Installer NeuraCore

-----BEGIN PGP PUBLIC KEY BLOCK-----

xsFNBGqVbAABEAC6jXS90PnvT4jlcOBssfaKJlLiONN4KP2zL2S68IeONuYuXj2K
MA2y+Pe3QRGqIoUMe8+txFHyACzKLM44x+j0M89+pC+lb9F852Fsl6L3m8Jut231
Q6a7BV+P92CXRcwYsdy7vBlLWD7h9qeLFi8HNYiiF0F9R2280EXsBn3iFlz5PV66
IFmLELSmQHJWk10cCaityXvgd05kZkmtdL/JURIaV9VHij3O0oXRSue1pamUgVnp
J9EyU+vMssF9Gst1yU7iJmQnVh9kmplVjiVk46E9rDr/36qxMIjppvJ5H8qlfh/X
mNKdvqbBxXG0Cgwv/bq++7hV5ieBP80NwS9V1uA6cO+xY6QUHs/Q9xIddUoUUCZS
qLmEdWbCSV2wooVWnGuBBoASJBArLBhz/wWb8vzbSLJlXyG3QxTz2jK5ZeEmMVfY
qqbMO/vo68A9lXG/SsifM5gDyBYgsWcA+EyFXaBRNdySpoNUmlRuG5ytjUEsTAAD
eT4W4UHjfRfcPi4BZFdn+dkmssSK0hGNlJrTI6+jt0gtkKhZUOJlBZXGnADIxheD
AgALu2o2ervFsCgoqKnh7KV4QxsJMdZlxBy4PU1kUynhVU9YiKrEqtObehlkFklK
SyZXGn7F+dL+UwoHMQ1vlSmtqVCQB0Zeed141ZDbKBPmLbIqWC03hQUq6wARAQAB
zTBOZXVyYUNvcmUgUGFja2FnZXMgPGhlbGxvK3BhY2thZ2VzQG5ldXJhY29yZS5j
aD7CwYQEEwEIAC4FAmqVbCUWIQSF2NazbuetCJIulEBUAe0EyL4CqAIbAQIeAQEL
ARUBFgEnAhkBAAoJEFQB7QTIvgKoS7oQALViQvdSno73t50vh7l+W/IPtOUrNVsC
AClGKypf/LXKLWfDXO3tQC2/Ctz/FFcq7tDU2TwsZ7M4r61Ig0QcKq9Pq2PE8qEJ
REAWWhvn3lP91VHyJrSkwHcph7IwoEcuCjl60O2KAfull8AS60L48n5P2kAwLOrX
X8XYKkTHWJ4tfwSn+aMgRbdskagGTwOKDhtKtnypP5+Hx8xdVXFNxsMvXqQJlBvo
e21YRIJLQLGRGd3e9L4poLrl+nu90L6bUgWC86I3c/Zl3U3D63hzNfCjHNZSwZNc
0GWP2K6CSLsaFNChVnZ8OLOGF4X/T5RmABisY1QK6hhOPRXabcyZFn6e3AdAkKlQ
HR+Q2+po611MlzjT4EVPbOirn8zhJgGFmhYWsdY/WNcTQc8Oot4bYmrA0QjZ0rpL
qNbA1x4KJLWqA77rxFzA36qEQToFBFnKdTMMcFNQvzKuj116QOQBywSLgeWr34bW
NeB/9SCQOYnXk3lX++cgCb1llxjzhVUKyhvLDD8f2BZfZVn014p+fZXyQuop6thj
yPtazfnMwOz2GngfvUE3rQDf6W1F6jylGFXvLfxQVE6jr+ENArXYbfNHiDi3YZcS
FybgKwFAtAY2VT7ZRNe5849jqpdfpyjU0o+f351z3XaIMETOOPJirzZMUr7JJtn+
4qyHDfEPSBHLzsFNBGqVbAABEADQ/rD7/MReQHEH7teCSD7GtqDIxO54bm56ZjXY
sYCTx3i8yCUxiGil+0En9kue/aFtWnIZ4Bztmyb+qZmCXC/QYFg9Pk5UHfL7UFCX
4M8cus27EmOe1bzCVkamGVBslgHtCO6ILd05dWaFMWQ+JhySrRK/56q3TqM97q7O
Tv5bFuDlxfcSs0Mbyy+ByGWBEh+AEO7Hhp8qtYD4rUCZrdrdUqXEmYbclAT7bB+9
r3D7Ucks2fVfv8D/vxEgTNO/R2gFsmPvqMLl0BBzIsU0ee2J6wDUFGIu1J3VX6og
