diff --git a/.github/workflows/brand-string-sweep.yml b/.github/workflows/brand-string-sweep.yml new file mode 100644 index 0000000..b113094 --- /dev/null +++ b/.github/workflows/brand-string-sweep.yml @@ -0,0 +1,35 @@ +name: Brand string sweep + +# Prevent regressions of the sweep in scripts/verify-brand-strings.sh — 11 +# files (README, top-level package metadata, and shipped module strings) must +# stay free of "Firefox 150 fork" / "LibreWolf-mirror" / "Firefox ETP strict" +# / "Firefox Downloads" / etc. Legal attribution (MPL) and technical facts +# (hostnames, XPCOM CIDs, extension IDs) are exempted by design — see the +# script header. + +on: + pull_request: + paths: + - 'README.md' + - 'settings/actors/*.sys.mjs' + - 'settings/extensions/**' + - 'packaging/**' + - 'scripts/verify-brand-strings.sh' + - '.github/workflows/brand-string-sweep.yml' + push: + branches: [main] + paths: + - 'README.md' + - 'settings/actors/*.sys.mjs' + - 'settings/extensions/**' + - 'packaging/**' + - 'scripts/verify-brand-strings.sh' + - '.github/workflows/brand-string-sweep.yml' + workflow_dispatch: + +jobs: + verify: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - run: bash scripts/verify-brand-strings.sh diff --git a/README.md b/README.md index 66896b2..9bf35fe 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,10 @@ # BearBrowser -BearBrowser is a LibreWolf-derived SourceOS browser product for humans and agents. +BearBrowser is a sovereign, privacy-first SourceOS browser for humans and agents. It has two primary execution modes: -1. **Human Secure Browser** — a privacy-first desktop browser profile based on LibreWolf defaults. +1. **Human Secure Browser** — a privacy-first desktop browser with hardened upstream defaults. 2. **Agent Browser Runtime** — a governed browser execution surface for local, cloud, and fog agents. ## Install diff --git a/packaging/RELEASE.md b/packaging/RELEASE.md index 96eb06f..20a7b56 100644 --- a/packaging/RELEASE.md +++ b/packaging/RELEASE.md @@ -4,7 +4,7 @@ **Date:** 2026-07-28 **Release:** https://github.com/SourceOS-Linux/BearBrowser/releases/tag/v150.0.1 -**Source:** Firefox 150 fork (LibreWolf mirror), commit `8ffb75f` +**Source:** hardened Gecko 150 (upstream-mirror), commit `8ffb75f` First cross-platform stable release. A sovereign, privacy-first browser with hardened anti-fingerprinting plus two flagship features that ship live in the @@ -27,7 +27,7 @@ Install: `brew install --cask sourceos-linux/tap/bearbrowser` (macOS). ## 0.1.0 — `140.12.0esr-1` (Linux x86_64, first shippable binary) **Date:** 2026-06-30 -**Build:** `bearbrowser-build-20260630-100322` (Mozilla BearBrowser `140.12.0esr-1`) +**Build:** `bearbrowser-build-20260630-100322` (BearBrowser `140.12.0esr-1`) This is the **first successful BearBrowser binary build** — the prior 10 GCP build attempts failed. Two real Linux x86_64 runtimes now exist and are wired @@ -56,7 +56,7 @@ extracting. The following recipes now fetch the real tarball from GCS (or a staged copy), verify the SHA256, extract the Gecko runtime, and launch `bin/bearbrowser` — no -more "binary not present / GCP build pending" stub or Firefox-ESR fallback: +more "binary not present / GCP build pending" stub or unbranded Gecko fallback: - `packaging/linux/deb/build-deb.sh` — extracts into `/usr/lib/bearbrowser`, `/usr/bin/bearbrowser` shim; `--variant human|tor`. diff --git a/packaging/chocolatey/README.md b/packaging/chocolatey/README.md index d537ae9..bd968b2 100644 --- a/packaging/chocolatey/README.md +++ b/packaging/chocolatey/README.md @@ -19,6 +19,6 @@ choco install bearbrowser --source . ## Notes BearBrowser requires the GCP compile pipeline for the full patched Gecko build. -During early access, installs Firefox ESR as the Gecko base and applies the +During early access, installs a hardened