# Ubuntu / Debian Setup Manager A collection of hardened install scripts for a fresh Ubuntu / Debian desktop, driven by an interactive `menu.sh`. Each script auto-detects the distro, uses `signed-by` APT keyrings (no `apt-key`), is idempotent (safe to re-run), and supports `--help` and `--dry-run`. ## Quick start — run the menu One-liner — fetches `menu.sh` and runs it. You'll see a numeric picker and can select one option, several, or all: ```bash bash -c "$(curl -fsSL https://opengist.rmrf.online/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/menu.sh)" ``` How to use the picker: - Enter one or more numbers separated by spaces, e.g. `1 6 11` - `0` runs every option in order - `-1` exits The menu caches `sudo` credentials up-front so multi-task runs don't keep re-prompting, and falls back to per-user execution for the three scripts that must not run as root (JetBrains Toolbox, IBus Pinyin, Ubuntu Sans Nerd Font). ## Available scripts | # | Script | Runs as | What it does | |---|---|---|---| | 1 | [`install-firefox.sh`](install-firefox.sh) | sudo | Removes the Firefox Snap and installs Firefox from Mozilla's official APT repo, with APT pinning so it stays on the Mozilla build. Verifies the Mozilla signing-key fingerprint. | | 2 | [`install-thunderbird.sh`](install-thunderbird.sh) | sudo | Ubuntu: removes the Snap, adds the Mozilla Team PPA, and pins it. Debian: installs from the standard repos. | | 3 | [`install-1password.sh`](install-1password.sh) | sudo | Configures the 1Password APT repo with `debsig` signature policy. Arch-aware (amd64 / arm64). | | 4 | [`install-espanso.sh`](install-espanso.sh) | sudo | Installs Espanso. Auto-detects Wayland vs X11 from `$XDG_SESSION_TYPE` and registers the systemd-user service as the invoking desktop user (not root). | | 5 | [`install-libreoffice.sh`](install-libreoffice.sh) | sudo | Detects the latest stable release on documentfoundation.org, downloads the matching `.deb` tarball, verifies the published MD5, and installs. Purges the distro's `libreoffice*` first to avoid library conflicts (opt-out with `--keep-distro-libreoffice`). | | 6 | [`install-vscode.sh`](install-vscode.sh) | sudo | Microsoft's official `code` APT repo, signed-by keyring. `--insiders` flag installs `code-insiders` instead. | | 7 | [`install-jetbrains-toolbox.sh`](install-jetbrains-toolbox.sh) | **user** | Per-user install into `~/.local/share/JetBrains/Toolbox`. SHA-256 verified against JetBrains' release feed. x86_64 + aarch64. Drops a `.desktop` launcher. | | 8 | [`install-bruno.sh`](install-bruno.sh) | sudo | Bruno API client from the official APT repo. Keyserver fetch is wrapped in a 5-attempt retry/backoff because `keyserver.ubuntu.com` is occasionally flaky. | | 9 | [`install-ipatool.sh`](install-ipatool.sh) | sudo | Installs the latest release of `majd/ipatool` from GitHub. SHA-256 verified against the release `checksums.txt`. Honors `$GITHUB_TOKEN` to avoid API rate limits. | | 10 | [`install-network_drive.sh`](install-network_drive.sh) | sudo | Discovers SMB shares on a Synology NAS and adds them to `/etc/fstab` under `/mnt/Synology` with `x-systemd.automount`. fstab block is managed via begin/end markers so re-runs replace rather than duplicate. Credentials file is `0600`. Best-effort GNOME Dock pin. | | 11 | [`install-ibus-pinyin.sh`](install-ibus-pinyin.sh) | **user** | Installs `ibus-libpinyin` and Simplified Chinese language packs, restarts the IBus daemon, and idempotently adds `('ibus', 'libpinyin')` to GNOME's input sources via `gsettings`. | | 12 | [`install_font.sh`](install_font.sh) | **user** | Installs the latest Ubuntu Sans Nerd Font to `~/.local/share/fonts/UbuntuSans` and refreshes the font cache. No sudo needed. | "Runs as **user**" entries must be invoked as your normal desktop user, not via `sudo`. The other entries elevate via `sudo` internally and the menu primes `sudo -v` up-front, so you'll only be prompted once. ## Running a single script directly If you'd rather skip the menu, each script can be run on its own. Use the right invocation pattern for that script's privilege mode: ```bash # sudo scripts (1, 2, 3, 4, 5, 6, 8, 9, 10) — pipe through sudo bash curl -fsSL https://opengist.rmrf.online/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install-firefox.sh | sudo bash # user scripts (7, 11, 12) — DO NOT use sudo; they install per-user bash -c "$(curl -fsSL https://opengist.rmrf.online/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install_font.sh)" ``` Every script accepts `--help` and `--dry-run` (the latter prints what would happen without executing). For example: ```bash curl -fsSL https://opengist.rmrf.online/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install-libreoffice.sh \ | bash -s -- --help ``` ## What "hardened" means here All scripts share the same robustness baseline: - `set -euo pipefail` + IFS hygiene + `ERR` trap reporting the failing line number - `/etc/os-release` distro auto-detection (no hardcoded codenames) - `dpkg --print-architecture` / `uname -m` for architecture (amd64 / arm64 / armhf / x86_64 / aarch64 as applicable to each upstream) - Idempotent — re-running a script does not duplicate APT sources, fstab entries, gsettings entries, or `.desktop` files - `signed-by` keyrings in `/etc/apt/keyrings` (no deprecated `apt-key add`) - Checksum verification where the upstream publishes one (JetBrains SHA-256, LibreOffice MD5, ipatool SHA-256) - Per-user installers refuse to run as root; system installers refuse to run as non-root ## Supported distros - Ubuntu (any modern release; some scripts target Ubuntu 25.10 specifically but work elsewhere) - Debian (most scripts; `install-thunderbird.sh` takes a different code path since Debian has no PPAs) Other distros are rejected up-front rather than failing later in unpredictable ways.

