From 905d9c6b7fdf408a031f518029a926fabf409f26 Mon Sep 17 00:00:00 2001 From: James Callahan Date: Thu, 28 Apr 2022 12:01:31 +1000 Subject: [PATCH 1/2] Put archlinux files in own subdirectory and stop generating from template --- linux/Makefile | 6 +-- linux/{ => arch}/PKGBUILD | 0 linux/{ => arch}/arch.install | 0 linux/arch/portmaster.desktop | 8 ++++ linux/arch/portmaster.service | 44 ++++++++++++++++++++ linux/arch/portmaster_logo.png | Bin 0 -> 31361 bytes linux/arch/portmaster_notifier.desktop | 9 ++++ linux/templates/PKGBUILD | 55 ------------------------- linux/templates/arch.install | 28 ------------- 9 files changed, 62 insertions(+), 88 deletions(-) rename linux/{ => arch}/PKGBUILD (100%) rename linux/{ => arch}/arch.install (100%) create mode 100644 linux/arch/portmaster.desktop create mode 100644 linux/arch/portmaster.service create mode 100644 linux/arch/portmaster_logo.png create mode 100644 linux/arch/portmaster_notifier.desktop delete mode 100644 linux/templates/PKGBUILD delete mode 100644 linux/templates/arch.install diff --git a/linux/Makefile b/linux/Makefile index 4434cb2..86f3e6b 100644 --- a/linux/Makefile +++ b/linux/Makefile @@ -9,7 +9,7 @@ all: deb rpm nfpm.yaml: portmaster-start sed -e "s/^version:.*$$/version: v$(shell ./portmaster-start version --short)-$(shell cat ./pkgrev)/g" ./nfpm.yaml.template > ./nfpm.yaml -build: icons nfpm.yaml gen-scripts gen-pkgbuild +build: icons nfpm.yaml gen-scripts icons: for res in 16 32 48 96 128 ; do \ @@ -51,9 +51,5 @@ gen-scripts: gomplate -f "templates/$${file}" > "./scripts/$${file}" ; \ done; -gen-pkgbuild: nfpm.yaml - gomplate -d "nfpm=./nfpm.yaml" -f templates/arch.install > arch.install - gomplate -d "nfpm=./nfpm.yaml" -f templates/PKGBUILD > PKGBUILD - lint: shellcheck ./scripts/* ./arch.install \ No newline at end of file diff --git a/linux/PKGBUILD b/linux/arch/PKGBUILD similarity index 100% rename from linux/PKGBUILD rename to linux/arch/PKGBUILD diff --git a/linux/arch.install b/linux/arch/arch.install similarity index 100% rename from linux/arch.install rename to linux/arch/arch.install diff --git a/linux/arch/portmaster.desktop b/linux/arch/portmaster.desktop new file mode 100644 index 0000000..de4b5b4 --- /dev/null +++ b/linux/arch/portmaster.desktop @@ -0,0 +1,8 @@ +[Desktop Entry] +Name=Portmaster +GenericName=Application Firewall +Exec=/opt/safing/portmaster/portmaster-start app --data=/opt/safing/portmaster +Icon=portmaster +Terminal=false +Type=Application +Categories=System diff --git a/linux/arch/portmaster.service b/linux/arch/portmaster.service new file mode 100644 index 0000000..af25a31 --- /dev/null +++ b/linux/arch/portmaster.service @@ -0,0 +1,44 @@ +[Unit] +Description=Portmaster by Safing +Documentation=https://safing.io +Documentation=https://docs.safing.io +Before=nss-lookup.target network.target shutdown.target +After=systemd-networkd.service +Conflicts=shutdown.target +Conflicts=firewalld.service +Wants=nss-lookup.target + +[Service] +Type=simple +Restart=on-failure +RestartSec=10 +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes +PrivateTmp=yes +PIDFile=/opt/safing/portmaster/core-lock.pid +Environment=LOGLEVEL=info +Environment=PORTMASTER_ARGS= +EnvironmentFile=-/etc/default/portmaster +ProtectSystem=true +#ReadWritePaths=/var/lib/portmaster +#ReadWritePaths=/run/xtables.lock +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +RestrictNamespaces=yes +# In future version portmaster will require access to user home +# directories to verify application permissions. +ProtectHome=read-only +ProtectKernelTunables=yes +ProtectKernelLogs=yes +ProtectControlGroups=yes +PrivateDevices=yes +AmbientCapabilities=cap_chown cap_kill cap_net_admin cap_net_bind_service cap_net_broadcast cap_net_raw cap_sys_module cap_sys_ptrace cap_dac_override cap_fowner cap_fsetid +CapabilityBoundingSet=cap_chown cap_kill cap_net_admin cap_net_bind_service cap_net_broadcast cap_net_raw cap_sys_module cap_sys_ptrace cap_dac_override cap_fowner cap_fsetid +# SystemCallArchitectures=native +# SystemCallFilter=@system-service @module +# SystemCallErrorNumber=EPERM +ExecStart=/opt/safing/portmaster/portmaster-start --data /opt/safing/portmaster core -- $PORTMASTER_ARGS +ExecStopPost=-/opt/safing/portmaster/portmaster-start recover-iptables + +[Install] +WantedBy=multi-user.target diff --git a/linux/arch/portmaster_logo.png b/linux/arch/portmaster_logo.png new file mode 100644 index 0000000000000000000000000000000000000000..357066732a521c730f0778c187972979c750cc4a GIT binary patch literal 31361 zcmcG!2UJtr);7FTAkvj89YF+y&_WGesUp2d5G0g@4iQ3cK@=&1B8v2?QUpPoNR7ur z7f_1yC@Kh2rAf=bJ@?%6-tQmxE#oVUkwLQeEYF;4wzc+7G&eP1qUWIp0D#HJP}dRw zpx{?1aEuoGw;4LT2LSXlp6Ab->v{$fe4N7oz%cRtgAnud@0@Q7R*gkZ*Te4#gtI*~ zJfV9|40?@t{QjN6Q*V#ggm7LWAj`_Im}f%8ltub3`{N9a4I#r*6GEBKio(ysLmLHI*g9wS{2`C`PeQHIruKIg((unw16IM4qWoACOV z{A^d3EO2t7g8>>E!vF`SYPh=HUhKLTi5m5C!F1(G)<*3rEJF6c=LWkomw;?;jFPsO=l(Y4SLxY9y<$dDmTejU zOY8QvH$bnB`su>~wW}9-vcj2;lqbQG2rYyie;)Yw=2=WOTFxb*?lk$hJLmP+%+FM2 zwLB9{g#b z(fb%v{KbRgT=+L8e4h_;7Y0A^#XORhNwA#JGU555?4WEo9&zO;Z`0)(|C1xFN4byF zB!SOGR~YV0dBy#7jU+fFOZSW;^P9Fb00QpzbZ_mcSa*Yo)E_+ziX zK7B+HTVGK+23%(jw9AR+AXG!lH7XM=NslA7Cw=VdKGKwFK~fXn&}{snlR^(D)D$uc z5S`&DyH^752ytBSW3S=5LbQpQ^m6iP2vxj`0B6a`M|LS&Wn`rvWPu-@Itrh~O+QOX ze?B{Ll_hWCt?}k(jXk<+*yDWHj2BqnUZ-(3P+=2z9V&e1m`HJguJDa6p@+HFjq+HVn_dzsqM5ey80{ocp}#DO4Bt z7rxpA2P41JPr9PqU}1M#4I9(*z8Kfuh9;fWyXkW7S!t;Gfy9Y>r!S!OOflLLMfa>K z#DnhPFYtb)eU!eDw2^qBG@v}PLSrPE=UmF8q;galLz!e5$FRmQ?V{%*)1ru%%ocCT zc~s%}khWa;u_{>OPm4Ii34SHBaRnWvLhOj(M=-q(E({4Tk0d0}gl zb5AjxtL^qn?1KD{lQXxD#U~VD*-=Vz+j6F|Pf^X>f>{+8T_2-R30bf2$v=?o&5FqC z%o@uY$UHpDbC&aL{@D{}S?`aZePSJ4q431P;=Ap4chA~NyP3+9wo2Y|-Xc#@gW`h< zwoGkoMy!J>7f+8!jp$YI+OU-6TSYzGORRd+h}*AAAE)_o|A$vF!