntu (any modern release; some scripts target Ubuntu 25.10 specifically but work elsewhere) - Debian (most scripts; `install-thunderbird.sh` takes a different code path since Debian has no PPAs) Other distros are rejected up-front rather than failing later in unpredictable ways.

#!/usr/bin/env bash set -euo pipefail CONFIG_URL_DEFAULT="https://opengist.resetrix.work/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/thunderbird-backup.conf" CONFIG_FILE="${THUNDERBIRD_BACKUP_CONFIG:-}" CONFIG_URL="${THUNDERBIRD_BACKUP_CONFIG_URL:-$CONFIG_URL_DEFAULT}" SHOW_HELP=false args=("$@") for ((i = 0; i < ${#args[@]}; i++)); do case "${args[$i]}" in --config) CONFIG_FILE="${args[$((i + 1))]:?Missing value for --config}" CONFIG_URL="" ;; --config-url) CONFIG_URL="${args[$((i + 1))]:?Missing value for --config-url}" CONFIG_FILE="" ;; -h|--help) SHOW_HELP=true ;; esac done SOURCE_DEFAULT="/home/vernon/.thunderbird/" DESTINATION_DEFAULT="/mnt/Synology/Backup/Applications/Thunderbird/" MOUNTPOINT_DEFAULT="/mnt/Synology/Backup" LOG_FILE_DEFAULT="/home/vernon/.local/state/thunderbird-backup.log" LOCK_FILE_DEFAULT="/home/vernon/.cache/thunderbird-backup.lock" DRY_RUN=false SOURCE="$SOURCE_DEFAULT" DESTINATION="$DESTINATION_DEFAULT" MOUNTPOINT="$MOUNTPOINT_DEFAULT" LOG_FILE="$LOG_FILE_DEFAULT" LOCK_FILE="$LOCK_FILE_DEFAULT" trim() { local value="$1" value="${value#"${value%%[![:space:]]*}"}" value="${value%"${value##*[![:space:]]}"}" printf '%s' "$value" } parse_config_content() { local line key raw value while IFS= read -r line || [[ -n "$line" ]]; do line="$(trim "$line")" [[ -z "$line" || "$line" == \#* ]] && continue if [[ ! "$line" =~ ^([A-Z_]+)[[:space:]]*=(.*)$ ]]; then echo "ERROR: Invalid config line: $line" >&2 exit 2 fi key="${BASH_REMATCH[1]}" raw="$(trim "${BASH_REMATCH[2]}")" if [[ "$raw" == \"*\" && "$raw" == *\" ]]; then value="${raw:1:${#raw}-2}" elif [[ "$raw" == \'*\' && "$raw" == *\' ]]; then value="${raw:1:${#raw}-2}" else value="$raw" fi case "$key" in SOURCE) SOURCE="$value" ;; DESTINATION) DESTINATION="$value" ;; MOUNTPOINT) MOUNTPOINT="$value" ;; LOG_FILE) LOG_FILE="$value" ;; LOCK_FILE) LOCK_FILE="$value" ;; *) echo "ERROR: Unsupported config key: $key" >&2 exit 2 ;; esac done } usage() { cat <<'USAGE' Usage: backup-thunderbird-to-synology.sh [options] Options: --source PATH Thunderbird profile directory to back up --destination PATH Backup destination directory --mountpoint PATH Required mounted path to check before backup --no-mount-check Disable the mountpoint safety check --log-file PATH Log file path --config PATH Local config file path; disables remote config --config-url URL Remote config URL --dry-run Show what would change without writing files -h, --help Show this help Config defaults to: https://opengist.resetrix.work/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/thunderbird-backup.conf Supported config variables: SOURCE, DESTINATION, MOUNTPOINT, LOG_FILE, LOCK_FILE. Environment