#!/usr/bin/env bash # install-1password.sh — Install 1Password desktop from the official 1Password APT repo. # Hardened: arch-aware, signed-by keyring, debsig verification dir, idempotent, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Configures the official 1Password APT repository (with debsig policy and keyring) and installs the 1Password desktop application. Idempotent: safe to re-run. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac # 1Password publishes builds for amd64 and arm64. ARCH="$(dpkg --print-architecture)" case "$ARCH" in amd64|arm64) : ;; *) die "1Password is only available for amd64/arm64 (detected: $ARCH)." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/1password-archive-keyring.gpg SOURCES=/etc/apt/sources.list.d/1password.list DEBSIG_POLICY_DIR=/etc/debsig/policies/AC2D62742012EA22 DEBSIG_KEYRING_DIR=/usr/share/debsig/keyrings/AC2D62742012EA22 log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl gpg ca-certificates" log "Configuring 1Password APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then run "curl -fsSL https://downloads.1password.com/linux/keys/1password.asc | gpg --dearmor -o '$KEYRING'" run "chmod 0644 '$KEYRING'" fi DESIRED_SRC="deb [arch=${ARCH} signed-by=${KEYRING}] https://downloads.1password.com/linux/debian/${ARCH} stable main" if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Installing debsig policy (verifies package signatures on install)..." run "install -d -m 0755 '$DEBSIG_POLICY_DIR' '$DEBSIG_KEYRING_DIR'" if [[ ! -s "${DEBSIG_POLICY_DIR}/1password.pol" ]]; then run "curl -fsSL https://downloads.1password.com/linux/debian/debsig/1password.pol -o '${DEBSIG_POLICY_DIR}/1password.pol'" fi if [[ ! -s "${DEBSIG_KEYRING_DIR}/debsig.gpg" ]]; then run "curl -fsSL https://downloads.1password.com/linux/keys/1password.asc | gpg --dearmor -o '${DEBSIG_KEYRING_DIR}/debsig.gpg'" fi log "Installing 1Password..." run "apt-get update -qq" run "apt-get install -y 1password" if (( ! DRY_RUN )) && command -v 1password >/dev/null 2>&1; then log "1Password binary available at: $(command -v 1password)" fi log "Done."

#!/usr/bin/env bash # install-bruno.sh — Install Bruno API client from the official APT repository. # Hardened: arch-aware, signed-by keyring with retries (keyserver flake), idempotent, # clean desktop entry, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Configures the official Bruno APT repository (signed-by keyring fetched from keyserver.ubuntu.com with retries) and installs Bruno. Idempotent: safe to re-run. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Bruno APT repo only ships amd64 (detected: $ARCH)." log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/bruno.gpg SOURCES=/etc/apt/sources.list.d/bruno.list KEY_ID="9FA6017ECABE0266" DESKTOP=/usr/share/applications/bruno.desktop log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl gpg ca-certificates" log "Configuring Bruno APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then # keyserver.ubuntu.com is occasionally flaky — retry a few times. ok=0 for attempt in 1 2 3 4 5; do if (( DRY_RUN )); then printf ' DRY-RUN: fetch key 0x%s (attempt %d)\n' "$KEY_ID" "$attempt" ok=1 break fi if curl -fsSL --max-time 30 "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${KEY_ID}" \ | gpg --dearmor -o "$KEYRING" 2>/dev/null && [[ -s "$KEYRING" ]]; then ok=1 break fi warn "Key fetch failed (attempt $attempt/5); retrying in $((attempt*2))s..." sleep "$((attempt*2))" done (( ok )) || die "Could not retrieve Bruno signing key after 5 attempts." run "chmod 0644 '$KEYRING'" fi DESIRED_SRC="deb [arch=${ARCH} signed-by=${KEYRING}] http://debian.usebruno.com/ bruno stable" if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Installing Bruno..." run "apt-get update -qq" run "apt-get install -y bruno" log "Writing desktop entry..." if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$DESKTOP" else cat >"$DESKTOP" <<'EOF' [Desktop Entry] Name=Bruno Comment=Open-source API Client Exec=bruno %U Terminal=false Type=Application Icon=bruno Categories=Development;Utility; StartupNotify=true EOF chmod 0644 "$DESKTOP" fi log "Done. Bruno installed."