#?vq|IJs=z8q6A z;-hgFEsYOM`g!N4Maq+Jg=ehO%aGPjti8=!o^IPa>P?@Uz7$ol$F~)*b$;>Eu#;z* zhn?51cY*?^hqV{q(8A!thc8}ePkoPXo=*p-o`hYgGe|DNm2;Gd4xN2JQ51CHNwV>$ z?5l?_TvjYsOjo%5lyASQ`%D)$-fB4$J%hVa-I%d`a#>{=GjV^SvtBJo9G!tam*w=DntPL*hntqShf$e3Up^A| z(Dk%zkCMGRacbd(+*oMq)r@uY9NSx&-HAx2Xz3UcszS%uYx3#W56NyV-MI8h0v=W>f6xG^-8iP31E}>_MpPJw=q==pYVW_u$7bh~ST>V-C9A7y;c+uD#9TXUn-ZJt+ zBSbmG?CR`~nNKf&CT!Y$y6Pw8TRHpjhU@Lr!!O^zm9MEU{3?CWb}4o2N_GBK+qw5| zm-)uN`Ys|jW>%(E^R+Z_2Lp3zQ5Pe1HElF+)8L_r*yoh2>JR1#Xp7#ukH?!C)vFp`L9a=*!#Y7iZxbXE8-Xa3J_ImFU4t!ao zEWbSLF)}O3E&it0pchzDs<)aFEjY(jclO(r${-&dAMf07hX4nYshhi`-P+xE*N5nS zvPqv=6vc}wiOSvmd^cEZ%Y-?%H98=q);r+pMwNuE72ZTu%f{bpW!Uw@aB1RW{tHEq zUYGtb`6Zlm+$M3)@q>#)=2LbQ7k^~{?YTtZPXlIAp4Q3F?#8}&*XToyH*aH zg8P`mqQm;sXxN#boC6UGvmr;@G_S7>(^N6^b8;eoTw!nZ7;qW=ocpFj=Bk5b&7|BjLDoFL5If=&ig*If7aUMnl)DIt7RF}x3|6#@Zf7sMvP?IJqPh1DWuF{?YY*^ zf0&tS`5t&;aeFNxW%=8;eK*#_>qR_r!X4t{`g@gQJ_?TqL_NWJPb*Kw?gVkPsm^h`$}jt%FlgL`nIED%U1A%l_Ps()yfoG!#pu1!leI7T-y_`?uly? z^ZR#q9H#|qI?CU*`$e>wMtz6yiL0!AesIspkDpQFV|dq``E)gBho5GjhQoVpg+9Lp z-#(uoJ{NqNgWdi}8^u?Dd)1+OU>i03#pA2ovg?!7x>PQHK^3`qU8m&AuOr>J(jBWl z*stbYPzn0E`S8Pof$RCIAxaBB%9Umt+2&gZ_%&9;j=E@WGo)}$ODj19v=Mhh#%5WZ zf?K8tZw@bf7kA7A6S64Yv_ev=P#%*+M)Ba!lX=k2>mhL~@ ztCovt*w)+Dh%DG?r=IUNn7$pM85Zfa&qw`*q4vq#lHu)`i1a<;+*>}aaJHi9=@f{cE7`HKh8W;|j8;!s`GZ!fv|01EB!F_Ind35sO^j3I^6fG~~r zE#P5ta=@Y3#s|k-M4L4)#QqnV+!9K1hD9!)Jh|Y{cXGFxw{VKaeum}U7C`Bx&5R;Z z>$f3M2O6~QN2}on`^zNBa( zYeG1W^YAnb55QT4n_9bud%LQ-32SKzsfVIL0lqk*vrwq7k6$1f22q~*d%PA?yqLieBTYwuLZKJ4@-p)B zNRR><80JTG4n_I}iu_Z8E-uhDz>`4q^!F3`Ez#Ms-~L~i++6<_P6!I{`4h35s|?Nu=Zo_r27-#r#AW<(EG~+La{9Eck>o5XN#u69k9~9t<(+dVQiu}`>K%yn? zKm7SWU+6=$TYAq-k5?dj=;mcz-*tE$T5k#ep$Wu$_Ol04Gc z6^BR4LT>)9pp5^3r0C*;l67@fMk=}BU63lO z3Mxn!d0AJaDoW196_0XOP<3(sr!=zwPcVy}eg0MIZ&YreL{&F=C7hzX98w7cBk<aqb=mXZtnUBFkALxpc;G;x|3#$#Lwle~+d}gH+#FYbzhGRzzl0aTIlvigm$-mH4PktMzps!pf#Bom>ijzvWrF?O z{^~-1N4OBtU+6z7(0}SSH(Y?{zr?}6YWW+2(Emk!|9#Z`j|$>H{Qs{}_y2sE{;VVa zC?$jdRKz(eAi)nF z>8#}JhIDgQ#Npgfa;nO1V3Yg@8vp;(ivK%`{&d5?%t!yc1P)!lzy3Y#fj|D97jb@I z?goI<;1h=sBLHywVx+5M9h$p59g^v2^P+Qob(7t){8atmqqxmf_VT1_;z?ZW&q}Ur zP4qT6@FqD{CoxUxSzE((lM01ww8PV8*zVrBqnVzy-?_>s&;58{eBUu*b#^}N9ZDj- zZnm#ab!pnWZOPF@Lqj7oD+|+5uaCguMMjx#!QSqK-+H1k5w0;2OV@VP%D(`~_Kq2y zq%W-74sj%JOsqZtdc9(7skt2F_nNnH4L7qmuCoDkM1>Ma1Ptql^~EBwc@v$Au|{N` zhJhU5Vx`8JLS3PyvCRt#gEHkBoIAg^&QUN}C0Ru1Un2T2E#p0Ph!^u9IquO!5 z!pWm#X0npUV8N}&U)%bWlr$>suY?|NVry#K4&@7_A2^wrk_4Le>9Sy`9M8gYC?1ki zbeg=eBbCivrsW6ogRbZ$#$_@6K}W(+@x`%G5m+;9NWHBV&Fo0252Qk@=|mH46L&wm zdeY+YzRI_Bq^yg2aR&km%rOSo5T-z7pAxhYmP&i&+UTa(O?|iW%Wo^LQ&>E@DbB;M$d%ThqH&*_k2iN{nYHil z<4d;q)9!O~+Lb zL6Qz9dD6yZRUkFPzRY|OK4!l7oHe_>r!Z;gk;8ri<}Ro?X%xNle9)s(9t0zxq!+U94{xMPeItc4D=B_C3ydK;T}0>M)3@;W%lv__I#k3D5u$Meb11HR<7|&OR3nx=7w#nl*DDaof|TfKL;elumjM zkzr1K(|4szQ)JB-Yf6x^1;AV4z8)#mDDuk7XPM)J0yOPOcsL$3j1FAcI91kAt%^nE zI+qtryUY`+HBw6K#%XN8(!dP)ra7$O8)&ePj~}!>!Bk{347RN<28>RABO@$=sJq~; z%4gEFM~EO!1yB^wr@g;xhIkB0#*cs3ZGgA~A+((?FLQy9<>ZLEDXp6tOw%D$g3%3IR#nc1*8G!m>$CA*Hx%F z|J+a^^#t}1R4b)nJlOaWWf7tysVWAH)NoZCZAC|;czg25rGvGk`3&(4f9HaBUu8``Z96;?#zmKr%0}AAqKjm$+IbGT z9siY}dRCzQ6#BR~pBV5p0BXN9s}2H{%)3G6GEbvyQ0yupxxl?w@g58VMol3dS-7Ru zGTg4>Q0&K#DiHB@HqrnrM<3yWzyItQzbuh9pGjOw40zMP*}SC1G`p39xn(?*_KBLr z{96AV%s`Hx_JD(*GPhckrKbvSVhoKS3MmETL&P%@$p*31*S?YcQpgUyItU9*r}L{X z@IsYfczYuAx*W=Q2)01`^){$>P(8|lv9!2BiRB2NQEOts@JXidr-77nKE!acnLKZ9 zC5WmMe!<#ssso8WzEr?QA}-%B{Wc+?!i=gL%1&8?MsxBfwB30Cyx-)coKxS;!91&i zr27kKEZMu~}yDu&6Sdb>)nnCZw9++cpzoXwfF5`CrWklUDagXy*NCStaOAp!GE}-)>C<>KM=V7$zy<1o}1tQQYfNI94OZVD_6d0H-&sk!*Ygj#?wm@Ek zlX8*r^j@{vAa8*2@=kx003L(pLeljmGC%y03%L28MZZ~nNKvV5Y9{?6*EMvWqo`t~ z*NDq=b>wSTZr|`2bb?A5z+zUpBFqYAcLY8z#YL-KfWL)#16E$Q%NuTguqb`rV8Qmp zs6ng1cArm>*0m%ENuVc~5%?Z`g9}|o#R`@L#nindLXt^{p|lE?QGqQ;w7>=Ew=qo_ zy}3cMR@=56n;pYPc;*e$q#T?5pN)5pRT&DLYkByTKDDGC#OTgT1l~#y#oAeNmQ>7_ znqR7KiBU~w*Ys+hY1>|S_$hn*_&Yl;k$|lN;5Bf<`rtm|v2+%tzhl7-k zt3)Br3Ix-(GVFP=&e18NJ5|@g&L}$-k5Hm*JXiHB1fqnnht1W7CX+&n#;v`D#DJ6# zsfjr)qzZHI?3@RwgQ3d#O7hAESJ63j-mJv3w^(H?3laV8t+)k2&Sfi-eHR*yRJ_GT zdW)vpl|GwUyAi?MB+$gO%SAv)+xJYwdjw3#y{~ZWW_E0K@uIb4`{meVl4NX0(Q>%0 zbOda_Br6uScFU35fi9PXU-Y@23*0hQTU^=swxI1Z96p$L^k_lou9`VQL$c#)*$!DU z_5n=hoEmdw<`Hu%y<&gu2?A6$fS>$)a4(%>z=tUG!D+DkR(bG9-2q<$o+eeVo5V2? z1h&@Ic&2nVQW`fRQm{%5b5#m#`{4$R)hyC!C*HgdK@kX)65ys0UJOk_||JX0JS z=@T#F01#ZXI=us%FH|ZXqv>>cQ_D?Yw0D}3RN>@pzdU&H-K%HL?7vApVbKYz2g%qI z&1}1niT3%=LcGaFqitS4}i+na8e}8zCL_3&qG9itR{$dyb0qb(61$d85k3Dz6JJ87jaiu41n$Pt$kV$ z@=w}$9&{Vq_zKX{XkbQE=*U(NG-)3IGA>mmP) zifPjGl4%&*HP>f0(XiZG>7)@ANNCaXBDIUvOK+CoM@bnjNA~+|m=ixp87xjW+~Jn% zA{2$l%(0)jK;=ph*=&tcaLqWj8WsZvr4M5;WCoU-Fnh^z&4zNQLI>mmo52cRJae8c zcFKU$IT*DTY*9Qonfm%r_=LTWTsXBk>5|zBEMEoFuB>LHc#mbh)X$p>+QK#( z5IYu|2dnIS1{_F(kbS3f8vFefc=-vrHEFCqLCQu!FmHztL=>{904<2M?-V$}Z%A{< zvCB>X53BKXAL&OB2M8~1{I9T+BQetg{D#*n&H()$#$DY*vDST2u7PQZP!&~QAyzqen6aV7g)OpYOY1CX%vc} z@3h)nrKO~hG1^u{A&#pWYZmp@vwiXIl9Uf+C52z-E|=v6;;fMn6`fF3U zB*G4C*BFa7+Fiz)FpzIulhU^!v|;%Ojy0yZVAClo6%={Od2$NahVGNYJ(MUZO@^}G zy%q)^XY~5_4l_BU6`0zFg3_73%M1xFptO2u9`{C>+Z~fnuo( z+7}iihzZ?h*XCsFY_@6IW3wmhTs2a%Gw(kYuc=f7sBs9Ylmi`K5+bH<*x|;+_|a*V zRC#-@AbF%CHBQL$aJHjScP*K zR?-;MKZUvYbn_tZTRQUG?|JlNC7>CfUDVH#`ba7mp~=gyD{{}74r^=;X$d9@iLUXX znSYjo%Z+)p92-pM!_Q~HO)TaenAJtdbLyD^XA0+{SW=lE!Udo+x01yBD|7KhXRbsK z@U@5yo%p$RZM-OvpTI~6AqvrqKyr;@O_`)DPf+B_G<=8dX0Z1em`EP+@pm2TKPQ&M ze+?g%0Yf%)L1S}0COwkMC2Efu8nS&RbZXd}yB!9cFGCN=UMr`+N_Zbf}`oS{kEm2ZA*=bE-*ieJ1 z720$LeaCr%-Pc6@*s}FPM5oprIx@AW{Wv}&C5WU|sM8>SB^NPfuhE&|1y#YFlUn|EzaJlo1}GhxdbmCj5w zzk#5Bx=d=^<8WS^<=7QK-}ezM5j@Z_rj01f0#Lp0T*>QAW@N)C){nC2grkSqKr4@m zFz63V{0d1XmD%m&6_!Xgn|&E*bLVd4R!j_iwvBAvkEz@AFhOu~G{hGQ3ud=_YkE<_`KY19G=VGT<6Pf?o&_OpjqH|ebMoON2;I`nypz$-#wOR zgvF4L?*h5ka*P=} zMaaA))uC8Mtg`iw9T%*`c-0QeV}vi0Ivs8jpV4;TP5XLU6&lgA5_U;m7a}vRW11dmilCq&nm#8Qd% zEBT*OuRkKUdxZVbxAD{4`lLtP{;^nBtQ)k31>HDG8?4;?