refactor: DRY hash checks with lib.sh and lib.ps1 by brainbloodbarrier · Pull Request #139 · xiv3r/Burpsuite-Professional

brainbloodbarrier · 2026-06-16T15:20:06Z

What changed

This PR implements P2.3 from PLAN.md: extract duplicated hash/version/download logic into shared libraries.

New files

lib.sh — bash helpers used by install.sh, update.sh, install_macos.sh:
- read_value, read_version
- hash_sha256, verify_sha256, download_with_hash
- require_command, verify_loader
lib.ps1 — PowerShell helpers used by install.ps1:
- Read-NormalizedValue, Read-BurpVersion
- Get-Sha256, Test-Sha256, Invoke-DownloadWithHash
- Test-LoaderHash
bootstrap.sh — optional one-liner entry point that downloads install.sh + lib.sh from a GitHub ref and runs the installer. Supports BURP_REPO_URL override.

Ported installers

All four installers now source/dot-source the shared helpers:

install.sh — sources lib.sh
update.sh — sources lib.sh
install_macos.sh — sources lib.sh
install.ps1 — dot-sources lib.ps1

This removes ~30 lines of duplicated VERSION/BURP_SHA256/LOADER_SHA256 read + hash verification logic from each bash script and ~20 lines from install.ps1.

Docs

AGENTS.md updated to document lib.sh, lib.ps1, bootstrap.sh, and the new source conventions.

Verification performed

bash -n install.sh update.sh install_macos.sh lib.sh bootstrap.sh help.sh — all pass.
shellcheck install.sh update.sh install_macos.sh lib.sh bootstrap.sh help.sh — no warnings.
lib.sh smoke test: read_version returns 2026, verify_loader passes, verify_sha256 passes against LOADER_SHA256.
lib.ps1 / install.ps1 could not be parsed locally because pwsh is not installed on this macOS machine; verification is pending on a Windows VM or CI.

Out of scope (tracked as future work)

Hash-pinning Oracle JDK/JRE downloads (issue not working in parrot OS #2).
Automated test suite (issue icon not showing in kali #3).
Nix support beyond x86_64-linux (issue Unable to locate package openjdk-23-jdk & jre #4).

The previous update.sh inherited install.sh verbatim, including sudo apt update && sudo apt install git wget openjdk-21-jre -y. Every update re-ran apt with sudo on already-provisioned machines. This rewrite keeps update.sh narrow: * require an existing git checkout in $HOME/Burpsuite-Professional * git pull --ff-only * revalidate VERSION/BURP_SHA256/LOADER_SHA256 * redownload and rehash the Burp JAR * rehash the bundled loader.jar * atomically replace /bin/burpsuitepro No package installs, no loader download, no Burp launch.

Launcher.jpg (capital L) and launcher.jpg (lowercase) tracked the same image. core.ignorecase=true on macOS hid the duplicate locally, but the repo on Linux/Nix shows both. The lowercase launcher.jpg is the one referenced by install_macos.sh and README.md; the capital-L variant is dead weight.

lib.sh (bash) exposes: - read_value, read_version - hash_sha256, verify_sha256, download_with_hash - require_command, verify_loader lib.ps1 (powershell) exposes: - Read-NormalizedValue, Read-BurpVersion - Get-Sha256, Test-Sha256, Invoke-DownloadWithHash - Test-LoaderHash Both normalize whitespace, lowercase hashes, and fail closed on mismatch.

All four installers now use the shared helpers: - install.sh, update.sh, install_macos.sh source lib.sh - install.ps1 dot-sources lib.ps1 This removes ~30 lines of duplicated VERSION/BURP_SHA256/LOADER_SHA256 read + hash verification logic from each script. The shared helpers normalize whitespace, lowercase hashes, and fail closed on mismatch.

bootstrap.sh downloads the canonical install.sh and lib.sh into a temp dir and execs install.sh. Supports BURP_REPO_URL override and a ref argument. Useful for curl|bash installs without cloning the full repo.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR centralizes Burp JAR versioning and integrity verification across platform installers by introducing shared helper libraries, while also improving launcher generation, update behavior, and Nix/CI integration.

