brand-string sweep: 11 files, remove leaked upstream product names

.github/workflows/brand-string-sweep.yml

@@ -0,0 +1,35 @@
+name: Brand string sweep
+
+# Prevent regressions of the sweep in scripts/verify-brand-strings.sh — 11
+# files (README, top-level package metadata, and shipped module strings) must
+# stay free of "Firefox 150 fork" / "LibreWolf-mirror" / "Firefox ETP strict"
+# / "Firefox Downloads" / etc. Legal attribution (MPL) and technical facts
+# (hostnames, XPCOM CIDs, extension IDs) are exempted by design — see the
+# script header.
+
+on:
+  pull_request:
+    paths:
+      - 'README.md'
+      - 'settings/actors/*.sys.mjs'
+      - 'settings/extensions/**'
+      - 'packaging/**'
+      - 'scripts/verify-brand-strings.sh'
+      - '.github/workflows/brand-string-sweep.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'README.md'
+      - 'settings/actors/*.sys.mjs'
+      - 'settings/extensions/**'
+      - 'packaging/**'
+      - 'scripts/verify-brand-strings.sh'
+      - '.github/workflows/brand-string-sweep.yml'
+  workflow_dispatch:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: bash scripts/verify-brand-strings.sh

README.md

@@ -1,10 +1,10 @@
 # BearBrowser
 
-BearBrowser is a LibreWolf-derived SourceOS browser product for humans and agents.
+BearBrowser is a sovereign, privacy-first SourceOS browser for humans and agents.
 
 It has two primary execution modes:
 
-1. **Human Secure Browser** — a privacy-first desktop browser profile based on LibreWolf defaults.
+1. **Human Secure Browser** — a privacy-first desktop browser with hardened upstream defaults.
 2. **Agent Browser Runtime** — a governed browser execution surface for local, cloud, and fog agents.
 
 ## Install

packaging/RELEASE.md

@@ -4,7 +4,7 @@
 
 **Date:** 2026-07-28
 **Release:** https://github.com/SourceOS-Linux/BearBrowser/releases/tag/v150.0.1
-**Source:** Firefox 150 fork (LibreWolf mirror), commit `8ffb75f`
+**Source:** hardened Gecko 150 (upstream-mirror), commit `8ffb75f`
 
 First cross-platform stable release. A sovereign, privacy-first browser with
 hardened anti-fingerprinting plus two flagship features that ship live in the
@@ -27,7 +27,7 @@ Install: `brew install --cask sourceos-linux/tap/bearbrowser` (macOS).
 ## 0.1.0 — `140.12.0esr-1` (Linux x86_64, first shippable binary)
 
 **Date:** 2026-06-30
-**Build:** `bearbrowser-build-20260630-100322` (Mozilla BearBrowser `140.12.0esr-1`)
+**Build:** `bearbrowser-build-20260630-100322` (BearBrowser `140.12.0esr-1`)
 
 This is the **first successful BearBrowser binary build** — the prior 10 GCP
 build attempts failed. Two real Linux x86_64 runtimes now exist and are wired
@@ -56,7 +56,7 @@ extracting.
 
 The following recipes now fetch the real tarball from GCS (or a staged copy),
 verify the SHA256, extract the Gecko runtime, and launch `bin/bearbrowser` — no
-more "binary not present / GCP build pending" stub or Firefox-ESR fallback:
+more "binary not present / GCP build pending" stub or unbranded Gecko fallback:
 
 - `packaging/linux/deb/build-deb.sh` — extracts into `/usr/lib/bearbrowser`,
   `/usr/bin/bearbrowser` shim; `--variant human|tor`.

packaging/chocolatey/README.md

@@ -19,6 +19,6 @@ choco install bearbrowser --source .
 ## Notes
 
 BearBrowser requires the GCP compile pipeline for the full patched Gecko build.
-During early access, installs Firefox ESR as the Gecko base and applies the
+During early access, installs a hardened Gecko base and applies the
 BearBrowser configuration profile (user.js with 101 fingerprinting protections).
 The patched build (OS-spoof patch + FF140 ESR cohort patch) ships via GitHub Releases.

packaging/linux/binary-source.env

@@ -1,5 +1,5 @@
 # BearBrowser Linux x86_64 binary source — single source of truth for packaging.
-# Points at the v150.0.1 stable GitHub release (Firefox 150 fork; BearNet + BearTrap).
+# Points at the v150.0.1 stable GitHub release (hardened Gecko engine; BearNet + BearTrap).
 # Consumed by deb/snap/appimage/flatpak/rpm packaging to fetch the REAL binary tarball.
 #
 # The tarball extracts to a top-level bearbrowser/ directory containing the full

packaging/linux/deb/control

@@ -7,7 +7,7 @@ Maintainer: SourceOS <maintainers@sourceos.dev>
 Depends: libgtk-3-0, libdbus-glib-1-2, libx11-6, libxcomposite1, libxdamage1, libxext6, libxfixes3, libxrandr2, libasound2
 Homepage: https://github.com/SourceOS-Linux/BearBrowser
 Description: SourceOS governed browser for humans and agents
- BearBrowser is a sovereign, privacy-first browser built on Firefox 150,
+ BearBrowser is a sovereign, privacy-first browser built on a hardened Gecko engine,
  with hardened anti-fingerprinting (Canvas, WebGL, AudioContext,
  fonts, timing), BearNet (a built-in loopback network monitor with a live graph,
  world map and on-demand OSINT), and BearTrap (a fingerprint-probe honeypot that

packaging/linux/rpm/bearbrowser.spec

@@ -32,6 +32,6 @@ install -m 0644 branding/bearbrowser.svg %{buildroot}%{_datadir}/icons/hicolor/s
 
