Add native Brave Origin and embed distro SVG logos

apps_config.csv

@@ -1,5 +1,6 @@
 Category,Label,Package Name,Flatpak ID,Exec Name,Notes
 Browsers,Brave Browser,,com.brave.Browser,brave,
+Browsers,Brave Origin,brave-origin,,brave-origin,Light Privacy-focused browser
 Browsers,Google Chrome,,com.google.Chrome,google-chrome,
 Browsers,Firefox,firefox,,firefox,
 Browsers,Microsoft Edge,,com.microsoft.Edge,microsoft-edge,

assets/keys/brave-install.sh.asc

@@ -0,0 +1,31 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGfPDCoBEACouDRqDFEP/AbVvlNktBGPa8TzeDWoi0ybIZRGHMhHb/JAHKd7
+ziD44gvjCgrq1O+w1I70VZA4JwJelWY9rmlIUwTTZwmV2gBpIeZ1F6+dUU7BRWSg
+Lnc5uhfXFTNe81aY81Ne4WbskUSRB1Go13m/mHZV7vJdwcqwcxmZGqhWPbvVInes
+Y6Bx9oe/sHs2dtVKD74JGtdLWYF6VzTMqyx0tDv8Dgkjr5iO1XnZcH5vl0/3Rc/x
+TlUKw265yjV9SQcd+l0mTcUFlwCGvjGuNa/Z4IwkR2Q19IF94B8/YbYXUk5B/RET
+JtZcW2xt8lsUTUdGAUOr0Cj3Kt01xcj+zWBUVs6gdgxdWTHAB6MVUx8BG5ScR+r8
+77/Udx6jkiG4zOAC2kR99pGFkLFwaIyqi9aLufPcROwmRcCZ2wXpGPGgsDPbWwh9
+KgMXidbcTD2j4H3SSr9cJfITB9Vf3Jh8YJiMbjHq0kI5LxqLL01H58FKa2Hsg8vQ
+60BxRqPiQNKlPp9RQa3kEwC8MB7YdZ8a3/Bfsk9sKHQXlRhdgwtRsdvVFlHHWoAW
+H6gOGfqwSWLOVrPXk/YCEvfF3MDk07eH3Bp4lfgtIum9bPzPf72bWE9LZyvgys/X
+rTuMnDt/y0GFeUjhdlkXout2UFIPLWWsMw2qdRsfCpdeIy1A4CFABjVXGQARAQAB
+tFJPbmUgTGluZSBJbnN0YWxsZXIgZm9yIEJyYXZlIChPbmUgTGluZSBJbnN0YWxs
+ZXIgZm9yIEJyYXZlKSA8aW5zdGFsbC1zaEBicmF2ZS5jb20+iQJ+BBMBCABoAhsD
+BQkSzAMABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAFiEE0WFmByys3yyUKcvx
+G/QeN9A59pEFAmfPDC0mFIAAAAAADwAObGFiZWxAYnJhdmUuY29taW5zdGFsbF9z
+aF9tcmsACgkQG/QeN9A59pHQ0A/8DnJIl56ld9Xgy0rxoyLaC2T+5dSsPAqKCAVX
+jqwumxu2iukwXjzoI/yZf+oNEBpy1NtyuOb7AKmijzK1XIFYfkmYAlFnezGGWVjo
+coE9vNoYZxsxHdc8iJx5NoW7BeQw/oOCr6XAj1KLdSomeyZfI7NOpTxy2apGYDSq
+buaBWbZIasNSSh1asQwn7oW0IErgEBzz2Lag9lo5mt4qf0BLZ2vTs5q/R1pqQXXc
+DJSM7/LOEOJfeHPjlvuIix9oTP+hqkGR770ziOA9TxZKPeJq1LEvOreUmBzz1EKI
+u3LGhIKtsR9gqDP27PX7sNNT4E/0kqhTzWFg+eEk9tMPz/V1UKWDxaYSklt7R7rF
+UVIp6ZLT7r8ROnTx3pPNWJjOJyRmTJ3mdRYmLoPcMKjW3JF2gJuaX+OEzFW8dagK
+01Rv8epOAxxyCKBCFEJ2iTfIZn3YLwI7ItU45O4xmruHhhOPp7fe59pQDK9JMt04
+Cir/TsImNaWDdTBUv0Cx4fxu38w3by0tQZz3CVJ/oepC/fwfz8IQ36IOIUrLBrzg
+T5lmUUehgRnLXsJ167TFUVHDiwSqAT0eEw2gz36CEa1xWroCQ5ZEJuYCqgi+Vn64
+SXuNvb3Q0vqXtiqy24wjy/AX4kMgbxAQpro9pLKyEVD9ygptcNFHYJI0IStuLDQA
+FBMz8IY=
+=oWX1
+-----END PGP PUBLIC KEY BLOCK-----

