Proposal: fpagent-release-installer

Why

Field laptops need fpagent installed and kept current, but the fingerprint-agent repository is private: its releases require a forge token that operators do not have. Today an operator must obtain a bundle out of band and run its installer by hand. A public one-line installer hosted by the tools app removes that step while keeping the forge credential server-side.

What Changes

Add a public installer script served at /fpagent/install.sh, intended to be piped into bash. It fetches the latest release, selects the bundle matching the host (the Ubuntu-codename offline bundle when present, else the generic online bundle), verifies the published sha256, extracts it, and runs the bundle's own installer, forwarding flags such as --enable-service, --check and --uninstall.
Add same-origin proxy routes /fpagent/releases/latest and /fpagent/releases/download/:tag/:name that read the private release from the forge using the GITEA_RELEASE_INSTALL_KEY environment variable and stream assets to the client. The token and the forge host are never exposed.
Extend the app's sanctioned environment configuration to include the installer key, alongside the existing Image Cropper credentials.

Capabilities

New Capabilities

fpagent-installer: the public installer surface — the download/verify/handoff script and the token-guarded same-origin release proxy that backs it.

Modified Capabilities

tools-app: the hardcoded-configuration requirement now sanctions a second environment variable (the fpagent installer key) in addition to the Image Cropper credentials.

Impact

tools/server.js: GITEA_URL / FPAGENT_REPO constants, the installer key read, and two public routes registered before the session middleware.
tools/public/fpagent/install.sh: new installer script.
tools/test/fpagent-install.test.js: proxy and script tests.
.env / .env.production hold the key; .env.example and README.md document the install flow.
Depends on the private fingerprint-agent releases and their bundle naming (fpagent-<version>-{linux-x86_64|ubuntu-<codename>-x86_64}.tar.gz) plus the matching .sha256 assets.

2.2 KiB Raw Blame History