Skip to content

Debup

Latest
Latest

Choose a tag to compare

View all tags
@Ruraam Ruraam released this 02 Nov 19:54
· 16 commits to main since this release
v4.2.1
b0e31ea
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🐧 debup v4.2.1 — Security Hardening & Reliability Release

A bridge between GitHub Releases and APT — now truly fail-closed.

v4.2.0 focuses on three pillars: security hardening, reliability fixes, and localization polish. No breaking CLI changes, no config migration — existing installations upgrade transparently.

🛡️ Security

  • GPG verification is now fail-closed. The key is downloaded to a temp file, fingerprint-verified, then atomically moved to /etc/apt/keyrings. Previously the key was written to disk before validation.
  • SHA-256 verification is now fail-closed. A missing checksum asset or a missing sha256sum/shasum utility now aborts installation instead of silently skipping.
  • dbp -r no longer purges without confirmation. Interactive [y/N] prompt by default; -y / --yes required for automation.
  • dbp -r no longer vulnerable to regex injection via crafted package names (sed-based filtering replaced by Bash-native line filtering).
  • </dev/tty failures fixed in CI/cron. New prompt_read helper falls back to non-interactive defaults with an explicit warning.
  • Single-request HTTP probe for the GPG URL (%{http_code} + %{content_type} in one HEAD), with reliable detection of HTML 404 pages masquerading as 200 OK.

🐛 Reliability fixes

  • Temp dir leak on success — /tmp/debup-install.* and /tmp/debup-build.* were never cleaned on nominal runs. New cleanup_tempdir_now helper: rm -rf then reset.
  • .deb loss on install-skip — option 3 (build from source) produced the .deb inside /tmp/debup-build.* and lost it when the user answered n. Build output now goes directly to the user's CWD.
  • Duplicate tracking entries — grep -qF "^debup|" treated ^ literally and never matched, causing duplicates in /etc/debup/sources.list on every re-install.
  • Self-tracking now works for options 2 and 3 — dbp -u was silently a no-op for GitHub-release and source builds.
  • Root-owned source tree crash — build no longer fails with Permission denied when a previous sudo dpkg-deb --build left root:root files behind; clear chown hint provided.
  • Missing build dependencies — git / dpkg-deb now auto-installed in option 3.
  • $HOME pollution — option 3 now builds in a dedicated mktemp -d instead of ~/debup.
  • Post-install PATH verification — all three options confirm dbp/debup are reachable.
  • GitHub tag normalization — new normalize_gh_tag handles release-, app-v, cli-v0.5.0-linux-amd64, v1.2.3-beta.1, dpkg epochs (1:1.2.3-1), etc.
  • GitHub search URL encoding — &, #, %, +, ?, / in queries are now safely encoded via jq -sRr @uri.

🎁 Added

  • dbp (no argument) now runs a quick update check — non-destructive summary across APT + tracked GitHub packages. Perfect for cron / MOTD hooks.
  • --non-interactive / -y / --yes documented in installer.sh, with automatic fallback to APT-repo install when no TTY is available.
  • git clone --depth 1 in option 3 — faster, less disk usage.
  • .deb preserved on install failure — option 3 keeps the built package in your CWD even when apt-get install fails; apt-get install -f suggested.
  • --dry-run now surfaces version normalization (latest_tag → normalized_ver).

🌍 Localization

  • 6 languages aligned: en, fr, de, es, it, pt.
  • Missing keys added: MSG_HELP_INSPECT, MSG_PROMPT_REMOVE_CONFIRM, MSG_ERR_UNKNOWN_OPTION, MSG_NO_TTY, MSG_ERR_NO_TTY, MSG_VERSION_NORMALIZED.
  • Typos fixed:
    • de.sh: einenGPG → einen GPG, Installationwird → Installation wird, [y/N] → [j/N].
    • pt.sh: [y/N] → [s/N].
    • fr.sh: [y/N] → [o/N].
  • en.sh duplicate MSG_ERR_NO_ELEVATE removed.
  • MSG_USAGE_REMOVE now shows [-y] in all 6 languages.

🔧 Changed

  • installer.sh: per-option traps replaced by a single global accumulating trap (_cleanup_all).
  • installer.sh: apt-get update -qq is non-blocking in option 1 (|| warning).
  • installer.sh: checksum asset resolution is prioritized (<deb>.sha256 → checksums.txt → *.sha256).
  • README.md: the "Search informations" section now uses dbp -f <owner>/<repo> (was incorrectly -i, which installs).
  • README.md: GitHub token storage is documented as user-level ${XDG_CONFIG_HOME:-$HOME/.config}/debup/token (default) + root-level /etc/debup/debup.conf.

🗑️ Removed

  • debup: dead variable ARCH_REGEX (assigned, never read).
  • installer.sh: redundant second curl -sIL call for Content-Type.
  • Locales: MSG_ERR_CMD_REQUIRED (replaced by MSG_CMD_REQUIRED_SUFFIX).

📦 Installation

Fresh install (recommended — APT repository)

curl -sSL https://raw.githubusercontent.com/Ruraam/debup/main/installer.sh | bash

Automated / CI

curl -sSL https://raw.githubusercontent.com/Ruraam/debup/main/installer.sh | bash -s -- -y

Upgrade from v4.1.x or earlier

If you installed via the APT repository (option 1):

sudo apt update && sudo apt upgrade debup

If you installed via latest release (option 2) or build from source (option 3):

dbp -u
Assets 4
Loading