#!/usr/bin/env bash # install-espanso.sh — Install Espanso (text expander) with Wayland or X11 build. # Auto-detects session type; falls back to X11 if Wayland is not active. # Hardened: session detection, registers service as the invoking user, idempotent. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 FORCE_VARIANT="" # "wayland" | "x11" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--wayland|--x11] [--help] Installs Espanso from the latest GitHub release. Auto-detects whether to use the Wayland or X11 build based on \$XDG_SESSION_TYPE of the invoking user (SUDO_USER). The systemd-user service is registered for that user, not root. Options: --wayland Force the Wayland build. --x11 Force the X11 build. --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; --wayland) FORCE_VARIANT=wayland ;; --x11) FORCE_VARIANT=x11 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Espanso .deb is published for amd64 only (detected: $ARCH)." ACTUAL_USER="${SUDO_USER:-${USER:-}}" [[ -n "$ACTUAL_USER" && "$ACTUAL_USER" != "root" ]] || die "Run via sudo as a regular user; cannot register the service as root." USER_ID="$(id -u "$ACTUAL_USER")" # Detect session type from the invoking user's environment, fallback to env, fallback to wayland if [[ -n "$FORCE_VARIANT" ]]; then VARIANT="$FORCE_VARIANT" else SESSION_TYPE="$(sudo -u "$ACTUAL_USER" -i printenv XDG_SESSION_TYPE 2>/dev/null || true)" [[ -z "$SESSION_TYPE" ]] && SESSION_TYPE="${XDG_SESSION_TYPE:-wayland}" case "$SESSION_TYPE" in wayland) VARIANT=wayland ;; x11|tty) VARIANT=x11 ;; *) warn "Unknown XDG_SESSION_TYPE='$SESSION_TYPE'; defaulting to wayland."; VARIANT=wayland ;; esac fi log "Detected: ${PRETTY_NAME:-unknown}, user: $ACTUAL_USER, session: $VARIANT" export DEBIAN_FRONTEND=noninteractive TEMP_DEB="$(mktemp -t espanso.XXXXXX.deb)" trap 'rm -f "$TEMP_DEB"' EXIT DEB_NAME="espanso-debian-${VARIANT}-amd64.deb" URL="https://github.com/espanso/espanso/releases/latest/download/${DEB_NAME}" log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y wget libcap2-bin" log "Downloading ${DEB_NAME}..." run "wget -qO '$TEMP_DEB' '$URL'" log "Installing package..." run "apt-get install -y '$TEMP_DEB'" ESPANSO_BIN="$(command -v espanso || true)" [[ -x "$ESPANSO_BIN" ]] || die "espanso binary not found after install." if [[ "$VARIANT" == "wayland" ]]; then log "Setting CAP_DAC_OVERRIDE on $ESPANSO_BIN..." run "setcap 'cap_dac_override+p' '$ESPANSO_BIN'" fi log "Registering & starting espanso service for $ACTUAL_USER..." # Register may fail if already registered — treat that as success. if (( DRY_RUN )); then printf ' DRY-RUN: sudo -u %s XDG_RUNTIME_DIR=/run/user/%s espanso service register || true\n' "$ACTUAL_USER" "$USER_ID" printf ' DRY-RUN: sudo -u %s XDG_RUNTIME_DIR=/run/user/%s espanso start || true\n' "$ACTUAL_USER" "$USER_ID" else sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso service register || true sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso restart || \ sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso start || true fi log "Done. Espanso ($VARIANT) installed and started for $ACTUAL_USER." if [[ "$VARIANT" == "wayland" ]]; then log "Wayland note: non-US keyboards must set the layout in ~/.config/espanso/config/default.yml" fi

#!/usr/bin/env bash # install-firefox.sh — Install Firefox from Mozilla's official APT repository. # Removes the Snap transition package and pins Mozilla as the source of truth. # Hardened: distro-detect, idempotent, signed-by keyring, ERR trap, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 ASSUME_YES=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--yes] [--help] Removes Firefox Snap (and Ubuntu's transitional wrapper), configures the official Mozilla APT repository (signed-by keyring + APT pin), then installs Firefox so it auto-updates from Mozilla. Options: --dry-run Print the actions without executing them. --yes, -y Pass -y to apt for non-interactive install. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } on_err() { local rc=$? line=$1; printf '\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n' "${SCRIPT_NAME%.sh}" "$line" "$rc" >&2; } trap 'on_err $LINENO' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -y|--yes) ASSUME_YES=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found; cannot detect distro." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}. Requires Debian/Ubuntu." ;; esac log "Detected: ${PRETTY_NAME:-unknown} (codename: ${VERSION_CODENAME:-?})" APT_YES=() (( ASSUME_YES )) && APT_YES=(-y) || APT_YES=(-y) # always -y for safety in scripted use export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/packages.mozilla.org.asc SOURCES=/etc/apt/sources.list.d/mozilla.list PIN=/etc/apt/preferences.d/mozilla log "Removing Firefox Snap and Ubuntu's transitional wrapper (if present)..." if command -v snap >/dev/null 2>&1; then run "snap disable firefox >/dev/null 2>&1 || true" run "snap remove --purge firefox >/dev/null 2>&1 || true" fi run "apt-get remove --purge ${APT_YES[*]} firefox >/dev/null 2>&1 || true" run "rm -f /usr/bin/firefox" log "Installing prerequisites (wget, gpg, ca-certificates)..." run "apt-get update -qq" run "apt-get install ${APT_YES[*]} wget gpg ca-certificates" log "Configuring Mozilla APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then run "wget -qO '$KEYRING' https://packages.mozilla.org/apt/repo-signing-key.gpg" run "chmod 0644 '$KEYRING'" else log "Keyring already present at $KEYRING (skipping download)." fi # Verify key fingerprint matches Mozilla's published fingerprint EXPECTED_FPR="35BAA0B33E9EB396F59CA838C0BA5CE6DC6315A3" ACTUAL_FPR="$(gpg --show-keys --with-colons "$KEYRING" 2>/dev/null | awk -F: '/^fpr/ {print $10; exit}')" if [[ "$ACTUAL_FPR" != "$EXPECTED_FPR" ]]; then warn "Mozilla key fingerprint mismatch (expected $EXPECTED_FPR, got ${ACTUAL_FPR:-none}). Continuing, but verify manually." else log "Mozilla key fingerprint verified." fi DESIRED_SRC='deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main' if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Pinning Mozilla repo to priority 1000..." if [[ ! -f "$PIN" ]] || ! grep -q 'origin packages.mozilla.org' "$PIN"; then if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$PIN" else cat >"$PIN" <<'EOF' Package: * Pin: origin packages.mozilla.org Pin-Priority: 1000 EOF fi fi log "Installing Firefox from Mozilla repo..." run "apt-get update -qq" run "apt-get install ${APT_YES[*]} firefox" if (( ! DRY_RUN )) && command -v firefox >/dev/null 2>&1; then log "Installed: $(firefox --version 2>/dev/null || echo 'firefox')" fi log "Done. Firefox installed from Mozilla APT and will auto-update."