>I&Ex1$`F~J1HJ*8Y5P_ zi!`zR(8u6pX{%U(c$dg5d^M+JXZN@Towg*8cCovVW#cgw?ohDSYQ8P%I~pnb=wEsB zms=HETh|pq{shdMN^R8j=V0e$}b2CD(R{J3=s@)gx9)rKpl+ddqhO-}WYew7#F@3@c)aKW?R>^f1nhICGQ$*(X9i%^SHyt~hExpMUa~6H)iYe?Uu8HliwvjK7t;QG}3OR;T79j%ksUkLF(92)0 z7PYdHO4g^T+U<-Eocy{nV$fCXM59HMX#FP)U~bsn%gx5L=W8q9C=XIKdC3@n77@D* zFQl<)+)vrQ@s#FB44rU=`MgYzzbN%snl@T@R5~W@TZ4eY{}^Y>UPQ z-e#+ZE5;b&yr-qfouu`9F>C%hZA>d~`Fr|`Hw*L3o*N+U76x?{nM&M-Q>IlNN)p~I1jm|9{p`@X z1aV4cF2|NHb$H^a6XZ^dyS9xlJNQQw57>R5ZBqPgrEVAV8#VU8DG#OcRg$?$ z%=gN7hdXTYb@Pr3GN+bs+Z>Fs>`J7sFDyl#@jPvhS3=K`w4gV^G`=%$u0e*SM8228 z1KY3SVw~KMYwgA{@2JKHFdg-mjeaRuD6;^~f78gg%PxKFhc7GoO?^?VAs{blCtk*D zD)(w)F( z04vaobK|D%NhC)tP=qi2%DF!oN)apr-YMj?@)9nK_8<6F!Z z7ZVjjRa*m{N@HxHQ^>+_mwA|6b&4ko$eke1pKZPw>rc};NZZPlsk1(Im@}A1x)ig0!7A+~|YH=`K6J{Pn#_9l9S#S-A-~e0K}y zt}pR8ohm1Pu+o_nLts>B4wcOC&G@ySkvD7xR(bx}Sbz2q^{WASUczb81sqvqiec>+ zZ@%zFkBWKfLTeb-KGUk3aZhOiCW z9wsiVbmX}(=b9|^Eol|Loc(ZwSGp53XHRMt;XZFhdUhJ%{rodqXK8u%bmPLx7CD%G zXC;P@pgOU{8%4OA^=P%Fi4(vwV0VU&=0IYZmk25_#dx5(wwD7Hvz!W|(veNbVr!Z) zDBk>tt4^e5HiLbZ&bvTsFeA0`V!O!?$E9-e1Um|{0IVQ1uhoTt&i1#M!VKt#(=G1H zyOfv!jjto9kd;$P4AV>;E}ZLngOEO$W>Um{&Un`}b45zTx43Unm1qYwN)G<3%DlU9zBgV9&iWO;Y_YGlFXmb@)W9tUe5 zMMyzS-A4qB4cIo{rw)l6j)j}ZinSFLEGj7o;Yd|gV{1amgU9rbsON()HjSDDis8{q zLpD+z>AT2*GA@vJ(Vokh{~l2J(9WAWH^{Jg@cSviz5H{iI-Aj+V=M?BPbh&Req=I! zaJ}jK&I3ptv|5X2%QR*dJo)LnuzZu<8?V5yFMkb3N@M)y4UM?1k{gf(JCI(O_&{=% z7^Tc6jqVSSm%t`t*`iK)g?)AFrQX)n`qdwxD_4o@io6gwN*+VYTSH3PI(bSl) zk;_+Aod)_o2SGa?hNcYhl&72+hTJ+0DGUEufFp;2?x1buJH&F~mSdn^@7I%at6P-U zG>P_)vTS<62c$zfaJBHJ0+qXPN|y!P^33xR2=b3pWF_{}B`3*=jUA2+$J&o4ROmua ztOYB$y5L9Tc$>iK7pn$E-TayO$^-x(9`XdKd|l&p8J)dsv3f(e>hL*C3wo3{r>KlD z)&D?E9?BSbUKIDFuM!>2!>?WAS$2|O2r@FmAKy~SX0>BHKrc)nigYT)y{T;G{wwMo zSC)!g(@LK$+I`_z$o%sB^8`oT*%#d4)+<4~UqJ=(G1($l!CIIL!h&#k&QUdgtK{Sj zB(iLRI{78!+?Xzfop>5Qi@D2D7WmoI!@jSt$DjLZOM~UQ3--NvfkG}E%Tu$I`AXuc zz%W+W1(@Odc=Iz~h${2+uX&p-(EkUBC$|@LWv+i1{GN!njpl*{mc$*a7kO0{%VP?y zp+kp0t`HFM^Z(vEbT9nG%8?prziTJqOUdAmVRJf5aBNv%YI<-3!!gA?#mcW+NJo}F zAN8KVO5!R}-l=G&7lnjfMpRL`iZ(j9MI~kp`tNSk@LmAoFY^xFNMbY7ce;djp%Pq2)=9`2Yf~< zLwPXby@t8tC@KB|U|+s{?>ifL7WPyP5=yuC?a|C`DILdjWPuIGE`|p@zq^pCAJ`Ut zZi`2MQ1(?H{X8Az?t&1sYT$V9&Uvt76t+}VG#|G+PMGF5KVfhpiF&56`h$t8F?BAR{id+y$JOxxV7 zS+{$+ix@?gIIlHYZK7d!3EX*lKh&s4OD%1(lWV#P9V)X1>ZUdJP4k2j! z;BHrRR3&<_IYxk=`WPZs7~5>ot*^YuK{!nizTnYUslFmYebr@Ii;PoP=aqtFo@-Dm zn?9y4K$wmj+S@ivniQ@t?%Vsp_jH7@m38a6AJJtvE`yC(PYpi7dvJi~EJZX4fpIli zXnSD%6WoidslLDnVrwI38c<1PO(RiAAszE*!d^E1qB`>k4)55*2 z?+6>~TC>Mz6d;Cf`PnepA!O~K=3lovF0r8wI}m8{nXR~(3G-Mtfq6f{8;x~eEZ8i} zpuu{bbY{JuvcbZ@VI84NCaFPajRD$eP4j>gR{AC${OGL~DjqAa7NhFmEjgTU_OtjG z>G#wtnd55?dUEtn>S~ZMK1Ky|sI0)UUUe~!%mf*m=KFYUbM;895H7Lw;l$-Z&Nk+a z<#-k5CSI`o-<=EUmr_$MdPF*#eXY^FgRD(Q-u6(l=gC%dU9yP4}(rY`K!k+r&y z?p1Y@jl0{|s-N3ZR4JWhFVeE^8xNO1mH61$p~WW-S=dRJ{JcT(_DkCKmS$+$HYCF4 zzY+4{hLna|M~`wW`a1`P81H1=ANa~XM`)1pxuB)Ibtnp+LnE7$niGwHVC@mA#Hx)i zVnw_32rPCc_3vkxOgnT{#c9Za)Kaq#Qj!E6RTHH)DmgTBWYq?fgHyL(@D zia25QU6Zw{Y*%Iplk|#I{^bE2-w%yPa9Qac7=Fg|A6gs405bied(^k1J>tvoD)~n&PdWb9lXG>3r&O z8{hLLrvJB=@if>_#(nk1b4o>+2Tn!pv|#lKv7F}DRNFp`J7OhOa01f8_?)gQ;-4<4 zLKe>KSH&z9w@_O%&Y{g)<|hN1^RwQxBrkIAwNnTkAU)UDcHkJ)I7_Eje3!&Xw5g}X*Kxqs#Xl>u5_0qLbF7B6u9Th3iE#u$i{WY+iiQ%beo(|z#e7e`#PDlP`y>oKd8}{@CgXij@|M?{x zW>mi(vY%$gYCYReLB`-mf_Q7d%mk`DxG7*jQ9JidK^+O-QNbE9;9)r%yh#lsvB-I-r+((YaEj^U5KtRViVf~g6? zVSvX)4d)6kVeWjJP?Q#0=I6p^+*T`w9jj$-%lH)`2J|na)+cS`A0d{ze+W%OJoyMr z8OfTv6c9;ZQ^p|1&t%F^HvHupmGLe(aqnH6|zuB+bh zV;+!Tv4R$=C|UGjj!zb*T|kHCrA;04L@-ljK2Vv`{LH5R!J(9m7jNjVvGG@G_fr%NB}kC$Y3xlL}SX+UZ~J*LVxlvn)-3?AVwR0RS`3 z-GALJ?9$Bj4B4aXPl|n&p|Y4w^2gKvPKb? zn>WF+So(dG;Jf#_z`FQq0EwN%p~cF;m(o| z{+WRAkJImZ) zj`tr!hR*&-(y(G`=j`)lg~yrJ-|A!b_DOz)7T_8?oie3tJ zAN|9AyGwNBiHB<9IEmHo1xoctcNguLgifOHkyh7dQCoXE(GR4Cu zdyLvMvj+`>j)bK9-?t8_7*4%++BA1CtGykfbMwk|0hwlsEHw7KwgnK6q-4=PHdQBo zB$mhX3{cp#(!KUe`OG9WLh{05?GI-x{;S+=pUe5Bi!^lFBbB=2PWg|a>4tSEN45#J z9GjRQ!Syuqy>EGa%Scz9fBR)4^Y&d*MHc-N8Hja%ts#_r`b0R(Vw4Ol1X~$O-JoRS>Dg@R& z@g?ayDOmb5P_{)n^7SsmYwDLGzC6nEDJ6GSWceTlvMQsubxRbB&fii$^v8?HiJ?ir zTaG8IW2D3i;6a;l$5GLTp#sun$u{D%=!|!@dIQG_H^8ybk&8fn z|F7_>vJLq+YQuY*VYXJzR^8D%=atX8D4=)~OG{wKWb-FjwQbl)tvk_;g+0CO4}e7) zB1ROjGS4%zrS5QA5C8JfAMnS2wRz(Ru#v9z56j0=u)<#)cjX{aRaSWrJMCbZ>xy05 z)R}9hK@N9^e&%4pG>o&2>o8uAlwgC*L^y)&)G8c{{vLeUhn90p0F%jhOJtIpF*=jgPP>LkGu2tLGJ-f{$N z)Q*+iJQzzJ6PolTxDK6f)HqSAPA#NUlnGZV`5i$|yr8n}6~@3cSb_52rmrw+E01rz z@;ldUW*ahZLJp`H?|aqvc188Q)Vp^R*DKxu#B|4j{n(4TaW-BbhE2rx`@H~P9WW-( z0FrBrq^uNE<&jE3o=epb!yqrTq{f#5;G)npH%XvY66lkJtkIG1N<1g#bm;R7AZ6Kp z8?*9Y%-pe|bua^JbARWe3>L-PB2e+-Mrb7JJM#rhQsxG?L9^46lsmB4|G3st3p}I+ z)#%%}1KCfMww%V!2Y1deKTILAk^E{+0CZR5c2Uw&2!8aW#=@E6fW;P|LVVR%u$=j* zkW1Uv>9#tnpcsHxvbQk--d+l#E#&p(@3r!NH^y6Dc?DQ@>)0S%WRld)edSeOPgRogapOfjl8q$%R@W|P$;-11hmSQDmeNLm zW>!1hU=*OS&>CCLtpUCVcKP)!0)57aJ5bTcIH((}=MOUqqb=ml%pVF2feoZNe*O^G zxOTC3;a7j<)TmGa%Gk2*VGkX7IJf#mCh>uNHc5h8lX|YU0MaEN4Q{X`tWgjRJv;FOS|U7Jl~ zM^|Zl6vU6WjRalXT!w^56=l+*Pg$ zm|+kt7CPRaL@fRy)=Q0GsR@h!U1qGo;zid02Wpo`@+*uQ46ZcCsy4sCZCJhbQxKXyq6aMsCow+@EW#MOz)2A-}QWN0@xNyY*x|^8gwZ^7IchHF1d#? zp(G2=ZXXYerUS5kZl`q~r%{!omA=muJ%uZsZgIT}zE}1gb4YEmFp!afWsVbq%=?u- zCzIZ6!Lh-AlE>_S40CJY_mf(r)3%NHK0hLW35NTer_-)50%73LBU3ar$L%mNsC+hV zqdS~nU*WvtdwJ?vnKEobsAS#=qJFW_SSXJy)yhBE7ccf%UzX;l^N6;>O=8P1&Qt&0 zSWfa?lJyc`A6q3Kz9K*=noz8Le}kUe5qypPm0XI~JD@LigpKsH$?gxI%%5A|3i~AA zzza2RW{=aiC?o4nz!y&vAaW>2lsxR;ns*@ zAqb8u!?S@O7qgvQQO2Ek@TD5N*hZXI0Z^&CRA+*t_4N~@*5g;cAv|r(}N0=!>>=J7~OWhuAV~gUi<;!guWQg2n ztaiq~X+VB&XL0{7=M@!Gp$P+i`P0C6mA@ZRwhBK6_pkA=loULd>Y&vqt6JB5I370C z=VB97I{0%dx^4F4lL#{Ysh=|9WU|r_~cG3^29qqZ#uD%_UtNUE;1tr8B za<$Ep<}Lfr$Bv3o@yE>ovoyScw)rWFRBcspN8*nV*zj|>066mXS&qW_7=9QB2WjXH z>j%&0KU_)MlL;3C1`2h`y+%bRw^okSq*b9`j=r#UD8|BT*$-x48#8t3@Y}xBNG^nQ@ErP7TMc4aWxlFE@=OgE znqo?!t@VFBoMNh~etK>x^O478V)}Q{I_tsRr-DB_3)r)aZdOFg9Y_d*QFs645-k z6n>&2VuB@9ZB3C9LY^P`LFT+il}hO^`^MPyVKW=DaQVg|q5auuSHxyRSKYAv(V?e@mSEXE%xw1@4@b`2cQnfjT1t}oJj zgN6(XP~m?1R-L$7Um~EBPn-XQ`q&>z5DX8zxb;*)ai~Q?KLjA8|!v_n) z#K%PeM{-b^s}tM!|JTxa1~k!xTQ~(0>C(hd6-1D(fMDodq$LVS6_gK%bfwoMpdeiZ zQP4;rijm$$YOtZyM0!mWkqAej9sluM`1g=QzW=& zJzW+d_yvpbyifqKi!QB5{rwmmbh_{c<@tnW7O`NuqdbQ9dRSH2BW4!%Yz(#lEY1of$NPXf>7b=fXAKgxwrRN5h`ZjGHY5Hkk8OZ?(v#35ZZu?l-B=T5v zc~^y@m8fdpHy57=BgRQnPQJsA#p88z@+Y6*@`Pt#&%n>P;t;|jL5_QSLxFaOZ624Y zW`%6T6#+^pv${axd2yo^MRUb$QdREZ&vS+%yUt@=OOpfLnG`E(`ng49hA^cQb7`H9 z@aR$MPDj^Hjx*-nzm)!BMcC_9gB2v*KvP+q&w|aW7Uy@PvoQQxv1go;ef}1X(l@B? z2m8*#0p`{g6u4!JQP*t^ZM)u8Q9BZwO!n62&7X!{Ia_P#;~34NUwlQIvy9}nj0B`s(@pJ(%Y!-#S<;KY=6sl*i=5S_=LxFV zm-H{~;Xj3$%O|tneGVEr_-$J6F;UJvVOjUN0bXHbkm3U$F|)!(Pr{xEgiH%feck5U z6$^U~lKiZjtFdHqxcFzCs&#sJ7H@PnRE+rjt&(1bKyfQFtirI*?wZYnx|+}X2Cjnd zL1BM9NP6atcRxa3`+*skVh9kYQ4ffk*yii1;=p?skXs60RWB|YU->z!-fGSla@J4( z;b_KZ&ale`i{Nr*0q#9jA}FmTZDE4?)fX$lSvQ0i6?dSKHU<|uI<&@vN?Y_w5!z~u z<~O9n-ZR_4)GzR&ToF?UIkZjSK=U=b#vuGS0v+u)i(7_b-)ewI+1w(pl)A33gWg+% z4561Dy!HB~3*qRyJ_~ZU8$eav-;j@qo1LwB5Xa&>v;VCbh)$HFvtT2q8h3)_moREE zMn*2Yyr-93%9N(<4BQjoyEmpL=yF#-L@>>AUwM;nnjeH@*;g2T#5vQ?48T>)3<{&; z^_r>M2bn)u2U=ofUx4)1T&GknXv(PfOC6luOTpe9HI z0gJ~A;JoEI$i=rX9ey**CKdQAGdv&{58aI4ZvZpYA#S;M{aK@HvH(Tve!}$fsjN z#?c*KCKPKSPqe+65DNqZYO#+COsM=PP}N^kG(gj5CV z6>#)`;4u|}yR~p=D=?a0H*pbG2CIrj&X>8ttNCMY%>_!X@_ki>u{kVA-R=bx)#BqlAOeuj#oiwv#!0MR{r-^TO}6{cf_g7sC%-u|tXK?1B=a(iZ}iJ) zA9Ye?G@oH!zrTq+zH76`dm}5r`Xm1bafxXECG;K5d0FOSy_fCio`lO_nnJfLueC)F znE!6E&meAeIDrteiB&|>XS;F!qru-x{SYPr^HK_6rg0s}K{MycAn6#%1sC+Skevww zR2s5{n}30$NQ{f3pGUAr!Ch?*P3{6Ap%jO~ROV;8biMzI;VXi^P{`6II^{!Y3}o{% zf*Mj1$QpU##JQ+xG}?BgB39%&UrgJ@<>PCXPLi;G*%C=&kZeJM9w>^h+8ZVAs9c8= zl>fw_X9#R{u(`7?hM5~Xxc40GQF$M|-ip6buI}w^P#YXOSvdZoGBVqguNoH9Ij5yM=&ZL!4 z47jHVq1*(DU8*u?`J(xs-$z>clv7OQPCH5p;vAgnP+JG3M1POu zLn;aC1Bt!{sd`+l+H zk*c_Z{9KL1LYu@l&RpDFTmSSO*r6{qj3s6n3!vcSIhZF2r-J*6j9{+=8%j!yqfRJy5C{Gvtv3X8Z)RQ%F$qG|a^ z>(th(ZwWW9*bP);D@#Z%9f1~tXvly!ix`aTPdM za|etlu^aczZ>MNvKS}02SH6U~T);st z8#q!=()v4y--dP-K~u^nW|AZBE0K;T88ChSB5%O3)NdD6IhrFBf{Z6sQ@mdUXIy>w zbK3s7?dhPF@j{eWiMbqjmWtcZsh?)b<<1Iy=E8f7BoHpy7vfIv*f`1A*67-fwAx84SgAovJ=4iiJWT(THw%>&dI?UZJNTGS~ zyCh+sMxxf19Ig(XlvUjJMPni?m+kjGSoJyK#`8R@$1|T_lZvH|-mKQjIF|cg99Y?A zZ1p!JPNJ_?=;pLknED16qYi&|pIzA2aoh{DN6(S@Ye5>998TqpCO7AkA6VsbQK$C- zwZ|utP6M3?UU?O@3Rfn@i4EV<$XVva)5v^7n>rh|j(w1f4VrUo*zogUa?9NyjS~SQ zpIN9ceWt1V_GxuW4x`DiXP>)S2h_7)93l~>++ttl zVeo522`|}bYZ5SulXr^rYreanbeMW)uF<40s~ss#&sjv{u~}$UVcIL|xzG19Uz$v) zrX1#8ijo5)^BY8G+$%Kg7?V9(p}EdoNa!kUDuq|486teiu`U0zQ@N?D{b&a7sp~f6 z$6YlT%SsG;PM`cwsUmkdv@|{T%IyoJax*b2NC*NcTe%P+-FRZnNP{O*(NAuV&fM`4 z%fCy8ez&8p<@rL*Uy0d#2@(*u=(c^WCray8e5cKD(bzlgZ8da$l5v%Ekm6+tl4Msw zyzfv=_t982_bFzjZ*@8zlqc6L7{RX*QaP0tUF8D*Yo;A@h%K5$mCZjA3f;C;FL2)H zt>I~yN!~@x*1 z;o)q2<;qw2;y=u$B`o`=>I*^pS0eenoRSfXXKsoV9i)^a`s_9mU46Zz*~uwH-% z(6BzTX7w9`M|ONjwnZ-T^iSgrpP753cFvkb2wW*PlNYR?!fUJG^0;FLaQ`%@@@5oq z4BJJer0%DkJ)iCOA$`5DNe*ZOrK~uqx>pH&crTB=(l9b~cJ;()p-R1kS}EF*lh-IS z;S>6IX9vL{{Op6f>684E@tU$$IC|!$rRbke4aWmb)c+ps-l}MQZmRC#Vcz$onU;a$ zV!!H~YRl!Og}i^lqR7Wh(2}+Dt4M=HFsDtX8{p`!i-#FmP^ldA>9^0aU7@3anJ#Ru zf2Xr&j(5POD5Z`~-bh!^`WTdPy;;}^u&v>N_QaV(h5`R@^nt#1mfo$=j+q2IXvD*e zpBfbWGd}TYvYcX53ZR{49h8m>XoCpnv{Tmz8rqiw$*5m|ndZj}4q4VK(n>6i>u`b= zF#0qVIJz}~&OE@MeenbA$tQ}+82{YRBXxfDZCa2ZLxN`Hw7krofScg-xEFJz9zC7d z8C1`$rm3B!TVHf$VbD2T!0Ul#QQ>&7pur~g)aqBp@yly)(Rx7=pl!{e#xNT*W8Njk z@{Vye$smt%sSA5AsG3_|hYuGBW6W8jbyNXMXB$A4ICAj#a@NX9l>L8Of7re^iH=>+ z&azjs`1tdU=Jzk6(O1{RYvfE``Uw1UbSe$iVJ3$Vlu@)-(L72DA7g+&C&D{2z&@sg zyw4q&*8awV*!{bf`*6F6b+!J=9|nC=mO{vksWtBhPQ|*~L{|oZkaFsXp0mVoNzuuohtDo0<-=3RDBYWqm3i-O7GzJ7=I&+nS=+o zg+D$&(#jQRrP$-&!qI0PFSrzxx@8mgqv}f=W*2*%^js}HuY~@d!!Wp|D5tFbn0U&| z`7aZ*ej4`!vL50ysl619FpH7YT2}EX=q9ALaiXdPZ9+Wv&%sE+LUt3BNV+}Rg4BRH zXBr+93w;IX=AW=g_#}h>)S*;-N#GV{Lr`QahkQb40HmmBq{#qxkz(1~FZO9J+TK-|OG$zY@hQ{8@P1kzzrOb#)%uTSTG~w@z;yq-pSm zPw8rCXXWaq8$xm%_D- zeT%B_q7ByN2l0Gma%`K~BpcoWCr#?M#Oh;`3URYb9m9xvvE`JwoYnJP7~>wN=ZOwc z${a~+PboZ^unMmTja~JazMv7cniAjx0+o;&R&45`))E)YGasq|lFLh8E=y;HZEEbw z;-4iha4c{b>y(wePARBdK1imf!dgByWOGsblXtszy;SC!#g+q+E-Ctw@quYG<5g9= z&8&Hx2U{1U;BT|!v_`&?S&Q}mYT(1mf9cx4-l@rW-f^!09lW|o9qkGz|2Zld-!LMn z+?JqMxpka;7A;b$?liMlQw%KipU!)W?I+i2tzPpK(|C&hbjnv3pw)37DpP!c0Xb@L ze72?o`o#|h3fpF>#zmQU6oU2nCGO+{_QHDBemGgJ(%K5qX2Vv=K9l4VUM!KBH5ru6 zd+KbJGzq$03nX;{(eY~i3waP#BUN2>tDfhS7If$EInfZtrNo64M?FaEBaH}OYm-eC zS2Os-Cs^Px&X3*MD*r0B&Nym1}d2b*x%X;fB&IgU~s;E!e+MymetSnrL7q9B3+#P+(wY;p01+ws>iuQ~>D z`u}pLe1AW<8>))1IT-aOfHoK~ZRp>l$WxzsZv^l?|(EoPU z4B42|lgc^2rvLV(JX2D=AI<}kC$%5dR$Al|rW#PsKE8JPY|lV5Gl+FOEa;0scWf7Z z(v%U9yZT~{bpTta@+^Cr+0PxV(3AdyM)sBM)=p2*k2tnvPWafX6q|!qudG8us$ni3 zHr{HzUqvbGl&cr#S$nq`%78X_A>}{a9TRXry`Em6+pz!yfU^ITK$WU6W|^Ff^&i92X9zx&)|T==rIrd6vK1K&^vY`Uddm*u+ti} z%r;};0)NmZymMY(vBZFj8cUUlc2gQ)1BKoBsp=eFkYBN^@l`vmuDjoK@S_ziz)-9d zmB3k1bPY5mag4y@BT@hIx6@Gjn}l=M5w1JD-ny5r(QRNUpEEjDC?2<@a`Den1sdIc z5I|v|s|;rxUNItQv3_MNFPNX zpo63ZaE^>~o~%|?w-faDs=2L8DO;zu)%MTK^443gozDCJc3Poo|;HlxI2X6318l7hMGb^er?f``kOb^g3VHK-c<+* zw+6V3RO?gfz%BIx;U!qFxf?Y#B~ zsEV=8<8o{vn?7ON3@})nXKc&!S05^y4$@w4EUMI*;MJ)@Yfc_VmzeW=HyM)kqkjQ@ zR$2W)KzT_qe%90eOUKzuwRzuL4%$x>3mf=yX6jikOx-6EB&g+>2?n-S)2b@|2!tzu zxZ@+)xPPjIg;k4v{m)l-!TzmS!KI+wmy$rbY6t<}S$lG*l5a^JP6~aAdNBKip1I*Sibu3r<|CEa&yvGO)R%q~k~nFsUfXvo_P2ZxP#U%>?{!OfO!4)W{XAJ?*X4Gn~+KiZiCl8Fftoad5z zc{@ouRVzPn(U9J;a#Y(}_YMapcKbSD=cPoGW4+1$+^^&dR9nD$+nFiP@dSYJ;B8EN zFZUWIIq+-NC?GJEdIeO9D>iI9dSfGcBfdT69U5Et6R0ZO#UFbW+yAId-{m|Kb$RvM2Em8E~8L&g(S2E6AedpQ^xH?hld^^%e7!CGDF{X%si-cv20QM2K$~H|yzOs^` zy@lz(3jL_;Ipn549{Y1`=tHUAVIkY0uvkA)KNWEEBGcJm*o(d};<6nD4VYIyWTUTp zqE|dgy=)2hM#{<>H~Z5_2<0zsnT=od_<>Tk7J>DFm~5i-mvI{2FlPQNHjQ|2pM3+y zPzQ=rZ;=iAk~&_Nwk!UaC+jQBb+WWIV*TH*BLoopC)?Nn&UDUn^1R89sE9C*0NhOV z<=4Afi~iyh6Wer(2sP$bDX;0u=xoxgd|C&j;~sDEn;`)ZmG9vFKZo-?N}WS&!jdx4 zY8jbgY z+|{qYejVJY%NNDv$498Gz=xtGGI<7^DRfd26Ob~1!ptd!q$K(Kx0p=EW58%vEr<(W zo#=Q;x;EFrRzbpYYerofFOf&*3j>c)mwVqX?C61Ipon3x4lxu`0vOa!gwhNn0i;H1 zH2D(q37h&_36-MK|y5Nq?KOZRjI&9-G=b61P2o%KLpTS$~Ib!