docs(openspec): archive fpagent-release-installer and sync specs

2026-10-02 09:53:35 +01:00
parent 46027acec1
commit e3392c7750
8 changed files with 479 additions and 5 deletions
@@ -0,0 +1,49 @@
+# Proposal: fpagent-release-installer
+
+## Why
+
+Field laptops need `fpagent` installed and kept current, but the
+`fingerprint-agent` repository is private: its releases require a forge token
+that operators do not have. Today an operator must obtain a bundle out of band
+and run its installer by hand. A public one-line installer hosted by the tools
+app removes that step while keeping the forge credential server-side.
+
+## What Changes
+
+- Add a public installer script served at `/fpagent/install.sh`, intended to be
+  piped into `bash`. It fetches the latest release, selects the bundle matching
+  the host (the Ubuntu-codename offline bundle when present, else the generic
+  online bundle), verifies the published sha256, extracts it, and runs the
+  bundle's own installer, forwarding flags such as `--enable-service`,
+  `--check` and `--uninstall`.
+- Add same-origin proxy routes `/fpagent/releases/latest` and
+  `/fpagent/releases/download/:tag/:name` that read the private release from the
+  forge using the `GITEA_RELEASE_INSTALL_KEY` environment variable and stream
+  assets to the client. The token and the forge host are never exposed.
+- Extend the app's sanctioned environment configuration to include the installer
+  key, alongside the existing Image Cropper credentials.
+
+## Capabilities
+
+### New Capabilities
+
+- `fpagent-installer`: the public installer surface — the download/verify/handoff
+  script and the token-guarded same-origin release proxy that backs it.
+
+### Modified Capabilities
+
+- `tools-app`: the hardcoded-configuration requirement now sanctions a second
+  environment variable (the fpagent installer key) in addition to the Image
+  Cropper credentials.
+
+## Impact
+
+- `tools/server.js`: `GITEA_URL` / `FPAGENT_REPO` constants, the installer key
+  read, and two public routes registered before the session middleware.
+- `tools/public/fpagent/install.sh`: new installer script.
+- `tools/test/fpagent-install.test.js`: proxy and script tests.
+- `.env` / `.env.production` hold the key; `.env.example` and `README.md`
+  document the install flow.
+- Depends on the private `fingerprint-agent` releases and their bundle naming
+  (`fpagent-<version>-{linux-x86_64|ubuntu-<codename>-x86_64}.tar.gz`) plus the
+  matching `.sha256` assets.