Anti-fingerprint: measured baseline, harness, T3 patch + CI

.github/workflows/anti-fingerprint.yml

@@ -0,0 +1,129 @@
+name: Anti-fingerprint
+
+# Three tiers of verification for the anti-fingerprint track:
+#   1. harness-and-measure  — config harness + empirical fingerprint baseline
+#                             (real Gecko via Playwright). Fast; the regression gate.
+#   2. patch-apply          — proves the gecko-patches/ apply to the pinned Firefox
+#                             source (the `check-patchfail` equivalent). No compile.
+#   3. full-build           — manual: real `make build` + geckodriver measurement of
+#                             the actual binary. Heavy; needs a large/self-hosted
+#                             runner (a full Firefox build OOMs/overflows the stock
+#                             14 GB GitHub runner — the project's Forgejo/Woodpecker
+#                             pipeline is the natural home; this is the GH scaffold).
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '23 7 * * 1'
+  workflow_dispatch:
+
+env:
+  # Keep in sync with the build repo's `version` file.
+  FIREFOX_VERSION: '150.0.1'
+
+jobs:
+  # ── Tier 1: config posture + measured fingerprint baseline ─────────────────
+  harness-and-measure:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Install deps + Gecko engine
+        run: |
+          npm ci || npm install
+          npx playwright install --with-deps firefox
+      - name: Config harness (static + runtime RFP) — HARD GATE
+        run: node scripts/verify-gecko-rfp.mjs
+      - name: Fingerprint measurement (both profiles)
+        run: |
+          node scripts/measure-fingerprint.mjs --profile human-secure  --json > fp-human-secure.json
+          node scripts/measure-fingerprint.mjs --profile agent-runtime --json > fp-agent-runtime.json
+          echo "human-secure:  $(jq -r '.neutralized' fp-human-secure.json)/$(jq -r '.total' fp-human-secure.json) neutralized"
+          echo "agent-runtime: $(jq -r '.neutralized' fp-agent-runtime.json)/$(jq -r '.total' fp-agent-runtime.json) neutralized"
+      - name: Upload fingerprint scorecards
+        uses: actions/upload-artifact@v4
+        with:
+          name: fingerprint-scorecards
+          path: fp-*.json
+
+  # ── Tier 2: do the gecko-patches still apply to pinned Firefox source? ──────
+  patch-apply:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Fetch pinned Firefox source
+        run: |
+          url="https://archive.mozilla.org/pub/firefox/releases/${FIREFOX_VERSION}/source/firefox-${FIREFOX_VERSION}.source.tar.xz"
+          echo "fetching $url"
+          wget -q "$url" -O firefox-src.tar.xz
+          tar xf firefox-src.tar.xz
+      - name: Dry-run apply every anti-fp patch (fail on reject)
+        run: |
+          patches="$(pwd)/gecko-patches"
+          cd "firefox-${FIREFOX_VERSION}"
+          fail=0
+          while IFS= read -r p; do
+            echo "==> $p"
+            if ! patch -p1 --dry-run -i "$p"; then
+              echo "::error file=$p::patch does not apply to firefox-${FIREFOX_VERSION}"
+              fail=1
+            fi
+          done < <(find "$patches" -name '*.patch' | sort)
+          exit $fail
+
+  # ── Tier 3: real build + measure the actual binary (manual, large runner) ──
+  full-build:
+    if: github.event_name == 'workflow_dispatch'
+    # A full Firefox build needs ~40 GB disk + lots of RAM/time. Override with a
+    # large or self-hosted runner: set repo variable BUILD_RUNNER (e.g. a
+    # self-hosted label) — falls back to ubuntu-latest, which will likely run out
+    # of space (kept here so the wiring is visible; the Forgejo pipeline is the
+    # production path).
+    runs-on: ${{ vars.BUILD_RUNNER || 'ubuntu-latest' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: overlay
+      - name: Checkout build repo
+        uses: actions/checkout@v4
+        with:
+          # Set repo variable BUILD_REPO to the LibreWolf-style build repo
+          # (the one with Makefile + scripts/bearbrowser-patches.py + assets/patches.txt).
+          repository: ${{ vars.BUILD_REPO }}
+          path: build-repo
+      - name: Register anti-fp patches into the build
+        run: |
+          cp overlay/gecko-patches/anti-fingerprint/*.patch build-repo/patches/
+          for p in overlay/gecko-patches/anti-fingerprint/*.patch; do
+            echo "patches/$(basename "$p")" >> build-repo/assets/patches.txt
+          done
+      - name: Validate patches apply (fast gate before the slow build)
+        run: cd build-repo && make check-patchfail
+      - name: Build BearBrowser
+        run: cd build-repo && make bootstrap && make build
+      - name: Set up measurement deps
+        run: cd overlay && npm ci || (cd overlay && npm install)
+      - name: Measure the REAL binary (geckodriver — authoritative)
+        run: |
+          # Locate the built binary (Linux: dist/bin/{firefox,bearbrowser};
+          # macOS: dist/*.app/Contents/MacOS/*). measure-fingerprint.mjs --bin
+          # drives it via geckodriver — Playwright (Juggler) can't drive a stock
+          # build. This is the authoritative measurement: it sees what Playwright
+          # masks (e.g. RFP timezone, real letterboxing).
+          bin="$(find build-repo -type f \( -name firefox -o -name bearbrowser \) -path '*dist*' 2>/dev/null | grep -vE '\.dSYM' | head -1)"
+          if [ -z "$bin" ]; then echo "::error::built binary not found under build-repo dist"; exit 1; fi
+          echo "measuring: $bin"
+          export PATH="$PWD/overlay/node_modules/.bin:$PATH"
+          node overlay/scripts/measure-fingerprint.mjs --profile human-secure  --bin "$bin" --json > fp-real-human-secure.json
+          node overlay/scripts/measure-fingerprint.mjs --profile agent-runtime --bin "$bin" --json > fp-real-agent-runtime.json
+          echo "human-secure (real binary): $(jq -r '.neutralized' fp-real-human-secure.json)/$(jq -r '.total' fp-real-human-secure.json)"
+          jq -r '.rows[] | select(.status=="LEAKING") | "  LEAK: \(.vector)"' fp-real-human-secure.json
+      - name: Upload real-binary scorecards
+        uses: actions/upload-artifact@v4
+        with:
+          name: real-binary-scorecards
+          path: fp-real-*.json