-=Io&FoUDwUs(TKswHr7jetp!W9o($o5Hv78P0 zt$@{@t@ZfM`R2*B-43%-yTA1Gg^0A!iZV-9&Z`Z2W z_QeYLGw5$%r&#U72q*itVUv|E!(9@0B~~5N)OQ99&jR(mRn1vt@ckM94aJKAsH~&x z8$zpo_Eu=KSP1>&^)s4d%FNUZ-}FDQZQH_$C$_mtgJr=~++{6iNofB#S} zhMpnH;YT4?*}5LQIi}GU1G-tb<2yHWXL(nLHu0B_>R%&&-rV(|bsu><9rqqBHvi&f zI~!`7do^K7%u{2*Ic~V|$THt=JYQAKegkni>J4}Wrf*XNV>x3c=t(SQ909_8hEqoB6NIwinU*7i+lDKFzeW&EG zkSoi}DJ>7wYkH8|CZvY!p*E7FfZ(s@J#EHM>!7AJ!({N_G3m$p%vgxIcci^;t0lmV z80HY?bVEpd4rwrls~KmLUgGFy8`b;EN@vc7oLg-eL!DCxN9lcZo~ixrXS`Ch#EjdP z0zXbR*N9OC_nT`upGW$lh@DbtT2R!sa+sVyX)u$QUtu<%tE*UZRHb_xTNhSeEZva; zq@bnbKi3BvTuaKkDhCX3&rt{*T`k*Hd>S-}DrtxZM$)zkBTPW2$d9{(*ix;$y3yfH zV&~Z(ATAtw6fHHHZ3fl5jQ|fCua{nO7|fmJ^&t&ugOrLAsn$l`Pt*}^;Jv1Zybrr@ zWQ^m@e#0k!*odL)B`nV~NZh0EyoY@hUvx`2-=Wt!f>V3Pf%o!2S+5UbF8D$0nNqj896Dw_?lf-`lKRh_sXc>1Y`y@NL5B23!j;cHUI0tv z6BKLAu5|u9A2=AI0&pkzeIQ*$B0sI|`53ZbvDDpbhtU)VjFrdNK=+iJ$6QtnP66|E z6r>M%>{b^Xwa*6f^dFiFnr3Ks18xWcS+t4U2h>Fh#6K-U;8k>GJP-VD3`?+d?P)C6 zG;Ej08~CbMYgY$rBE<#mP@aY>YD+Tw7wCalWJ3IjEH8Uo?E~2Q3uXyXcWD7_`It4=r-(hpvX$s%h8> z9t~b?PHllPVOfYGHKOxt>(PL*0@{F~Scu4~NIjwIVqk2_*Q|vX`l0~M#Vxz^P{bU5 z&e0oCvk_JBIsjWl`b}{&POKPuv-%cAg>3HW5q1@D;2gQMo>&cTAQ@r#T}BP~nqYxT ziaFuv8u}lgF`w0$ZjYV{ll!fhwp3tjytZ0pc^mr<kJMMMT@rE zpgAH;W?v_C-uf>vzCP4bDh#ff>X3@d!PjdRfjcB*D|DCj`8#tjUz~|SP*0N zs+R*q?%val3kz`!f*s~0O5n#q{zRC)PO(l^Ahp*pUad4(x&G6y_>CZuOF%kncyE;W z`tV#JT`bF)c|z*yU*GvFWVuUc9_fKW4%OIHhe)0gryeTpo$uwo_xUdPO=`qDciPjn zPvjs^_6al!`{2>x#}PxD@`c{fEP>K4)SsCOrV1;FGh*Kl+6JrG4*rJ$qg6Us5iUl zloaF;=sYax^`U~R7(svAC+R{17?SZvB!3#hT>k7M*6gA zlJapCDCugRQcGv4wg*~8h(r}fWkl`)`#2Cxaa~GtL0x$+hw2>epoy(^pp58iQzYxb z9)RjH0zBxc0Q<#I0Q=%xb_oJfnAqidey-=eEX6{ei5N#by_3grp6z^m$N z?$4*c-6q6^R$1t!{xVfJ=JLz_i@{+*O;R>Xs-GgaO`?Sh93}z4Mp~3qsc-3>Qs4(? zi}(FzjZ__lNSVl$kAE)D^ns0-6F5hItv|_nc;}d-a39YGGmt0}zhcz3-T3Lbe)jUU z4q#)p{gyI_+1| z&&-&UgH!y0+)T2-oipSa@7qhGg49k6L8_9;%CDVvSFc5AYXr1HP_B^ImImFC~!9gPuD1GaSvF~`Ew+Z433)Ew+UhOu=6 z7LP{rI(%_e5ChYXUOwJhlG?mGYB8*uePxr$gZ^~hQx63}FYiWIL*j36jI&Yg9}9s*MEE~Da?5d*TUfv4Zz@h(luq*v}a0|GK$Jfc1ABHj_i1(0Cc&K)5sJ3P$^r`?m90+tON7T17P?sX_cEp8Sq+-!GLDGN?5r?8WKC;?54hV1cj#i#Whx!-`Q3{&>U zjsk$j-l!q{wQvAVcu$vW>c~E4piG$2{Y~F<)v5*G>F}`==f%Z}#L)D+767Y_Qw}6E zUx2&uG;@p1Bcp&z`5sSKq9$~&XlB0((wN25W&R6kzr=C^D3RaUJj0OGYhiNWj}bZ{ z>@KI9gjWPB(;~ul=l@V>02b;F^0ye z>T=jlK{sS87x6pGxN)?KO3CUg*n&Ql@a%B=Nd(MQ3&=u8i)D&g_{QTdf2>U-x4S^_ zqQm_hW0_j><|D%1v4t%83t&tJU-3w%z9Bj8C+P8rt`rPOeVd1gXV5U#%O!k@UIw;}vD z`z5V`;K-=;(24KK-I8UkvV$0b=CbWdgjjD9<;zakK(99V^Nc-XlH#8*R>^w`F3%RI`sMo3n~%1Q4g^VjCy>1$4=qj=cHpN1||jiynl9Q-db zC^%+mI|segQ_x^B`Ghs^=rCH;$$HK-?C#|-OaOvip-8E^-y6iaq+L?WsF!SY>sHO{ ztwj|_p2OLggJubgStN7Q!m27|WlGs<9uf?H{(pqqAB%mIt2oVn$X+X|7LJd|Hhd1? z(qdD<2IhBBK0YNcOZmR}_`L-fyt8H)AQ%0Q`O6;59R*+QVj7ly@{c~d49Noh!v*I% z6BlW*MQ|2Cnf|WJ)e07d<%QGV|;Z+%- z>c$tq7rS^VEJ!RsXY$E=U_pyv{RJv|47z+<5!tcd@~={F#<_Z~?j)=4*E{ zIMmnITh86i+bZ6qgFNc`(F*iyf~ybq`#8{+ad|yxE1x#-dF;sn(2GS;4fmfiYJKJR z4q@VnaMpi7jgtXkLO-9<@TxvOuNT?c*~B^a|DjOtJO-tC$uXW%+B;fD#L#Q1 zu{#+BBWed3AvPbc8X1?lqz{38ZBe3E9QV=Ql*g(#iB1c0co%K)Htf#*DG zbph_|aiBnlMu4`CQjr6(pul12z5GZ0kgzV6u-iR1PTQV{w$EM zoZpz3Foz^CwdTvNs4%VoU?IFyBY@uSiUOFO7P!rS1vZrasoyzt`Nh-c04nchz>&D) z+U%-aPx9SBaWH^&b+jj25VwE??Hor|4)&J*k_4n;N$L9vT^xoDnnjN9SRAeL0KB7T zAb_!lX~rgmC>{I2fdlt~X3`?KthoSAd2OA*4#MweXe{urUJl%5;|0I1TheMLfl~hE z9iT#JWd`quuM9TIZXMqxwyZ3G!SU($>7jSqZbTjJV^;S7R{BNt5N+hfEbbqt{KvB4 zM7gfgfy?F^UliM#q9@J< zlBP+AZ_tlA#)$x{{9*+@OCmw8Iy6Md2WAJMnxDL`aI|nW+F~hjCA}Q?57y5Nmz`bGAQ8dPDvX5uxSV-@= z27x9nZMefa9bgJO_ID59)Ng;$LNFpmXFWa20qNDuT`R zdkomhM6S7oC8My=0(Cn2|L+Ybp5Tf)69TH1q6z@bpej@7)Q!WJlv*mL*ZeaFPI%hX zlZ)ZW&}NuXhJY6=)aMa(4%X2p>FyNuBL4hLydX&NX&|busLel{2Y3TOV(hV|lC36S zn$$T5aEk$)zV~^q21$K!;iHw=KHR;qTJa}b`x4W?=xkFd&71j;fY(8krTKXJGGqae zp$g?Euq-P)hXes;2>7a7y4`dgC(xx14JWG+E~mADG{uv|H;6oUzEWz3NRt3?nWW{l z10T#I0QPTP0&0Qo5%WH%zMDSM^Bv8w4P)5G>#2HY;mA140K2vNHi`lczxRV|loA>R*y<{k-1&ExkWnq)5U1zWhe%dKi4HCKL3%<5}U>6y!GkH6oHt4jv@ zEw2#BbT)Lk$Xkxxcc?oeR_vWTLI$aiBq8UASEi)O4tCKRs{@q>Z7a;a+raJh_Le6e aN+~RSfIeOLsqpXBd6s6jrj^E?iT?v^;&uiA literal 0 HcmV?d00001 diff --git a/linux/arch/portmaster_notifier.desktop b/linux/arch/portmaster_notifier.desktop new file mode 100644 index 0000000..e34a1c4 --- /dev/null +++ b/linux/arch/portmaster_notifier.desktop @@ -0,0 +1,9 @@ +[Desktop Entry] +Name=Portmaster Notifier +GenericName=Application Firewall Notifier +Exec=/opt/safing/portmaster/portmaster-start notifier --data=/opt/safing/portmaster +Icon=portmaster +Terminal=false +Type=Application +Categories=System +NoDisplay=true diff --git a/linux/templates/PKGBUILD b/linux/templates/PKGBUILD deleted file mode 100644 index 3ea6eb1..0000000 --- a/linux/templates/PKGBUILD +++ /dev/null @@ -1,55 +0,0 @@ -{{/* Template file expects repo root as working directory */}} -{{- $nfpm := (datasource "nfpm") -}} -# Maintainer: {{ $nfpm.maintainer }} -# -{{ strings.Indent 1 "# " $nfpm.description -}} -# -pkgname=portmaster-bin -pkgver={{ index ($nfpm.version | strings.TrimPrefix "v" | strings.SplitN "-" 2) 0 }} -pkgrel={{ index ($nfpm.version | strings.SplitN "-" 2) 1 }} -pkgdesc='Application Firewall: Block Mass Surveillance - Love Freedom' -arch=('x86_64') -url='https://safing.io/portmaster' -license=('AGPL3') -depends=('libnetfilter_queue') -makedepends=('imagemagick') # for convert -optdepends=('libappindicator-gtk3: for systray indicator') -options=('!strip') -provides=('portmaster') -conflicts=('portmaster') -install=arch.install -source=("portmaster-start::https://updates.safing.io/linux_amd64/start/portmaster-start_v${pkgver//./-}" - 'portmaster.desktop' - 'portmaster_notifier.desktop' - 