# Ubuntu / Debian Setup Manager A collection of hardened install scripts for a fresh Ubuntu / Debian desktop, driven by an interactive `menu.sh`. Each script auto-detects the distro, uses `signed-by` APT keyrings where applicable (no `apt-key`), and is idempotent (safe to re-run). ## Quick start — run the menu One-liner — fetches `menu.sh` and runs it. You'll see a numeric picker and can select one option, several, or all: ```bash bash -c "$(curl -fsSL https://opengist.rmrf.online/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/menu.sh)" ``` How to use the picker: - Enter one or more numbers separated by spaces, e.g. `1 6 11` - `0` runs every option in order - `-1` exits The menu caches `sudo` credentials up-front so multi-task runs don't keep re-prompting, and falls back to per-user execution for the three scripts that must not run as root (JetBrains Toolbox, IBus Pinyin, Nerd Fonts). ## Available scripts | # | Script | Runs as | What it does | |---|---|---|---| | 1 | [`install-chrome.sh`](install-chrome.sh) | sudo | Installs Google Chrome Stable from Google's official APT repo using a `signed-by` keyring. | | 2 | [`install-firefox.sh`](install-firefox.sh) | sudo | Removes the Firefox Snap and installs Firefox from Mozilla's official APT repo, with APT pinning so it stays on the Mozilla build. Verifies the Mozilla signing-key fingerprint. | | 3 | [`install-thunderbird.sh`](install-thunderbird.sh) | sudo | Ubuntu: removes the Snap, adds the Mozilla Team PPA, and pins it. Debian: installs from the standard repos. | | 4 | [`install-1password.sh`](install-1password.sh) | sudo | Configures the 1Password APT repo with `debsig` signature policy. Arch-aware (amd64 / arm64). | | 5 | [`install-espanso.sh`](install-espanso.sh) | sudo | Installs Espanso. Auto-detects Wayland vs X11 from `$XDG_SESSION_TYPE` and registers the systemd-user service as the invoking desktop user (not root). | | 6 | [`install-libreoffice.sh`](install-libreoffice.sh) | sudo | Detects the latest stable release on documentfoundation.org, downloads the matching `.deb` tarball, verifies the published MD5, and installs. Purges the distro's `libreoffice*` first to avoid library conflicts (opt-out with `--keep-distro-libreoffice`). | | 7 | [`install-obsidian.sh`](install-obsidian.sh) | sudo | Installs the latest official Obsidian amd64 `.deb` from `obsidianmd/obsidian-releases`. SHA-256 verified against the GitHub release asset digest when available. Honors `$GITHUB_TOKEN` to avoid API rate limits. | | 8 | [`install-drawio.sh`](install-drawio.sh) | sudo | Installs the latest official draw.io Desktop `.deb` from `jgraph/drawio-desktop`. SHA-256 verified against the GitHub release asset digest when available. Honors `$GITHUB_TOKEN` to avoid API rate limits. | | 9 | [`install-vscode.sh`](install-vscode.sh) | sudo | Microsoft's official `code` APT repo, signed-by keyring. `--insiders` flag installs `code-insiders` instead. | | 10 | [`install-jetbrains-toolbox.sh`](install-jetbrains-toolbox.sh) | **user** | Per-user install into `~/.local/share/JetBrains/Toolbox`. SHA-256 verified against JetBrains' release feed. x86_64 + aarch64. Drops a `.desktop` launcher. | | 11 | [`install-bruno.sh`](install-bruno.sh) | sudo | Bruno API client from the official APT repo. Keyserver fetch is wrapped in a 5-attempt retry/backoff because `keyserver.ubuntu.com` is occasionally flaky. | | 12 | [`install-ipatool.sh`](install-ipatool.sh) | sudo | Installs the latest release of `majd/ipatool` from GitHub. SHA-256 verified against the release `checksums.txt`. Honors `$GITHUB_TOKEN` to avoid API rate limits. | | 13 | [`install-qbittorrent.sh`](install-qbittorrent.sh) | sudo | Installs the latest official qBittorrent x86_64 AppImage from `qbittorrent/qBittorrent`. SHA-256 verified against the GitHub release asset digest when available. Installs launcher, icons, and torrent/magnet handlers. | | 14 | [`install-network_drive.sh`](install-network_drive.sh) | sudo | Discovers SMB shares on a Synology NAS and adds them to `/etc/fstab` under `/mnt/Synology` with `x-systemd.automount`. fstab block is managed via begin/end markers so re-runs replace rather than duplicate. Credentials file is `0600`. Best-effort GNOME Dock pin. | | 15 | [`install-ibus-pinyin.sh`](install-ibus-pinyin.sh) | **user** | Installs `ibus-libpinyin` and Simplified Chinese language packs, restarts the IBus daemon, and idempotently adds `('ibus', 'libpinyin')` to GNOME's input sources via `gsettings`. | | 16 | [`install-font.sh`](install-font.sh) | **user** | Installs the latest Ubuntu Sans Nerd Font and JetBrains Mono Nerd Font to `~/.local/share/fonts`, then refreshes the font cache. No sudo needed. | | 17 | [`timedatectl-fix.sh`](timedatectl-fix.sh) | sudo | Sets the hardware clock to UTC to avoid time drift when dual-booting Linux and Windows. | | 18 | [`install-localsend.sh`](install-localsend.sh) | sudo | Installs the latest official LocalSend `.deb` from `localsend/localsend`. SHA-256 verified against the GitHub release asset digest when available. | | 19 | [`install-telegram.sh`](install-telegram.sh) | sudo | Installs the latest official Telegram Desktop Linux build from Telegram's latest download endpoint. Adds launcher and `tg:` URL handler. | | 20 | [`install-discord.sh`](install-discord.sh) | sudo | Installs the latest official Discord Linux `.deb` from Discord's latest download endpoint. | "Runs as **user**" entries must be invoked as your normal desktop user, not via `sudo`. The other entries elevate via `sudo` internally and the menu primes `sudo -v` up-front, so you'll only be prompted once. ## Running a single script directly If you'd rather skip the menu, each script can be run on its own. Use the right invocation pattern for that script's privilege mode: ```bash # sudo scripts (1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13, 14, 17, 18, 19, 20) — pipe through sudo bash curl -fsSL https://opengist.rmrf.online/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install-firefox.sh | sudo bash # user scripts (10, 15, 16) — DO NOT use sudo; they install per-user bash -c "$(curl -fsSL https://opengist.rmrf.online/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install-font.sh)" ``` Most installers accept `--help` and `--dry-run` (the latter prints what would happen without executing). For example: ```bash curl -fsSL https://opengist.rmrf.online/weehong/2de15ba0106a475fa41215159203a63b/raw/HEAD/install-libreoffice.sh \ | bash -s -- --help ``` ## What "hardened" means here The hardened installers generally share this robustness baseline: - `set -euo pipefail` + IFS hygiene + `ERR` trap reporting the failing line number - `/etc/os-release` distro auto-detection (no hardcoded codenames) - `dpkg --print-architecture` / `uname -m` for architecture (amd64 / arm64 / armhf / x86_64 / aarch64 as applicable to each upstream) - Idempotent — re-running a script does not duplicate APT sources, fstab entries, gsettings entries, or `.desktop` files - `signed-by` keyrings in `/etc/apt/keyrings` (no deprecated `apt-key add`) - Checksum verification where the upstream publishes one (JetBrains SHA-256, LibreOffice MD5, Obsidian SHA-256, ipatool SHA-256, draw.io SHA-256, qBittorrent SHA-256, LocalSend SHA-256) - Per-user installers refuse to run as root; system installers refuse to run as non-root ## Supported distros - Ubuntu (any modern release; some scripts target Ubuntu 25.10 specifically but work elsewhere) - Debian (most scripts; `install-thunderbird.sh` takes a different code path since Debian has no PPAs) Other distros are rejected up-front rather than failing later in unpredictable ways.

#!/usr/bin/env bash # install-1password.sh — Install 1Password desktop from the official 1Password APT repo. # Hardened: arch-aware, signed-by keyring, debsig verification dir, idempotent, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Configures the official 1Password APT repository (with debsig policy and keyring) and installs the 1Password desktop application. Idempotent: safe to re-run. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac # 1Password publishes builds for amd64 and arm64. ARCH="$(dpkg --print-architecture)" case "$ARCH" in amd64|arm64) : ;; *) die "1Password is only available for amd64/arm64 (detected: $ARCH)." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/1password-archive-keyring.gpg SOURCES=/etc/apt/sources.list.d/1password.list DEBSIG_POLICY_DIR=/etc/debsig/policies/AC2D62742012EA22 DEBSIG_KEYRING_DIR=/usr/share/debsig/keyrings/AC2D62742012EA22 log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl gpg ca-certificates" log "Configuring 1Password APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then run "curl -fsSL https://downloads.1password.com/linux/keys/1password.asc | gpg --dearmor -o '$KEYRING'" run "chmod 0644 '$KEYRING'" fi DESIRED_SRC="deb [arch=${ARCH} signed-by=${KEYRING}] https://downloads.1password.com/linux/debian/${ARCH} stable main" if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Installing debsig policy (verifies package signatures on install)..." run "install -d -m 0755 '$DEBSIG_POLICY_DIR' '$DEBSIG_KEYRING_DIR'" if [[ ! -s "${DEBSIG_POLICY_DIR}/1password.pol" ]]; then run "curl -fsSL https://downloads.1password.com/linux/debian/debsig/1password.pol -o '${DEBSIG_POLICY_DIR}/1password.pol'" fi if [[ ! -s "${DEBSIG_KEYRING_DIR}/debsig.gpg" ]]; then run "curl -fsSL https://downloads.1password.com/linux/keys/1password.asc | gpg --dearmor -o '${DEBSIG_KEYRING_DIR}/debsig.gpg'" fi log "Installing 1Password..." run "apt-get update -qq" run "apt-get install -y 1password" if (( ! DRY_RUN )) && command -v 1password >/dev/null 2>&1; then log "1Password binary available at: $(command -v 1password)" fi log "Done."