.github/workflows/feature-plane.yml

@@ -26,6 +26,8 @@ on:
       - "scripts/verify-interactive-sidecar.sh"
       - "scripts/verify-comparison-plane.sh"
       - "scripts/verify-agent-sidecar-contract.py"
+      - "scripts/bearbrowser-create-receipt.py"
+      - "scripts/bearbrowser-update-receipt.py"
       - ".github/workflows/feature-plane.yml"
   push:
     branches: [main]
@@ -53,6 +55,8 @@ on:
       - "scripts/verify-interactive-sidecar.sh"
       - "scripts/verify-comparison-plane.sh"
       - "scripts/verify-agent-sidecar-contract.py"
+      - "scripts/bearbrowser-create-receipt.py"
+      - "scripts/bearbrowser-update-receipt.py"
       - ".github/workflows/feature-plane.yml"
   workflow_dispatch:
 
@@ -84,7 +88,9 @@ jobs:
             scripts/bearbrowser-governance-queue.py \
             scripts/bearbrowser-sidecar-server.py \
             scripts/bearbrowser-sidecar-status.py \
-            scripts/verify-agent-sidecar-contract.py
+            scripts/verify-agent-sidecar-contract.py \
+            scripts/bearbrowser-create-receipt.py \
+            scripts/bearbrowser-update-receipt.py
 