'portmaster_logo.png' - "portmaster.service") -noextract=('portmaster-start') -sha256sums=('{{ file.Read "portmaster-start" | crypto.SHA256 }}' - '{{ file.Read "portmaster.desktop" | crypto.SHA256 }}' - '{{ file.Read "portmaster_notifier.desktop" | crypto.SHA256 }}' - '{{ file.Read "portmaster_logo.png" | crypto.SHA256 }}' - '{{ file.Read "portmaster.service" | crypto.SHA256 }}') - -prepare() { - for res in 16 32 48 96 128 ; do - local iconpath="${srcdir}/icons/${res}x${res}/" - mkdir -p "${iconpath}" ; - convert ./portmaster_logo.png -resize "${res}x${res}" "${iconpath}/portmaster.png" ; - done -} - -package() { - {{- range $nfpm.contents }} - {{- if not (index . "type") }} - {{- $mode := 0644 }} - {{- with (index . "file_info") }} - {{- $mode = (or (index . "mode") 0644 ) }} - {{- else }} - {{- end }} - install -Dm {{ printf "%#o" $mode }} "${srcdir}/{{.src}}" "${pkgdir}{{.dst}}" - {{- else if eq (index . "type") "symlink" }} - install -dm 0755 "${pkgdir}{{ path.Dir .dst }}" - ln -s "{{.src}}" "${pkgdir}{{.dst}}" - {{- end }} - {{- end }} -} diff --git a/linux/templates/arch.install b/linux/templates/arch.install deleted file mode 100644 index 5e34bc6..0000000 --- a/linux/templates/arch.install +++ /dev/null @@ -1,28 +0,0 @@ -{{/* Template file expects repo root as working directory */}} -{{- define "log" -}} - log() { - echo "$@" - } -{{- end -}} - -post_install() { - {{ template "log" }} -{{ file.Read "templates/snippets/install-systemd-utils.sh" | strings.Indent 4 " " }} -{{ file.Read "templates/snippets/post-install.sh" | strings.Indent 4 " " }} -} - -post_upgrade() { - {{ template "log" }} -{{ file.Read "templates/snippets/install-systemd-utils.sh" | strings.Indent 4 " " }} -{{ file.Read "templates/snippets/post-upgrade.sh" | strings.Indent 4 " " }} -} - -pre_remove() { - {{ template "log" }} -{{ file.Read "templates/snippets/pre-remove.sh" | strings.Indent 4 " " }} -} - -post_remove() { - {{ template "log" }} -{{ file.Read "templates/snippets/post-remove.sh" | strings.Indent 4 " " }} -} From 7fec81c8ee5d16d5c6b6de0288bb4be03a188bad Mon Sep 17 00:00:00 2001 From: James Callahan Date: Thu, 28 Apr 2022 12:05:11 +1000 Subject: [PATCH 2/2] Overhaul of arch packaging - Build the go binary instead of downloading prebuilt binary - Clean out un-wanted parts of arch.install script - Install into normal system directories instead of /opt - Reproducible builds (don't embed information about build system into binary) --- linux/arch/PKGBUILD | 92 +++++++++----- linux/arch/arch.install | 162 +------------------------ linux/arch/portmaster.desktop | 2 +- linux/arch/portmaster.service | 6 +- linux/arch/portmaster_notifier.desktop | 2 +- 5 files changed, 69 insertions(+), 195 deletions(-) diff --git a/linux/arch/PKGBUILD b/linux/arch/PKGBUILD index 4fcc5a6..44035f0 100644 --- a/linux/arch/PKGBUILD +++ b/linux/arch/PKGBUILD @@ -1,13 +1,14 @@ # Maintainer: Safing ICS Technologies +# Contributor: James Callahan # # Application Firewall: Block Mass Surveillance - Love Freedom # The Portmaster enables you to protect your data on your device. You # are back in charge of your outgoing connections: you choose what data # you share and what data stays private. Read more on docs.safing.io. # -pkgname=portmaster-bin -pkgver=0.7.0 -pkgrel=2 +pkgname=portmaster +pkgver=0.8.5 +pkgrel=1 pkgdesc='Application Firewall: Block Mass Surveillance - Love Freedom' arch=('x86_64') url='https://safing.io/portmaster' @@ -15,41 +16,74 @@ license=('AGPL3') depends=('libnetfilter_queue') makedepends=('imagemagick') # for convert optdepends=('libappindicator-gtk3: for systray indicator') -options=('!strip') -provides=('portmaster') -conflicts=('portmaster') +options=('!lto') install=arch.install -source=("portmaster-start::https://updates.safing.io/linux_amd64/start/portmaster-start_v${pkgver//./-}" +source=("https://github.com/safing/portmaster/archive/refs/tags/v${pkgver}.tar.gz" 'portmaster.desktop' 'portmaster_notifier.desktop' 'portmaster_logo.png' "portmaster.service") noextract=('portmaster-start') -sha256sums=('6ade636aaf2b608f251972fd98b25a8020b301023a6377e5275de5195a132e7f' - '7b0c03e4552dd86caeff2d628b13346cfe70a646af11abac6555e348e46c28da' - '490b586f185218fdd947e8f12aa2dc412d78d89c8ce9b8ef5a75cb2e5ffb94ae' - 'ecb02625952594af86d3b53762363c1e227c2b9604fc9c9423682fc87a92a957' - 'bc26dd37e6953af018ad3676ee77570070e075f2b9f5df6fa59d65651a481468') +sha256sums=('3a504033aacd63f65fda1a15d1b2d354f7083b1025b991c228e66d31089ce7c1' + 'a226e5b69e1086affb1aa205d54d7853eb3dbfd4336dc0f494873746f11ae5f0' + 'fcd9adf46b3f258456b414e7013ead77290d2a49b82bc5ff25ef1fd1cf40286a' + 'ecb02625952594af86d3b53762363c1e227c2b9604fc9c9423682fc87a92a957' + '8b9c98ce48a899ab1709359f11700095eb2a8d38513733329cd78644cf22a12b') prepare() { - for res in 16 32 48 96 128 ; do - local iconpath="${srcdir}/icons/${res}x${res}/" - mkdir -p "${iconpath}" ; - convert ./portmaster_logo.png -resize "${res}x${res}" "${iconpath}/portmaster.png" ; - done + cd "portmaster-$pkgver" + + go mod download +} + +build() { + for res in 16 32 48 96 128 ; do + local iconpath="icons/${res}x${res}/" + mkdir -p "${iconpath}" + convert ./portmaster_logo.png -resize "${res}x${res}" "${iconpath}/portmaster.png" + done + + cd "portmaster-$pkgver" + + export CGO_CPPFLAGS="${CPPFLAGS}" + export CGO_CFLAGS="${CFLAGS}" + export CGO_CXXFLAGS="${CXXFLAGS}" + export CGO_LDFLAGS="${LDFLAGS}" + export GOPROXY=off + go build -o portmaster-start \ + -trimpath \ + -buildmode=pie \ + -mod=readonly \ + -modcacherw \ + -ldflags "-X github.com/safing/portbase/info.commit= \ + -X github.com/safing/portbase/info.buildOptions= \ + -X github.com/safing/portbase/info.buildUser= \ + -X github.com/safing/portbase/info.buildHost= \ + -X github.com/safing/portbase/info.buildDate=$(date -u +'%Y-%m-%dT%H:%M:%SZ' --date=@${SOURCE_DATE_EPOCH}) \ + -X github.com/safing/portbase/info.buildSource=https://github.com/safing/portmaster \ + -linkmode=external \ + -extldflags \"${LDFLAGS}\"" \ + ./cmds/portmaster-start + # https://github.com/safing/portmaster/issues/630 + #./portmaster-start completion bash > portmaster-start.bash + #./portmaster-start completion fish > portmaster-start.fish + #./portmaster-start completion zsh > portmaster-start.zsh } package() { - install -Dm 0755 "${srcdir}/portmaster-start" "${pkgdir}/opt/safing/portmaster/portmaster-start" - install -Dm 0644 "${srcdir}/portmaster.desktop" "${pkgdir}/opt/safing/portmaster/portmaster.desktop" - install -Dm 0644 "${srcdir}/portmaster_notifier.desktop" "${pkgdir}/opt/safing/portmaster/portmaster_notifier.desktop" - install -dm 0755 "${pkgdir}/etc/xdg/autostart" - ln -s "/opt/safing/portmaster/portmaster_notifier.desktop" "${pkgdir}/etc/xdg/autostart/portmaster_notifier.desktop" - install -Dm 0644 "${srcdir}/portmaster.service" "${pkgdir}/opt/safing/portmaster/portmaster.service" - install -Dm 0644 "${srcdir}/icons/32x32/portmaster.png" "${pkgdir}/usr/share/pixmaps/portmaster.png" - install -Dm 0644 "${srcdir}/icons/16x16/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/16x16/apps/portmaster.png" - install -Dm 0644 "${srcdir}/icons/32x32/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/32x32/apps/portmaster.png" - install -Dm 0644 "${srcdir}/icons/48x48/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/48x48/apps/portmaster.png" - install -Dm 0644 "${srcdir}/icons/96x96/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/96x96/apps/portmaster.png" - install -Dm 0644 "${srcdir}/icons/128x128/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/portmaster.png" + install -Dm644 "portmaster.desktop" "${pkgdir}/usr/share/applications/portmaster.desktop" + install -Dm644 "portmaster_notifier.desktop" "${pkgdir}/usr/share/applications/portmaster_notifier.desktop" + install -Dm644 "portmaster.service" "${pkgdir}/usr/lib/systemd/system/portmaster.service" + install -Dm644 "icons/32x32/portmaster.png" "${pkgdir}/usr/share/pixmaps/portmaster.png" + install -Dm644 "icons/16x16/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/16x16/apps/portmaster.png" + install -Dm644 "icons/32x32/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/32x32/apps/portmaster.png" + install -Dm644 "icons/48x48/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/48x48/apps/portmaster.png" + install -Dm644 "icons/96x96/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/96x96/apps/portmaster.png" + install -Dm644 "icons/128x128/portmaster.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/portmaster.png" + cd "portmaster-$pkgver" + install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE" + install -Dm755 portmaster-start "${pkgdir}/usr/bin/portmaster-start" + #install -Dm644 portmaster-start.bash "$pkgdir/usr/share/bash-completion/completions/portmaster-start" + #install -Dm644 portmaster-start.fish "$pkgdir/usr/share/fish/vendor_completions.d/portmaster-start.fish" + #install -Dm644 portmaster-start.zsh "$pkgdir/usr/share/zsh/site-functions/_portmaster-start" } diff --git a/linux/arch/arch.install b/linux/arch/arch.install index d5e759d..401531c 100644 --- a/linux/arch/arch.install +++ b/linux/arch/arch.install @@ -1,166 +1,6 @@ post_install() { - log() { - echo "$@" - } - # - # Prepares systemd support by creating a symlink for the .service file - # and enabling/disabling certain features of our .service unit based on - # the available systemd version. - # - installSystemdSupport() { - local changed="False" - if command -V systemctl >/dev/null 2>&1; then - local systemd_version="$(systemctl --version | head -1 | sed -n 's/systemd \([0-9]*\).*/\1/p')" - # not all distros have migrated /lib to /usr/lib yet but all that - # have provide a symlink from /lib -> /usr/lib so we just prefix with - # /lib here. - ln -s /opt/safing/portmaster/portmaster.service /lib/systemd/system/portmaster.service 2>/dev/null >&2 ||: - - # rhel/centos8 does not yet have ProtectKernelLogs available - if [ "${systemd_version}" -lt 244 ]; then - sed -i "s/^ProtectKernelLogs/#ProtectKernelLogs/g" /opt/safing/portmaster/portmaster.service ||: - changed="True" - fi - - if [ "${changed}" = "True" ] && [ "$1" = "upgrade" ]; then - systemctl daemon-reload ||: - fi - - log "Configuring portmaster.service to launch at boot" - systemctl enable portmaster.service ||: - fi - } - # - # install .desktop files, either using desktop-file-install when available - # or by just copying the files into /usr/share/applications. - # - if command -V desktop-file-install >/dev/null 2>&1; then - desktop-file-install /opt/safing/portmaster/portmaster.desktop ||: - desktop-file-install /opt/safing/portmaster/portmaster_notifier.desktop ||: - elif [ -d /usr/share/applications ]; then - cp /opt/safing/portmaster/portmaster.desktop /usr/share/applications 2>/dev/null ||: - cp /opt/safing/portmaster/portmaster_notifier.desktop /usr/share/applications 2>/dev/null ||: - fi - - installSystemdSupport - - # - # Fix selinux permissions for portmaster-start - # - if command -V getenforce >/dev/null 2>&1; then - chcon -t bin_t /opt/safing/portmaster/portmaster-start - fi - # # Prepare the installation directory tree # - /opt/safing/portmaster/portmaster-start --data /opt/safing/portmaster clean-structure - - # - # Finally, trigger downloading modules. As this requires internet access - # it is more likely to fail and is thus the last thing we do. - # - if [ "${skip_downloads}" = "True" ]; then - log "Downloading of Portmaster modules skipped!" - log "Please run '/opt/safing/portmaster/portmaster-start --data /opt/safing/portmaster update' manually.