nix: support aarch64-darwin, x86_64-darwin and aarch64-linux - #142
Open
brainbloodbarrier wants to merge 11 commits into
Open
nix: support aarch64-darwin, x86_64-darwin and aarch64-linux#142brainbloodbarrier wants to merge 11 commits into
brainbloodbarrier wants to merge 11 commits into
Conversation
Includes baseline architecture, 6-group review plan, prioritized findings, and arm64 macOS deployment requirements. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
…x flake for hash source; workflow reads hashes from files
…ncher, atomic update, and hash verification
… launcher, jpackage fixes, and hash verification
…acing, and add hash verification
…es and hash verification notes
The previous update.sh inherited install.sh verbatim, including sudo apt update && sudo apt install git wget openjdk-21-jre -y. Every update re-ran apt with sudo on already-provisioned machines. This rewrite keeps update.sh narrow: * require an existing git checkout in $HOME/Burpsuite-Professional * git pull --ff-only * revalidate VERSION/BURP_SHA256/LOADER_SHA256 * redownload and rehash the Burp JAR * rehash the bundled loader.jar * atomically replace /bin/burpsuitepro No package installs, no loader download, no Burp launch.
Launcher.jpg (capital L) and launcher.jpg (lowercase) tracked the same image. core.ignorecase=true on macOS hid the duplicate locally, but the repo on Linux/Nix shows both. The lowercase launcher.jpg is the one referenced by install_macos.sh and README.md; the capital-L variant is dead weight.
- Add darwin.nix: mkDerivation wrapper for macOS using makeWrapper. - Update flake.nix to support x86_64-linux, aarch64-linux, aarch64-darwin, and x86_64-darwin; Linux keeps buildFHSEnv, Darwin uses darwin.nix. - Update README.md Nix section to list supported systems. - Update AGENTS.md to document darwin.nix and the Nix/Darwin testing checklist.
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR centralizes Burp versioning via VERSION, adds consistent SHA-256 verification across installers/CI, and expands Nix packaging to support Linux + Darwin systems.
Changes:
- Add strict-mode bash (
set -euo pipefail) and implement SHA-256 verification in Linux/macOS/Windows installers and Linux updater. - Introduce
VERSION,BURP_SHA256,LOADER_SHA256as single sources of truth; update CI workflow to use/verify them. - Extend Nix flake to multiple systems and add a Darwin-specific derivation.
Reviewed changes
Copilot reviewed 14 out of 15 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| update.sh | Reworked into an in-place updater with hash checks and atomic launcher replacement. |
| install_macos.sh | Adds strict-mode, repo update logic, prerequisites checks, hash verification, launcher + app bundle creation. |
| install.sh | Reads version/hash files, verifies downloads, writes a safer launcher, and handles sudo copying. |
| install.ps1 | Moves JDK/JRE detection off Win32_Product, adds version/hash reading + verification, improves generated launchers. |
| help.sh | Enables strict-mode and makes arg handling safe under -u. |
| flake.nix | Adds multi-system outputs and selects Linux vs Darwin packaging. |
| default.nix | Switches version/hash to file-driven values; updates fetch URL and metadata. |
| darwin.nix | Adds a macOS Nix derivation wrapper for java + loader agent. |
| VERSION | Adds centralized version value used by scripts/Nix/CI. |
| BURP_SHA256 | Adds expected SHA-256 for the mirrored Burp JAR. |
| LOADER_SHA256 | Adds expected SHA-256 for bundled loader.jar. |
| README.md | Rewrites docs to reflect new versioning + verification and multi-platform workflows. |
| AGENTS.md | Adds repo guidelines and operational notes for contributors. |
| .github/workflows/burp-pro.yml | Reads version/hash files and verifies the downloaded JAR before producing checksum artifacts. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| unzip, | ||
| }: let | ||
| version = "2025.1.1"; | ||
| version = lib.removeSuffix "\n" (lib.fileContents ./VERSION); |
Comment on lines
+14
to
22
| burpHash = lib.removeSuffix "\n" (lib.fileContents ./BURP_SHA256); | ||
|
|
||
| burpSrc = fetchurl { | ||
| name = "burpsuite.jar"; | ||
| urls = [ | ||
| "https://portswigger.net/burp/releases/download?product=${productName}&version=${version}&type=Jar" | ||
| "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=${productName}&version=${version}&type=Jar" | ||
| "https://github.com/xiv3r/Burpsuite-Professional/releases/download/burpsuite-pro/burpsuite_pro_v${version}.jar" | ||
| ]; | ||
| hash = burpHash; | ||
| sha256 = burpHash; | ||
| }; |
Comment on lines
+8
to
+17
| version = lib.removeSuffix "\n" (lib.fileContents ./VERSION); | ||
| burpHash = lib.removeSuffix "\n" (lib.fileContents ./BURP_SHA256); | ||
|
|
||
| burpSrc = fetchurl { | ||
| name = "burpsuite.jar"; | ||
| urls = [ | ||
| "https://github.com/xiv3r/Burpsuite-Professional/releases/download/burpsuite-pro/burpsuite_pro_v${version}.jar" | ||
| ]; | ||
| sha256 = burpHash; | ||
| }; |
Comment on lines
+20
to
+33
| packages = forEachSystem (system: let | ||
| pkgs = import nixpkgs { | ||
| inherit system; | ||
| config.allowUnfree = true; | ||
| }; | ||
| isLinux = nixpkgs.lib.hasSuffix "-linux" system; | ||
| burpsuitepro = | ||
| pkgs.callPackage ./default.nix { | ||
| }; | ||
| if isLinux | ||
| then pkgs.callPackage ./default.nix { } | ||
| else pkgs.callPackage ./darwin.nix { }; | ||
| in { | ||
| inherit burpsuitepro; | ||
| default = self.packages.${system}.burpsuitepro; | ||
| }; | ||
| }); |
| inherit pname version; | ||
|
|
||
| runScript = "${jdk}/bin/java --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm.tree=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm.Opcodes=ALL-UNNAMED -javaagent:${loaderSrc}/loader.jar -noverify -jar ${burpSrc} &"; | ||
| runScript = "${jdk}/bin/java --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm.tree=ALL-UNNAMED -javaagent:${loaderSrc}/loader.jar -noverify -jar ${burpSrc}"; |
Comment on lines
+123
to
+125
| awk -v dir="${INSTALL_DIR}" -v ver="${version}" ' | ||
| { gsub(/__INSTALL_DIR__/, dir); gsub(/__VERSION__/, ver); print } | ||
| ' burp > burp.tmp |
| echo "Error: LOADER_SHA256 is empty." >&2 | ||
| exit 1 | ||
| fi | ||
| actual_loader_sha256=$(sha256sum loader.jar | cut -d' ' -f1 | tr '[:upper:]' '[:lower:]') |
| fi | ||
| echo "SHA-256 verified for burpsuite_pro_v${version}.jar" | ||
|
|
||
| actual_loader_sha256=$(sha256sum loader.jar | cut -d' ' -f1 | tr '[:upper:]' '[:lower:]') |
Comment on lines
+11
to
+14
| # Does NOT install OS packages, the loader, or launch Burp. | ||
| # Run from the install directory; safe to invoke repeatedly. | ||
|
|
||
| # Installing Dependencies | ||
| echo "Installing Dependencies..." | ||
| sudo apt update | ||
| sudo apt install git wget openjdk-21-jre -y | ||
| INSTALL_DIR="$HOME/Burpsuite-Professional" |
Comment on lines
+21
to
+22
| git -C "$INSTALL_DIR" pull --ff-only | ||
| cd "$INSTALL_DIR" |
|
W bro |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.