overrides: THUNDERBIRD_BACKUP_SOURCE, THUNDERBIRD_BACKUP_DESTINATION, THUNDERBIRD_BACKUP_MOUNTPOINT, THUNDERBIRD_BACKUP_LOG_FILE, THUNDERBIRD_BACKUP_LOCK_FILE, THUNDERBIRD_BACKUP_CONFIG, THUNDERBIRD_BACKUP_CONFIG_URL. USAGE } if [[ "$SHOW_HELP" == true ]]; then usage exit 0 fi if [[ -n "$CONFIG_FILE" ]]; then if [[ ! -f "$CONFIG_FILE" ]]; then mkdir -p "$(dirname "$LOG_FILE")" echo "$(date -Is) ERROR: Config file not found: $CONFIG_FILE" >> "$LOG_FILE" exit 1 fi parse_config_content < "$CONFIG_FILE" elif [[ -n "$CONFIG_URL" ]]; then config_content="$(curl -fsSL --max-time 20 "$CONFIG_URL")" || { mkdir -p "$(dirname "$LOG_FILE")" echo "$(date -Is) ERROR: Unable to fetch config from $CONFIG_URL" >> "$LOG_FILE" exit 1 } parse_config_content <<< "$config_content" fi SOURCE="${THUNDERBIRD_BACKUP_SOURCE:-$SOURCE}" DESTINATION="${THUNDERBIRD_BACKUP_DESTINATION:-$DESTINATION}" MOUNTPOINT="${THUNDERBIRD_BACKUP_MOUNTPOINT:-$MOUNTPOINT}" LOG_FILE="${THUNDERBIRD_BACKUP_LOG_FILE:-$LOG_FILE}" LOCK_FILE="${THUNDERBIRD_BACKUP_LOCK_FILE:-$LOCK_FILE}" while [[ $# -gt 0 ]]; do case "$1" in --source) SOURCE="${2:?Missing value for --source}" shift 2 ;; --destination) DESTINATION="${2:?Missing value for --destination}" shift 2 ;; --mountpoint) MOUNTPOINT="${2:?Missing value for --mountpoint}" shift 2 ;; --no-mount-check) MOUNTPOINT="" shift ;; --log-file) LOG_FILE="${2:?Missing value for --log-file}" shift 2 ;; --dry-run) DRY_RUN=true shift ;; --config) shift 2 ;; --config-url) shift 2 ;; -h|--help) usage exit 0 ;; *) echo "ERROR: Unknown option: $1" >&2 usage >&2 exit 2 ;; esac done mkdir -p "$(dirname "$LOG_FILE")" "$(dirname "$LOCK_FILE")" timestamp() { date -Is } normalize_path() { realpath -m "$1" } SOURCE_REAL="$(normalize_path "$SOURCE")" DESTINATION_REAL="$(normalize_path "$DESTINATION")" if [[ "$SOURCE" != /* || "$DESTINATION" != /* || "$LOG_FILE" != /* || "$LOCK_FILE" != /* ]]; then echo "$(timestamp) ERROR: SOURCE, DESTINATION, LOG_FILE, and LOCK_FILE must be absolute paths." >> "$LOG_FILE" exit 1 fi if [[ -n "$MOUNTPOINT" && "$MOUNTPOINT" != /* ]]; then echo "$(timestamp) ERROR: MOUNTPOINT must be an absolute path." >> "$LOG_FILE" exit 1 fi if [[ "$SOURCE_REAL" == "$DESTINATION_REAL" ]]; then echo "$(timestamp) ERROR: SOURCE and DESTINATION cannot be the same path: $SOURCE_REAL" >> "$LOG_FILE" exit 1 fi if [[ "$DESTINATION_REAL" == "$SOURCE_REAL"/* ]]; then echo "$(timestamp) ERROR: DESTINATION cannot be inside SOURCE: $DESTINATION_REAL" >> "$LOG_FILE" exit 1 fi case "$DESTINATION_REAL" in /|/home|/home/vernon|/mnt|/mnt/Synology|/mnt/Synology/Backup) echo "$(timestamp) ERROR: Refusing unsafe backup destination: $DESTINATION_REAL" >> "$LOG_FILE" exit 1 ;; esac if [[ -n "$MOUNTPOINT" ]] && ! mountpoint -q "$MOUNTPOINT"; then echo "$(timestamp) ERROR: $MOUNTPOINT is not mounted; backup skipped." >> "$LOG_FILE" exit 1 fi if [[ ! -d "$SOURCE" ]]; then echo "$(timestamp) ERROR: Thunderbird profile directory not found: $SOURCE" >> "$LOG_FILE" exit 1 fi mkdir -p "$DESTINATION" exec 9>"$LOCK_FILE" if ! flock -n 9; then echo "$(timestamp) INFO: Previous Thunderbird backup still running; backup skipped." >> "$LOG_FILE" exit 0 fi { if [[ "$DRY_RUN" == true ]]; then echo "$(timestamp) INFO: Starting Thunderbird backup dry run: $SOURCE_REAL -> $DESTINATION_REAL" else echo "$(timestamp) INFO: Starting Thunderbird backup: $SOURCE_REAL -> $DESTINATION_REAL" fi rsync_args=(-a --delete) if [[ "$DRY_RUN" == true ]]; then rsync_args+=(-n --itemize-changes) fi rsync "${rsync_args[@]}" \ --exclude='*.parentlock' \ --exclude='lock' \ "$SOURCE" "$DESTINATION" if [[ "$DRY_RUN" == true ]]; then echo "$(timestamp) INFO: Thunderbird backup dry run completed." else echo "$(timestamp) INFO: Thunderbird backup completed." fi } >> "$LOG_FILE" 2>&1

#!/usr/bin/env bash # disable-grub-countdown.sh — Show the GRUB dual-boot menu without a countdown. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" readonly GRUB_DEFAULTS="/etc/default/grub" DRY_RUN=0 usage() { cat <<EOF Usage: $SCRIPT_NAME [--dry-run] [--help] Configures GRUB to show the boot menu and wait indefinitely: GRUB_TIMEOUT_STYLE=menu GRUB_TIMEOUT=-1 Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Please run as root: sudo bash $SCRIPT_NAME" [[ -f "$GRUB_DEFAULTS" ]] || die "Missing $GRUB_DEFAULTS. This system does not look like a GRUB-based Ubuntu/Debian install." for tool in cp date grep mktemp sed; do command -v "$tool" >/dev/null 2>&1 || die "Missing required tool: $tool" done if command -v update-grub >/dev/null 2>&1; then GRUB_UPDATE_CMD=(update-grub) elif command -v grub-mkconfig >/dev/null 2>&1; then GRUB_UPDATE_CMD=(grub-mkconfig -o /boot/grub/grub.cfg) elif command -v grub2-mkconfig >/dev/null 2>&1; then if [[ -d /boot/grub2 ]]; then GRUB_UPDATE_CMD=(grub2-mkconfig -o /boot/grub2/grub.cfg) else GRUB_UPDATE_CMD=(grub2-mkconfig -o /boot/grub/grub.cfg) fi else die "Could not find update-grub, grub-mkconfig, or grub2-mkconfig." fi BACKUP="${GRUB_DEFAULTS}.backup.$(date +%Y%m%d-%H%M%S)" STAGE="$(mktemp -t grub-defaults.XXXXXX)" trap 'rm -f "$STAGE"' EXIT cp "$GRUB_DEFAULTS" "$STAGE" if grep -q '^GRUB_TIMEOUT_STYLE=' "$STAGE"; then sed -i 's/^GRUB_TIMEOUT_STYLE=.*/GRUB_TIMEOUT_STYLE=menu/' "$STAGE" else printf '\nGRUB_TIMEOUT_STYLE=menu\n' >>"$STAGE" fi if grep -q '^GRUB_TIMEOUT=' "$STAGE"; then sed -i 's/^GRUB_TIMEOUT=.*/GRUB_TIMEOUT=-1/' "$STAGE" else printf 'GRUB_TIMEOUT=-1\n' >>"$STAGE" fi if (( DRY_RUN )); then log "Would back up $GRUB_DEFAULTS to $BACKUP" log "Would write these GRUB timeout settings:" grep -E '^GRUB_TIMEOUT_STYLE=|^GRUB_TIMEOUT=' "$STAGE" | sed 's/^/ /' log "Would run: ${GRUB_UPDATE_CMD[*]}" exit 0 fi cp "$GRUB_DEFAULTS" "$BACKUP" cp "$STAGE" "$GRUB_DEFAULTS" log "Updated $GRUB_DEFAULTS" log "Backup saved to $BACKUP" log "Regenerating GRUB configuration..." "${GRUB_UPDATE_CMD[@]}" log "Done. On next boot, the GRUB menu will wait until you choose an entry."