#!/bin/bash # Exit immediately if a command exits with a non-zero status set -e FONT_NAME="UbuntuSans" FONT_ZIP="${FONT_NAME}.zip" # Simplified directory: removed the "NerdFonts" subfolder FONT_DIR="$HOME/.local/share/fonts/${FONT_NAME}" TMP_DIR=$(mktemp -d) echo "Searching for the latest release of $FONT_NAME Nerd Font..." # Use GitHub API to find the latest release download URL for UbuntuSans.zip DOWNLOAD_URL=$(curl -s https://api.github.com/repos/ryanoasis/nerd-fonts/releases/latest \ | grep "browser_download_url.*${FONT_ZIP}" \ | cut -d '"' -f 4) if [ -z "$DOWNLOAD_URL" ]; then echo "Error: Could not find the download URL for $FONT_NAME. Check your internet connection or GitHub API limits." rm -rf "$TMP_DIR" exit 1 fi echo "Latest version found!" echo "Downloading from: $DOWNLOAD_URL" # Download the zip file to the temporary directory curl -L -q "$DOWNLOAD_URL" -o "$TMP_DIR/$FONT_ZIP" echo "Extracting fonts..." # Ensure unzip is installed (will fail gracefully if not) if ! command -v unzip &> /dev/null; then echo "Error: 'unzip' is not installed. Please install it using 'sudo apt install unzip' and try again." rm -rf "$TMP_DIR" exit 1 fi unzip -q -o "$TMP_DIR/$FONT_ZIP" -d "$TMP_DIR/extracted" echo "Installing fonts to $FONT_DIR..." # Create the simplified font directory if it doesn't exist mkdir -p "$FONT_DIR" # Move only the TrueType (.ttf) or OpenType (.otf) files to the fonts directory find "$TMP_DIR/extracted" -name '*.[ot]tf' -type f -exec cp {} "$FONT_DIR/" \; echo "Updating the system font cache..." fc-cache -f "$FONT_DIR" echo "Cleaning up temporary files..." rm -rf "$TMP_DIR" echo "Done! $FONT_NAME Nerd Font has been successfully installed."

#!/usr/bin/env bash # install-ibus-pinyin.sh — Install IBus + libpinyin and add Intelligent Pinyin # to GNOME's Input Sources. Tuned for Ubuntu 25.10 (GNOME 49 / Wayland) but # works on any modern Ubuntu/Debian GNOME desktop. # # Hardened: distro-detect, runs as the desktop user (not root) for gsettings, # uses sudo only for apt steps, idempotent re-runs, ERR trap, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 SKIP_GSETTINGS=0 usage() { cat <<EOF Usage: $SCRIPT_NAME [--dry-run] [--skip-gsettings] [--help] Installs ibus-libpinyin (plus Simplified Chinese language packs) and registers 'Intelligent Pinyin' as a GNOME input source. Idempotent. Do NOT run with sudo: gsettings is per-user and must run as the desktop user. The script invokes sudo internally only for apt-get steps. Options: --skip-gsettings Install packages but don't touch GNOME input sources (useful on non-GNOME desktops; configure manually afterwards). --dry-run Print actions without executing. --help, -h Show this help. Switch input methods at runtime with: Super + Space EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; --skip-gsettings) SKIP_GSETTINGS=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done # Resolve the desktop user. If invoked via sudo, gsettings must target SUDO_USER. if (( EUID == 0 )); then DESKTOP_USER="${SUDO_USER:-}" [[ -n "$DESKTOP_USER" && "$DESKTOP_USER" != "root" ]] \ || die "Run as a normal user (the script will call sudo itself for apt). gsettings can't run as root." else DESKTOP_USER="$USER" fi # Look up the user's UID for the DBus session bus. USER_ENTRY="$(getent passwd "$DESKTOP_USER")" || die "User '$DESKTOP_USER' not found in passwd." USER_ID="$(awk -F: '{print $3}' <<<"$USER_ENTRY")" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}. Requires Debian/Ubuntu." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, desktop user: $DESKTOP_USER" # Helper: invoke a command as $DESKTOP_USER with a working DBus address. run_as_user() { local cmd=("$@") if (( DRY_RUN )); then printf ' DRY-RUN (as %s): %s\n' "$DESKTOP_USER" "${cmd[*]}" return 0 fi if (( EUID == 0 )); then sudo -u "$DESKTOP_USER" \ DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" \ XDG_RUNTIME_DIR="/run/user/$USER_ID" \ "${cmd[@]}" else "${cmd[@]}" fi } # Helper: invoke a command with sudo when the caller is non-root. sudo_run() { if (( DRY_RUN )); then printf ' DRY-RUN (sudo): %s\n' "$*" return 0 fi if (( EUID == 0 )); then "$@"; else sudo "$@"; fi } export DEBIAN_FRONTEND=noninteractive log "Installing IBus Pinyin + Simplified Chinese language packs..." sudo_run apt-get update -qq sudo_run apt-get install -y \ ibus \ ibus-libpinyin \ language-pack-zh-hans \ language-pack-gnome-zh-hans # Make sure ibus-daemon picks up the new engines for the user. if command -v ibus >/dev/null 2>&1; then log "Restarting ibus-daemon for $DESKTOP_USER..." # `ibus exit` will fail if no daemon is running — treat as non-fatal. run_as_user ibus exit >/dev/null 2>&1 || true # Start fresh in the background; -drx replaces a running daemon. if (( ! DRY_RUN )); then sudo -u "$DESKTOP_USER" \ DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" \ XDG_RUNTIME_DIR="/run/user/$USER_ID" \ sh -c 'nohup ibus-daemon -drx >/dev/null 2>&1 &' || \ warn "ibus-daemon restart returned non-zero (non-fatal)." sleep 1 fi fi if (( SKIP_GSETTINGS )); then log "Skipping GNOME input-sources update (--skip-gsettings)." log "Done. Add 'Chinese (Intelligent Pinyin)' manually under Settings → Keyboard → Input Sources." exit 0 fi # Only manage gsettings if GNOME schemas are present. if ! run_as_user gsettings list-schemas 2>/dev/null | grep -q '^org.gnome.desktop.input-sources$'; then warn "GNOME schema org.gnome.desktop.input-sources not found; skipping gsettings update." log "Done. Add 'Chinese (Intelligent Pinyin)' manually in your DE's input settings." exit 0 fi log "Adding 'Intelligent Pinyin' to GNOME Input Sources (idempotent)..." CURRENT_SOURCES="$(run_as_user gsettings get org.gnome.desktop.input-sources sources 2>/dev/null || echo '[]')" # Strip the optional "@as " type annotation gvariant sometimes prepends. CLEAN_SOURCES="${CURRENT_SOURCES#@as }" if [[ "$CLEAN_SOURCES" == *"'ibus', 'libpinyin'"* ]]; then log "Intelligent Pinyin already present in input sources — nothing to do." else if [[ -z "$CLEAN_SOURCES" || "$CLEAN_SOURCES" == "[]" || "$CLEAN_SOURCES" == "@as []" ]]; then NEW_SOURCES="[('xkb', 'us'), ('ibus', 'libpinyin')]" else # Insert the libpinyin tuple before the closing bracket of the existing list. NEW_SOURCES="${CLEAN_SOURCES%]*}, ('ibus', 'libpinyin')]" fi run_as_user gsettings set org.gnome.desktop.input-sources sources "$NEW_SOURCES" log "Added: ('ibus', 'libpinyin')" fi log "Done. Switch input methods with: Super + Space" log "If 'Chinese (Intelligent Pinyin)' doesn't appear in the top bar, log out and back in."

