# Ubuntu Sans Nerd Font Setup A lightweight script to automatically fetch and install the latest **Ubuntu Sans Nerd Font** for Ubuntu Desktop. ## Quick Install Run the following command in your terminal: ```bash bash -c "$(curl -fsSL https://opengist.rmrf.online/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install_font.sh)" ``` ## Overview * **Always Latest:** Dynamically pulls the newest release from the official Nerd Fonts GitHub. * **No Sudo Needed:** Installs safely to your local user directory (`~/.local/share/fonts/UbuntuSans`). * **Ready to Use:** Automatically updates the font cache (`fc-cache`) so fonts are available immediately. * **Dependencies:** Requires `curl` and `unzip`.

#!/usr/bin/env bash # install-1password.sh — Install 1Password desktop from the official 1Password APT repo. # Hardened: arch-aware, signed-by keyring, debsig verification dir, idempotent, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Configures the official 1Password APT repository (with debsig policy and keyring) and installs the 1Password desktop application. Idempotent: safe to re-run. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac # 1Password publishes builds for amd64 and arm64. ARCH="$(dpkg --print-architecture)" case "$ARCH" in amd64|arm64) : ;; *) die "1Password is only available for amd64/arm64 (detected: $ARCH)." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/1password-archive-keyring.gpg SOURCES=/etc/apt/sources.list.d/1password.list DEBSIG_POLICY_DIR=/etc/debsig/policies/AC2D62742012EA22 DEBSIG_KEYRING_DIR=/usr/share/debsig/keyrings/AC2D62742012EA22 log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl gpg ca-certificates" log "Configuring 1Password APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then run "curl -fsSL https://downloads.1password.com/linux/keys/1password.asc | gpg --dearmor -o '$KEYRING'" run "chmod 0644 '$KEYRING'" fi DESIRED_SRC="deb [arch=${ARCH} signed-by=${KEYRING}] https://downloads.1password.com/linux/debian/${ARCH} stable main" if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Installing debsig policy (verifies package signatures on install)..." run "install -d -m 0755 '$DEBSIG_POLICY_DIR' '$DEBSIG_KEYRING_DIR'" if [[ ! -s "${DEBSIG_POLICY_DIR}/1password.pol" ]]; then run "curl -fsSL https://downloads.1password.com/linux/debian/debsig/1password.pol -o '${DEBSIG_POLICY_DIR}/1password.pol'" fi if [[ ! -s "${DEBSIG_KEYRING_DIR}/debsig.gpg" ]]; then run "curl -fsSL https://downloads.1password.com/linux/keys/1password.asc | gpg --dearmor -o '${DEBSIG_KEYRING_DIR}/debsig.gpg'" fi log "Installing 1Password..." run "apt-get update -qq" run "apt-get install -y 1password" if (( ! DRY_RUN )) && command -v 1password >/dev/null 2>&1; then log "1Password binary available at: $(command -v 1password)" fi log "Done."

#!/usr/bin/env bash # install-bruno.sh — Install Bruno API client from the official APT repository. # Hardened: arch-aware, signed-by keyring with retries (keyserver flake), idempotent, # clean desktop entry, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Configures the official Bruno APT repository (signed-by keyring fetched from keyserver.ubuntu.com with retries) and installs Bruno. Idempotent: safe to re-run. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Bruno APT repo only ships amd64 (detected: $ARCH)." log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/bruno.gpg SOURCES=/etc/apt/sources.list.d/bruno.list KEY_ID="9FA6017ECABE0266" DESKTOP=/usr/share/applications/bruno.desktop log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl gpg ca-certificates" log "Configuring Bruno APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then # keyserver.ubuntu.com is occasionally flaky — retry a few times. ok=0 for attempt in 1 2 3 4 5; do if (( DRY_RUN )); then printf ' DRY-RUN: fetch key 0x%s (attempt %d)\n' "$KEY_ID" "$attempt" ok=1 break fi if curl -fsSL --max-time 30 "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${KEY_ID}" \ | gpg --dearmor -o "$KEYRING" 2>/dev/null && [[ -s "$KEYRING" ]]; then ok=1 break fi warn "Key fetch failed (attempt $attempt/5); retrying in $((attempt*2))s..." sleep "$((attempt*2))" done (( ok )) || die "Could not retrieve Bruno signing key after 5 attempts." run "chmod 0644 '$KEYRING'" fi DESIRED_SRC="deb [arch=${ARCH} signed-by=${KEYRING}] http://debian.usebruno.com/ bruno stable" if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Installing Bruno..." run "apt-get update -qq" run "apt-get install -y bruno" log "Writing desktop entry..." if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$DESKTOP" else cat >"$DESKTOP" <<'EOF' [Desktop Entry] Name=Bruno Comment=Open-source API Client Exec=bruno %U Terminal=false Type=Application Icon=bruno Categories=Development;Utility; StartupNotify=true EOF chmod 0644 "$DESKTOP" fi log "Done. Bruno installed."