#!/usr/bin/env bash # install-bruno.sh — Install Bruno API client from the official APT repository. # Hardened: arch-aware, signed-by keyring with retries (keyserver flake), idempotent, # clean desktop entry, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Configures the official Bruno APT repository (signed-by keyring fetched from keyserver.ubuntu.com with retries) and installs Bruno. Idempotent: safe to re-run. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Bruno APT repo only ships amd64 (detected: $ARCH)." log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/bruno.gpg SOURCES=/etc/apt/sources.list.d/bruno.list KEY_ID="9FA6017ECABE0266" DESKTOP=/usr/share/applications/bruno.desktop log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl gpg ca-certificates" log "Configuring Bruno APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then # keyserver.ubuntu.com is occasionally flaky — retry a few times. ok=0 for attempt in 1 2 3 4 5; do if (( DRY_RUN )); then printf ' DRY-RUN: fetch key 0x%s (attempt %d)\n' "$KEY_ID" "$attempt" ok=1 break fi if curl -fsSL --max-time 30 "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${KEY_ID}" \ | gpg --dearmor -o "$KEYRING" 2>/dev/null && [[ -s "$KEYRING" ]]; then ok=1 break fi warn "Key fetch failed (attempt $attempt/5); retrying in $((attempt*2))s..." sleep "$((attempt*2))" done (( ok )) || die "Could not retrieve Bruno signing key after 5 attempts." run "chmod 0644 '$KEYRING'" fi DESIRED_SRC="deb [arch=${ARCH} signed-by=${KEYRING}] http://debian.usebruno.com/ bruno stable" if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Installing Bruno..." run "apt-get update -qq" run "apt-get install -y bruno" log "Writing desktop entry..." if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$DESKTOP" else cat >"$DESKTOP" <<'EOF' [Desktop Entry] Name=Bruno Comment=Open-source API Client Exec=bruno %U Terminal=false Type=Application Icon=bruno Categories=Development;Utility; StartupNotify=true EOF chmod 0644 "$DESKTOP" fi log "Done. Bruno installed."

#!/usr/bin/env bash # # install-chrome.sh — Native Google Chrome Installer for Ubuntu/Debian # Downloads and installs the latest official stable release without Snap. # # Usage: # sudo ./install-chrome.sh set -euo pipefail IFS=$'\n\t' # Ensure the script is run as root if (( EUID != 0 )); then echo "[ERROR] This script must be run as root (via sudo)." >&2 exit 1 fi echo "[1/4] Installing necessary prerequisites..." apt-get update -y apt-get install -y curl gnupg2 ca-certificates echo "[2/4] Setting up Google's official repository keys..." # Create directory for Third-Party APT keys if it doesn't exist install -d -m 0755 /etc/apt/keyrings # Fetch the official signing key and save it securely curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | \ gpg --dearmor --yes -o /etc/apt/keyrings/google-chrome.gpg # Configure the APT repository to strictly use that signing key echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \ > /etc/apt/sources.list.d/google-chrome.list echo "[3/4] Fetching package lists and installing Google Chrome..." apt-get update -y apt-get install -y google-chrome-stable echo "[4/4] Verifying installation..." if command -v google-chrome &>/dev/null; then echo "------------------------------------------------------" echo "SUCCESS: Google Chrome has been installed successfully!" echo "Version: $(google-chrome --version)" echo "------------------------------------------------------" else echo "[ERROR] Google Chrome installation could not be verified." >&2 exit 1 fi

#!/usr/bin/env bash # install-discord.sh — Install Discord from the latest official Linux .deb. # Hardened: official latest endpoint, idempotent, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 DOWNLOAD_URL="https://discord.com/api/download?platform=linux&format=deb" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Downloads Discord from Discord's official latest Linux .deb endpoint and installs it with apt-get. Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Discord's official Linux .deb targets amd64 only (detected: $ARCH)." log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl ca-certificates" STAGE="$(mktemp -d -t discord.XXXXXX)" trap 'rm -rf "$STAGE"' EXIT DEB="$STAGE/discord.deb" log "Downloading latest Discord .deb..." run "curl -fL -o '$DEB' '$DOWNLOAD_URL'" if (( DRY_RUN )); then printf ' DRY-RUN: apt-get install -y %s\n' "$DEB" log "Done." exit 0 fi log "Installing Discord..." run "apt-get install -y '$DEB'" if command -v discord >/dev/null 2>&1; then log "Installed: $(discord --version 2>/dev/null || dpkg-query -W -f='${Version}' discord 2>/dev/null || echo Discord)" else log "Installed: $(dpkg-query -W -f='${Version}' discord 2>/dev/null || echo Discord)" fi log "Done."