#!/usr/bin/env bash # install-1password.sh — Install 1Password desktop from the official 1Password APT repo. # Hardened: arch-aware, signed-by keyring, debsig verification dir, idempotent, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Configures the official 1Password APT repository (with debsig policy and keyring) and installs the 1Password desktop application. Idempotent: safe to re-run. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac # 1Password publishes builds for amd64 and arm64. ARCH="$(dpkg --print-architecture)" case "$ARCH" in amd64|arm64) : ;; *) die "1Password is only available for amd64/arm64 (detected: $ARCH)." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/1password-archive-keyring.gpg SOURCES=/etc/apt/sources.list.d/1password.list DEBSIG_POLICY_DIR=/etc/debsig/policies/AC2D62742012EA22 DEBSIG_KEYRING_DIR=/usr/share/debsig/keyrings/AC2D62742012EA22 log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl gpg ca-certificates" log "Configuring 1Password APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then run "curl -fsSL https://downloads.1password.com/linux/keys/1password.asc | gpg --dearmor -o '$KEYRING'" run "chmod 0644 '$KEYRING'" fi DESIRED_SRC="deb [arch=${ARCH} signed-by=${KEYRING}] https://downloads.1password.com/linux/debian/${ARCH} stable main" if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Installing debsig policy (verifies package signatures on install)..." run "install -d -m 0755 '$DEBSIG_POLICY_DIR' '$DEBSIG_KEYRING_DIR'" if [[ ! -s "${DEBSIG_POLICY_DIR}/1password.pol" ]]; then run "curl -fsSL https://downloads.1password.com/linux/debian/debsig/1password.pol -o '${DEBSIG_POLICY_DIR}/1password.pol'" fi if [[ ! -s "${DEBSIG_KEYRING_DIR}/debsig.gpg" ]]; then run "curl -fsSL https://downloads.1password.com/linux/keys/1password.asc | gpg --dearmor -o '${DEBSIG_KEYRING_DIR}/debsig.gpg'" fi log "Installing 1Password..." run "apt-get update -qq" run "apt-get install -y 1password" if (( ! DRY_RUN )) && command -v 1password >/dev/null 2>&1; then log "1Password binary available at: $(command -v 1password)" fi log "Done."

#!/usr/bin/env bash # install-bruno.sh — Install Bruno API client from the official APT repository. # Hardened: arch-aware, signed-by keyring with retries (keyserver flake), idempotent, # clean desktop entry, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Configures the official Bruno APT repository (signed-by keyring fetched from keyserver.ubuntu.com with retries) and installs Bruno. Idempotent: safe to re-run. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Bruno APT repo only ships amd64 (detected: $ARCH)." log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/bruno.gpg SOURCES=/etc/apt/sources.list.d/bruno.list KEY_ID="9FA6017ECABE0266" DESKTOP=/usr/share/applications/bruno.desktop log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl gpg ca-certificates" log "Configuring Bruno APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then # keyserver.ubuntu.com is occasionally flaky — retry a few times. ok=0 for attempt in 1 2 3 4 5; do if (( DRY_RUN )); then printf ' DRY-RUN: fetch key 0x%s (attempt %d)\n' "$KEY_ID" "$attempt" ok=1 break fi if curl -fsSL --max-time 30 "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${KEY_ID}" \ | gpg --dearmor -o "$KEYRING" 2>/dev/null && [[ -s "$KEYRING" ]]; then ok=1 break fi warn "Key fetch failed (attempt $attempt/5); retrying in $((attempt*2))s..." sleep "$((attempt*2))" done (( ok )) || die "Could not retrieve Bruno signing key after 5 attempts." run "chmod 0644 '$KEYRING'" fi DESIRED_SRC="deb [arch=${ARCH} signed-by=${KEYRING}] http://debian.usebruno.com/ bruno stable" if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Installing Bruno..." run "apt-get update -qq" run "apt-get install -y bruno" log "Writing desktop entry..." if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$DESKTOP" else cat >"$DESKTOP" <<'EOF' [Desktop Entry] Name=Bruno Comment=Open-source API Client Exec=bruno %U Terminal=false Type=Application Icon=bruno Categories=Development;Utility; StartupNotify=true EOF chmod 0644 "$DESKTOP" fi log "Done. Bruno installed."