main.sh

@@ -212,9 +212,88 @@ ensure_flatpak() {
     fi
 }
 
+brave_origin_is_installed() {
+    local candidate
+    while IFS= read -r candidate; do
+        require_package_name "$candidate"
+        if native_installed "$candidate"; then
+            return 0
+        fi
+    done < <(brave_origin_package_candidates "$PACKAGE_MANAGER")
+    return 1
+}
+
+# Download the pinned Brave installer, GPG-verify it, then run that file with
+# FLAVOR=origin. Never curl|sh and never eval.
+install_brave_origin() {
+    local tmp key_file wrap_dir
+
+    if brave_origin_is_installed; then
+        echo "brave-origin is already installed. Skipping installation."
+        return 0
+    fi
+
+    if ! command -v curl >/dev/null 2>&1; then
+        echo "curl is required to download the Brave installer." >&2
+        exit 1
+    fi
+    if ! command -v gpg >/dev/null 2>&1; then
+        echo "gpg is required to verify the Brave installer." >&2
+        exit 1
+    fi
+
+    key_file="${SCRIPT_DIR}/assets/keys/brave-install.sh.asc"
+    if [[ ! -f "$key_file" ]]; then
+        echo "Brave installer signing key was not found at $key_file." >&2
+        exit 1
+    fi
+
+    tmp=$(mktemp -d) || exit 1
+    chmod 700 "$tmp"
+    wrap_dir="$tmp/sudo-wrap"
+
+    if ! download_pinned_brave_file "$BRAVE_INSTALL_SH_URL" "$tmp/install.sh"; then
+        rm -rf "$tmp"
+        exit 1
+    fi
+    if ! download_pinned_brave_file "$BRAVE_INSTALL_SH_ASC_URL" "$tmp/install.sh.asc"; then
+        rm -rf "$tmp"
+        exit 1
+    fi
+
+    echo "Verifying Brave installer signature..."
+    if ! verify_brave_install_script "$tmp/install.sh" "$tmp/install.sh.asc" "$key_file"; then
+        rm -rf "$tmp"
+        echo "Refusing to run unverified Brave installer." >&2
+        exit 1
+    fi
+
+    chmod 700 "$tmp/install.sh"
+    if ! install_noninteractive_sudo_wrapper "$wrap_dir"; then
+        rm -rf "$tmp"
+        exit 1
+    fi
+
+    echo "Running verified Brave Origin installer..."
+    # Execute the downloaded file. Do not pipe curl to sh and do not eval.
+    if ! PATH="$wrap_dir:$PATH" FLAVOR=origin CHANNEL=release "$tmp/install.sh"; then
+        rm -rf "$tmp"
+        echo "Brave Origin installer failed." >&2
+        exit 1
+    fi
+
+    rm -rf "$tmp"
+}
+
 install_native() {
     local package=$1
     require_package_name "$package"
+
+    if [[ "$package" == "brave-origin" ]]; then
+        install_brave_origin
+        return
+    fi
+
     if native_installed "$package"; then
         echo "$package is already installed. Skipping installation."
         return 0
@@ -240,7 +319,7 @@ install_native() {
     esac
 }
 
-remove_native() {
+remove_native_package() {
     local package=$1
     require_package_name "$package"
     if ! native_installed "$package"; then
@@ -261,6 +340,28 @@ remove_native() {
     esac
 }
 
+remove_native() {
+    local package=$1
+    require_package_name "$package"
+
+    if [[ "$package" == "brave-origin" ]]; then
+        local candidate removed=0
+        while IFS= read -r candidate; do
+            require_package_name "$candidate"
+            if native_installed "$candidate"; then
+                remove_native_package "$candidate"
+                removed=1
+            fi
+        done < <(brave_origin_package_candidates "$PACKAGE_MANAGER")
+        if [[ "$removed" -eq 0 ]]; then
+            echo "brave-origin is not installed. Skipping removal."
+        fi
+        return 0
+    fi
+
+    remove_native_package "$package"
+}
+
 install_flatpak_app() {
     local app_id=$1
     require_flatpak_id "$app_id"

src/catalog.rs

@@ -557,6 +557,48 @@ mod tests {
         assert!(!load.apps.is_empty());
     }
 
+    #[test]
+    fn shipped_catalog_has_brave_origin_native_and_keeps_flatpak_brave() {
+        let root = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+        let load = load_apps(&root);
+        assert!(load.error.is_none(), "{:?}", load.error);
+        assert!(load.warnings.is_empty(), "{:?}", load.warnings);
+
+        let origin = load
+            .apps
+            .iter()
+            .find(|app| app.label == "Brave Origin")
+            .expect("Brave Origin catalog row");
+        assert_eq!(origin.category, "Browsers");
+        assert_eq!(origin.package_name, "brave-origin");
+        assert!(origin.flatpak_id.is_empty());
+        assert_eq!(origin.exec_name, "brave-origin");
+        assert_eq!(origin.source_label(), "native");
+
+        let command = origin.try_command(&root, "install").unwrap();
+        assert_eq!(command[0], "bash");
+        assert!(command[1].ends_with("main.sh"));
+        assert!(command.contains(&"--package".to_owned()));
+        assert!(command.contains(&"brave-origin".to_owned()));
+        assert!(command.contains(&"--exec".to_owned()));
+        assert!(!command.contains(&"--flatpak".to_owned()));
+        assert_eq!(command.last().map(String::as_str), Some("install"));
+
+        let remove = origin.try_command(&root, "remove").unwrap();
+        assert_eq!(remove.last().map(String::as_str), Some("remove"));
+        assert!(remove.contains(&"--package".to_owned()));
+        assert!(!remove.contains(&"--flatpak".to_owned()));
+
+        let flatpak_brave = load
+            .apps
+            .iter()
+            .find(|app| app.label == "Brave Browser")
+            .expect("Brave Browser Flatpak catalog row");
+        assert!(flatpak_brave.package_name.is_empty());
+        assert_eq!(flatpak_brave.flatpak_id, "com.brave.Browser");
+        assert_eq!(flatpak_brave.exec_name, "brave");
+    }
+
     fn empty_dir(label: &str) -> PathBuf {
         let seq = TEST_DIR_SEQ.fetch_add(1, Ordering::Relaxed);
         let path = std::env::temp_dir().join(format!(