DNKAbmxTzfLfX2mZ+xdqMLbEXp+oiRsObtnAizn1AXYjufncJf1QLujP7MyQV9dK
pfJX82X3CtxpqYW1zdbOvzhsS5ibLHnJ02YLptGW4BMXhtiQoeNHY4R6WZj27u0n
ftuBqrrFzsgxrEhlyBpNkNj/L5BoanwXwX4MBlBFiJMnhiH/uHHKenjxIN9lZ2zO
dyVjVN41vbccp7z60lxhgVOdK3ASE2rtiPCehl0cyL1y+YTNTQ6z40rHs4ZhYCgg
yVw0dHG+D1+Sj92vEmm8q/cRM5V0+MdnlEOQhYq58bgTMHLXibk9oigv5nmPvHCw
zgA5XnpUVTZ2+LHtbsFnccRkp6cbaPK/CGVsRUAO5UoVEP4URXDXqf+prEM5DD48
W0NyawARAQABwsOsBBgBCAJWBQJqlWwmAhsCFiEEhdjWs27nrQiSLpRAVAHtBMi+
AqjBdCAEGQEIAB0FAmqVbCUWIQQiJPyK7ya+BpZPVDcVGFtjGFpCBwAKCRAVGFtj
GFpCB5XhEACNulRSbi1Va8StHGmGzaph2KG/2ItjzZuSEs4t6oSKcGakFGW/mAzq
odJfUtjEH9g4NxapUWKhjxt/B8c5VpEYLr0YPcCXoZQmuNyhd0PoKy4hDxmSs9oR
szjgEGb7LA6Y9njVjRR9xk0BNb2Erf8SCRON24kZwEDDxEw97OZr/D6/doYqh3kg
U7zZ+TBTRUjjWMm+bJYsnFj4iwCbdh86d3ZEe9XxBzX7teMyhfph7vU7N7U/FLcu
48KfEdJ46L9MYfmWZ2PW5nxpX5utV1+2l8qjvp5YtRqGuEYNnrMh3Xx9EtA4K8mw
hnmlL9LDNyL8jdlQh5opCRD0djA65QdVVs1Fh/82dVh3gqHeHfzQhGTbf5DTCf/k
ehuWr4klWg/IeJmjOtSpGaXfQQ5ekltUBvnIHgCTWZjG9VdUfdDI8Y4P+0ijdyNn
owkmtkyquJmuzAZiZU6fGebUNgjgMzAF8YsqqgAcFug8mqncoUmZDHIS5McJtfDs
SJgMLcZZQJ9tqxNssy1VUksIkyz8yz51YTPy6toVSDdAWqSTGl4CchFgSICaAhHu
cyho8AWZugtiDUC7PhCKIxjqpQvHhHbQZD2EJtRw9yZpqiqS00Wy8BfzhgZmt5VH
YsNE4dE/OM94KtlpLz/fp84ZidAWL5PKH6B6/evBZ8pW2FAy6ua4SgAKCRBUAe0E
yL4CqJ5yEACJK/1Z85mwCgcqfNBmsGze2MFpVPc/2vXqZ3mS0+YsFCZT1wcX+iZJ
V1K7ILUlaR6SHSO1zWyHp4WmgrvfDlEj+h71fFQ3wZ31N+rvhdc7YtHBSxOIrRKW
IEiJyriduAJqzPrW7q5Mq4sQb+N8lh85vdTscJvNYAAjQQ2caBBl22WqeqskPRXP
uvcscXPc6Lm0gah+EHdfG9T6XXLlErv1Ih10VmJRJlbhCfnPkXKKOFAWjaqNDuNe
larVsSDxiN5IICgvzpiKv1RCkKDdt+LJHMW5Nw4gC47QC5/OLKs6v66FfUF/2O5F
E7fmAXfW5SaFc0Wa+jBs/Hc0WE/eqfy+VZupmlXlRMMhQyQ/Hy5cFhRkFmFNQAMv
SKV2hfUcv6k84cq+3kpB+NMsWcppG1JHbbclKRnwO25+flNjySZ4xJfXuoyl9EHJ
/XC1xI26jF5m8R/3pi5h1s9dLjIgKPUMcUdfBcGlOLyVR384rsjp+WdXD6GqnLBY
fG7Qf7YHPl/iMMQwuTM0LUnoakwdvQ3rG8wrlbPaAEWDS1EvQl1TBHM1RyzSOmqa
Mc0SVeGwZ4pOifXxmg8dJ530mQbhn7Wo2QoIWSoZ7y9UTkoo2qL6INf84ePZg/Li
EKVuJKQwI/J6kcUXZR5GF2HECf/ai6Yu06gBuJ8wIhERSptmKybLJw==
=oCLH
-----END PGP PUBLIC KEY BLOCK-----