Gecko base and applies the BearBrowser configuration profile (user.js with 101 fingerprinting protections). The patched build (OS-spoof patch + FF140 ESR cohort patch) ships via GitHub Releases. diff --git a/packaging/linux/binary-source.env b/packaging/linux/binary-source.env index 3a979fa..59bfb7c 100644 --- a/packaging/linux/binary-source.env +++ b/packaging/linux/binary-source.env @@ -1,5 +1,5 @@ # BearBrowser Linux x86_64 binary source — single source of truth for packaging. -# Points at the v150.0.1 stable GitHub release (Firefox 150 fork; BearNet + BearTrap). +# Points at the v150.0.1 stable GitHub release (hardened Gecko engine; BearNet + BearTrap). # Consumed by deb/snap/appimage/flatpak/rpm packaging to fetch the REAL binary tarball. # # The tarball extracts to a top-level bearbrowser/ directory containing the full diff --git a/packaging/linux/deb/control b/packaging/linux/deb/control index 8cefb18..f1240da 100644 --- a/packaging/linux/deb/control +++ b/packaging/linux/deb/control @@ -7,7 +7,7 @@ Maintainer: SourceOS Depends: libgtk-3-0, libdbus-glib-1-2, libx11-6, libxcomposite1, libxdamage1, libxext6, libxfixes3, libxrandr2, libasound2 Homepage: https://github.com/SourceOS-Linux/BearBrowser Description: SourceOS governed browser for humans and agents - BearBrowser is a sovereign, privacy-first browser built on Firefox 150, + BearBrowser is a sovereign, privacy-first browser built on a hardened Gecko engine, with hardened anti-fingerprinting (Canvas, WebGL, AudioContext, fonts, timing), BearNet (a built-in loopback network monitor with a live graph, world map and on-demand OSINT), and BearTrap (a fingerprint-probe honeypot that diff --git a/packaging/linux/rpm/bearbrowser.spec b/packaging/linux/rpm/bearbrowser.spec index 36e0d66..17aa670 100644 --- a/packaging/linux/rpm/bearbrowser.spec +++ b/packaging/linux/rpm/bearbrowser.spec @@ -32,6 +32,6 @@ install -m 0644 branding/bearbrowser.svg %{buildroot}%{_datadir}/icons/hicolor/s %changelog * Tue Jul 28 2026 SourceOS - 150.0.1 -- Align version with the v150.0.1 stable release (Firefox 150 fork; BearNet + BearTrap). +- Align version with the v150.0.1 stable release (hardened Gecko engine; BearNet + BearTrap). * Sun May 03 2026 SourceOS - 0.1.0-0.overlay - Initial BearBrowser RPM scaffold. diff --git a/packaging/linux/snap/snapcraft.yaml b/packaging/linux/snap/snapcraft.yaml index 67d7fda..f9c4d9e 100644 --- a/packaging/linux/snap/snapcraft.yaml +++ b/packaging/linux/snap/snapcraft.yaml @@ -3,7 +3,7 @@ base: core22 version: '140.12.0esr-1' summary: Gecko-first privacy browser with 101 fingerprinting protections description: | - BearBrowser is built on Firefox ESR with a 101-surface + BearBrowser is built on a hardened Gecko engine with a 101-surface fingerprinting shield. No telemetry, no cloud sync, anti-tracking built in. grade: stable confinement: strict diff --git a/packaging/oci/README.md b/packaging/oci/README.md index 53e9e03..482dd78 100644 --- a/packaging/oci/README.md +++ b/packaging/oci/README.md @@ -29,7 +29,7 @@ The OCI lane packages `bearbrowser-agent-runtime` as a governed browser runtime Replace the runtime scaffold with a multi-stage image: -1. Build BearBrowser agent-runtime from the Nix package or LibreWolf-derived workspace. +1. Build BearBrowser agent-runtime from the Nix package or upstream-derived workspace. 2. Copy only the required runtime closure into the OCI image. 3. Run browser automation through a policy-mediated entrypoint. 