#!/usr/bin/env bash # # install-chrome.sh — Native Google Chrome Installer for Ubuntu/Debian # Downloads and installs the latest official stable release without Snap. # # Usage: # sudo ./install-chrome.sh set -euo pipefail IFS=$'\n\t' # Ensure the script is run as root if (( EUID != 0 )); then echo "[ERROR] This script must be run as root (via sudo)." >&2 exit 1 fi echo "[1/4] Installing necessary prerequisites..." apt-get update -y apt-get install -y curl gnupg2 ca-certificates echo "[2/4] Setting up Google's official repository keys..." # Create directory for Third-Party APT keys if it doesn't exist install -d -m 0755 /etc/apt/keyrings # Fetch the official signing key and save it securely curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | \ gpg --dearmor --yes -o /etc/apt/keyrings/google-chrome.gpg # Configure the APT repository to strictly use that signing key echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \ > /etc/apt/sources.list.d/google-chrome.list echo "[3/4] Fetching package lists and installing Google Chrome..." apt-get update -y apt-get install -y google-chrome-stable echo "[4/4] Verifying installation..." if command -v google-chrome &>/dev/null; then echo "------------------------------------------------------" echo "SUCCESS: Google Chrome has been installed successfully!" echo "Version: $(google-chrome --version)" echo "------------------------------------------------------" else echo "[ERROR] Google Chrome installation could not be verified." >&2 exit 1 fi

#!/usr/bin/env bash # install-discord.sh — Install Discord from the latest official Linux .deb. # Hardened: official latest endpoint, idempotent, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 DOWNLOAD_URL="https://discord.com/api/download?platform=linux&format=deb" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Downloads Discord from Discord's official latest Linux .deb endpoint and installs it with apt-get. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Discord's official Linux .deb targets amd64 only (detected: $ARCH)." log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl ca-certificates" STAGE="$(mktemp -d -t discord.XXXXXX)" trap 'rm -rf "$STAGE"' EXIT DEB="$STAGE/discord.deb" log "Downloading latest Discord .deb..." run "curl -fL -o '$DEB' '$DOWNLOAD_URL'" if (( DRY_RUN )); then printf ' DRY-RUN: apt-get install -y %s\n' "$DEB" log "Done." exit 0 fi log "Installing Discord..." run "apt-get install -y '$DEB'" if command -v discord >/dev/null 2>&1; then log "Installed: $(discord --version 2>/dev/null || dpkg-query -W -f='${Version}' discord 2>/dev/null || echo Discord)" else log "Installed: $(dpkg-query -W -f='${Version}' discord 2>/dev/null || echo Discord)" fi log "Done."

#!/usr/bin/env bash # install-drawio.sh — Install draw.io Desktop from the latest official GitHub release. # Hardened: arch-aware, GitHub API token support, SHA-256 verification from the # release asset digest, idempotent, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 REPO="jgraph/drawio-desktop" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Resolves the latest release of jgraph/drawio-desktop, downloads the official Linux .deb package for your architecture, verifies its SHA-256 against the GitHub release asset digest when available, and installs it with apt-get. If \$GITHUB_TOKEN is set in the environment, it is used to authenticate the GitHub API request (avoids rate limits). Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" case "$ARCH" in amd64|arm64) : ;; *) die "draw.io Desktop publishes Linux .deb assets for amd64 and arm64 only (detected: $ARCH)." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl jq ca-certificates" GH_HDRS=(-H "Accept: application/vnd.github+json") [[ -n "${GITHUB_TOKEN:-}" ]] && GH_HDRS+=(-H "Authorization: Bearer ${GITHUB_TOKEN}") log "Querying GitHub API for latest release of $REPO..." RELEASE_JSON="$(curl -fsSL "${GH_HDRS[@]}" "https://api.github.com/repos/${REPO}/releases/latest")" TAG="$(jq -r '.tag_name // empty' <<<"$RELEASE_JSON")" [[ -n "$TAG" ]] || die "Could not parse latest release tag (rate limited? set GITHUB_TOKEN)." log "Latest release: $TAG" ASSET_REGEX="^drawio-${ARCH}-[^/]+\\.deb$" DOWNLOAD_URL="$(jq -r --arg re "$ASSET_REGEX" '.assets[] | select(.name | test($re)) | .browser_download_url' <<<"$RELEASE_JSON" | head -n1)" ASSET_NAME="$(jq -r --arg re "$ASSET_REGEX" '.assets[] | select(.name | test($re)) | .name' <<<"$RELEASE_JSON" | head -n1)" EXPECTED_SHA="$(jq -r --arg re "$ASSET_REGEX" '.assets[] | select(.name | test($re)) | (.digest // "") | sub("^sha256:"; "")' <<<"$RELEASE_JSON" | head -n1)" [[ "$DOWNLOAD_URL" =~ ^https:// ]] || die "No $ARCH .deb asset found in latest draw.io Desktop release." STAGE="$(mktemp -d -t drawio.XXXXXX)" trap 'rm -rf "$STAGE"' EXIT DEB="$STAGE/$ASSET_NAME" log "Downloading $ASSET_NAME..." run "curl -fsSL -o '$DEB' '$DOWNLOAD_URL'" if (( DRY_RUN )); then [[ -n "$EXPECTED_SHA" && "$EXPECTED_SHA" != "null" ]] \ && printf ' DRY-RUN: verify SHA-256 %s\n' "$EXPECTED_SHA" \ || printf ' DRY-RUN: skip SHA-256 verification; no GitHub asset digest found\n' printf ' DRY-RUN: apt-get install -y %s\n' "$DEB" log "Done." exit 0 fi if [[ -n "$EXPECTED_SHA" && "$EXPECTED_SHA" != "null" ]]; then log "Verifying SHA-256..." ACTUAL_SHA="$(sha256sum "$DEB" | awk '{print $1}')" [[ "$EXPECTED_SHA" == "$ACTUAL_SHA" ]] || die "SHA-256 mismatch: expected=$EXPECTED_SHA actual=$ACTUAL_SHA" log "SHA-256 ok." else warn "No SHA-256 asset digest in GitHub release metadata; skipping verification." fi log "Installing draw.io Desktop..." run "apt-get install -y '$DEB'" if (( ! DRY_RUN )) && command -v drawio >/dev/null 2>&1; then log "Installed: $(drawio --version 2>/dev/null || echo "$TAG")" fi log "Done."

#!/usr/bin/env bash # install-espanso.sh — Install Espanso (text expander) with Wayland or X11 build. # Auto-detects session type; falls back to Wayland if unknown. # Hardened: handles apt temp file permissions, package collisions, and ghost processes. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 FORCE_VARIANT="" # "wayland" | "x11" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--wayland|--x11] [--help] Installs Espanso from the latest GitHub release. Auto-detects whether to use the Wayland or X11 build based on the invoking user (SUDO_USER). The systemd-user service is registered for that user, not root. Options: --wayland Force the Wayland build. --x11 Force the X11 build. --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; --wayland) FORCE_VARIANT=wayland ;; --x11) FORCE_VARIANT=x11 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Espanso .deb is published for amd64 only (detected: $ARCH)." ACTUAL_USER="${SUDO_USER:-${USER:-}}" [[ -n "$ACTUAL_USER" && "$ACTUAL_USER" != "root" ]] || die "Run via sudo as a regular user; cannot register the service as root." USER_ID="$(id -u "$ACTUAL_USER")" # --- FIXED: Better session detection logic using loginctl --- if [[ -n "$FORCE_VARIANT" ]]; then VARIANT="$FORCE_VARIANT" else # 1. Try systemd loginctl (most reliable) SESSION_ID=$(loginctl list-sessions 2>/dev/null | grep " $ACTUAL_USER " | awk '{print $1}' | head -n 1 || true) if [[ -n "$SESSION_ID" ]]; then SESSION_TYPE=$(loginctl show-session "$SESSION_ID" -p Type --value 2>/dev/null || true) else SESSION_TYPE="" fi # 2. If loginctl fails, check for active Wayland/X11 socket files if [[ -z "$SESSION_TYPE" || "$SESSION_TYPE" == "tty" ]]; then if sudo -u "$ACTUAL_USER" test -S "/run/user/$USER_ID/wayland-0"; then SESSION_TYPE="wayland" elif sudo -u "$ACTUAL_USER" test -S "/tmp/.X11-unix/X0"; then SESSION_TYPE="x11" else SESSION_TYPE="wayland" # Default fallback for modern Ubuntu fi fi case "$SESSION_TYPE" in wayland) VARIANT=wayland ;; x11) VARIANT=x11 ;; *) warn "Unknown session