hifox/hifox.sh at main · q1sh101/hifox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
#!/usr/bin/env bash
set -euo pipefail

_dir="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"

source "${_dir}/lib/base.sh"
source "${_dir}/lib/deploy.sh"
source "${_dir}/lib/clean.sh"
source "${_dir}/lib/purge.sh"
source "${_dir}/lib/status.sh"
source "${_dir}/lib/watch.sh"
source "${_dir}/lib/systemconfig.sh"

cmd="${1:-}"

case "${cmd}" in
  install)
    [[ $# -le 2 ]] || die "usage: hifox install <--flatpak|--standard>"
    flag="${2:-}"
    target=""
    other=""
    case "${flag}" in
      --flatpak)  target="flatpak"; other="standard" ;;
      --standard) target="standard"; other="flatpak" ;;
      *)          die "usage: hifox install <--flatpak|--standard>" ;;
    esac
    if [[ "${target}" == "standard" && -f /snap/firefox/current/usr/lib/firefox/application.ini ]]; then
      warn "alternatives:"
      warn "  - Mozilla apt repo (.deb)"
      warn "  - Mozilla tarball at /opt/firefox"
      warn "  - hifox install --flatpak"
      die "snap Firefox not supported (/snap is read-only)"
    fi
    installs=$(_list_installations)
    echo "${installs}" | grep -q "^${target}|" || die "no ${target} Firefox found"
    if echo "${installs}" | grep -q "^${other}|"; then
      warn "${other} Firefox is also installed"
      warn "  remove it first, then re-run: hifox install --${target}"
      die "hifox is single-target - pick one Firefox target"
    fi
    _save_target "${target}"
    ok "target: ${target}"
    if [[ "${target}" == "standard" && -t 0 ]]; then
      log "sudo required for /etc/firefox and Firefox install directory"
      sudo -v || die "sudo authentication failed"
    fi
    if [[ "${target}" == "flatpak" ]]; then
      if _check_command flatpak-builder || flatpak info org.flatpak.Builder &>/dev/null; then
        hifox_install_systemconfig
      else
        warn "Flatpak Builder not found - systemconfig extension not registered"
        warn "  install: flatpak install --user flathub org.flatpak.Builder"
        warn "  then run: hifox install-systemconfig"
      fi
    fi
    hifox_deploy
    _bin="${HOME}/.local/bin"
    mkdir -p "${_bin}"
    ln -sf "${_dir}/hifox.sh" "${_bin}/hifox"
    [[ ":${PATH}:" == *":${_bin}:"* ]] || warn "add ${_bin} to PATH"
    ok "command: hifox"
    hifox_watch_install
    log "done - launch Firefox once, close it, launch again"
    ;;
  deploy)
    [[ $# -le 1 ]] || die "deploy takes no arguments"
    hifox_deploy
    ;;
  verify)
    [[ $# -le 1 ]] || die "verify takes no arguments"
    _require_firefox
    source "${_dir}/lib/verify.sh"
    _hifox_verify
    ;;
  clean)
    [[ $# -le 1 ]] || die "clean takes no arguments"
    hifox_clean
    ;;
  purge)
    [[ $# -le 2 ]] || die "usage: hifox purge [--flatpak|--standard]"
    hifox_purge "${2:-}"
    ;;
  status)
    [[ $# -le 1 ]] || die "status takes no arguments"
    hifox_status
    ;;
  logs)
    [[ $# -le 1 ]] || die "logs takes no arguments"
    _require_command journalctl
    exec journalctl --user -n 50 -f -o cat -u hifox-watch.path -u hifox-deploy.service -u hifox-verify.service
    ;;
  watch)
    [[ $# -le 2 ]] || die "usage: hifox watch <install|remove|status>"
    sub="${2:-}"
    case "${sub}" in
      install) hifox_watch_install ;;
      remove)  hifox_watch_remove ;;
      status)  hifox_watch_status ;;
      *)       die "usage: hifox watch <install|remove|status>" ;;
    esac
    ;;
  install-systemconfig)
    [[ $# -le 1 ]] || die "install-systemconfig takes no arguments"
    hifox_install_systemconfig
    ;;
  *)
    log "usage: hifox <command>"
    log "  install <--flatpak|--standard>  first-time setup (target required; saves it, deploys, starts watcher)"
    log "  deploy                          deploy hardening to saved target"
    log "  verify                          check hardening integrity (prefs + files + dump)"
    log "  clean                           remove stale remnant files from profiles"
    log "  purge [--flatpak|--standard]    delete all browsing data (irreversible)"
    log "  status                          show sync state between repo and live"
    log "  logs                            follow deploy + verify output"
    log "  watch   install                 auto-deploy on repo file changes"
    log "  watch   remove                  disable auto-deploy"
    log "  watch   status                  show watcher status"
    log "  install-systemconfig            register flatpak extension (autoconfig + policies in sandbox)"
    exit 1
    ;;
esac