#!/usr/bin/env bash # install-ipatool.sh — Install ipatool from the latest GitHub release. # Hardened: arch detection (amd64/arm64), GitHub API token support, SHA-256 verification # from the release checksum file, atomic install to /usr/local/bin, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 REPO="majd/ipatool" INSTALL_PATH="/usr/local/bin/ipatool" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Resolves the latest release of majd/ipatool, downloads the tarball for your architecture, verifies its SHA-256 against the published checksums.txt, and installs the binary to /usr/local/bin/ipatool atomically. If \$GITHUB_TOKEN is set in the environment, it is used to authenticate the GitHub API request (avoids rate limits). Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release log "Detected: ${PRETTY_NAME:-unknown}" ARCH_RAW="$(uname -m)" case "$ARCH_RAW" in x86_64) GO_ARCH=amd64 ;; aarch64) GO_ARCH=arm64 ;; armv7l|armv6l) GO_ARCH=arm ;; *) die "Unsupported architecture: $ARCH_RAW" ;; esac ASSET_SUFFIX="linux-${GO_ARCH}.tar.gz" export DEBIAN_FRONTEND=noninteractive log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl jq tar ca-certificates libsecret-1-0" GH_HDRS=(-H "Accept: application/vnd.github+json") [[ -n "${GITHUB_TOKEN:-}" ]] && GH_HDRS+=(-H "Authorization: Bearer ${GITHUB_TOKEN}") log "Querying GitHub API for latest release of $REPO..." RELEASE_JSON="$(curl -fsSL "${GH_HDRS[@]}" "https://api.github.com/repos/${REPO}/releases/latest")" TAG="$(jq -r '.tag_name // empty' <<<"$RELEASE_JSON")" [[ -n "$TAG" ]] || die "Could not parse latest release tag (rate limited? set GITHUB_TOKEN)." log "Latest release: $TAG" DOWNLOAD_URL="$(jq -r --arg s "$ASSET_SUFFIX" '.assets[] | select(.name | endswith($s)) | .browser_download_url' <<<"$RELEASE_JSON" | head -n1)" CHECKSUM_URL="$(jq -r '.assets[] | select(.name | test("checksums?\\.txt$")) | .browser_download_url' <<<"$RELEASE_JSON" | head -n1)" [[ "$DOWNLOAD_URL" =~ ^https:// ]] || die "No release asset matching '*${ASSET_SUFFIX}'." STAGE="$(mktemp -d -t ipatool.XXXXXX)" trap 'rm -rf "$STAGE"' EXIT TARBALL="$STAGE/ipatool.tar.gz" log "Downloading $(basename "$DOWNLOAD_URL")..." run "curl -fsSL -o '$TARBALL' '$DOWNLOAD_URL'" if [[ -n "$CHECKSUM_URL" ]]; then log "Verifying SHA-256..." EXPECTED="$(curl -fsSL "$CHECKSUM_URL" | awk -v f="$(basename "$DOWNLOAD_URL")" '$2 ~ f || $2 == "*"f {print $1; exit}')" ACTUAL="$(sha256sum "$TARBALL" | awk '{print $1}')" if [[ -n "$EXPECTED" && "$EXPECTED" != "$ACTUAL" ]]; then die "SHA-256 mismatch: expected=$EXPECTED actual=$ACTUAL" fi [[ -n "$EXPECTED" ]] && log "SHA-256 ok." || warn "Asset not listed in checksums.txt; skipping." else warn "No checksums.txt in release; skipping SHA-256 verification." fi log "Extracting..." run "tar -xzf '$TARBALL' -C '$STAGE'" BINARY_PATH="$(find "$STAGE" -type f -name ipatool -executable -not -name '*.tar.gz' | head -n1 || true)" if [[ -z "$BINARY_PATH" ]]; then # Some releases ship the binary without +x; relax the find BINARY_PATH="$(find "$STAGE" -type f -name ipatool -not -name '*.tar.gz' | head -n1 || true)" fi [[ -n "$BINARY_PATH" || $DRY_RUN -eq 1 ]] || die "ipatool binary not found inside archive." log "Installing to $INSTALL_PATH..." run "install -m 0755 '$BINARY_PATH' '$INSTALL_PATH'" if (( ! DRY_RUN )) && command -v ipatool >/dev/null 2>&1; then log "Installed: $(ipatool --version 2>/dev/null || basename "$INSTALL_PATH") ($TAG)" fi log "Done."