       - name: Shell syntax
         run: |

.github/workflows/nightly-dmg.yml

@@ -0,0 +1,124 @@
+name: BearBrowser Nightly DMG
+
+on:
+  schedule:
+    - cron: '0 4 * * *'
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - 'settings/**'
+      - 'scripts/bearbrowser-patches.py'
+      - 'branding/**'
+
+jobs:
+  nightly-dmg:
+    name: Build and package (macOS)
+    runs-on: macos-15
+    timeout-minutes: 360
+
+    env:
+      MOZBUILD_STATE_PATH: ${{ github.workspace }}/.mozbuild
+      VERSION: 150.0.1
+      RELEASE: 1
+      PROFILE: human-secure
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Cache Mozilla toolchain
+        uses: actions/cache@v4
+        with:
+          path: .mozbuild
+          key: mozbuild-${{ env.VERSION }}-macos15-v1
+          restore-keys: mozbuild-${{ env.VERSION }}-macos15-
+
+      - name: Cache Firefox source tarball
+        uses: actions/cache@v4
+        with:
+          path: build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/firefox-${{ env.VERSION }}.source.tar.xz
+          key: ff-tarball-${{ env.VERSION }}
+
+      - name: Cache Cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: cargo-${{ env.VERSION }}-macos15-v1
+
+      - name: Set up workspace from LibreWolf mirror
+        run: |
+          bash scripts/apply-sourceos-overlays.sh \
+            --profile ${{ env.PROFILE }} \
+            --ref latest \
+            --workspace-root build/workspaces
+
+      - name: Fetch Firefox source tarball
+        working-directory: build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source
+        run: make fetch
+
+      - name: Apply BearBrowser patches
+        working-directory: build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source
+        run: make dir
+
+      - name: Bootstrap Gecko build environment
+        working-directory: build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }}
+        run: |
+          MOZBUILD_STATE_PATH=${{ github.workspace }}/.mozbuild \
+            ./mach --no-interactive bootstrap --application-choice=browser
+
+      - name: Build BearBrowser
+        working-directory: build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }}
+        run: MOZBUILD_STATE_PATH=${{ github.workspace }}/.mozbuild ./mach build
+
+      - name: Package BearBrowser.app
+        run: |
+          bash scripts/bearbrowser-package-source-build.sh \
+            --workspace build/workspaces/${{ env.PROFILE }}-${{ env.VERSION }}-${{ env.RELEASE }}/source/bearbrowser-${{ env.VERSION }}-${{ env.RELEASE }} \
+            --profile ${{ env.PROFILE }} \
+            --out-dir build/nightly \
+            --version ${{ env.VERSION }} \
+            --skip-verify
+
+      - name: Create DMG
+        id: dmg
+        run: |
+          DATE=$(date +%Y%m%d)
+          DMG="BearBrowser-${{ env.VERSION }}-${DATE}-dev.dmg"
+          hdiutil create \
+            -volname "BearBrowser" \
+            -srcfolder "build/nightly/BearBrowser.app" \
+            -ov -format UDZO \
+            "build/nightly/${DMG}"
+          echo "name=${DMG}" >> $GITHUB_OUTPUT
+          echo "path=build/nightly/${DMG}" >> $GITHUB_OUTPUT
+
+      - name: Upload DMG artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.dmg.outputs.name }}
+          path: ${{ steps.dmg.outputs.path }}
+          retention-days: 30
+
+      - name: Publish nightly release
+        if: github.ref == 'refs/heads/main'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          DATE=$(date +%Y-%m-%d)
+          TAG="nightly-${DATE}"
+          # Replace any same-day release rather than fail on duplicate tag
+          gh release delete "$TAG" --yes 2>/dev/null || true
+          gh release create "$TAG" \
+            "${{ steps.dmg.outputs.path }}" \
+            --title "BearBrowser Nightly ${DATE}" \
+            --notes "Automated nightly build from \`main\`.
+
+**Not notarized — developer use only.**
+To open: right-click BearBrowser.app → Open (bypasses Gatekeeper).
+
+Commit: \`${{ github.sha }}\`
+Firefox base: ${{ env.VERSION }}" \
+            --prerelease