#!/usr/bin/env bash # install-drawio.sh — Install draw.io Desktop from the latest official GitHub release. # Hardened: arch-aware, GitHub API token support, SHA-256 verification from the # release asset digest, idempotent, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 REPO="jgraph/drawio-desktop" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Resolves the latest release of jgraph/drawio-desktop, downloads the official Linux .deb package for your architecture, verifies its SHA-256 against the GitHub release asset digest when available, and installs it with apt-get. If \$GITHUB_TOKEN is set in the environment, it is used to authenticate the GitHub API request (avoids rate limits). Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" case "$ARCH" in amd64|arm64) : ;; *) die "draw.io Desktop publishes Linux .deb assets for amd64 and arm64 only (detected: $ARCH)." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, arch: $ARCH" export DEBIAN_FRONTEND=noninteractive log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl jq ca-certificates" GH_HDRS=(-H "Accept: application/vnd.github+json") [[ -n "${GITHUB_TOKEN:-}" ]] && GH_HDRS+=(-H "Authorization: Bearer ${GITHUB_TOKEN}") log "Querying GitHub API for latest release of $REPO..." RELEASE_JSON="$(curl -fsSL "${GH_HDRS[@]}" "https://api.github.com/repos/${REPO}/releases/latest")" TAG="$(jq -r '.tag_name // empty' <<<"$RELEASE_JSON")" [[ -n "$TAG" ]] || die "Could not parse latest release tag (rate limited? set GITHUB_TOKEN)." log "Latest release: $TAG" ASSET_REGEX="^drawio-${ARCH}-[^/]+\\.deb$" DOWNLOAD_URL="$(jq -r --arg re "$ASSET_REGEX" '.assets[] | select(.name | test($re)) | .browser_download_url' <<<"$RELEASE_JSON" | head -n1)" ASSET_NAME="$(jq -r --arg re "$ASSET_REGEX" '.assets[] | select(.name | test($re)) | .name' <<<"$RELEASE_JSON" | head -n1)" EXPECTED_SHA="$(jq -r --arg re "$ASSET_REGEX" '.assets[] | select(.name | test($re)) | (.digest // "") | sub("^sha256:"; "")' <<<"$RELEASE_JSON" | head -n1)" [[ "$DOWNLOAD_URL" =~ ^https:// ]] || die "No $ARCH .deb asset found in latest draw.io Desktop release." STAGE="$(mktemp -d -t drawio.XXXXXX)" trap 'rm -rf "$STAGE"' EXIT DEB="$STAGE/$ASSET_NAME" log "Downloading $ASSET_NAME..." run "curl -fsSL -o '$DEB' '$DOWNLOAD_URL'" if (( DRY_RUN )); then [[ -n "$EXPECTED_SHA" && "$EXPECTED_SHA" != "null" ]] \ && printf ' DRY-RUN: verify SHA-256 %s\n' "$EXPECTED_SHA" \ || printf ' DRY-RUN: skip SHA-256 verification; no GitHub asset digest found\n' printf ' DRY-RUN: apt-get install -y %s\n' "$DEB" log "Done." exit 0 fi if [[ -n "$EXPECTED_SHA" && "$EXPECTED_SHA" != "null" ]]; then log "Verifying SHA-256..." ACTUAL_SHA="$(sha256sum "$DEB" | awk '{print $1}')" [[ "$EXPECTED_SHA" == "$ACTUAL_SHA" ]] || die "SHA-256 mismatch: expected=$EXPECTED_SHA actual=$ACTUAL_SHA" log "SHA-256 ok." else warn "No SHA-256 asset digest in GitHub release metadata; skipping verification." fi log "Installing draw.io Desktop..." run "apt-get install -y '$DEB'" if (( ! DRY_RUN )) && command -v drawio >/dev/null 2>&1; then log "Installed: $(drawio --version 2>/dev/null || echo "$TAG")" fi log "Done."

#!/usr/bin/env bash # install-espanso.sh — Install Espanso (text expander) with Wayland or X11 build. # Auto-detects session type; falls back to X11 if Wayland is not active. # Hardened: handles apt temp file permissions, package collisions, and ghost processes. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 FORCE_VARIANT="" # "wayland" | "x11" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--wayland|--x11] [--help] Installs Espanso from the latest GitHub release. Auto-detects whether to use the Wayland or X11 build based on \$XDG_SESSION_TYPE of the invoking user (SUDO_USER). The systemd-user service is registered for that user, not root. Options: --wayland Force the Wayland build. --x11 Force the X11 build. --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; --wayland) FORCE_VARIANT=wayland ;; --x11) FORCE_VARIANT=x11 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}." ;; esac ARCH="$(dpkg --print-architecture)" [[ "$ARCH" == "amd64" ]] || die "Espanso .deb is published for amd64 only (detected: $ARCH)." ACTUAL_USER="${SUDO_USER:-${USER:-}}" [[ -n "$ACTUAL_USER" && "$ACTUAL_USER" != "root" ]] || die "Run via sudo as a regular user; cannot register the service as root." USER_ID="$(id -u "$ACTUAL_USER")" # Detect session type from the invoking user's environment, fallback to env, fallback to wayland if [[ -n "$FORCE_VARIANT" ]]; then VARIANT="$FORCE_VARIANT" else SESSION_TYPE="$(sudo -u "$ACTUAL_USER" -i printenv XDG_SESSION_TYPE 2>/dev/null || true)" [[ -z "$SESSION_TYPE" ]] && SESSION_TYPE="${XDG_SESSION_TYPE:-wayland}" case "$SESSION_TYPE" in wayland) VARIANT=wayland ;; x11|tty) VARIANT=x11 ;; *) warn "Unknown XDG_SESSION_TYPE='$SESSION_TYPE'; defaulting to wayland."; VARIANT=wayland ;; esac fi log "Detected: ${PRETTY_NAME:-unknown}, user: $ACTUAL_USER, session: $VARIANT" export DEBIAN_FRONTEND=noninteractive TEMP_DEB="$(mktemp -t espanso.XXXXXX.deb)" # Ensure the _apt user can read the temporary file to prevent permission denied errors chmod 644 "$TEMP_DEB" trap 'rm -f "$TEMP_DEB"' EXIT