type='$SESSION_TYPE'; defaulting to wayland."; VARIANT=wayland ;; esac fi log "Detected: ${PRETTY_NAME:-unknown}, user: $ACTUAL_USER, session: $VARIANT" export DEBIAN_FRONTEND=noninteractive # --- FIXED: Use a subdirectory to avoid apt "unsandboxed" permission warnings --- WORK_DIR="$(mktemp -d /tmp/espanso-install.XXXXXX)" chmod 755 "$WORK_DIR" TEMP_DEB="$WORK_DIR/espanso.deb" trap 'rm -rf "$WORK_DIR"' EXIT DEB_NAME="espanso-debian-${VARIANT}-amd64.deb" URL="https://github.com/espanso/espanso/releases/latest/download/${DEB_NAME}" log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y wget libcap2-bin psmisc" # --- FIXED: Use wget with progress bar instead of silent mode --- log "Downloading ${DEB_NAME}..." run "wget -q --show-progress -O '$TEMP_DEB' '$URL'" log "Removing conflicting Espanso packages (if any)..." run "apt-get remove -y espanso espanso-wayland >/dev/null 2>&1 || true" log "Installing package..." run "apt-get install -y '$TEMP_DEB'" ESPANSO_BIN="$(command -v espanso || true)" [[ -x "$ESPANSO_BIN" ]] || die "espanso binary not found after install." if [[ "$VARIANT" == "wayland" ]]; then log "Setting CAP_DAC_OVERRIDE on $ESPANSO_BIN..." run "setcap 'cap_dac_override+p' '$ESPANSO_BIN'" fi log "Clearing ghost processes to prevent start timeouts..." run "sudo -u '$ACTUAL_USER' killall espanso 2>/dev/null || true" log "Registering & starting espanso service for $ACTUAL_USER..." if (( DRY_RUN )); then printf ' DRY-RUN: sudo -u %s XDG_RUNTIME_DIR=/run/user/%s espanso service register || true\n' "$ACTUAL_USER" "$USER_ID" printf ' DRY-RUN: sudo -u %s XDG_RUNTIME_DIR=/run/user/%s espanso start || true\n' "$ACTUAL_USER" "$USER_ID" else sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso service register || true sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso restart || \ sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso start || true fi log "Done. Espanso ($VARIANT) installed and started for $ACTUAL_USER." if [[ "$VARIANT" == "wayland" ]]; then log "Wayland note: non-US keyboards must set the layout in ~/.config/espanso/config/default.yml" fi

#!/usr/bin/env bash # install-firefox.sh — Install Firefox from Mozilla's official APT repository. # Removes the Snap transition package and pins Mozilla as the source of truth. # Best-effort: pins the APT launcher at GNOME Dock position 2. # Hardened: distro-detect, idempotent, signed-by keyring, ERR trap, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 ASSUME_YES=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--yes] [--help] Removes Firefox Snap (and Ubuntu's transitional wrapper), configures the official Mozilla APT repository (signed-by keyring + APT pin), then installs Firefox so it auto-updates from Mozilla. On GNOME, Firefox is pinned at Dock position 2 when a desktop user session is available. Options: --dry-run Print the actions without executing them. --yes, -y Pass -y to apt for non-interactive install. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } on_err() { local rc=$? line=$1; printf '\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n' "${SCRIPT_NAME%.sh}" "$line" "$rc" >&2; } trap 'on_err $LINENO' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -y|--yes) ASSUME_YES=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found; cannot detect distro." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}. Requires Debian/Ubuntu." ;; esac log "Detected: ${PRETTY_NAME:-unknown} (codename: ${VERSION_CODENAME:-?