#!/usr/bin/env bash # install-jetbrains-toolbox.sh — Install JetBrains Toolbox into the invoking user's home. # Hardened: dependency check w/ auto-install, SHA-256 verification against JetBrains' # release metadata, idempotent (replaces atomically), .desktop entry, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 ASSUME_YES=0 usage() { cat <<EOF Usage: $SCRIPT_NAME [--dry-run] [--yes] [--help] Installs the latest JetBrains Toolbox to ~/.local/share/JetBrains/Toolbox and creates a .desktop launcher in ~/.local/share/applications. The .tar.gz is verified against the SHA-256 published in JetBrains' release feed. Do NOT run with sudo: Toolbox is a per-user install. If a missing system package (curl/jq/tar/libfuse2) needs installing, the script will call sudo just for that step. Options: --yes, -y Auto-confirm prompts for installing missing system packages. --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -y|--yes) ASSUME_YES=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID != 0 )) || die "Do NOT run as root. Toolbox is a per-user install." [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) PKG_MGR=apt ;; *fedora*|*rhel*) PKG_MGR=dnf ;; *arch*) PKG_MGR=pacman ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac log "Detected: ${PRETTY_NAME:-unknown} (pkg: $PKG_MGR)" confirm() { (( ASSUME_YES )) && return 0 read -rp "$1 [y/N] " ans [[ "$ans" =~ ^[Yy] ]] } ensure_pkg() { local pkg="$1" probe="$2" if eval "$probe" >/dev/null 2>&1; then return 0; fi if ! confirm "Package '$pkg' is missing. Install via sudo $PKG_MGR?"; then die "'$pkg' is required." fi case "$PKG_MGR" in apt) run "sudo apt-get update -qq && sudo apt-get install -y '$pkg'" ;; dnf) run "sudo dnf install -y '$pkg'" ;; pacman) run "sudo pacman -Sy --noconfirm '$pkg'" ;; esac } # Map deps: command-or-package-probe ensure_pkg curl "command -v curl" ensure_pkg jq "command -v jq" ensure_pkg tar "command -v tar" case "$PKG_MGR" in apt) ensure_pkg libfuse2 "dpkg -s libfuse2" ;; dnf) ensure_pkg fuse-libs "rpm -q fuse-libs" ;; pacman) ensure_pkg fuse2 "pacman -Q fuse2" ;; esac ARCH_RAW="$(uname -m)" case "$ARCH_RAW" in x86_64) TOOLBOX_ARCH_KEY=linux ;; aarch64) TOOLBOX_ARCH_KEY=linuxARM64 ;; *) die "Unsupported architecture: $ARCH_RAW" ;; esac log "Querying JetBrains release feed..." RELEASE_JSON="$(curl -fsSL 'https://data.services.jetbrains.com/products/releases?code=TBA&latest=true&type=release' \ -H 'Origin: https://www.jetbrains.com' \ -H 'Referer: https://www.jetbrains.com/toolbox/download/')" TOOLBOX_URL="$(jq -r --arg k "$TOOLBOX_ARCH_KEY" '.TBA[0].downloads[$k].link // empty' <<<"$RELEASE_JSON")" TOOLBOX_SHA="$(jq -r --arg k "$TOOLBOX_ARCH_KEY" '.TBA[0].downloads[$k].checksumLink // empty' <<<"$RELEASE_JSON")" TOOLBOX_VER="$(jq -r '.TBA[0].version // "?"' <<<"$RELEASE_JSON")" [[ -n "$TOOLBOX_URL" ]] || die "Could not resolve Toolbox download URL from release feed." log "Latest Toolbox: $TOOLBOX_VER ($TOOLBOX_ARCH_KEY)" INSTALL_DIR="$HOME/.local/share/JetBrains/Toolbox" STAGE_DIR="$(mktemp -d -t toolbox.XXXXXX)" trap 'rm -rf "$STAGE_DIR"' EXIT TARBALL="$STAGE_DIR/toolbox.tar.gz" log "Downloading..." run "curl -fsSL -o '$TARBALL' '$TOOLBOX_URL'" if [[ -n "$TOOLBOX_SHA" ]]; then log "Verifying SHA-256..." EXPECTED_SHA="$(curl -fsSL "$TOOLBOX_SHA" | awk '{print $1}')" ACTUAL_SHA="$(sha256sum "$TARBALL" | awk '{print $1}')" if [[ -n "$EXPECTED_SHA" && "$EXPECTED_SHA" != "$ACTUAL_SHA" ]]; then die "SHA-256 mismatch! expected=$EXPECTED_SHA actual=$ACTUAL_SHA" fi log "SHA-256 ok." else warn "No checksum URL in release feed; skipping verification." fi log "Extracting to $INSTALL_DIR..." run "mkdir -p '$INSTALL_DIR'" run "tar -xzf '$TARBALL' --strip-components=1 -C '$INSTALL_DIR'" BIN_PATH="$INSTALL_DIR/bin/jetbrains-toolbox" DESKTOP_SRC="$INSTALL_DIR/bin/jetbrains-toolbox.desktop" ICON_PATH="$INSTALL_DIR/bin/toolbox-tray-color.png" [[ -x "$BIN_PATH" || $DRY_RUN -eq 1 ]] || die "Toolbox binary missing after extract." # Optional ~/bin symlink if [[ -d "$HOME/bin" ]]; then run "ln -sfn '$BIN_PATH' '$HOME/bin/jetbrains-toolbox'" fi # .desktop launcher APPS_DIR="$HOME/.local/share/applications" run "mkdir -p '$APPS_DIR'" DESKTOP_DST="$APPS_DIR/jetbrains-toolbox.desktop" if [[ -f "$DESKTOP_SRC" ]] || (( DRY_RUN )); then run "cp '$DESKTOP_SRC' '$DESKTOP_DST'" run "sed -i 's|^Exec=.*|Exec=$BIN_PATH %u|' '$DESKTOP_DST'" if [[ -f "$ICON_PATH" ]]; then run "sed -i 's|^Icon=.*|Icon=$ICON_PATH|' '$DESKTOP_DST'" fi run "chmod 0755 '$DESKTOP_DST'" log "Desktop entry installed: $DESKTOP_DST" else warn "No .desktop file in archive; skipping launcher." fi log "Done. JetBrains Toolbox $TOOLBOX_VER installed to $INSTALL_DIR"