Changes:

Add shared Bash (lib.sh) and PowerShell (lib.ps1) helper libraries for version reading, downloads, and SHA-256 verification.
Update Linux/macOS/Windows installers and Linux updater to read VERSION, verify BURP_SHA256/LOADER_SHA256, and generate launchers using absolute paths.
Update Nix flake/derivation and GitHub Actions workflow to consume VERSION/BURP_SHA256 and verify artifacts; refresh README + add bootstrap script and repo guidelines.

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
update.sh	Converts updater into a safe, repeatable “refresh + hash-verified download + atomic launcher replace” flow using `lib.sh`.
lib.sh	Adds shared Bash helpers for normalized file reads, SHA-256 hashing/verification, and download+verify.
lib.ps1	Adds shared PowerShell helpers for normalized reads, SHA-256 verification, and download+verify.
install_macos.sh	Reworks macOS installer to use shared helpers, verify hashes, and generate a launcher/app bundle more reliably.
install.sh	Reworks Linux installer to use shared helpers, pinned version/hash, and absolute-path launcher creation.
install.ps1	Reworks Windows installer to use shared PowerShell helpers and pinned version/hash verification.
help.sh	Hardens help script with `set -euo pipefail` and safer argument handling.
flake.nix	Refactors flake outputs to a `genAttrs`-based package set.
default.nix	Switches version/hash inputs to files and points fetch URL at GitHub releases; adjusts metadata and run script.
bootstrap.sh	Adds one-liner bootstrapper that downloads `install.sh` + `lib.sh` into a temp dir and executes installer.
VERSION	Introduces centralized version file used by installers/Nix/CI.
README.md	Rewrites docs to reflect new versioning, hash verification, and platform-specific installers.
LOADER_SHA256	Adds hash pin for `loader.jar` verification.
BURP_SHA256	Adds hash pin for Burp JAR verification.
AGENTS.md	Adds contributor guidelines and validation/linting commands.
.github/workflows/burp-pro.yml	Updates workflow to read `VERSION`/`BURP_SHA256`, download the matching JAR, and verify its SHA-256.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+        throw "Failed to download ${Url}: $_"
+    }
+
+    Test-Sha256 -Path $OutFile -ExpectedSha256 $ExpectedSha256


  unzip,
 }: let
-  version = "2025.1.1";
+  version = lib.removeSuffix "\n" (lib.fileContents ./VERSION);


+  burpHash = lib.removeSuffix "\n" (lib.fileContents ./BURP_SHA256);

  burpSrc = fetchurl {
    name = "burpsuite.jar";
    urls = [
-      "https://portswigger.net/burp/releases/download?product=${productName}&version=${version}&type=Jar"
-      "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=${productName}&version=${version}&type=Jar"
+      "https://github.com/xiv3r/Burpsuite-Professional/releases/download/burpsuite-pro/burpsuite_pro_v${version}.jar"
    ];
-    hash = burpHash;
+    sha256 = burpHash;
  };


+# Usage:
+#   curl -fsSL https://github.com/xiv3r/Burpsuite-Professional/raw/main/bootstrap.sh | bash -s -- [ref]
+#
+REPO_URL="${BURP_REPO_URL:-https://github.com/xiv3r/Burpsuite-Professional}"


+
+set -euo pipefail
+
+REPO_URL="https://github.com/xiv3r/Burpsuite-Professional"


+# Downloads install.sh and lib.sh from a GitHub ref into a temp dir,
+# verifies lib.sh against LOADER_SHA256 (if available), then execs install.sh.