#!/usr/bin/env bash # install-espanso.sh — Install Espanso (text expander) with Wayland or X11 build. # Auto-detects session type; falls back to X11 if Wayland is not active. # Hardened: session detection, registers service as the invoking user, idempotent. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 FORCE_VARIANT="" # "wayland" | "x11" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--wayland|--x11] [--help] Installs Espanso from the latest GitHub release. Auto-detects whether to use the Wayland or X11 build based on \$XDG_SESSION_TYPE of the invoking user (SUDO_USER). The systemd-user service is registered for that user, not root. Options: --wayland Force the Wayland build. --x11 Force the X11 build. --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; --wayland) FORCE_VARIANT=wayland ;; --x11) FORCE_VARIANT=x11 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Espanso .deb is published for amd64 only (detected: $ARCH)." ACTUAL_USER="${SUDO_USER:-${USER:-}}" [[ -n "$ACTUAL_USER" && "$ACTUAL_USER" != "root" ]] || die "Run via sudo as a regular user; cannot register the service as root." USER_ID="$(id -u "$ACTUAL_USER")" # Detect session type from the invoking user's environment, fallback to env, fallback to wayland if [[ -n "$FORCE_VARIANT" ]]; then VARIANT="$FORCE_VARIANT" else SESSION_TYPE="$(sudo -u "$ACTUAL_USER" -i printenv XDG_SESSION_TYPE 2>/dev/null || true)" [[ -z "$SESSION_TYPE" ]] && SESSION_TYPE="${XDG_SESSION_TYPE:-wayland}" case "$SESSION_TYPE" in wayland) VARIANT=wayland ;; x11|tty) VARIANT=x11 ;; *) warn "Unknown XDG_SESSION_TYPE='$SESSION_TYPE'; defaulting to wayland."; VARIANT=wayland ;; esac fi log "Detected: ${PRETTY_NAME:-unknown}, user: $ACTUAL_USER, session: $VARIANT" export DEBIAN_FRONTEND=noninteractive TEMP_DEB="$(mktemp -t espanso.XXXXXX.deb)" trap 'rm -f "$TEMP_DEB"' EXIT DEB_NAME="espanso-debian-${VARIANT}-amd64.deb" URL="https://github.com/espanso/espanso/releases/latest/download/${DEB_NAME}" log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y wget libcap2-bin" log "Downloading ${DEB_NAME}..." run "wget -qO '$TEMP_DEB' '$URL'" log "Installing package..." run "apt-get install -y '$TEMP_DEB'" ESPANSO_BIN="$(command -v espanso || true)" [[ -x "$ESPANSO_BIN" ]] || die "espanso binary not found after install." if [[ "$VARIANT" == "wayland" ]]; then log "Setting CAP_DAC_OVERRIDE on $ESPANSO_BIN..." run "setcap 'cap_dac_override+p' '$ESPANSO_BIN'" fi log "Registering & starting espanso service for $ACTUAL_USER..." # Register may fail if already registered — treat that as success. if (( DRY_RUN )); then printf ' DRY-RUN: sudo -u %s XDG_RUNTIME_DIR=/run/user/%s espanso service register || true\n' "$ACTUAL_USER" "$USER_ID" printf ' DRY-RUN: sudo -u %s XDG_RUNTIME_DIR=/run/user/%s espanso start || true\n' "$ACTUAL_USER" "$USER_ID" else sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso service register || true sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso restart || \ sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso start || true fi log "Done. Espanso ($VARIANT) installed and started for $ACTUAL_USER." if [[ "$VARIANT" == "wayland" ]]; then log "Wayland note: non-US keyboards must set the layout in ~/.config/espanso/config/default.yml" fi