#!/usr/bin/env bash # install-libreoffice.sh — Install the latest stable LibreOffice from documentfoundation.org. # Hardened: arch detection, version JSON when available with HTML fallback, MD5 verification, # uninstalls bundled distro libreoffice* first to avoid conflicts, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 SKIP_REMOVE_DISTRO=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--keep-distro-libreoffice] [--help] Detects the latest stable LibreOffice version on download.documentfoundation.org, downloads the matching DEB tarball for your architecture, verifies the MD5 sum published alongside it, and installs the .deb packages. Options: --keep-distro-libreoffice Don't purge any pre-installed distro libreoffice* (default: purge to avoid library conflicts). --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; --keep-distro-libreoffice) SKIP_REMOVE_DISTRO=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown} (this script installs .deb packages)." ;; esac ARCH_RAW="$(uname -m)" case "$ARCH_RAW" in x86_64) LO_ARCH=x86_64; LO_SUFFIX=Linux_x86-64 ;; aarch64) LO_ARCH=aarch64; LO_SUFFIX=Linux_aarch64 ;; *) die "Unsupported architecture: $ARCH_RAW (LibreOffice ships x86_64 and aarch64)." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH_RAW" export DEBIAN_FRONTEND=noninteractive log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl wget tar coreutils ca-certificates" log "Resolving latest stable LibreOffice version..." INDEX="$(curl -fsSL https://download.documentfoundation.org/libreoffice/stable/)" LATEST_VERSION="$(printf '%s\n' "$INDEX" \ | grep -oP '(?<=href=")[0-9]+\.[0-9]+\.[0-9]+(?=/")' \ | sort -V | tail -1 || true)" [[ -n "$LATEST_VERSION" ]] || die "Could not detect latest version from index page." log "Latest stable: $LATEST_VERSION" BASE="https://download.documentfoundation.org/libreoffice/stable/${LATEST_VERSION}/deb/${LO_ARCH}" ARCHIVE_NAME="LibreOffice_${LATEST_VERSION}_${LO_SUFFIX}_deb.tar.gz" URL="${BASE}/${ARCHIVE_NAME}" SUM_URL="${URL}.md5" STAGE="$(mktemp -d -t lo.XXXXXX)" trap 'rm -rf "$STAGE"' EXIT ARCHIVE="$STAGE/$ARCHIVE_NAME" log "Downloading $ARCHIVE_NAME..." run "wget -q --show-progress -O '$ARCHIVE' '$URL'" log "Verifying MD5..." if EXPECTED_MD5="$(curl -fsSL "$SUM_URL" 2>/dev/null | awk '{print $1}')" && [[ -n "$EXPECTED_MD5" ]]; then ACTUAL_MD5="$(md5sum "$ARCHIVE" | awk '{print $1}')" [[ "$EXPECTED_MD5" == "$ACTUAL_MD5" ]] || die "MD5 mismatch: expected=$EXPECTED_MD5 actual=$ACTUAL_MD5" log "MD5 ok." else warn "No MD5 published for $SUM_URL; skipping checksum." fi log "Extracting..." run "tar -xzf '$ARCHIVE' -C '$STAGE'" DEBS_DIR="$(find "$STAGE" -maxdepth 3 -type d -name DEBS | head -n1 || true)" [[ -n "$DEBS_DIR" || $DRY_RUN -eq 1 ]] || die "DEBS/ directory not found in archive." if (( ! SKIP_REMOVE_DISTRO )); then if dpkg -l 'libreoffice*' 2>/dev/null | awk '/^ii/ {print $2}' | grep -q .; then log "Removing distro-supplied libreoffice* packages to avoid conflicts..." run "apt-get remove --purge -y 'libreoffice*'" fi fi log "Installing .deb packages..." run "dpkg -i -R '$DEBS_DIR'" log "Resolving any missing dependencies..." run "apt-get install -f -y" log "Done. LibreOffice $LATEST_VERSION installed."

#!/usr/bin/env bash # install-network_drive.sh — Auto-mount Synology (SMB/CIFS) shares under /mnt/Synology. # Hardened: safe input handling, no eval-on-username, hostname validation, # fstab managed via begin/end markers (idempotent re-run), creds file 0600, # GNOME dock pinning is best-effort. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 SERVER_ADDR="" SMB_USER="" SMB_PASS="" MASTER_DIR="/mnt/Synology" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [options] Discovers SMB shares on a Synology NAS and adds them to /etc/fstab so they auto-mount under $MASTER_DIR. Creates a desktop launcher and (best-effort) pins it to the top of the GNOME Dock. Options: --server HOST_OR_IP Synology address (skips prompt). --user USERNAME SMB username (skips prompt). --password-stdin Read SMB password from stdin (skips prompt). (Otherwise the script prompts on the controlling tty.) --mount-root DIR Override parent directory (default: $MASTER_DIR). --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR PASS_FROM_STDIN=0 while (( $# )); do case "$1" in --server) SERVER_ADDR="${2:?}"; shift ;; --user) SMB_USER="${2:?}"; shift ;; --password-stdin) PASS_FROM_STDIN=1 ;; --mount-root) MASTER_DIR="${2:?