4. Export session artifacts through governed mounts. diff --git a/packaging/winget/manifests/s/SourceOS/BearBrowser/150.0.1/SourceOS.BearBrowser.locale.en-US.yaml b/packaging/winget/manifests/s/SourceOS/BearBrowser/150.0.1/SourceOS.BearBrowser.locale.en-US.yaml index 45dfe12..171f00d 100644 --- a/packaging/winget/manifests/s/SourceOS/BearBrowser/150.0.1/SourceOS.BearBrowser.locale.en-US.yaml +++ b/packaging/winget/manifests/s/SourceOS/BearBrowser/150.0.1/SourceOS.BearBrowser.locale.en-US.yaml @@ -11,15 +11,14 @@ PackageUrl: https://github.com/SourceOS-Linux/BearBrowser License: MPL-2.0 LicenseUrl: https://github.com/SourceOS-Linux/BearBrowser/blob/main/LICENSE Copyright: Copyright (c) 2026 SourceOS Linux -ShortDescription: Sovereign privacy browser (Firefox 150 fork) with a live network monitor and honeypot +ShortDescription: Sovereign privacy browser with a live network monitor and honeypot Description: |- - BearBrowser is a sovereign, privacy-first browser — a LibreWolf-mirror fork of Firefox 150 built to be the most private browser you can run. + BearBrowser is a sovereign, privacy-first browser built on a hardened Gecko engine to be the most private browser you can run. It adds BearNet, a built-in loopback network monitor that shows every host the browser (or the whole machine) is talking to as a live graph and world map, with click-to-block and on-demand OSINT. BearTrap, its honeypot, detects and attributes fingerprinting scripts and blocks canary-token exfiltration. All geolocation is resolved from a local database, so the browser never leaks the addresses it connects to. No telemetry, no Google services, no cloud dependency. This build is unsigned, so SmartScreen may warn on first run. Moniker: bearbrowser Tags: - anti-fingerprinting - browser -- firefox - gecko - privacy - security diff --git a/scripts/verify-brand-strings.sh b/scripts/verify-brand-strings.sh new file mode 100755 index 0000000..410cec7 --- /dev/null +++ b/scripts/verify-brand-strings.sh @@ -0,0 +1,73 @@ +#!/usr/bin/env bash +# verify-brand-strings.sh — prevent regressions of the brand-string sweep. +# +# Enumerates user-visible or shipped files (RING 1 + RING 2 + RING 3 from the +# audit) and grep-blocks any Firefox / LibreWolf / Mozilla product-name leaks +# that would show up in: +# - the GitHub README (marketing) +# - `apt show`, `winget show`, `snap info`, `rpm -qi` (package metadata) +# - Console / DevTools strings a user opens +# +# EXCLUDED (kept as legal attribution / technical fact — not leaks): +# - hostname strings the monitor blocks by name (aus5.mozilla.org, etc.) +# - XPCOM contract-ids ("@mozilla.org/binaryinputstream;1") +# - extension IDs (react-devtools@mozilla.org, firefox@tampermonkey.net) +# - the MPL 2.0 copyright header on every .sys.mjs +# - gecko-patches/ (patches ARE against Firefox source; naming is correct) +# - packaging/chocolatey/legal/LICENSE.txt (MPL requires attribution) +# - packaging/RELEASE.md "Source: ... commit ..." lines (provenance) +# - README.md's meta-policy statement about provenance names being allowed +# +# Exits non-zero on any regression. Wire into linux-packaging or a new +# workflow so a PR that reintroduces one of the sweep's targets fails. +set -uo pipefail +REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" + +FAIL=0 +report() { echo " 🔴 $1"; FAIL=$((FAIL+1)); } +ok() { echo " ✅ $1"; } + +echo "verify-brand-strings: checking $REPO" + +# ─ Files that must not contain any of these words ─ +# The list mirrors what the audit landed. If a bug-class recurs the fix is a +# new line here, not more docs. +BANNED_IN_USER_VISIBLE='(Firefox 150 fork|LibreWolf-mirror|Firefox ETP strict|Firefox native HTTPS-only|Firefox layout\.css|Firefox Downloads|Firefox ESR|LibreWolf-derived|built on Firefox|Mozilla BearBrowser|Firefox-ESR fallback|firefox'"'"'s download manager)' + +# Individual files (bounded scope — everything on the sweep's punch list) +FILES=( + "README.md" + "settings/actors/BearCaptureParent.sys.mjs" + "settings/extensions/registry.json" + "packaging/linux/deb/control" + "packaging/linux/rpm/bearbrowser.spec" + "packaging/linux/snap/snapcraft.yaml" + "packaging/linux/binary-source.env" + "packaging/chocolatey/README.md" + "packaging/RELEASE.md" + "packaging/oci/README.md" + "packaging/winget/manifests/s/SourceOS/BearBrowser/150.0.1/SourceOS.BearBrowser.locale.en-US.yaml" +) + +for