root-w3bs-os: package it for w3bs.org/packages (version, pinned installer) (#203)

root-w3bs-os.sh gets ROOT_W3BS_OS_VERSION=0.1.0 and --version (w3bs tracks updates with
it). install-root-w3bs-os.sh fetches the script from the tag root-w3bs-os-v<version> and
checks it against the pinned sha256, so the signed w3bs release installs exactly what was
reviewed; root installs to /usr/local/sbin, others to ~/.local/bin. A test keeps the
installer's version and sha in step with the script.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: ralyodio

install-root-w3bs-os.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# Installs root-w3bs-os, the W3BS OS box setup and maintenance script (users, ssh, Caddy,
+# firewall, confinement), as the package profullstack.com/root-w3bs-os on w3bs.org/packages:
+#
+#   w3bs install profullstack.com/root-w3bs-os     # or: w3bs os setup
+#
+# The script is fetched from this release's git tag and must match the sha256 below, so
+# the signed release installs exactly what was reviewed. Re-run to update.
+set -eu
+VERSION=0.1.0
+SHA256=de06d5cf0fd62d8f9a9d867a1e2a4eb753601ad7eaa2600a5ad7cf8788e54a76
+URL="https://raw.githubusercontent.com/profullstack/cli-tools/root-w3bs-os-v$VERSION/root-w3bs-os.sh"
+fail() { printf 'root-w3bs-os: %s\n' "$*" >&2; exit 1; }
+command -v curl >/dev/null 2>&1 || fail 'curl is required'
+if [ "$(id -u)" = 0 ]; then bin=/usr/local/sbin; else bin=${HOME:?HOME must be set}/.local/bin; fi
+mkdir -p "$bin"
+tmp=$(mktemp "$bin/.root-w3bs-os.XXXXXX")
+trap 'rm -f "$tmp"' EXIT INT TERM
+curl -fsSL "$URL" -o "$tmp" || fail "could not download $URL"
+if command -v sha256sum >/dev/null 2>&1; then got=$(sha256sum "$tmp" | cut -d' ' -f1)
+else got=$(shasum -a 256 "$tmp" | cut -d' ' -f1); fi
+[ "$got" = "$SHA256" ] || fail "downloaded script does not match this installer (got $got)"
+chmod 0755 "$tmp" && mv "$tmp" "$bin/root-w3bs-os"
+trap - EXIT INT TERM
+printf 'root-w3bs-os %s installed in %s\n' "$VERSION" "$bin"
+printf 'Run it as root: doas %s/root-w3bs-os anthony --groups wheel   (or: w3bs os setup)\n' "$bin"

root-w3bs-os.sh

@@ -184,6 +184,13 @@ fi
 
 set -uo pipefail
 
+# The packaged release (w3bs install profullstack.com/root-w3bs-os). Bump with every
+# change that ships, and tag the commit root-w3bs-os-v<version>.
+ROOT_W3BS_OS_VERSION=0.1.0
+case "${1:-}" in
+	--version|-V) printf 'root-w3bs-os %s\n' "$ROOT_W3BS_OS_VERSION"; exit 0 ;;
+esac
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)" || SCRIPT_DIR=""
 
 # ------------------------------------------------------------------ config ---

test/root-w3bs-os.test.ts

@@ -1,4 +1,5 @@
 import { execFileSync, spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { chmodSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
@@ -521,3 +522,22 @@ describe('the unprivileged subcommands', () => {
     expect(out).toContain('/mnt/sshfs.files.example.com/data');
   });
 });
+
+describe('the w3bs package (profullstack.com/root-w3bs-os)', () => {
+  it('pins the script it installs: same version, same sha256', () => {
+    const installer = readFileSync(join(dirname(SCRIPT), 'install-root-w3bs-os.sh'), 'utf8');
+    const version = /^ROOT_W3BS_OS_VERSION=(\S+)$/m.exec(SOURCE)?.[1];
+    expect(version).toBeTruthy();
+    expect(installer).toContain(`VERSION=${version}\n`);
+    const sha = createHash('sha256').update(readFileSync(SCRIPT)).digest('hex');
+    // Edit root-w3bs-os.sh => bump ROOT_W3BS_OS_VERSION, update the installer's
+    // VERSION and SHA256, tag root-w3bs-os-v<version>, publish the release.
+    expect(installer).toContain(`SHA256=${sha}\n`);
+  });
+
+  it('answers --version without root', () => {
+    expect(execFileSync('bash', [SCRIPT, '--version'], { encoding: 'utf8' }).trim()).toMatch(
+      /^root-w3bs-os \d+\.\d+\.\d+$/,
+    );
+  });
+});