}"; shift ;; --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ACTUAL_USER="${SUDO_USER:-${USER:-}}" [[ -n "$ACTUAL_USER" && "$ACTUAL_USER" != "root" ]] || die "Run via sudo as a regular user." # Use getent so we don't depend on eval/~expansion or shell glob safety. USER_ENTRY="$(getent passwd "$ACTUAL_USER")" || die "User '$ACTUAL_USER' not found in passwd." USER_HOME="$(awk -F: '{print $6}' <<<"$USER_ENTRY")" USER_ID="$(awk -F: '{print $3}' <<<"$USER_ENTRY")" USER_GID="$(awk -F: '{print $4}' <<<"$USER_ENTRY")" export DEBIAN_FRONTEND=noninteractive log "Installing cifs-utils, smbclient..." run "apt-get update -qq" run "apt-get install -y cifs-utils smbclient" # --- Collect creds --- [[ -n "$SERVER_ADDR" ]] || read -rp "Synology NAS address or IP: " SERVER_ADDR </dev/tty SERVER_ADDR="${SERVER_ADDR#smb://}" SERVER_ADDR="${SERVER_ADDR#//}" SERVER_ADDR="${SERVER_ADDR%/}" [[ "$SERVER_ADDR" =~ ^[A-Za-z0-9._-]+$ ]] || die "Invalid host/IP: '$SERVER_ADDR'" [[ -n "$SMB_USER" ]] || read -rp "Synology username: " SMB_USER </dev/tty [[ "$SMB_USER" =~ ^[A-Za-z0-9._@-]+$ ]] || die "Invalid SMB username." if (( PASS_FROM_STDIN )); then IFS= read -r SMB_PASS else read -rsp "Synology password: " SMB_PASS </dev/tty echo fi [[ -n "$SMB_PASS" ]] || die "Password is empty." # --- Credentials file --- CRED_FILE="$USER_HOME/.smbcredentials_synology" log "Writing credentials to $CRED_FILE (mode 0600)..." if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$CRED_FILE" else umask 077 { printf 'username=%s\n' "$SMB_USER" printf 'password=%s\n' "$SMB_PASS" } >"$CRED_FILE" chown "$USER_ID:$USER_GID" "$CRED_FILE" chmod 0600 "$CRED_FILE" fi # --- Query shares --- log "Discovering shares on //$SERVER_ADDR..." if (( DRY_RUN )); then SHARE_LIST=$'home\nphoto\nvideo' else SHARE_LIST="$(smbclient -L "//$SERVER_ADDR" -U "$SMB_USER%$SMB_PASS" -g 2>/dev/null \ | awk -F'|' '$1=="Disk" {print $2}' || true)" fi [[ -n "$SHARE_LIST" ]] || die "No shares returned. Check host, credentials, or network." # --- Parent mount dir --- run "mkdir -p '$MASTER_DIR'" run "chown '$USER_ID:$USER_GID' '$MASTER_DIR'" # --- Backup fstab once --- if [[ ! -f /etc/fstab.bak.synology ]]; then run "cp /etc/fstab /etc/fstab.bak.synology" log "Backed up fstab -> /etc/fstab.bak.synology" fi MARK_BEGIN="# >>> synology-master >>> (managed by ${SCRIPT_NAME})" MARK_END="# <<< synology-master <<<" # Remove any previous managed block (so re-run replaces, not appends). if grep -qF "$MARK_BEGIN" /etc/fstab; then if (( DRY_RUN )); then printf ' DRY-RUN: strip previous managed block from /etc/fstab\n' else sed -i "\|$MARK_BEGIN|,\|$MARK_END|d" /etc/fstab fi fi log "Writing managed block to /etc/fstab..." FSTAB_BLOCK="$MARK_BEGIN"$'\n' while IFS= read -r SHARE; do [[ -z "$SHARE" || "$SHARE" == "IPC\$" || "$SHARE" == "print\$" ]] && continue MOUNT_POINT="$MASTER_DIR/$SHARE" run "mkdir -p '$MOUNT_POINT'" run "chown '$USER_ID:$USER_GID' '$MOUNT_POINT'" FSTAB_BLOCK+="//${SERVER_ADDR}/${SHARE} ${MOUNT_POINT} cifs credentials=${CRED_FILE},uid=${USER_ID},gid=${USER_GID},_netdev,nofail,x-systemd.automount,x-systemd.idle-timeout=60 0 0"$'\n' done <<<"$SHARE_LIST" FSTAB_BLOCK+="$MARK_END"$'\n' if (( DRY_RUN )); then printf ' DRY-RUN: append fstab block:\n%s\n' "$FSTAB_BLOCK" else printf '%s' "$FSTAB_BLOCK" >>/etc/fstab fi log "Reloading systemd and mounting..." run "systemctl daemon-reload" run "mount -a -t cifs" # --- Desktop entry --- APPS_DIR="$USER_HOME/.local/share/applications" DESKTOP_FILENAME="synology-master.desktop" DESKTOP_FILE="$APPS_DIR/$DESKTOP_FILENAME" run "install -d -o '$USER_ID' -g '$USER_GID' -m 0755 '$APPS_DIR'" if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$DESKTOP_FILE" else cat >"$DESKTOP_FILE" <<EOF [Desktop Entry] Name=Synology NAS Comment=Open Synology Master Directory Exec=xdg-open ${MASTER_DIR} Icon=folder-remote Terminal=false Type=Application Categories=Network;FileTools; EOF chown "$USER_ID:$USER_GID" "$DESKTOP_FILE" chmod 0755 "$DESKTOP_FILE" fi # --- Best-effort GNOME dock pin --- if (( ! DRY_RUN )) && sudo -u "$ACTUAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" gsettings list-keys org.gnome.shell >/dev/null 2>&1; then log "Pinning to top of GNOME dock..." CURRENT_FAVS="$(sudo -u "$ACTUAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" gsettings get org.gnome.shell favorite-apps 2>/dev/null || echo '[]')" if [[ "$CURRENT_FAVS" != *"$DESKTOP_FILENAME"* ]]; then CLEAN_FAVS="${CURRENT_FAVS#@as }" if [[ "$CLEAN_FAVS" == "[]" || -z "$CLEAN_FAVS" ]]; then NEW_FAVS="['$DESKTOP_FILENAME']" else NEW_FAVS="['$DESKTOP_FILENAME', ${CLEAN_FAVS:1}" fi sudo -u "$ACTUAL_USER" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" \ gsettings set org.gnome.shell favorite-apps "$NEW_FAVS" || warn "Dock pin failed (non-fatal)." else log "Already pinned." fi else log "GNOME not detected (or no active dbus session); skipping dock pin." fi log "Done. Shares mounted under $MASTER_DIR."