Le fichier lui-même : /neuracore.asc

#!/bin/sh
#
# NeuraCore installer.
#
#   curl -fsSL https://download.neuracore.ch/install.sh | sudo sh
#
# On Linux, this adds the NeuraCore package repository and its signing key,
# then installs NeuraCore from it as an ordinary package.
# On macOS, this downloads the signed application bundle, installs it to
# /Applications, clears the quarantine mark, and symlinks the terminal command.
#
# It is generated by NeuraCoreDeploy and carries this release's signing
# fingerprint. Read it before running it; that is what the pipe into `sh`
# deserves.

set -eu

SITE="https://download.neuracore.ch"
KEY_FINGERPRINT="85D8D6B36EE7AD08922E94405401ED04C8BE02A8"

say() { printf '%s\n' "$*"; }
fail() { printf '%s\n' "$*" >&2; exit 1; }

# Root is needed to install software, and asking for it up front is better than
# failing halfway through with a permission error.
[ "$(id -u)" = "0" ] || fail "Please run this with sudo:  curl -fsSL $SITE/install.sh | sudo sh"

OS="$(uname -s)"
if [ "$OS" = "Darwin" ]; then
    say "macOS detected. Installing NeuraCore ..."

    command -v curl >/dev/null 2>&1 || fail "curl is required to install NeuraCore."
    command -v tar >/dev/null 2>&1 || fail "tar is required to unpack NeuraCore."

    say "Checking latest release from $SITE/latest.json ..."
    LATEST_JSON=$(curl -fsSL "$SITE/latest.json" 2>/dev/null || true)
    TARBALL_PATH=$(printf '%s\n' "$LATEST_JSON" | grep -o 'files/[^"]*macos[^"]*\.tar\.gz' | head -n 1 || true)
    if [ -z "$TARBALL_PATH" ]; then
        VERSION=$(printf '%s\n' "$LATEST_JSON" | grep -o '"version"[[:space:]]*:[[:space:]]*"[^"]*"' | head -n 1 | cut -d'"' -f4 || true)
        if [ -n "$VERSION" ]; then
            TARBALL_PATH="files/$VERSION/NeuraCore-$VERSION-macos.tar.gz"
        fi
    fi

    if [ -z "$TARBALL_PATH" ]; then
        for V in 2.0.0 1.0.1 1.0.0; do
            if curl -fsI "$SITE/files/$V/NeuraCore-$V-macos.tar.gz" 2>/dev/null | grep -q "200 OK"; then
                TARBALL_PATH="files/$V/NeuraCore-$V-macos.tar.gz"
                break
            fi
        done
    fi

    [ -n "$TARBALL_PATH" ] || fail "Could not locate a macOS release archive on $SITE."

    DOWNLOAD_URL="$SITE/$TARBALL_PATH"
    TMPDIR=$(mktemp -d /tmp/neuracore.XXXXXX)
    trap 'rm -rf "$TMPDIR"' EXIT INT TERM

    say "Downloading $DOWNLOAD_URL ..."
    curl -fsSL "$DOWNLOAD_URL" -o "$TMPDIR/macos.tar.gz" || fail "Failed to download NeuraCore from $DOWNLOAD_URL"

    say "Extracting archive ..."
    tar -xzf "$TMPDIR/macos.tar.gz" -C "$TMPDIR" || fail "Failed to extract NeuraCore archive."

