1 files changed, 187 insertions, 0 deletions

diff --git a/scripts/package-windows-tor.sh b/scripts/package-windows-tor.sh
new file mode 100755
index 0000000..c8cca3b
--- /dev/null
+++ b/scripts/package-windows-tor.sh
@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+VERSION="${VERSION:-$(sed -n 's/^VERSION[[:space:]]*:= *//p' "$ROOT/Makefile" | head -1)}"
+
+TOR_VERSION="${TOR_VERSION:-15.0.19}"
+TOR_ARCHIVE_NAME="tor-expert-bundle-windows-x86_64-${TOR_VERSION}.tar.gz"
+TOR_URL="${TOR_URL:-https://archive.torproject.org/tor-package-archive/torbrowser/${TOR_VERSION}/${TOR_ARCHIVE_NAME}}"
+TOR_SHA256="${TOR_SHA256:-6AC067402C7B4A3DC37887ED3754B3914B67FDC220C966190683E9CCF91ABF0F}"
+TOR_ASC_URL="${TOR_ASC_URL:-${TOR_URL}.asc}"
+TOR_SIGNING_KEY_FINGERPRINT="${TOR_SIGNING_KEY_FINGERPRINT:-EF6E286DDA85EA2A4BA7DE684E2C6E8793298290}"
+TOR_VERIFY_GPG="${TOR_VERIFY_GPG:-auto}"
+
+BUNDLE_DIR="${BUNDLE_DIR:-$ROOT/Bitflash-${VERSION}-windows}"
+OUT_ZIP="${OUT_ZIP:-$ROOT/Bitflash-${VERSION}-windows-with-tor.zip}"
+CACHE_DIR="${CACHE_DIR:-$ROOT/.cache}"
+ARCHIVE="${TOR_ARCHIVE:-$CACHE_DIR/$TOR_ARCHIVE_NAME}"
+ASC_FILE="${TOR_ASC:-$ARCHIVE.asc}"
+
+usage() {
+  cat <<EOF
+Usage: scripts/package-windows-tor.sh
+
+Creates Bitflash-${VERSION}-windows-with-tor.zip from an existing
+Bitflash-${VERSION}-windows/ release directory.
+
+Environment overrides:
+  VERSION       Bitflash release version, default read from Makefile
+  TOR_VERSION   Tor Expert Bundle version, default ${TOR_VERSION}
+  TOR_URL       Download URL, default official Tor archive URL
+  TOR_ASC_URL   Signature URL, default TOR_URL.asc
+  TOR_SHA256    Expected archive SHA256
+  TOR_ARCHIVE   Use an existing archive instead of downloading
+  TOR_ASC       Use an existing detached signature
+  TOR_VERIFY_GPG auto, required, or off; default auto
+  BUNDLE_DIR    Existing unpacked Windows release directory
+  OUT_ZIP       Output zip path
+EOF
+}
+
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  usage
+  exit 0
+fi
+
+need() {
+  command -v "$1" >/dev/null 2>&1 || {
+    echo "missing required command: $1" >&2
+    exit 1
+  }
+}
+
+need sha256sum
+need tar
+need zip
+
+download() {
+  local url="$1"
+  local out="$2"
+  if command -v curl >/dev/null 2>&1; then
+    curl -L --fail --output "$out" "$url"
+  elif command -v wget >/dev/null 2>&1; then
+    wget -O "$out" "$url"
+  else
+    echo "missing required command: curl or wget" >&2
+    exit 1
+  fi
+}
+
+if [ ! -d "$BUNDLE_DIR" ]; then
+  echo "missing Windows release directory: $BUNDLE_DIR" >&2
+  echo "run 'make windows' first, or set BUNDLE_DIR" >&2
+  exit 1
+fi
+if [ ! -f "$BUNDLE_DIR/Bitflash.exe" ]; then
+  echo "missing Bitflash.exe in $BUNDLE_DIR" >&2
+  exit 1
+fi
+BUNDLE_PARENT="$(cd "$(dirname "$BUNDLE_DIR")" && pwd)"
+BUNDLE_NAME="$(basename "$BUNDLE_DIR")"
+OUT_PARENT="$(mkdir -p "$(dirname "$OUT_ZIP")" && cd "$(dirname "$OUT_ZIP")" && pwd)"
+OUT_NAME="$(basename "$OUT_ZIP")"
+OUT_ZIP_ABS="$OUT_PARENT/$OUT_NAME"
+
+mkdir -p "$CACHE_DIR"
+if [ ! -f "$ARCHIVE" ]; then
+  download "$TOR_URL" "$ARCHIVE"
+fi
+
+got="$(sha256sum "$ARCHIVE" | awk '{print tolower($1)}')"
+want="$(printf '%s' "$TOR_SHA256" | tr 'A-F' 'a-f')"
+if [ "$got" != "$want" ]; then