})" APT_YES=() (( ASSUME_YES )) && APT_YES=(-y) || APT_YES=(-y) # always -y for safety in scripted use export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/packages.mozilla.org.asc SOURCES=/etc/apt/sources.list.d/mozilla.list PIN=/etc/apt/preferences.d/mozilla log "Removing Firefox Snap and Ubuntu's transitional wrapper (if present)..." if command -v snap >/dev/null 2>&1; then run "snap disable firefox >/dev/null 2>&1 || true" run "snap remove --purge firefox >/dev/null 2>&1 || true" fi run "apt-get remove --purge ${APT_YES[*]} firefox >/dev/null 2>&1 || true" run "rm -f /usr/bin/firefox" log "Installing prerequisites (wget, gpg, ca-certificates)..." run "apt-get update -qq" run "apt-get install ${APT_YES[*]} wget gpg ca-certificates" log "Configuring Mozilla APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then run "wget -qO '$KEYRING' https://packages.mozilla.org/apt/repo-signing-key.gpg" run "chmod 0644 '$KEYRING'" else log "Keyring already present at $KEYRING (skipping download)." fi # Verify key fingerprint matches Mozilla's published fingerprint EXPECTED_FPR="35BAA0B33E9EB396F59CA838C0BA5CE6DC6315A3" ACTUAL_FPR="$(gpg --show-keys --with-colons "$KEYRING" 2>/dev/null | awk -F: '/^fpr/ {print $10; exit}')" if [[ "$ACTUAL_FPR" != "$EXPECTED_FPR" ]]; then warn "Mozilla key fingerprint mismatch (expected $EXPECTED_FPR, got ${ACTUAL_FPR:-none}). Continuing, but verify manually." else log "Mozilla key fingerprint verified." fi DESIRED_SRC='deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main' if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Pinning Mozilla repo to priority 1000..." if [[ ! -f "$PIN" ]] || ! grep -q 'origin packages.mozilla.org' "$PIN"; then if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$PIN" else cat >"$PIN" <<'EOF' Package: * Pin: origin packages.mozilla.org Pin-Priority: 1000 EOF fi fi log "Installing Firefox from Mozilla repo..." run "apt-get update -qq" run "apt-get install ${APT_YES[*]} firefox" if (( ! DRY_RUN )) && command -v firefox >/dev/null 2>&1; then log "Installed: $(firefox --version 2>/dev/null || echo 'firefox')" fi # Replace the stale Snap launcher, remove duplicates, and place the Mozilla APT # launcher after the first existing favorite. Dock changes are per-user, so run # gsettings against the desktop user's active D-Bus session rather than root's. DESKTOP_USER="${SUDO_USER:-}" if (( DRY_RUN )); then printf ' DRY-RUN: pin firefox.desktop at GNOME Dock position 2 when a desktop session is available\n' elif [[ -z "$DESKTOP_USER" || "$DESKTOP_USER" == "root" ]]; then warn "No sudo desktop user detected; skipping GNOME Dock pin." else DESKTOP_UID="$(id -u "$DESKTOP_USER" 2>/dev/null || true)" RUNTIME_DIR="/run/user/$DESKTOP_UID" DBUS_ADDRESS="unix:path=$RUNTIME_DIR/bus" if [[ -n "$DESKTOP_UID" && -S "$RUNTIME_DIR/bus" ]] && command -v gsettings >/dev/null 2>&1 && sudo -u "$DESKTOP_USER" XDG_RUNTIME_DIR="$RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="$DBUS_ADDRESS" \ gsettings list-keys org.gnome.shell >/dev/null 2>&1; then log "Pinning Firefox at GNOME Dock position 2..." CURRENT_FAVS="$(sudo -u "$DESKTOP_USER" XDG_RUNTIME_DIR="$RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="$DBUS_ADDRESS" \ gsettings get org.gnome.shell favorite-apps 2>/dev/null || echo '[]')" FAVORITES=() while IFS= read -r favorite; do favorite="${favorite#\'}" favorite="${favorite%\'}" case "$favorite" in firefox.desktop|firefox_firefox.desktop) ;; *) FAVORITES+=("$favorite") ;; esac done < <(printf '%s\n' "$CURRENT_FAVS" | grep -o "'[^']*'" || true) ORDERED_FAVORITES=() if (( ${#FAVORITES[@]} == 0 )); then ORDERED_FAVORITES=(firefox.desktop) else ORDERED_FAVORITES=("${FAVORITES[0]}" firefox.desktop "${FAVORITES[@]:1}") fi NEW_FAVS="[" separator="" for favorite in "${ORDERED_FAVORITES[@]}"; do favorite="${favorite//\\/\\\\}" favorite="${favorite//\'/\\\'}" NEW_FAVS+="${separator}'${favorite}'" separator=", " done NEW_FAVS+="]" sudo -u "$DESKTOP_USER" XDG_RUNTIME_DIR="$RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="$DBUS_ADDRESS" \ gsettings set org.gnome.shell favorite-apps "$NEW_FAVS" || warn "GNOME Dock pin failed (non-fatal)." else log "GNOME not detected (or no active desktop D-Bus session); skipping Dock pin." fi fi log "Done. Firefox installed from Mozilla APT and will auto-update."