    APP_SRC=""
    if [ -d "$TMPDIR/neuracore/NeuraCore.app" ]; then
        APP_SRC="$TMPDIR/neuracore/NeuraCore.app"
    elif [ -d "$TMPDIR/NeuraCore.app" ]; then
        APP_SRC="$TMPDIR/NeuraCore.app"
    fi
    [ -n "$APP_SRC" ] || fail "Archive does not contain NeuraCore.app."

    say "Installing NeuraCore.app to /Applications ..."
    rm -rf /Applications/NeuraCore.app
    cp -R "$APP_SRC" /Applications/

    say "Clearing quarantine mark ..."
    xattr -dr com.apple.quarantine /Applications/NeuraCore.app 2>/dev/null || true

    say "Linking terminal command to /usr/local/bin/neuracore ..."
    mkdir -p /usr/local/bin
    ln -sf /Applications/NeuraCore.app/Contents/MacOS/neuracore /usr/local/bin/neuracore

    say ""
    say "NeuraCore is installed. Start it from your Applications folder, Launchpad, Spotlight, or run: neuracore"
    say "To upgrade later, run this installer command again."
    exit 0
fi

# Linux package manager detection
if command -v apt-get >/dev/null 2>&1; then
    say "Debian or Ubuntu detected. Adding the NeuraCore repository ..."

    # Which of the two apt repositories this machine belongs to. They are
    # separate roots because an apt suite's Release file names the
    # architectures it serves, so one root per architecture is the only
    # arrangement in which publishing for one cannot break the other. A
    # Raspberry Pi pasting the generic command lands here, and has to be sent
    # to its own root or apt finds the repository and no installable package
    # in it.
    APT_ROOT="apt"
    DPKG_ARCH=$(dpkg --print-architecture 2>/dev/null || echo unknown)
    case "$DPKG_ARCH" in
        arm64) APT_ROOT="apt-arm64" ;;
        amd64) APT_ROOT="apt" ;;
        armhf|armel)
            fail "NeuraCore needs a 64-bit system, and this one is running a 32-bit ($DPKG_ARCH) Debian. On a Raspberry Pi, install the 64-bit Raspberry Pi OS and run this again."
            ;;
        *)
            say "This machine reports the $DPKG_ARCH architecture, which NeuraCore is not published for. Trying the 64-bit x86 repository; see $SITE if apt finds no package."
            ;;
    esac

    mkdir -p /etc/apt/keyrings
    # The armoured key is used directly. apt has read `signed-by` keyrings in
    # this form since 2.4 (Debian 12, Ubuntu 22.04), and it keeps the key out of
    # the deprecated system-wide trusted set, where it would have been trusted
    # for every repository on the machine rather than only this one.
    curl -fsSL "$SITE/neuracore.asc" -o /etc/apt/keyrings/neuracore.asc
    chmod 0644 /etc/apt/keyrings/neuracore.asc
    printf '%s\n' \
        "deb [signed-by=/etc/apt/keyrings/neuracore.asc] $SITE/$APT_ROOT stable main" \
        > /etc/apt/sources.list.d/neuracore.list
    apt-get update
    apt-get install -y neuracore

elif command -v dnf >/dev/null 2>&1; then
    say "Fedora or RHEL detected. Adding the NeuraCore repository ..."
    # `repo_gpgcheck=1` verifies the repository metadata as well as the package.
    # Without it dnf checks only the package signature, and an attacker who could
    # replace the metadata could hide an upgrade rather than forge one.
    cat > /etc/yum.repos.d/neuracore.repo <<REPO
[neuracore]
name=NeuraCore
baseurl=$SITE/rpm
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=$SITE/neuracore.asc
metadata_expire=300
REPO
    dnf install -y neuracore

elif command -v pacman >/dev/null 2>&1; then
    say "Arch detected. Adding the NeuraCore repository ..."
    curl -fsSL "$SITE/neuracore.asc" -o /tmp/neuracore.asc
    pacman-key --add /tmp/neuracore.asc
    # Locally signing the key is what moves it from "known" to "trusted".
    # Without this step pacman imports the key and then refuses every package
    # signed with it, reporting them as being from an unknown trust source.
    pacman-key --lsign-key "$KEY_FINGERPRINT"
    rm -f /tmp/neuracore.asc
    if ! grep -q '^\[neuracore\]' /etc/pacman.conf; then
        cat >> /etc/pacman.conf <<REPO

[neuracore]
SigLevel = Required DatabaseOptional
Server = $SITE/arch
REPO
    fi
    pacman -Sy --noconfirm neuracore

else
    fail "This system has none of apt, dnf or pacman. See $SITE for the other ways to install NeuraCore."
fi

say ""
say "NeuraCore is installed. Start it from your applications menu, or run: neuracore"
say "It will upgrade with the rest of your system from now on."