#!/usr/bin/env bash # install-firefox.sh — Install Firefox from Mozilla's official APT repository. # Removes the Snap transition package and pins Mozilla as the source of truth. # Hardened: distro-detect, idempotent, signed-by keyring, ERR trap, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 ASSUME_YES=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--yes] [--help] Removes Firefox Snap (and Ubuntu's transitional wrapper), configures the official Mozilla APT repository (signed-by keyring + APT pin), then installs Firefox so it auto-updates from Mozilla. Options: --dry-run Print the actions without executing them. --yes, -y Pass -y to apt for non-interactive install. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } on_err() { local rc=$? line=$1; printf '\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n' "${SCRIPT_NAME%.sh}" "$line" "$rc" >&2; } trap 'on_err $LINENO' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -y|--yes) ASSUME_YES=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found; cannot detect distro." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}. Requires Debian/Ubuntu." ;; esac log "Detected: ${PRETTY_NAME:-unknown} (codename: ${VERSION_CODENAME:-?})" APT_YES=() (( ASSUME_YES )) && APT_YES=(-y) || APT_YES=(-y) # always -y for safety in scripted use export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/packages.mozilla.org.asc SOURCES=/etc/apt/sources.list.d/mozilla.list PIN=/etc/apt/preferences.d/mozilla log "Removing Firefox Snap and Ubuntu's transitional wrapper (if present)..." if command -v snap >/dev/null 2>&1; then run "snap disable firefox >/dev/null 2>&1 || true" run "snap remove --purge firefox >/dev/null 2>&1 || true" fi run "apt-get remove --purge ${APT_YES[*]} firefox >/dev/null 2>&1 || true" run "rm -f /usr/bin/firefox" log "Installing prerequisites (wget, gpg, ca-certificates)..." run "apt-get update -qq" run "apt-get install ${APT_YES[*]} wget gpg ca-certificates" log "Configuring Mozilla APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then run "wget -qO '$KEYRING' https://packages.mozilla.org/apt/repo-signing-key.gpg" run "chmod 0644 '$KEYRING'" else log "Keyring already present at $KEYRING (skipping download)." fi # Verify key fingerprint matches Mozilla's published fingerprint EXPECTED_FPR="35BAA0B33E9EB396F59CA838C0BA5CE6DC6315A3" ACTUAL_FPR="$(gpg --show-keys --with-colons "$KEYRING" 2>/dev/null | awk -F: '/^fpr/ {print $10; exit}')" if [[ "$ACTUAL_FPR" != "$EXPECTED_FPR" ]]; then warn "Mozilla key fingerprint mismatch (expected $EXPECTED_FPR, got ${ACTUAL_FPR:-none}). Continuing, but verify manually." else log "Mozilla key fingerprint verified." fi DESIRED_SRC='deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main' if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Pinning Mozilla repo to priority 1000..." if [[ ! -f "$PIN" ]] || ! grep -q 'origin packages.mozilla.org' "$PIN"; then if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$PIN" else cat >"$PIN" <<'EOF' Package: * Pin: origin packages.mozilla.org Pin-Priority: 1000 EOF fi fi log "Installing Firefox from Mozilla repo..." run "apt-get update -qq" run "apt-get install ${APT_YES[*]} firefox" if (( ! DRY_RUN )) && command -v firefox >/dev/null 2>&1; then log "Installed: $(firefox --version 2>/dev/null || echo 'firefox')" fi log "Done. Firefox installed from Mozilla APT and will auto-update."