 %changelog
 * Tue Jul 28 2026 SourceOS <maintainers@sourceos.dev> - 150.0.1
-- Align version with the v150.0.1 stable release (Firefox 150 fork; BearNet + BearTrap).
+- Align version with the v150.0.1 stable release (hardened Gecko engine; BearNet + BearTrap).
 * Sun May 03 2026 SourceOS <maintainers@sourceos.dev> - 0.1.0-0.overlay
 - Initial BearBrowser RPM scaffold.

packaging/linux/snap/snapcraft.yaml

@@ -3,7 +3,7 @@ base: core22
 version: '140.12.0esr-1'
 summary: Gecko-first privacy browser with 101 fingerprinting protections
 description: |
-  BearBrowser is built on Firefox ESR with a 101-surface
+  BearBrowser is built on a hardened Gecko engine with a 101-surface
   fingerprinting shield. No telemetry, no cloud sync, anti-tracking built in.
 grade: stable
 confinement: strict

packaging/oci/README.md

@@ -29,7 +29,7 @@ The OCI lane packages `bearbrowser-agent-runtime` as a governed browser runtime
 
 Replace the runtime scaffold with a multi-stage image:
 
-1. Build BearBrowser agent-runtime from the Nix package or LibreWolf-derived workspace.
+1. Build BearBrowser agent-runtime from the Nix package or upstream-derived workspace.
 2. Copy only the required runtime closure into the OCI image.
 3. Run browser automation through a policy-mediated entrypoint.
 4. Export session artifacts through governed mounts.

packaging/winget/manifests/s/SourceOS/BearBrowser/150.0.1/SourceOS.BearBrowser.locale.en-US.yaml

@@ -11,15 +11,14 @@ PackageUrl: https://github.com/SourceOS-Linux/BearBrowser
 License: MPL-2.0
 LicenseUrl: https://github.com/SourceOS-Linux/BearBrowser/blob/main/LICENSE
 Copyright: Copyright (c) 2026 SourceOS Linux
-ShortDescription: Sovereign privacy browser (Firefox 150 fork) with a live network monitor and honeypot
+ShortDescription: Sovereign privacy browser with a live network monitor and honeypot
 Description: |-
-  BearBrowser is a sovereign, privacy-first browser — a LibreWolf-mirror fork of Firefox 150 built to be the most private browser you can run.
+  BearBrowser is a sovereign, privacy-first browser built on a hardened Gecko engine to be the most private browser you can run.
   It adds BearNet, a built-in loopback network monitor that shows every host the browser (or the whole machine) is talking to as a live graph and world map, with click-to-block and on-demand OSINT. BearTrap, its honeypot, detects and attributes fingerprinting scripts and blocks canary-token exfiltration. All geolocation is resolved from a local database, so the browser never leaks the addresses it connects to. No telemetry, no Google services, no cloud dependency. This build is unsigned, so SmartScreen may warn on first run.
 Moniker: bearbrowser
 Tags:
 - anti-fingerprinting
 - browser
-- firefox
 - gecko
 - privacy
 - security