\n" - return - fi - log "Downloading portmaster modules. This may take a while ..." - /opt/safing/portmaster/portmaster-start --data /opt/safing/portmaster update --update-agent "${download_agent}" 2>/dev/null >/dev/null || ( - log "Failed to download modules" - log "Please run '/opt/safing/portmaster/portmaster-start --data /opt/safing/portmaster update' manually.\n" - ) -} - -post_upgrade() { - log() { - echo "$@" - } - # - # Prepares systemd support by creating a symlink for the .service file - # and enabling/disabling certain features of our .service unit based on - # the available systemd version. - # - installSystemdSupport() { - local changed="False" - if command -V systemctl >/dev/null 2>&1; then - local systemd_version="$(systemctl --version | head -1 | sed -n 's/systemd \([0-9]*\).*/\1/p')" - # not all distros have migrated /lib to /usr/lib yet but all that - # have provide a symlink from /lib -> /usr/lib so we just prefix with - # /lib here. - ln -s /opt/safing/portmaster/portmaster.service /lib/systemd/system/portmaster.service 2>/dev/null >&2 ||: - - # rhel/centos8 does not yet have ProtectKernelLogs available - if [ "${systemd_version}" -lt 244 ]; then - sed -i "s/^ProtectKernelLogs/#ProtectKernelLogs/g" /opt/safing/portmaster/portmaster.service ||: - changed="True" - fi - - if [ "${changed}" = "True" ] && [ "$1" = "upgrade" ]; then - systemctl daemon-reload ||: - fi - - log "Configuring portmaster.service to launch at boot" - systemctl enable portmaster.service ||: - fi - } - # - # As of 0.4.0 portmaster-control has been renamed to portmaster-start - # and is not placed in /usr/bin anymore. Unfortunately, the postrm script - # of the old installer does not get rid of portmaster-control so we should - # take care during an upgrade. - # - rm /usr/bin/portmaster-control 2>/dev/null >&2 ||: - - # - # If there's already a /var/lib/portmaster installation we're going to move - # configs and databases and remove the complete directory - # The preinstall.sh already checked that /var/lib/portmaster/updates MUST NOT - # exist so we should be safe to touch the databases here. - # - if [ -d /var/lib/portmaster ]; then - if [ ! -d /opt/safing/portmaster/config.json ]; then - log "Migrating from previous installation at /var/lib/portmaster to /opt/safing/portmaster ..." - mv /var/lib/portmaster/databases /opt/safing/portmaster/databases ||: - mv /var/lib/portmaster/config.json /opt/safing/portmaster/config.json ||: - fi - log "Removing previous installation directory at /var/lib/portmaster" - rm -r /var/lib/portmaster 2>/dev/null >&2 ||: - fi - -} - -pre_remove() { - log() { - echo "$@" - } - # stop the portmaster service and disable it if it's enabled. - if command -V systemctl >/dev/null 2>&1; then - if (systemctl -q is-active portmaster.service); then - log "Stopping portmaster.service" - systemctl stop portmaster.service ||: - fi - if (systemctl -q is-enabled portmaster.service); then - log "Disabling portmaster.service to launch at boot" - systemctl disable portmaster.service ||: - fi - fi -} - -post_remove() { - log() { - echo "$@" - } - rm -rf /opt/safing/portmaster/updates ||: - - # file is marked as a ghost on RPM system so it might have - # been automatically deleted by the package manager. - rm /lib/systemd/system/portmaster.service 2>/dev/null >&2 ||: - rm /usr/share/applications/portmaster.desktop 2>/dev/null >&2 ||: - rm /usr/share/applications/portmaster_notifier.desktop 2>/dev/null >&2 ||: - - if [ "$1" = "purge" ]; then - rm -rf /opt/safing/portmaster ||: - fi - + portmaster-start --data /var/lib/portmaster clean-structure } diff --git a/linux/arch/portmaster.desktop b/linux/arch/portmaster.desktop index de4b5b4..79b425b 100644 --- a/linux/arch/portmaster.desktop +++ b/linux/arch/portmaster.desktop @@ -1,7 +1,7 @@ [Desktop Entry] Name=Portmaster GenericName=Application Firewall -Exec=/opt/safing/portmaster/portmaster-start app --data=/opt/safing/portmaster +Exec=/usr/bin/portmaster-start app --data=/var/lib/portmaster Icon=portmaster Terminal=false Type=Application diff --git a/linux/arch/portmaster.service b/linux/arch/portmaster.service index af25a31..04e0e77 100644 --- a/linux/arch/portmaster.service +++ b/linux/arch/portmaster.service @@ -16,7 +16,7 @@ LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes PrivateTmp=yes -PIDFile=/opt/safing/portmaster/core-lock.pid +PIDFile=/var/lib/portmaster/core-lock.pid Environment=LOGLEVEL=info Environment=PORTMASTER_ARGS= EnvironmentFile=-/etc/default/portmaster @@ -37,8 +37,8 @@ CapabilityBoundingSet=cap_chown cap_kill cap_net_admin cap_net_bind_service cap_ # SystemCallArchitectures=native # SystemCallFilter=@system-service @module # SystemCallErrorNumber=EPERM -ExecStart=/opt/safing/portmaster/portmaster-start --data /opt/safing/portmaster core -- $PORTMASTER_ARGS -ExecStopPost=-/opt/safing/portmaster/portmaster-start recover-iptables +ExecStart=/usr/bin/portmaster-start --data /var/lib/portmaster core -- $PORTMASTER_ARGS +ExecStopPost=-/usr/bin/portmaster-start recover-iptables [Install] WantedBy=multi-user.target diff --git a/linux/arch/portmaster_notifier.desktop b/linux/arch/portmaster_notifier.desktop index e34a1c4..3776474 100644 --- a/linux/arch/portmaster_notifier.desktop +++ b/linux/arch/portmaster_notifier.desktop @@ -1,7 +1,7 @@ [Desktop Entry] Name=Portmaster Notifier GenericName=Application Firewall Notifier -Exec=/opt/safing/portmaster/portmaster-start notifier --data=/opt/safing/portmaster +Exec=/usr/bin/portmaster-start notifier --data=/var/lib/portmaster Icon=portmaster Terminal=false Type=Application