50 lines
2.2 KiB
Markdown
50 lines
2.2 KiB
Markdown
# Proposal: fpagent-release-installer
|
|
|
|
## Why
|
|
|
|
Field laptops need `fpagent` installed and kept current, but the
|
|
`fingerprint-agent` repository is private: its releases require a forge token
|
|
that operators do not have. Today an operator must obtain a bundle out of band
|
|
and run its installer by hand. A public one-line installer hosted by the tools
|
|
app removes that step while keeping the forge credential server-side.
|
|
|
|
## What Changes
|
|
|
|
- Add a public installer script served at `/fpagent/install.sh`, intended to be
|
|
piped into `bash`. It fetches the latest release, selects the bundle matching
|
|
the host (the Ubuntu-codename offline bundle when present, else the generic
|
|
online bundle), verifies the published sha256, extracts it, and runs the
|
|
bundle's own installer, forwarding flags such as `--enable-service`,
|
|
`--check` and `--uninstall`.
|
|
- Add same-origin proxy routes `/fpagent/releases/latest` and
|
|
`/fpagent/releases/download/:tag/:name` that read the private release from the
|
|
forge using the `GITEA_RELEASE_INSTALL_KEY` environment variable and stream
|
|
assets to the client. The token and the forge host are never exposed.
|
|
- Extend the app's sanctioned environment configuration to include the installer
|
|
key, alongside the existing Image Cropper credentials.
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
|
|
- `fpagent-installer`: the public installer surface — the download/verify/handoff
|
|
script and the token-guarded same-origin release proxy that backs it.
|
|
|
|
### Modified Capabilities
|
|
|
|
- `tools-app`: the hardcoded-configuration requirement now sanctions a second
|
|
environment variable (the fpagent installer key) in addition to the Image
|
|
Cropper credentials.
|
|
|
|
## Impact
|
|
|
|
- `tools/server.js`: `GITEA_URL` / `FPAGENT_REPO` constants, the installer key
|
|
read, and two public routes registered before the session middleware.
|
|
- `tools/public/fpagent/install.sh`: new installer script.
|
|
- `tools/test/fpagent-install.test.js`: proxy and script tests.
|
|
- `.env` / `.env.production` hold the key; `.env.example` and `README.md`
|
|
document the install flow.
|
|
- Depends on the private `fingerprint-agent` releases and their bundle naming
|
|
(`fpagent-<version>-{linux-x86_64|ubuntu-<codename>-x86_64}.tar.gz`) plus the
|
|
matching `.sha256` assets.
|