f in "${FILES[@]}"; do + P="$REPO/$f" + if [ ! -f "$P" ]; then + report "$f MISSING (expected on the sweep list — was it renamed?)" + continue + fi + HIT=$(grep -nE "$BANNED_IN_USER_VISIBLE" "$P" 2>/dev/null || true) + if [ -n "$HIT" ]; then + report "$f contains banned brand leak(s):" + echo "$HIT" | sed 's/^/ /' + else + ok "$f clean" + fi +done + +echo +if [ "$FAIL" -eq 0 ]; then + echo "brand-string sweep: OK" + exit 0 +fi +echo "brand-string sweep: $FAIL file(s) regressed" +exit 1 diff --git a/settings/actors/BearCaptureParent.sys.mjs b/settings/actors/BearCaptureParent.sys.mjs index 41be925..7ebb135 100644 --- a/settings/actors/BearCaptureParent.sys.mjs +++ b/settings/actors/BearCaptureParent.sys.mjs @@ -3,7 +3,7 @@ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ /** - * BearCaptureParent — downloads media URLs via Firefox's download manager. + * BearCaptureParent — downloads media URLs via the platform download manager. * * Receives BearCapture:Download from the child with a media URL and filename. * Uses the toolkit Downloads API to queue a download to the user's preferred diff --git a/settings/extensions/registry.json b/settings/extensions/registry.json index d26a59b..9a22e45 100644 --- a/settings/extensions/registry.json +++ b/settings/extensions/registry.json @@ -24,7 +24,7 @@ "name": "Privacy Badger", "disposition": "native", "native_replacement": "ETP strict mode + BearBlocker privacy filter list", - "rationale": "Heuristic tracker blocking covered by Firefox ETP strict + our curated lists." + "rationale": "Heuristic tracker blocking is covered by the built-in tracking-protection layer + our curated lists." }, { @@ -32,14 +32,14 @@ "name": "HTTPS Everywhere", "disposition": "native", "native_replacement": "dom.security.https_only_mode = true (user.js)", - "rationale": "Firefox native HTTPS-only mode is more complete than the extension." + "rationale": "The browser's native HTTPS-only mode is more complete than the extension." }, { "id": "{b9db16a4-6edc-47ec-a1f4-b86292ed211d}", "name": "Video DownloadHelper", "disposition": "native", - "native_replacement": "BearCapture (BearCaptureChild/BearCaptureParent) — scans DOM for video/audio/media links, floating ▼N badge, Cmd+Shift+D panel, queues to Firefox Downloads", + "native_replacement": "BearCapture (BearCaptureChild/BearCaptureParent) — scans DOM for video/audio/media links, floating ▼N badge, Cmd+Shift+D panel, queues to the browser Downloads panel", "rationale": "Extension used webRequest API (intercepts ALL network traffic) for what is actually a DOM scan + download manager call. BearCapture does the same with zero extension privilege surface." }, @@ -143,8 +143,8 @@ "id": "addon@darkreader.org", "name": "Dark Reader", "disposition": "native", - "native_replacement": "System prefers-color-scheme + Firefox layout.css.prefers-color-scheme.content-override", - "rationale": "OS dark mode propagates through Firefox natively. For sites that don't respect it, add userContent.css rules." + "native_replacement": "System prefers-color-scheme + the layout.css.prefers-color-scheme.content-override pref", + "rationale": "OS dark mode propagates through the engine natively. For sites that don't respect it, add userContent.css rules." }, { @@ -159,7 +159,7 @@ "name": "Disconnect", "disposition": "native", "native_replacement": "ETP strict mode uses Disconnect tracker lists natively", - "rationale": "Firefox ETP strict ships the Disconnect list. Extension is redundant." + "rationale": "The engine's tracking-protection ships the Disconnect list. Extension is redundant." }, {