DEB_NAME="espanso-debian-${VARIANT}-amd64.deb" URL="https://github.com/espanso/espanso/releases/latest/download/${DEB_NAME}" log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y wget libcap2-bin psmisc" log "Downloading ${DEB_NAME}..." run "wget -qO '$TEMP_DEB' '$URL'" log "Removing conflicting Espanso packages (if any)..." # Suppress output and errors if packages don't exist run "apt-get remove -y espanso espanso-wayland >/dev/null 2>&1 || true" log "Installing package..." run "apt-get install -y '$TEMP_DEB'" ESPANSO_BIN="$(command -v espanso || true)" [[ -x "$ESPANSO_BIN" ]] || die "espanso binary not found after install." if [[ "$VARIANT" == "wayland" ]]; then log "Setting CAP_DAC_OVERRIDE on $ESPANSO_BIN..." run "setcap 'cap_dac_override+p' '$ESPANSO_BIN'" fi log "Clearing ghost processes to prevent start timeouts..." run "sudo -u '$ACTUAL_USER' killall espanso 2>/dev/null || true" log "Registering & starting espanso service for $ACTUAL_USER..." # Register may fail if already registered — treat that as success. if (( DRY_RUN )); then printf ' DRY-RUN: sudo -u %s XDG_RUNTIME_DIR=/run/user/%s espanso service register || true\n' "$ACTUAL_USER" "$USER_ID" printf ' DRY-RUN: sudo -u %s XDG_RUNTIME_DIR=/run/user/%s espanso start || true\n' "$ACTUAL_USER" "$USER_ID" else sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso service register || true sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso restart || \ sudo -u "$ACTUAL_USER" XDG_RUNTIME_DIR="/run/user/$USER_ID" espanso start || true fi log "Done. Espanso ($VARIANT) installed and started for $ACTUAL_USER." if [[ "$VARIANT" == "wayland" ]]; then log "Wayland note: non-US keyboards must set the layout in ~/.config/espanso/config/default.yml" fi

#!/usr/bin/env bash # install-firefox.sh — Install Firefox from Mozilla's official APT repository. # Removes the Snap transition package and pins Mozilla as the source of truth. # Hardened: distro-detect, idempotent, signed-by keyring, ERR trap, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 ASSUME_YES=0 usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--yes] [--help] Removes Firefox Snap (and Ubuntu's transitional wrapper), configures the official Mozilla APT repository (signed-by keyring + APT pin), then installs Firefox so it auto-updates from Mozilla. Options: --dry-run Print the actions without executing them. --yes, -y Pass -y to apt for non-interactive install. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } on_err() { local rc=$? line=$1; printf '\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n' "${SCRIPT_NAME%.sh}" "$line" "$rc" >&2; } trap 'on_err $LINENO' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -y|--yes) ASSUME_YES=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found; cannot detect distro." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}. Requires Debian/Ubuntu." ;; esac log "Detected: ${PRETTY_NAME:-unknown} (codename: ${VERSION_CODENAME:-?})" APT_YES=() (( ASSUME_YES )) && APT_YES=(-y) || APT_YES=(-y) # always -y for safety in scripted use export DEBIAN_FRONTEND=noninteractive KEYRING=/etc/apt/keyrings/packages.mozilla.org.asc SOURCES=/etc/apt/sources.list.d/mozilla.list PIN=/etc/apt/preferences.d/mozilla log "Removing Firefox Snap and Ubuntu's transitional wrapper (if present)..." if command -v snap >/dev/null 2>&1; then run "snap disable firefox >/dev/null 2>&1 || true" run "snap remove --purge firefox >/dev/null 2>&1 || true" fi run "apt-get remove --purge ${APT_YES[*]} firefox >/dev/null 2>&1 || true" run "rm -f /usr/bin/firefox" log "Installing prerequisites (wget, gpg, ca-certificates)..." run "apt-get update -qq" run "apt-get install ${APT_YES[*]} wget gpg ca-certificates" log "Configuring Mozilla APT repository..." run "install -d -m 0755 /etc/apt/keyrings" if [[ ! -s "$KEYRING" ]]; then run "wget -qO '$KEYRING' https://packages.mozilla.org/apt/repo-signing-key.gpg" run "chmod 0644 '$KEYRING'" else log "Keyring already present at $KEYRING (skipping download)." fi # Verify key fingerprint matches Mozilla's published fingerprint EXPECTED_FPR="35BAA0B33E9EB396F59CA838C0BA5CE6DC6315A3" ACTUAL_FPR="$(gpg --show-keys --with-colons "$KEYRING" 2>/dev/null | awk -F: '/^fpr/ {print $10; exit}')" if [[ "$ACTUAL_FPR" != "$EXPECTED_FPR" ]]; then warn "Mozilla key fingerprint mismatch (expected $EXPECTED_FPR, got ${ACTUAL_FPR:-none}). Continuing, but verify manually." else log "Mozilla key fingerprint verified." fi DESIRED_SRC='deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main' if [[ ! -f "$SOURCES" ]] || ! grep -qxF "$DESIRED_SRC" "$SOURCES"; then run "printf '%s\n' '$DESIRED_SRC' > '$SOURCES'" fi log "Pinning Mozilla repo to priority 1000..." if [[ ! -f "$PIN" ]] || ! grep -q 'origin packages.mozilla.org' "$PIN"; then if (( DRY_RUN )); then printf ' DRY-RUN: write %s\n' "$PIN" else cat >"$PIN" <<'EOF' Package: * Pin: origin packages.mozilla.org Pin-Priority: 1000 EOF fi fi log "Installing Firefox from Mozilla repo..." run "apt-get update -qq" run "apt-get install ${APT_YES[*]} firefox" if (( ! DRY_RUN )) && command -v firefox >/dev/null 2>&1; then log "Installed: $(firefox --version 2>/dev/null || echo 'firefox')" fi log "Done. Firefox installed from Mozilla APT and will auto-update."