#!/usr/bin/env bash # install-ipatool.sh — Install ipatool from the latest GitHub release. # Hardened: arch detection (amd64/arm64), GitHub API token support, SHA-256 verification # from the release checksum file, atomic install to /usr/local/bin, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 REPO="majd/ipatool" INSTALL_PATH="/usr/local/bin/ipatool" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Resolves the latest release of majd/ipatool, downloads the tarball for your architecture, verifies its SHA-256 against the published checksums.txt, and installs the binary to /usr/local/bin/ipatool atomically. If \$GITHUB_TOKEN is set in the environment, it is used to authenticate the GitHub API request (avoids rate limits). Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release log "Detected: ${PRETTY_NAME:-unknown}" ARCH_RAW="$(uname -m)" case "$ARCH_RAW" in x86_64) GO_ARCH=amd64 ;; aarch64) GO_ARCH=arm64 ;; armv7l|armv6l) GO_ARCH=arm ;; *) die "Unsupported architecture: $ARCH_RAW" ;; esac ASSET_SUFFIX="linux-${GO_ARCH}.tar.gz" export DEBIAN_FRONTEND=noninteractive log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl jq tar ca-certificates libsecret-1-0" GH_HDRS=(-H "Accept: application/vnd.github+json") [[ -n "${GITHUB_TOKEN:-}" ]] && GH_HDRS+=(-H "Authorization: Bearer ${GITHUB_TOKEN}") log "Querying GitHub API for latest release of $REPO..." RELEASE_JSON="$(curl -fsSL "${GH_HDRS[@]}" "https://api.github.com/repos/${REPO}/releases/latest")" TAG="$(jq -r '.tag_name // empty' <<<"$RELEASE_JSON")" [[ -n "$TAG" ]] || die "Could not parse latest release tag (rate limited? set GITHUB_TOKEN)." log "Latest release: $TAG" DOWNLOAD_URL="$(jq -r --arg s "$ASSET_SUFFIX" '.assets[] | select(.name | endswith($s)) | .browser_download_url' <<<"$RELEASE_JSON" | head -n1)" CHECKSUM_URL="$(jq -r '.assets[] | select(.name | test("checksums?\\.txt$")) | .browser_download_url' <<<"$RELEASE_JSON" | head -n1)" [[ "$DOWNLOAD_URL" =~ ^https:// ]] || die "No release asset matching '*${ASSET_SUFFIX}'." STAGE="$(mktemp -d -t ipatool.XXXXXX)" trap 'rm -rf "$STAGE"' EXIT TARBALL="$STAGE/ipatool.tar.gz" log "Downloading $(basename "$DOWNLOAD_URL")..." run "curl -fsSL -o '$TARBALL' '$DOWNLOAD_URL'" if [[ -n "$CHECKSUM_URL" ]]; then log "Verifying SHA-256..." EXPECTED="$(curl -fsSL "$CHECKSUM_URL" | awk -v f="$(basename "$DOWNLOAD_URL")" '$2 ~ f || $2 == "*"f {print $1; exit}')" ACTUAL="$(sha256sum "$TARBALL" | awk '{print $1}')" if [[ -n "$EXPECTED" && "$EXPECTED" != "$ACTUAL" ]]; then die "SHA-256 mismatch: expected=$EXPECTED actual=$ACTUAL" fi [[ -n "$EXPECTED" ]] && log "SHA-256 ok." || warn "Asset not listed in checksums.txt; skipping." else warn "No checksums.txt in release; skipping SHA-256 verification." fi log "Extracting..." run "tar -xzf '$TARBALL' -C '$STAGE'" BINARY_PATH="$(find "$STAGE" -type f -name ipatool -executable -not -name '*.tar.gz' | head -n1 || true)" if [[ -z "$BINARY_PATH" ]]; then # Some releases ship the binary without +x; relax the find BINARY_PATH="$(find "$STAGE" -type f -name ipatool -not -name '*.tar.gz' | head -n1 || true)" fi [[ -n "$BINARY_PATH" || $DRY_RUN -eq 1 ]] || die "ipatool binary not found inside archive." log "Installing to $INSTALL_PATH..." run "install -m 0755 '$BINARY_PATH' '$INSTALL_PATH'" if (( ! DRY_RUN )) && command -v ipatool >/dev/null 2>&1; then log "Installed: $(ipatool --version 2>/dev/null || basename "$INSTALL_PATH") ($TAG)" fi log "Done."

#!/usr/bin/env bash # install-jetbrains-toolbox.sh — Install JetBrains Toolbox into the invoking user's home. # Hardened: dependency check w/ auto-install, SHA-256 verification against JetBrains' # release metadata, idempotent (replaces atomically), .desktop entry, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 ASSUME_YES=0 usage() { cat <<EOF Usage: $SCRIPT_NAME [--dry-run] [--yes] [--help] Installs the latest JetBrains Toolbox to ~/.local/share/JetBrains/Toolbox and creates a .desktop launcher in ~/.local/share/applications. The .tar.gz is verified against the SHA-256 published in JetBrains' release feed. Do NOT run with sudo: Toolbox is a per-user install. If a