# Proposal: fpagent-release-installer

## Why

Field laptops need `fpagent` installed and kept current, but the
`fingerprint-agent` repository is private: its releases require a forge token
that operators do not have. Today an operator must obtain a bundle out of band
and run its installer by hand. A public one-line installer hosted by the tools
app removes that step while keeping the forge credential server-side.

## What Changes

- Add a public installer script served at `/fpagent/install.sh`, intended to be
  piped into `bash`. It fetches the latest release, selects the bundle matching
  the host (the Ubuntu-codename offline bundle when present, else the generic
  online bundle), verifies the published sha256, extracts it, and runs the
  bundle's own installer, forwarding flags such as `--enable-service`,
  `--check` and `--uninstall`.
- Add same-origin proxy routes `/fpagent/releases/latest` and
  `/fpagent/releases/download/:tag/:name` that read the private release from the
  forge using the `GITEA_RELEASE_INSTALL_KEY` environment variable and stream
  assets to the client. The token and the forge host are never exposed.
- Extend the app's sanctioned environment configuration to include the installer
  key, alongside the existing Image Cropper credentials.

## Capabilities

### New Capabilities

- `fpagent-installer`: the public installer surface — the download/verify/handoff
  script and the token-guarded same-origin release proxy that backs it.

### Modified Capabilities

- `tools-app`: the hardcoded-configuration requirement now sanctions a second
  environment variable (the fpagent installer key) in addition to the Image
  Cropper credentials.

## Impact

- `tools/server.js`: `GITEA_URL` / `FPAGENT_REPO` constants, the installer key
  read, and two public routes registered before the session middleware.
- `tools/public/fpagent/install.sh`: new installer script.
- `tools/test/fpagent-install.test.js`: proxy and script tests.
- `.env` / `.env.production` hold the key; `.env.example` and `README.md`
  document the install flow.
- Depends on the private `fingerprint-agent` releases and their bundle naming
  (`fpagent-<version>-{linux-x86_64|ubuntu-<codename>-x86_64}.tar.gz`) plus the
  matching `.sha256` assets.