#!/usr/bin/env bash set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" readonly FONT_BASE_DIR="$HOME/.local/share/fonts" readonly TMP_DIR="$(mktemp -d)" log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } cleanup() { rm -rf "$TMP_DIR" } trap cleanup EXIT if (( EUID == 0 )); then die "Do not run as root. Run as your normal desktop user so fonts install under $HOME." fi for tool in curl unzip fc-cache find; do command -v "$tool" >/dev/null 2>&1 || die "Missing required tool: $tool" done latest_nerd_font_url() { local asset_name="$1" local url url="$( curl -fsSL https://api.github.com/repos/ryanoasis/nerd-fonts/releases/latest \ | grep "browser_download_url.*${asset_name}" \ | cut -d '"' -f 4 \ | head -n 1 \ || true )" [[ -n "$url" ]] || die "Could not find download URL for $asset_name. Check connectivity or GitHub API limits." printf '%s' "$url" } install_nerd_font() { local display_name="$1" local asset_name="$2" local font_dir="$3" local download_url="$4" local zip_path="$TMP_DIR/${asset_name}.zip" local extract_dir="$TMP_DIR/${asset_name}" local installed_count if [[ -z "$download_url" ]]; then log "Finding latest $display_name release..." download_url="$(latest_nerd_font_url "${asset_name}.zip")" fi log "Downloading $display_name..." curl -fL --retry 3 --retry-delay 2 -o "$zip_path" "$download_url" log "Extracting $display_name..." mkdir -p "$extract_dir" "$font_dir" unzip -q -o "$zip_path" -d "$extract_dir" installed_count="$( find "$extract_dir" -type f \( -name '*.ttf' -o -name '*.otf' \) \ -exec cp {} "$font_dir/" \; \ -printf '.' \ | wc -c )" [[ "$installed_count" -gt 0 ]] || die "No font files found in ${asset_name}.zip" find "$font_dir" -type f \( -name '*.ttf' -o -name '*.otf' \) -exec chmod 0644 {} + log "Installed $installed_count font files to $font_dir" } mkdir -p "$FONT_BASE_DIR" install_nerd_font \ "Ubuntu Sans Nerd Font" \ "UbuntuSans" \ "$FONT_BASE_DIR/UbuntuSans" \ "" install_nerd_font \ "JetBrains Mono Nerd Font" \ "JetBrainsMono" \ "$FONT_BASE_DIR/JetBrainsMonoNerdFont" \ "" log "Updating font cache..." fc-cache -f "$FONT_BASE_DIR" if command -v fc-match >/dev/null 2>&1; then log "Resolved terminal font: $(fc-match 'JetBrainsMono Nerd Font Mono')" fi log "Done. Configure your terminal to use JetBrainsMono Nerd Font Mono for Starship Powerline symbols."

#!/usr/bin/env bash # install-ibus-rime.sh — Install IBus + Rime and add it # to GNOME's Input Sources. Tuned for Ubuntu 26.04 (GNOME 50 / Wayland) but # works on any modern Ubuntu/Debian GNOME desktop. # # Hardened: distro-detect, runs as the desktop user (not root) for gsettings, # uses sudo only for apt steps, idempotent re-runs, ERR trap, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 SKIP_GSETTINGS=0 usage() { cat <<EOF Usage: $SCRIPT_NAME [--dry-run] [--skip-gsettings] [--help] Purges old ibus-libpinyin, installs ibus-rime (plus Chinese language packs), configures Rime to default to Simplified Pinyin, and registers 'Rime' as a GNOME input source. Idempotent. Do NOT run with sudo: gsettings is per-user and must run as the desktop user. The script invokes sudo internally only for apt-get steps. Options: --skip-gsettings Install packages but don't touch GNOME input sources (useful on non-GNOME desktops; configure manually afterwards). --dry-run Print actions without executing. --help, -h Show this help. Switch input methods at runtime with: Super + Space EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; --skip-gsettings) SKIP_GSETTINGS=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done # Resolve the desktop user. If invoked via sudo, gsettings must target SUDO_USER. if (( EUID == 0 )); then DESKTOP_USER="${SUDO_USER:-}" [[ -n "$DESKTOP_USER" && "$DESKTOP_USER" != "root" ]] \ || die "Run as a normal user (the script will call sudo itself for apt). gsettings can't run as root." else DESKTOP_USER="$USER" fi # Look up the user's UID and Home Directory for configs and DBus. USER_ENTRY="$(getent passwd "$DESKTOP_USER")" || die "User '$DESKTOP_USER' not found in passwd." USER_ID="$(awk -F: '{print $3}' <<<"$USER_ENTRY")" USER_HOME="$(awk -F: '{print $6}' <<<"$USER_ENTRY")" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release case "${ID:-}:${ID_LIKE:-}" in *ubuntu*|*debian*) : ;; *) die "Unsupported distro: ${PRETTY_NAME:-unknown}. Requires Debian/Ubuntu." ;; esac log "Detected: ${PRETTY_NAME:-unknown}, desktop user: $DESKTOP_USER" # Helper: invoke a command as $DESKTOP_USER with a working DBus address. run_as_user() { local cmd=("$@") if (( DRY_RUN )); then printf ' DRY-RUN (as %s): %s\n' "$DESKTOP_USER" "${cmd[*]}" return 0 fi if (( EUID == 0 )); then sudo -u "$DESKTOP_USER" \ DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" \ XDG_RUNTIME_DIR="/run/user/$USER_ID" \ "${cmd[@]}" else "${cmd[@]}" fi } # Helper: invoke a command with sudo when the caller is non-root. sudo_run() { if (( DRY_RUN )); then printf ' DRY-RUN (sudo): %s\n' "$*" return 0 fi if (( EUID == 0 )); then "$@"; else sudo "$@"; fi } export DEBIAN_FRONTEND=noninteractive log "Removing old ibus-libpinyin if present..." sudo_run apt-get remove --purge -y ibus-libpinyin || true log "Installing IBus Rime + Chinese language packs..." sudo_run apt-get update -qq sudo_run apt-get install -y \ ibus \ ibus-rime \ language-pack-zh-hans \ language-pack-gnome-zh-hans log "Configuring Rime to permanently default to Simplified Pinyin..." RIME_DIR="$USER_HOME/.config/ibus/rime" if (( DRY_RUN )); then printf ' DRY-RUN (as %s): Create %s/default.custom.yaml\n' "$DESKTOP_USER" "$RIME_DIR" else if (( EUID == 0 )); then sudo -u "$DESKTOP_USER" mkdir -p "$RIME_DIR" sudo -u "$DESKTOP_USER" tee "$RIME_DIR/default.custom.yaml" > /dev/null <<'EOF' patch: schema_list: - schema: luna_pinyin_simp EOF else mkdir -p "$RIME_DIR" tee "$RIME_DIR/default.custom.yaml" > /dev/null <<'EOF' patch: schema_list: - schema: luna_pinyin_simp EOF fi fi # Make sure ibus-daemon picks up the new engines and config for the user. if command -v ibus >/dev/null 2>&1; then log "Restarting ibus-daemon for $DESKTOP_USER..." # `ibus exit` will fail if no daemon is running — treat as non-fatal. run_as_user ibus exit >/dev/null 2>&1 || true # Start fresh in the background; -drx replaces a running daemon. if (( ! DRY_RUN )); then sudo -u "$DESKTOP_USER" \ DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$USER_ID/bus" \ XDG_RUNTIME_DIR="/run/user/$USER_ID" \ sh -c 'nohup ibus-daemon -drx >/dev/null 2>&1 &' || \ warn "ibus-daemon restart returned non-zero (non-fatal)." sleep 1 fi fi if (( SKIP_GSETTINGS )); then log "Skipping GNOME input-sources update (--skip-gsettings)." log "Done. Add 'Chinese (Rime)' manually under Settings → Keyboard → Input Sources." exit 0 fi # Only manage gsettings if GNOME schemas are present. if ! run_as_user gsettings list-schemas 2>/dev/null | grep -q '^org.gnome.desktop.input-sources$'; then warn "GNOME schema org.gnome.desktop.input-sources not found; skipping gsettings update." log "Done. Add 'Chinese (Rime)' manually in your DE's input settings." exit 0 fi log "Adding 'Rime' to GNOME Input Sources (idempotent)..." CURRENT_SOURCES="$(run_as_user gsettings get org.gnome.desktop.input-sources sources 2>/dev/null || echo '[]')" # Strip the optional "@as " type annotation gvariant sometimes prepends. CLEAN_SOURCES="${CURRENT_SOURCES#@as }" if [[ "$CLEAN_SOURCES" == *"'ibus', 'rime'"* ]]; then log "Rime already present in input sources — nothing to do." else if [[ "$CLEAN_SOURCES" == *"'ibus', 'libpinyin'"* ]]; then # Dynamically replace libpinyin with rime NEW_SOURCES="${CLEAN_SOURCES//\'libpinyin\'/\'rime\'}" elif [[ -z "$CLEAN_SOURCES" || "$CLEAN_SOURCES" == "[]" || "$CLEAN_SOURCES" == "@as []" ]]; then NEW_SOURCES="[('xkb', 'us'), ('ibus', 'rime')]" else # Insert the rime tuple before the closing bracket of the existing list. NEW_SOURCES="${CLEAN_SOURCES%]*}, ('ibus', 'rime')]" fi run_as_user gsettings set org.gnome.desktop.input-sources sources "$NEW_SOURCES" log "Input sources updated to include: ('ibus', 'rime')" fi log "---" log "Done! Rime is installed and configured for Simplified Pinyin." log "Switch input methods with: Super + Space" log "If 'Chinese (Rime)' doesn't appear in the top bar right away, log out and back in."

