refactor: DRY hash checks with lib.sh and lib.ps1

.github/workflows/burp-pro.yml

@@ -17,28 +17,51 @@ jobs:
       with:
         fetch-depth: 0
 
+    - name: Read VERSION
+      id: version
+      run: |
+        VERSION=$(cat VERSION | tr -d '[:space:]')
+        echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+
+    - name: Read BURP_SHA256
+      id: burp_sha256
+      run: |
+        BURP_SHA256=$(cat BURP_SHA256 | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')
+        echo "BURP_SHA256=$BURP_SHA256" >> $GITHUB_OUTPUT
+
     - name: Download files
       run: |
         sudo apt update
         sudo apt install axel -y
         mkdir -p downloads
         cd downloads
-        axel -o burpsuite_pro_v2026.jar https://portswigger.net/burp/releases/download?product=pro&type=Jar
+        axel -o "burpsuite_pro_v${{ steps.version.outputs.VERSION }}.jar" "https://github.com/xiv3r/Burpsuite-Professional/releases/download/burpsuite-pro/burpsuite_pro_v${{ steps.version.outputs.VERSION }}.jar"
 
-    - name: Verifying Checksum
+    - name: Verify JAR hash
+      run: |
+        cd downloads
+        EXPECTED_SHA256="${{ steps.burp_sha256.outputs.BURP_SHA256 }}"
+        ACTUAL_SHA256=$(sha256sum "burpsuite_pro_v${{ steps.version.outputs.VERSION }}.jar" | cut -d' ' -f1 | tr '[:upper:]' '[:lower:]')
+        if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
+          echo "SHA-256 mismatch: expected $EXPECTED_SHA256, got $ACTUAL_SHA256"
+          exit 1
+        fi
+        echo "SHA-256 hash verified: $ACTUAL_SHA256"
+
+    - name: Generate checksum files
       run: |
         cd downloads
         echo MD5: > md5
-        md5sum burpsuite_pro_v2026.jar >> md5
+        md5sum "burpsuite_pro_v${{ steps.version.outputs.VERSION }}.jar" >> md5
 
         echo SHA1: > sha1
-        sha1sum burpsuite_pro_v2026.jar >> sha1
+        sha1sum "burpsuite_pro_v${{ steps.version.outputs.VERSION }}.jar" >> sha1
 
         echo SHA256: > sha256
-        sha256sum burpsuite_pro_v2026.jar >> sha256
+        sha256sum "burpsuite_pro_v${{ steps.version.outputs.VERSION }}.jar" >> sha256
 
         echo SHA512: > sha512
-        sha512sum burpsuite_pro_v2026.jar >> sha512
+        sha512sum "burpsuite_pro_v${{ steps.version.outputs.VERSION }}.jar" >> sha512
 
     - name: Determine release tag
       id: get_tag

AGENTS.md

@@ -0,0 +1,75 @@
+# Repository Guidelines
+
+This repository packages and installs Burp Suite Professional across Linux, macOS, Windows, and NixOS. It is a distribution/installer project, not a web application.
+
+## Project Structure
+
+- `install.sh` — Linux installer (`apt`/`wget`)
+- `install_macos.sh` — macOS installer (`curl`/`jpackage`)
+- `install.ps1` — Windows installer (PowerShell)
+- `update.sh` — Linux updater
+- `lib.sh` — Shared bash helpers (hash, version, download)
+- `lib.ps1` — Shared PowerShell helpers
+- `bootstrap.sh` — One-liner bootstrap that downloads `install.sh` + `lib.sh`
+- `default.nix` / `flake.nix` / `flake.lock` — Nix/NixOS packaging
+- `.github/workflows/burp-pro.yml` — CI release workflow
+- `help.sh` — CLI helper that lists available scripts
+- Binary assets: `loader.jar`, `launcher.jpg`, `burp_suite.icns`, `burp_suite.ico`
+
+## Build, Test, and Development Commands
+
+There is no build system or test suite. Verify scripts locally by reviewing and running them in a safe environment:
+
+```bash
+# Syntax check all bash scripts
+bash -n install.sh update.sh install_macos.sh lib.sh bootstrap.sh help.sh
+
+# Lint bash scripts
+shellcheck install.sh update.sh install_macos.sh lib.sh bootstrap.sh help.sh
+
+# List available commands
+./help.sh
+
+# Inspect an installer before execution
+cat install.sh
+```
+
+For Nix:
+
+```bash
+nix build .#burpsuitepro
+```
+
+## Coding Style and Naming Conventions
+
+- Shell scripts use `#!/bin/bash` + `set -euo pipefail`.
+- New shared bash helpers go in `lib.sh` and are sourced by installers using `$SCRIPT_DIR/lib.sh`.
+- New shared PowerShell helpers go in `lib.ps1` and are dot-sourced using `Join-Path $PSScriptRoot 'lib.ps1'`.
+- Quote all variable expansions, especially paths and URLs.
+- Prefer absolute paths or `$BASH_SOURCE`/`$0` over `$(pwd)` in generated launchers.
+- PowerShell variables use `PascalCase`; batch output is generated inline.
+- Version numbers must be centralized. `VERSION`, `BURP_SHA256`, and `LOADER_SHA256` are the single sources of truth.
+
+## Testing Guidelines
+
+No automated tests exist. Manual verification checklist:
+
+1. Run each installer in a fresh VM or container.
+2. Confirm the generated launcher can start from a different working directory.
+3. Check that `loader.jar` is present and referenced correctly as a Java agent.
+4. On macOS, verify a full JDK with `jpackage` is installed, not just a JRE.
+5. Run `bash -n` and `shellcheck` on every modified `.sh` file before committing.
+
+## Commit and Pull Request Guidelines
+
+- Use descriptive commit messages in the format: `area: what changed` (for example, `install.sh: add set -euo pipefail`).
+- One logical change per commit.
+- Pull requests should explain which platform was tested and any known risks.
+- Do not include downloaded JARs, license keys, or personal loader output in commits.
+
+## Security and Agent-Specific Instructions
+
+- Never commit `loader.jar` activation keys, logs, or credentials.
+- Downloaded binaries must be checked against known hashes before release.
+- Treat installer output paths and Java argument construction as high-risk for quoting and injection bugs.
+- Update README.md when install instructions, filenames, or version numbers change.

BURP_SHA256

@@ -0,0 +1 @@
+2d7ed0c16b87bbd45e539f02494e843a40d22401d2490592167389709670f820

LOADER_SHA256

@@ -0,0 +1 @@
+dcdf28acf360554a5a98d78f403c96ccea500be24b27d02b020e142820637c0a