missing system package (curl/jq/tar/libfuse2) needs installing, the script will call sudo just for that step. Options: --yes, -y Auto-confirm prompts for installing missing system packages. --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -y|--yes) ASSUME_YES=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID != 0 )) || die "Do NOT run as root. Toolbox is a per-user install." [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) PKG_MGR=apt ;; *fedora*|*rhel*) PKG_MGR=dnf ;; *arch*) PKG_MGR=pacman ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac log "Detected: ${PRETTY_NAME:-unknown} (pkg: $PKG_MGR)" confirm() { (( ASSUME_YES )) && return 0 read -rp "$1 [y/N] " ans [[ "$ans" =~ ^[Yy] ]] } ensure_pkg() { local pkg="$1" probe="$2" if eval "$probe" >/dev/null 2>&1; then return 0; fi if ! confirm "Package '$pkg' is missing. Install via sudo $PKG_MGR?"; then die "'$pkg' is required." fi case "$PKG_MGR" in apt) run "sudo apt-get update -qq && sudo apt-get install -y '$pkg'" ;; dnf) run "sudo dnf install -y '$pkg'" ;; pacman) run "sudo pacman -Sy --noconfirm '$pkg'" ;; esac } # Map deps: command-or-package-probe ensure_pkg curl "command -v curl" ensure_pkg jq "command -v jq" ensure_pkg tar "command -v tar" case "$PKG_MGR" in apt) ensure_pkg libfuse2 "dpkg -s libfuse2" ;; dnf) ensure_pkg fuse-libs "rpm -q fuse-libs" ;; pacman) ensure_pkg fuse2 "pacman -Q fuse2" ;; esac ARCH_RAW="$(uname -m)" case "$ARCH_RAW" in x86_64) TOOLBOX_ARCH_KEY=linux ;; aarch64) TOOLBOX_ARCH_KEY=linuxARM64 ;; *) die "Unsupported architecture: $ARCH_RAW" ;; esac log "Querying JetBrains release feed..." RELEASE_JSON="$(curl -fsSL 'https://data.services.jetbrains.com/products/releases?code=TBA&latest=true&type=release' \ -H 'Origin: https://www.jetbrains.com' \ -H 'Referer: https://www.jetbrains.com/toolbox/download/')" TOOLBOX_URL="$(jq -r --arg k "$TOOLBOX_ARCH_KEY" '.TBA[0].downloads[$k].link // empty' <<<"$RELEASE_JSON")" TOOLBOX_SHA="$(jq -r --arg k "$TOOLBOX_ARCH_KEY" '.TBA[0].downloads[$k].checksumLink // empty' <<<"$RELEASE_JSON")" TOOLBOX_VER="$(jq -r '.TBA[0].version // "?"' <<<"$RELEASE_JSON")" [[ -n "$TOOLBOX_URL" ]] || die "Could not resolve Toolbox download URL from release feed." log "Latest Toolbox: $TOOLBOX_VER ($TOOLBOX_ARCH_KEY)" INSTALL_DIR="$HOME/.local/share/JetBrains/Toolbox" STAGE_DIR="$(mktemp -d -t toolbox.XXXXXX)" trap 'rm -rf "$STAGE_DIR"' EXIT TARBALL="$STAGE_DIR/toolbox.tar.gz" log "Downloading..." run "curl -fsSL -o '$TARBALL' '$TOOLBOX_URL'" if [[ -n "$TOOLBOX_SHA" ]]; then log "Verifying SHA-256..." EXPECTED_SHA="$(curl -fsSL "$TOOLBOX_SHA" | awk '{print $1}')" ACTUAL_SHA="$(sha256sum "$TARBALL" | awk '{print $1}')" if [[ -n "$EXPECTED_SHA" && "$EXPECTED_SHA" != "$ACTUAL_SHA" ]]; then die "SHA-256 mismatch! expected=$EXPECTED_SHA actual=$ACTUAL_SHA" fi log "SHA-256 ok." else warn "No checksum URL in release feed; skipping verification." fi log "Extracting to $INSTALL_DIR..." run "mkdir -p '$INSTALL_DIR'" run "tar -xzf '$TARBALL' --strip-components=1 -C '$INSTALL_DIR'" BIN_PATH="$INSTALL_DIR/bin/jetbrains-toolbox" DESKTOP_SRC="$INSTALL_DIR/bin/jetbrains-toolbox.desktop" ICON_PATH="$INSTALL_DIR/bin/toolbox-tray-color.png" [[ -x "$BIN_PATH" || $DRY_RUN -eq 1 ]] || die "Toolbox binary missing after extract." # Optional ~/bin symlink if [[ -d "$HOME/bin" ]]; then run "ln -sfn '$BIN_PATH' '$HOME/bin/jetbrains-toolbox'" fi # .desktop launcher APPS_DIR="$HOME/.local/share/applications" run "mkdir -p '$APPS_DIR'" DESKTOP_DST="$APPS_DIR/jetbrains-toolbox.desktop" if [[ -f "$DESKTOP_SRC" ]] || (( DRY_RUN )); then run "cp '$DESKTOP_SRC' '$DESKTOP_DST'" run "sed -i 's|^Exec=.*|Exec=$BIN_PATH %u|' '$DESKTOP_DST'" if [[ -f "$ICON_PATH" ]]; then run "sed -i 's|^Icon=.*|Icon=$ICON_PATH|' '$DESKTOP_DST'" fi run "chmod 0755 '$DESKTOP_DST'" log "Desktop entry installed: $DESKTOP_DST" else warn "No .desktop file in archive; skipping launcher." fi log "Done. JetBrains Toolbox $TOOLBOX_VER installed to $INSTALL_DIR"

#!/usr/bin/env bash # install-libreoffice.sh — Install the latest stable LibreOffice from documentfoundation.org. # Hardened: arch detection, version JSON when available with HTML fallback, MD5 verification, # uninstalls bundled distro libreoffice* first to avoid conflicts, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 SKIP_REMOVE_DISTRO=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--keep-distro-libreoffice] [--help] Detects the latest stable LibreOffice version on download.documentfoundation.org, downloads the matching DEB tarball for your architecture, verifies the MD5 sum published alongside it, and installs the .deb packages. Options: --keep-distro-libreoffice Don't purge any pre-installed distro libreoffice* (default: purge to avoid library conflicts). --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; --keep-distro-libreoffice) SKIP_REMOVE_DISTRO=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown} (this script installs .deb packages)." ;; esac ARCH_RAW="$(uname -m)" case "$ARCH_RAW" in x86_64) LO_ARCH=x86_64; LO_SUFFIX=Linux_x86-64 ;; aarch64) LO_ARCH=aarch64; LO_SUFFIX=Linux_aarch64 ;; *) die "Unsupported architecture: $ARCH_RAW (LibreOffice ships x86_64 and aarch64)." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH_RAW" export DEBIAN_FRONTEND=noninteractive log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl wget tar coreutils ca-certificates" log "Resolving latest stable LibreOffice version..." INDEX="$(curl -fsSL https://download.documentfoundation.org/libreoffice/stable/)" LATEST_VERSION="$(printf '%s\n' "$INDEX" \ | grep -oP '(?<=href=")[0-9]+\.[0-9]+\.[0-9]+(?=/")' \ | sort -V | tail -1 || true)" [[ -n "$LATEST_VERSION" ]] || die "Could not detect latest version from index page." log "Latest stable: $LATEST_VERSION" BASE="https://download.documentfoundation.org/libreoffice/stable/${LATEST_VERSION}/deb/${LO_ARCH}" ARCHIVE_NAME="LibreOffice_${LATEST_VERSION}_${LO_SUFFIX}_deb.tar.gz" URL="${BASE}/${ARCHIVE_NAME}" SUM_URL="${URL}.md5" STAGE="$(mktemp -d -t lo.XXXXXX)" trap 'rm -rf "$STAGE"' EXIT ARCHIVE="$STAGE/$ARCHIVE_NAME" log "Downloading $ARCHIVE_NAME..." run "wget -q --show-progress -O '$ARCHIVE' '$URL'" log "Verifying MD5..." if EXPECTED_MD5="$(curl -fsSL "$SUM_URL" 2>/dev/null | awk '{print $1}')" && [[ -n "$EXPECTED_MD5" ]]; then ACTUAL_MD5="$(md5sum "$ARCHIVE" | awk '{print $1}')" [[ "$EXPECTED_MD5" == "$ACTUAL_MD5" ]] || die "MD5 mismatch: expected=$EXPECTED_MD5 actual=$ACTUAL_MD5" log "MD5 ok." else warn "No MD5 published for $SUM_URL; skipping checksum." fi log "Extracting..." run "tar -xzf '$ARCHIVE' -C '$STAGE'" DEBS_DIR="$(find "$STAGE" -maxdepth 3 -type d -name DEBS | head -n1 || true)" [[ -n "$DEBS_DIR" || $DRY_RUN -eq 1 ]] || die "DEBS/ directory not found in archive." if (( ! SKIP_REMOVE_DISTRO )); then if dpkg -l 'libreoffice*' 2>/dev/null | awk '/^ii/ {print $2}' | grep -q .; then log "Removing distro-supplied libreoffice* packages to avoid conflicts..." run "apt-get remove --purge -y 'libreoffice*'" fi fi log "Installing .deb packages..." run "dpkg -i -R '$DEBS_DIR'" log "Resolving any missing dependencies..." run "apt-get install -f -y" log "Done. LibreOffice $LATEST_VERSION installed."

#!/usr/bin/env bash # install-network_drive.sh — Auto-mount Synology (SMB/CIFS) shares under /mnt/Synology. # Hardened: safe input handling, no eval-on-username, hostname validation, # fstab managed via begin/end markers (idempotent re-run), creds file 0600, # GNOME dock pinning is best-effort. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 SERVER_ADDR="" SMB_USER="" SMB_PASS="" MASTER_DIR="/mnt/Synology" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [options] Discovers SMB shares on a Synology NAS and adds them to /etc/fstab so they auto-mount under $MASTER_DIR. Creates a desktop launcher and (best-effort) pins it to the top of the GNOME Dock. Options: --server HOST_OR_IP Synology address (skips prompt). --user USERNAME SMB username (skips prompt). --password-stdin Read SMB password from stdin (skips prompt). (Otherwise the script prompts on the controlling tty.) --mount-root DIR Override parent directory (default: $MASTER_DIR). --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR PASS_FROM_STDIN=0 while (( $# )); do case "$1" in --server) SERVER_ADDR="${2:?}"; shift ;; --user) SMB_USER="${2:?}"; shift ;; --password-stdin) PASS_FROM_STDIN=1 ;; --mount-root) MASTER_DIR="${2:?}"; shift ;; --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ACTUAL_USER="${SUDO_USER:-${USER:-}}" [[ -n "$ACTUAL_USER" && "$ACTUAL_USER" != "root" ]] || die "Run via sudo as a regular user." # Use getent so we don't depend on eval/~expansion or shell glob safety. USER_ENTRY="$(getent passwd "$ACTUAL_USER")" || die "User '$ACTUAL_USER' not found in passwd." USER_HOME="$(awk -F: '{print $6}' <<<"$USER_ENTRY")" USER_ID="$(awk -F: '{print $3}' <<<"$USER_ENTRY")" USER_GID="$(awk -F: '{print $4}' <<<"$USER_ENTRY")" export DEBIAN_FRONTEND=noninteractive log "Installing cifs-utils, smbclient..." run "apt-get update -qq" run "apt-get install -y cifs-utils smbclient" # --- Collect creds --- [[ -n "$SERVER_ADDR" ]] || read -rp "Synology NAS address or IP: " SERVER_ADDR </dev/tty SERVER_ADDR="${SERVER_ADDR#smb://}" SERVER_ADDR="${SERVER_ADDR#//}" SERVER_ADDR="${SERVER_ADDR%/}" [[ "$SERVER_ADDR" =~ ^[A-Za-z0-9._-]+$ ]] || die "Invalid host/IP: '$SERVER_ADDR'" [[ -n "$SMB_USER" ]] || read -rp "Synology username: " SMB_USER </dev/tty [[ "$SMB_USER" =~ ^[A-Za-z0-9._@-]+$ ]] || die "Invalid SMB username." if (( PASS_FROM_STDIN )); then IFS= read -r SMB_PASS else read -rsp "Synology password: " SMB_PASS </dev/tty echo fi [[ -n "$SMB_PASS" ]] || die "Password is empty." # --- Credentials file --- CRED_FILE="$USER_HOME/.smbcredentials_synology" log "Writing credentials to $CRED_FILE (mode 0600)..." if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$CRED_FILE" else umask 077 { printf 'username=%s\n' "$SMB_USER" printf 'password=%s\n' "$SMB_PASS" } >"$CRED_FILE" chown "$USER_ID:$USER_GID" "$CRED_FILE" chmod 0600 "$CRED_FILE" fi # --- Query shares --- log "Discovering shares on //$SERVER_ADDR..." if (( DRY_RUN )); then SHARE_LIST=$'home\nphoto\nvideo' else SHARE_LIST="$(smbclient -L "//$SERVER_ADDR" -U "$SMB_USER%$SMB_PASS" -g 2>/dev/null \ | awk -F'|' '$1=="Disk" {print $2}' || true)" fi [[ -n "$SHARE_LIST" ]] || die "No shares returned. Check host, credentials, or network." # --- Parent mount dir --- run "mkdir -p '$MASTER_DIR'" run "chown '$USER_ID:$USER_GID' '$MASTER_DIR'" # --- Backup fstab once --- if [[ ! -f /etc/fstab.bak.synology ]]; then run "cp /etc/fstab /etc/fstab.bak.synology" log "Backed up fstab -> /etc/fstab.bak.synology" fi MARK_BEGIN="# >>> synology-master >>> (managed by ${SCRIPT_NAME})" MARK_END="# <<< synology-master <<<" # Remove any previous managed block (so re-run replaces, not appends). if grep -qF "$MARK_BEGIN" /etc/fstab; then if (( DRY_RUN )); then printf ' DRY-RUN: strip previous managed block from /etc/fstab\n' else sed -i "\|$MARK_BEGIN|,\|$MARK_END|d" /etc/fstab fi fi log "Writing managed block to /etc/fstab..." FSTAB_BLOCK="$MARK_BEGIN"$'\n' while IFS= read -r SHARE; do [[ -z "$SHARE" || "$SHARE" == "IPC\$" || "$SHARE" == "print\$" ]] && continue MOUNT_POINT="$MASTER_DIR/$SHARE" run "mkdir -p '$MOUNT_POINT'" run "chown '$USER_ID:$USER_GID' '$MOUNT_POINT'" FSTAB_BLOCK+="//${SERVER_ADDR}/${SHARE} ${MOUNT_POINT} cifs credentials=${CRED_FILE},uid=${USER_ID},gid=${USER_GID},_netdev,nofail,x-systemd.automount,x-systemd.idle-timeout=60 0 0"$'\n' done <<<"$SHARE_LIST" FSTAB_BLOCK+="$MARK_END"$'\n' if (( DRY_RUN )); then printf ' DRY-RUN: append fstab block:\n%s\n' "$FSTAB_BLOCK" else printf '%s' "$FSTAB_BLOCK" >>/etc/fstab fi log "Reloading systemd and mounting..." run "systemctl daemon-reload" run "mount -a -t cifs" # --- Desktop entry --- APPS_DIR="$USER_HOME/.local/share/applications" DESKTOP_FILENAME="synology-master.desktop" DESKTOP_FILE="$APPS_DIR/$DESKTOP_FILENAME" run "install -d -o '$USER_ID' -g '$USER_GID' -m 0755 '$APPS_DIR'" if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$DESKTOP_FILE" else cat >"$DESKTOP_FILE" <<EOF [Desktop Entry] Name=Synology NAS Comment=Open Synology Master Directory Exec=xdg-open ${MASTER_DIR} Icon=folder-remote Terminal=false Type=Application Categories=Network;FileTools; EOF chown "$USER_ID:$USER_GID" "$DESKTOP_FILE" chmod 0755 "$DESKTOP_FILE" fi # --- Best-effort GNOME dock pin --- if (( ! DRY_RUN )) && sudo -u "$ACTUAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" gsettings list-keys org.gnome.shell >/dev/null 2>&1; then log "Pinning to top of GNOME dock..." CURRENT_FAVS="$(sudo -u "$ACTUAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" gsettings get org.gnome.shell favorite-apps 2>/dev/null || echo '[]')" if [[ "$CURRENT_FAVS" != *"$DESKTOP_FILENAME"* ]]; then CLEAN_FAVS="${CURRENT_FAVS#@as }" if [[ "$CLEAN_FAVS" == "[]" || -z "$CLEAN_FAVS" ]]; then NEW_FAVS="['$DESKTOP_FILENAME']" else NEW_FAVS="['$DESKTOP_FILENAME', ${CLEAN_FAVS:1}" fi sudo -u "$ACTUAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" \ gsettings set org.gnome.shell favorite-apps "$NEW_FAVS" || warn "Dock pin failed (non-fatal)." else log "Already pinned." fi else log "GNOME not detected (or no active dbus session); skipping dock pin." fi log "Done. Shares mounted under $MASTER_DIR."

#!/usr/bin/env bash # install-thunderbird.sh — Install Thunderbird. # On Ubuntu: uses the Mozilla Team PPA (with APT pinning so Snap transition is bypassed). # On Debian: uses the regular Debian package (no PPA available). # Hardened: distro-detect, idempotent, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Installs Thunderbird. - Ubuntu: removes Snap version (if any), adds Mozilla Team PPA, pins it, and installs the .deb. This avoids the Ubuntu snap transition wrapper. - Debian: installs from the standard Debian repos. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release log "Detected: ${PRETTY_NAME:-unknown} (id=${ID:-?})" export DEBIAN_FRONTEND=noninteractive case "${ID:-}" in ubuntu) log "Removing Thunderbird Snap (if present)..." if command -v snap >/dev/null 2>&1; then run "snap remove --purge thunderbird >/dev/null 2>&1 || true" fi log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y software-properties-common" log "Adding Mozilla Team PPA..." PPA_LIST=/etc/apt/sources.list.d/mozillateam-ubuntu-ppa-*.list # shellcheck disable=SC2086 if ! ls $PPA_LIST >/dev/null 2>&1; then run "add-apt-repository -y ppa:mozillateam/ppa" else log "Mozilla Team PPA already configured." fi PIN=/etc/apt/preferences.d/mozillateamppa log "Pinning Mozilla Team PPA so .deb wins over Snap transition wrapper..." if [[ ! -f "$PIN" ]] || ! grep -q 'release o=LP-PPA-mozillateam' "$PIN"; then if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$PIN" else cat >"$PIN" <<'EOF' Package: thunderbird* Pin: release o=LP-PPA-mozillateam Pin-Priority: 1001 EOF fi fi log "Installing thunderbird from PPA..." run "apt-get update -qq" run "apt-get install -y --allow-downgrades thunderbird" ;; debian) log "Installing thunderbird from Debian repos..." run "apt-get update -qq" run "apt-get install -y thunderbird" ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}. Supported: ubuntu, debian." ;; esac log "Done."