#!/usr/bin/env bash # install-ipatool.sh — Install ipatool from the latest GitHub release. # Hardened: arch detection (amd64/arm64), GitHub API token support, SHA-256 verification # from the release checksum file, atomic install to /usr/local/bin, --dry-run. set -euo pipefail IFS=$'\n\t' readonly SCRIPT_NAME="${0##*/}" DRY_RUN=0 REPO="majd/ipatool" INSTALL_PATH="/usr/local/bin/ipatool" usage() { cat <<EOF Usage: sudo $SCRIPT_NAME [--dry-run] [--help] Resolves the latest release of majd/ipatool, downloads the tarball for your architecture, verifies its SHA-256 against the published checksums.txt, and installs the binary to /usr/local/bin/ipatool atomically. If \$GITHUB_TOKEN is set in the environment, it is used to authenticate the GitHub API request (avoids rate limits). Options: --dry-run Print actions without executing. --help, -h Show this help. EOF } log() { printf '\033[1;34m[%s]\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*"; } warn() { printf '\033[1;33m[%s] WARN:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; } die() { printf '\033[1;31m[%s] ERROR:\033[0m %s\n' "${SCRIPT_NAME%.sh}" "$*" >&2; exit 1; } run() { if (( DRY_RUN )); then printf ' DRY-RUN: %s\n' "$*"; else eval "$@"; fi; } trap 'rc=$?; (( rc )) && printf "\033[1;31m[%s] failed at line %s (exit %d)\033[0m\n" "${SCRIPT_NAME%.sh}" "$LINENO" "$rc" >&2' ERR while (( $# )); do case "$1" in --dry-run) DRY_RUN=1 ;; -h|--help) usage; exit 0 ;; *) die "Unknown argument: $1 (try --help)" ;; esac shift done (( EUID == 0 )) || die "Must run as root. Try: sudo $SCRIPT_NAME" [[ -r /etc/os-release ]] || die "/etc/os-release not found." # shellcheck disable=SC1091 . /etc/os-release log "Detected: ${PRETTY_NAME:-unknown}" ARCH_RAW="$(uname -m)" case "$ARCH_RAW" in x86_64) GO_ARCH=amd64 ;; aarch64) GO_ARCH=arm64 ;; armv7l|armv6l) GO_ARCH=arm ;; *) die "Unsupported architecture: $ARCH_RAW" ;; esac ASSET_SUFFIX="linux-${GO_ARCH}.tar.gz" export DEBIAN_FRONTEND=noninteractive log "Installing prerequisites..." run "apt-get update -qq" run "apt-get install -y curl jq tar ca-certificates libsecret-1-0" GH_HDRS=(-H "Accept: application/vnd.github+json") [[ -n "${GITHUB_TOKEN:-}" ]] && GH_HDRS+=(-H "Authorization: Bearer ${GITHUB_TOKEN}") log "Querying GitHub API for latest release of $REPO..." RELEASE_JSON="$(curl -fsSL "${GH_HDRS[@]}" "https://api.github.com/repos/${REPO}/releases/latest")" TAG="$(jq -r '.tag_name // empty' <<<"$RELEASE_JSON")" [[ -n "$TAG" ]] || die "Could not parse latest release tag (rate limited? set GITHUB_TOKEN)." log "Latest release: $TAG" DOWNLOAD_URL="$(jq -r --arg s "$ASSET_SUFFIX" '.assets[] | select(.name | endswith($s)) | .browser_download_url' <<<"$RELEASE_JSON" | head -n1)" CHECKSUM_URL="$(jq -r '.assets[] | select(.name | test("checksums?\\.txt$")) | .browser_download_url' <<<"$RELEASE_JSON" | head -n1)" [[ "$DOWNLOAD_URL" =~ ^https:// ]] || die "No release asset matching '*${ASSET_SUFFIX}'." STAGE="$(mktemp -d -t ipatool.XXXXXX)" trap 'rm -rf "$STAGE"' EXIT TARBALL="$STAGE/ipatool.tar.gz" log "Downloading $(basename "$DOWNLOAD_URL")..." run "curl -fsSL -o '$TARBALL' '$DOWNLOAD_URL'" if [[ -n "$CHECKSUM_URL" ]]; then log "Verifying SHA-256..." EXPECTED="$(curl -fsSL "$CHECKSUM_URL" | awk -v f="$(basename "$DOWNLOAD_URL")" '$2 ~ f || $2 == "*"f {print $1; exit}')" ACTUAL="$(sha256sum "$TARBALL" | awk '{print $1}')" if [[ -n "$EXPECTED" && "$EXPECTED" != "$ACTUAL" ]]; then die "SHA-256 mismatch: expected=$EXPECTED actual=$ACTUAL" fi [[ -n "$EXPECTED" ]] && log "SHA-256 ok." || warn "Asset not listed in checksums.txt; skipping." else warn "No checksums.txt in release; skipping SHA-256 verification." fi log "Extracting..." run "tar -xzf '$TARBALL' -C '$STAGE'" BINARY_PATH="$(find "$STAGE" -type f -name ipatool -executable -not -name '*.tar.gz' | head -n1 || true)" if [[ -z "$BINARY_PATH" ]]; then # Some releases ship the binary without +x; relax the find BINARY_PATH="$(find "$STAGE" -type f -name ipatool -not -name '*.tar.gz' | head -n1 || true)" fi [[ -n "$BINARY_PATH" || $DRY_RUN -eq 1 ]] || die "ipatool binary not found inside archive." log "Installing to $INSTALL_PATH..." run "install -m 0755 '$BINARY_PATH' '$INSTALL_PATH'" if (( ! DRY_RUN )) && command -v ipatool >/dev/null 2>&1; then log "Installed: $(ipatool --version 2>/dev/null || basename "$INSTALL_PATH") ($TAG)" fi log "Done."