Le fichier lui-même : /install.sh

#!/bin/sh
#
# NeuraCore installer for the Raspberry Pi.
#
#   curl -fsSL https://download.neuracore.ch/install-raspberry.sh | sudo sh
#
# This adds the NeuraCore package repository for 64-bit ARM and its signing
# key, then installs NeuraCore from it as an ordinary package. Afterwards
# `sudo apt update && sudo apt upgrade` keeps it current along with the rest of
# the system, and nothing here ever replaces a file behind apt's back.
#
# It is generated by NeuraCoreDeploy and carries this release's signing
# fingerprint. Read it before running it; that is what the pipe into `sh`
# deserves.

set -eu

SITE="https://download.neuracore.ch"
KEY_FINGERPRINT="85D8D6B36EE7AD08922E94405401ED04C8BE02A8"

say() { printf '%s\n' "$*"; }
fail() { printf '%s\n' "$*" >&2; exit 1; }

# Root is needed to install software, and asking for it up front is better than
# failing halfway through with a permission error.
[ "$(id -u)" = "0" ] || fail "Please run this with sudo:  curl -fsSL $SITE/install-raspberry.sh | sudo sh"

command -v apt-get >/dev/null 2>&1 || fail "This does not look like Raspberry Pi OS or any other Debian system: apt-get is not here. See $SITE for the other ways to install NeuraCore."
command -v curl >/dev/null 2>&1 || fail "curl is required to fetch the signing key:  sudo apt install curl"

# What the firmware calls this board. Present on every Raspberry Pi and absent
# on an ordinary PC, so it is reported when it is there and skipped when it is
# not, rather than being required.
if [ -r /proc/device-tree/model ]; then
    MODEL=$(tr -d '\0' < /proc/device-tree/model)
    say "Installing NeuraCore on: $MODEL"
fi

# The architecture, which is what decides whether there is a package at all.
# A 32-bit Raspberry Pi OS is the common case worth answering properly: it is
# the default download on the Raspberry Pi site for older boards, it runs
# perfectly well, and NeuraCore is not published for it. apt on its own would
# say only that there is no installation candidate.
DPKG_ARCH=$(dpkg --print-architecture 2>/dev/null || echo unknown)
case "$DPKG_ARCH" in
    arm64)
        ;;
    armhf|armel)
        fail "This Raspberry Pi is running the 32-bit ($DPKG_ARCH) Raspberry Pi OS, and NeuraCore is published only for the 64-bit one. Check with: uname -m . A Pi 3, 4, 5, 400, 500 or Zero 2 W can run the 64-bit system; reinstall it with Raspberry Pi Imager, choosing the 64-bit edition, and run this again."
        ;;
    amd64)
        fail "This is a 64-bit x86 machine rather than a Raspberry Pi, so it wants the ordinary installer:  curl -fsSL $SITE/install.sh | sudo sh"
        ;;
    *)
        fail "This machine reports the $DPKG_ARCH architecture, and NeuraCore is published for arm64 and amd64 only. See $SITE."
        ;;
esac

say "Adding the NeuraCore repository for 64-bit ARM ..."
mkdir -p /etc/apt/keyrings
# The armoured key is used directly. apt has read `signed-by` keyrings in this
# form since 2.4, which is every Raspberry Pi OS from Bookworm on, and it keeps
# the key out of the deprecated system-wide trusted set where it would have
# been trusted for every repository on the machine rather than only this one.
curl -fsSL "$SITE/neuracore.asc" -o /etc/apt/keyrings/neuracore.asc
chmod 0644 /etc/apt/keyrings/neuracore.asc

# Its own repository root, not the x86 one. An apt suite's Release file names
# the architectures it serves, so the two releases are served from two roots
# and a publication of either cannot disturb the other.
printf '%s\n' \
    "deb [arch=arm64 signed-by=/etc/apt/keyrings/neuracore.asc] $SITE/apt-arm64 stable main" \
    > /etc/apt/sources.list.d/neuracore.list

apt-get update
apt-get install -y neuracore

say ""
say "NeuraCore is installed. Start it from your applications menu, or run: neuracore"
say "It will upgrade with the rest of your system from now on."
say "The signing key this repository is verified against is $KEY_FINGERPRINT."

Le fichier lui-même : /install-raspberry.sh