+  echo "Tor archive SHA256 mismatch" >&2
+  echo "  expected: $want" >&2
+  echo "       got: $got" >&2
+  exit 1
+fi
+
+tmp="$(mktemp -d "${TMPDIR:-/tmp}/bitflash-tor-package.XXXXXX")"
+trap 'rm -rf "$tmp"' EXIT
+
+case "$TOR_VERIFY_GPG" in
+  auto|required|off) ;;
+  *) echo "TOR_VERIFY_GPG must be auto, required, or off" >&2; exit 2 ;;
+esac
+
+if [ "$TOR_VERIFY_GPG" != "off" ]; then
+  if command -v gpg >/dev/null 2>&1; then
+    if [ ! -f "$ASC_FILE" ]; then
+      download "$TOR_ASC_URL" "$ASC_FILE"
+    fi
+    gnupg_home="$tmp/gnupg"
+    mkdir -p "$gnupg_home"
+    chmod 0700 "$gnupg_home"
+    gpg --homedir "$gnupg_home" --batch --auto-key-locate nodefault,wkd,keyserver \
+      --locate-keys torbrowser@torproject.org >/dev/null 2>&1 || {
+        if [ "$TOR_VERIFY_GPG" = "required" ]; then
+          echo "could not import Tor Browser Developers signing key" >&2
+          exit 1
+        fi
+        echo "WARNING: skipped Tor GPG signature verification; signing key import failed" >&2
+      }
+    if gpg --homedir "$gnupg_home" --batch --with-colons --fingerprint "$TOR_SIGNING_KEY_FINGERPRINT" \
+        2>/dev/null | grep -q "^fpr:::::::::${TOR_SIGNING_KEY_FINGERPRINT}:"; then
+      gpg --homedir "$gnupg_home" --batch --verify "$ASC_FILE" "$ARCHIVE" >/dev/null 2>&1 || {
+        echo "Tor archive GPG signature verification failed" >&2
+        exit 1
+      }
+      echo "Tor archive GPG signature verified against ${TOR_SIGNING_KEY_FINGERPRINT}"
+    elif [ "$TOR_VERIFY_GPG" = "required" ]; then
+      echo "Tor signing key fingerprint mismatch" >&2
+      exit 1
+    else
+      echo "WARNING: skipped Tor GPG signature verification; signing key fingerprint was not available" >&2
+    fi
+  elif [ "$TOR_VERIFY_GPG" = "required" ]; then
+    echo "missing required command for TOR_VERIFY_GPG=required: gpg" >&2
+    exit 1
+  else
+    echo "WARNING: gpg not found; relying on pinned SHA256 only" >&2
+  fi
+fi
+
+mkdir -p "$tmp/extract"
+tar -xzf "$ARCHIVE" -C "$tmp/extract"
+
+if [ ! -f "$tmp/extract/tor/tor.exe" ]; then
+  echo "Tor archive did not contain tor/tor.exe" >&2
+  exit 1
+fi
+
+rm -rf "$BUNDLE_DIR/tor"
+mkdir -p "$BUNDLE_DIR/tor"
+cp -R "$tmp/extract/tor/." "$BUNDLE_DIR/tor/"
+if [ -d "$tmp/extract/docs" ]; then
+  mkdir -p "$BUNDLE_DIR/tor/docs"
+  cp -R "$tmp/extract/docs/." "$BUNDLE_DIR/tor/docs/"
+fi
+if [ -d "$tmp/extract/data" ]; then
+  mkdir -p "$BUNDLE_DIR/tor/data-defaults"
+  cp -R "$tmp/extract/data/." "$BUNDLE_DIR/tor/data-defaults/"
+fi
+
+cat > "$BUNDLE_DIR/TOR-EXPERT-BUNDLE.txt" <<EOF
+Bitflash managed Tor bundle
+
+This Windows package includes the Tor Expert Bundle so -managedtor can start
+Tor without requiring a separate Tor install.
+
+Tor Expert Bundle: ${TOR_VERSION}
+Archive URL: ${TOR_URL}
+Archive SHA256: ${TOR_SHA256}
+
+Bitflash uses tor/tor.exe from this package. Runtime state, hidden-service keys,
+and control authentication cookies are written under the user's Bitflash data
+directory, not inside this release directory.
+EOF
+
+rm -f "$OUT_ZIP_ABS"
+(
+  cd "$BUNDLE_PARENT"
+  zip -qr "$OUT_ZIP_ABS" "$BUNDLE_NAME"
+)
+
+echo "Bundled Tor Expert Bundle ${TOR_VERSION}"
+echo "Built: $OUT_ZIP_ABS"