scripts/verify-brand-strings.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# verify-brand-strings.sh — prevent regressions of the brand-string sweep.
+#
+# Enumerates user-visible or shipped files (RING 1 + RING 2 + RING 3 from the
+# audit) and grep-blocks any Firefox / LibreWolf / Mozilla product-name leaks
+# that would show up in:
+#   - the GitHub README (marketing)
+#   - `apt show`, `winget show`, `snap info`, `rpm -qi` (package metadata)
+#   - Console / DevTools strings a user opens
+#
+# EXCLUDED (kept as legal attribution / technical fact — not leaks):
+#   - hostname strings the monitor blocks by name (aus5.mozilla.org, etc.)
+#   - XPCOM contract-ids ("@mozilla.org/binaryinputstream;1")
+#   - extension IDs (react-devtools@mozilla.org, firefox@tampermonkey.net)
+#   - the MPL 2.0 copyright header on every .sys.mjs
+#   - gecko-patches/ (patches ARE against Firefox source; naming is correct)
+#   - packaging/chocolatey/legal/LICENSE.txt (MPL requires attribution)
+#   - packaging/RELEASE.md "Source: ... commit ..." lines (provenance)
+#   - README.md's meta-policy statement about provenance names being allowed
+#
+# Exits non-zero on any regression. Wire into linux-packaging or a new
+# workflow so a PR that reintroduces one of the sweep's targets fails.
+set -uo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+FAIL=0
+report() { echo "  🔴 $1"; FAIL=$((FAIL+1)); }
+ok()     { echo "  ✅ $1"; }
+
+echo "verify-brand-strings: checking $REPO"
+
+# ─ Files that must not contain any of these words ─
+# The list mirrors what the audit landed. If a bug-class recurs the fix is a
+# new line here, not more docs.
+BANNED_IN_USER_VISIBLE='(Firefox 150 fork|LibreWolf-mirror|Firefox ETP strict|Firefox native HTTPS-only|Firefox layout\.css|Firefox Downloads|Firefox ESR|LibreWolf-derived|built on Firefox|Mozilla BearBrowser|Firefox-ESR fallback|firefox'"'"'s download manager)'
+
+# Individual files (bounded scope — everything on the sweep's punch list)
+FILES=(
+  "README.md"
+  "settings/actors/BearCaptureParent.sys.mjs"
+  "settings/extensions/registry.json"
+  "packaging/linux/deb/control"
+  "packaging/linux/rpm/bearbrowser.spec"
+  "packaging/linux/snap/snapcraft.yaml"
+  "packaging/linux/binary-source.env"
+  "packaging/chocolatey/README.md"
+  "packaging/RELEASE.md"
+  "packaging/oci/README.md"
+  "packaging/winget/manifests/s/SourceOS/BearBrowser/150.0.1/SourceOS.BearBrowser.locale.en-US.yaml"
+)
+
+for f in "${FILES[@]}"; do
+  P="$REPO/$f"
+  if [ ! -f "$P" ]; then
+    report "$f MISSING (expected on the sweep list — was it renamed?)"
+    continue
+  fi
+  HIT=$(grep -nE "$BANNED_IN_USER_VISIBLE" "$P" 2>/dev/null || true)
+  if [ -n "$HIT" ]; then
+    report "$f contains banned brand leak(s):"
+    echo "$HIT" | sed 's/^/       /'
+  else
+    ok "$f clean"
+  fi
+done
+
+echo
+if [ "$FAIL" -eq 0 ]; then
+  echo "brand-string sweep: OK"
+  exit 0
+fi
+echo "brand-string sweep: $FAIL file(s) regressed"
+exit 1

settings/actors/BearCaptureParent.sys.mjs

@@ -3,7 +3,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /**
- * BearCaptureParent — downloads media URLs via Firefox's download manager.
+ * BearCaptureParent — downloads media URLs via the platform download manager.
  *
  * Receives BearCapture:Download from the child with a media URL and filename.
  * Uses the toolkit Downloads API to queue a download to the user's preferred

settings/extensions/registry.json

@@ -24,22 +24,22 @@
       "name": "Privacy Badger",
       "disposition": "native",
       "native_replacement": "ETP strict mode + BearBlocker privacy filter list",
-      "rationale": "Heuristic tracker blocking covered by Firefox ETP strict + our curated lists."
+      "rationale": "Heuristic tracker blocking is covered by the built-in tracking-protection layer + our curated lists."
     },
 
     {
       "id": "https-everywhere@eff.org",
       "name": "HTTPS Everywhere",
       "disposition": "native",
       "native_replacement": "dom.security.https_only_mode = true (user.js)",
-      "rationale": "Firefox native HTTPS-only mode is more complete than the extension."
+      "rationale": "The browser's native HTTPS-only mode is more complete than the extension."
     },
 
     {
       "id": "{b9db16a4-6edc-47ec-a1f4-b86292ed211d}",
       "name": "Video DownloadHelper",
       "disposition": "native",
-      "native_replacement": "BearCapture (BearCaptureChild/BearCaptureParent) — scans DOM for video/audio/media links, floating ▼N badge, Cmd+Shift+D panel, queues to Firefox Downloads",
+      "native_replacement": "BearCapture (BearCaptureChild/BearCaptureParent) — scans DOM for video/audio/media links, floating ▼N badge, Cmd+Shift+D panel, queues to the browser Downloads panel",
       "rationale": "Extension used webRequest API (intercepts ALL network traffic) for what is actually a DOM scan + download manager call. BearCapture does the same with zero extension privilege surface."
     },
 
@@ -143,8 +143,8 @@
       "id": "addon@darkreader.org",
       "name": "Dark Reader",
       "disposition": "native",
-      "native_replacement": "System prefers-color-scheme + Firefox layout.css.prefers-color-scheme.content-override",
-      "rationale": "OS dark mode propagates through Firefox natively. For sites that don't respect it, add userContent.css rules."
+      "native_replacement": "System prefers-color-scheme + the layout.css.prefers-color-scheme.content-override pref",
+      "rationale": "OS dark mode propagates through the engine natively. For sites that don't respect it, add userContent.css rules."
     },
 
     {
@@ -159,7 +159,7 @@
       "name": "Disconnect",
       "disposition": "native",
       "native_replacement": "ETP strict mode uses Disconnect tracker lists natively",
-      "rationale": "Firefox ETP strict ships the Disconnect list. Extension is redundant."
+      "rationale": "The engine's tracking-protection ships the Disconnect list. Extension is redundant."
     },
 
     {