+# Best-effort hash check of the downloaded lib.sh against the same ref.
+# If LOADER_SHA256 is not reachable without auth, we still proceed (defense in depth).
+if command -v sha256sum >/dev/null 2>&1; then
+    echo "SHA-256 of downloaded lib.sh: $(sha256sum "${TMP_DIR}/lib.sh" | cut -d' ' -f1)"
+fi


+read_version
+expected_sha256=$(read_value "BURP_SHA256")
+if [[ -z "$expected_sha256" ]]; then
+    echo "Error: BURP_SHA256 is empty." >&2
+    exit 1
+fi


    inherit pname version;

-    runScript = "${jdk}/bin/java --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm.tree=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm.Opcodes=ALL-UNNAMED -javaagent:${loaderSrc}/loader.jar -noverify -jar ${burpSrc} &";
+    runScript = "${jdk}/bin/java --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm.tree=ALL-UNNAMED -javaagent:${loaderSrc}/loader.jar -noverify -jar ${burpSrc}";


+TMP_LAUNCHER="/bin/burpsuitepro.new.$$"
+if [[ "$EUID" -eq 0 ]]; then
+    cp burpsuitepro "$TMP_LAUNCHER"
+    mv -f "$TMP_LAUNCHER" /bin/burpsuitepro
+else
+    sudo cp burpsuitepro "$TMP_LAUNCHER"
+    sudo mv -f "$TMP_LAUNCHER" /bin/burpsuitepro


fax and others added 14 commits June 15, 2026 18:33

docs: replace README.md with full review plan and findings

ce5a4e9

Includes baseline architecture, 6-group review plan, prioritized findings, and arm64 macOS deployment requirements. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

versioning: centralize VERSION, BURP_SHA256, LOADER_SHA256; update Ni…

0fbb7a6

…x flake for hash source; workflow reads hashes from files

linux: add set -euo pipefail, deterministic install dir, absolute lau…

d51692e

…ncher, atomic update, and hash verification

macos: add shebang and set -euo pipefail, dependency checks, portable…

57a245b

… launcher, jpackage fixes, and hash verification

windows: replace Win32_Product with registry queries, fix Burp.bat sp…

af6be48

…acing, and add hash verification

docs: rewrite README.md as install documentation with current filenam…

6dbd97a

…es and hash verification notes

docs: add AGENTS.md repository guidelines

141a8fb

help.sh: enable strict mode and guard $1

0412859

bootstrap: add one-liner helper that downloads install.sh + lib.sh

546cce8

bootstrap.sh downloads the canonical install.sh and lib.sh into a temp dir and execs install.sh. Supports BURP_REPO_URL override and a ref argument. Useful for curl|bash installs without cloning the full repo.

docs: update AGENTS.md for lib.sh, lib.ps1 and bootstrap.sh

752e315

Copilot AI review requested due to automatic review settings June 16, 2026 15:20

docs: add canonical PLAN.md with batch roadmap

7165f1e

brainbloodbarrier mentioned this pull request Jun 16, 2026

P2.3 — DRY hash checks across shell installers via lib.sh / lib.ps1 brainbloodbarrier/Burpsuite-Professional#1

Open

Copilot AI reviewed Jun 16, 2026

View reviewed changes

docs: update PLAN.md with final batch status and PR links

5372ed6

Navigation Menu

refactor: DRY hash checks with lib.sh and lib.ps1 - #139

refactor: DRY hash checks with lib.sh and lib.ps1#139
brainbloodbarrier wants to merge 16 commits into
xiv3r:mainfrom
brainbloodbarrier:batch1-dry-hash

brainbloodbarrier commented Jun 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		set -euo pipefail

		REPO_URL="https://github.com/xiv3r/Burpsuite-Professional"

		# Downloads install.sh and lib.sh from a GitHub ref into a temp dir,
		# verifies lib.sh against LOADER_SHA256 (if available), then execs install.sh.

Conversation

brainbloodbarrier commented Jun 16, 2026

What changed

New files

Ported installers

Docs

Verification performed

Out of scope (tracked as future work)

Related

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants