LibreWolf AppImage - script to install and update

[Girafenaine]

Hello MX community,

I am a happy user of LibreWolf, a nice browser about which you can learn there. It's a Firefox compilation with some parts removed, and parameters config (through user.js) for privacy and security. On Debian, there is a package but it needs sid repo to be used, so not for everyone here. There is also a flatpack (I just saw a thread about this option in this Tips&Tricks section), and an AppImage. I like AppImage because it's quite simple and universal and does not need any package management system like flatpak. But there is a drawback : you have to manually install, and update if needed, and make a destkop file for it to appear in your menus if you want.

That's why I wrote a script that can do all of that :
- "install" LibreWolf AppImage last release (that means : download the file, unzip it, make it executable, and that's all)
- create a desktop file, so you have LibreWolf in your menu(s). You can choose between normal commandline (a simple "path/to/librewolf") and launch through firejail for sandboxing ("firejail --appimage --dns=X.X.X.X --profile=librewolf path/to/librewolf") - if you have firejail installed. It downloads the logo.
- check for update if already installed and "install" the last version - which is the main goal I have.

I guess if some of you are interested in and share their thoughts and tests results, we could make it better. It could even ends up in the MX package installer, popular applications tab, browser section, as a way to use LibreWolf ?

Here is the help text of the script :

### This script helps to manage LibreWolf browser as an AppImage. You can copy
### it in ~/.local/bin or anywhere else (and make it executable).
### It checks if you have already LibreWolf AppImage, and check if the online
### version is newer than yours. If you don't have it or if the online version
### is newer, it downloads the online version, unpzip the archive, change the
### file name and give the execution permission. At first installation, it
### create a desktop file to get LibreWolf in your apps menu.

### The default installation path is ~/.local/bin/. The defaut file name is
### LibreWolf.AppImage.

### You can then launch LibreWolf with the command : LibreWolf.AppImage, as
### well as associate this command with a keyboard shortcut. Or with firejail
### for sandboxing :
### firejail --appimage --private --net=usb0 --dns=9.9.9.9 --profile=librewolf
### ~/.local/bin/LibreWolf.AppImage

Options :
-h or --help to display this text
-f or --force to download and install LibreWolf AppImage even if the version
online is the same or older as yours. If used with -d option, this option
forces desktop file to be written as well, even if a desktop file already
exists.
-d or --desktop to make a desktop file in your ~/.local/share/application
folder, then the script stops.
-r or --replace to make the script to delete previous LibreWolf.AppImage file
with the new downloaded file. Default behaviour is to save the previous
LibreWolf.AppImage with the name LibreWolf-version number.x86_64.AppImage. You
can then manually delete the older files when you want.
-j or --firejail to launch LibreWolf.AppImage through firejail for sandboxing.
You need to have installed firejail, more info on https://firejail.wordpress.com/.
Default setting use 9.9.9.9 as DNS. To be used with -d option (no effect without
-d option).

And here is the full script. To use it, copy this text in your text editor, save it under /home/yourusername/.local/bin/LWupdater (or elsewhere if you prefer), make it executable (you can right-click and adjust that in file properties). You can then launch the script in a terminal with the command : "LWupdater". Some options could be added, see the help about that.

Code: Select all

#!/bin/bash

# LibreWolf AppImage udpater
# Written by Girafenaine for use on MX-Fluxbox - but fit other needs as well
# Released under GNU General Public License V3
# November 2021

SOURCE="https://gitlab.com/librewolf-community/browser/appimage/-/jobs/artifacts/master/download?job=appimage_x86_64"
LOGOSOURCE="https://librewolf-community.gitlab.io/images/logo.png"
FORCE=0
LWPATH="$HOME/.local/bin"
LWNAME="LibreWolf.AppImage"
MAKEDESKTOP=0
REPLACE=0
DNS=9.9.9.9
FIREJAIL=0
SEP="###################################################"

DESKTOPTEXT="[Desktop Entry]\n
Name=LibreWolf\n
GenericName=Web Browser\n
Comment=Secure Browser based on Firefox\n
Exec=$LWPATH/$LWNAME\n
Icon=$LWPATH/LibreWolf-logo.png\n
NoDisplay=false\n
Terminal=0\n
TerminalOptions=\n
Type=Application\n
Categories=Browser;Internet"

DESKTOPTEXT2="[Desktop Entry]\n
Name=LibreWolf\n
GenericName=Web Browser\n
Comment=Secure Browser based on Firefox\n
Exec=firejail --appimage --dns=$DNS --profile=librewolf $LWPATH/$LWNAME\n
Icon=$LWPATH/LibreWolf-logo.png\n
NoDisplay=false\n
Terminal=0\n
TerminalOptions=\n
Type=Application\n
Categories=Browser;Internet"

### to catch options
#########################################################################
while [ $# -gt 0 ] ; do

if [[ $1 = "-h" || $1 = "--help" ]] ; then
echo "
$SEP
LWupdate - LibreWolf AppImage installer and updater 
$SEP

LWupdate V1.0 - 06/11/2021 - Written by Girafenaine for use on MX-Fluxbox -
but fit other needs as well

### This script helps to manage LibreWolf browser as an AppImage. You can copy
### it in ~/.local/bin or anywhere else (and make it executable).
### It checks if you have already LibreWolf AppImage, and check if the online
### version is newer than yours. If you don't have it or if the online version
### is newer, it downloads the online version, unpzip the archive, change the
### file name and give the execution permission. At first installation, it
### create a desktop file to get LibreWolf in your apps menu.

### The default installation path is ~/.local/bin/. The defaut file name is
### LibreWolf.AppImage.

### You can then launch LibreWolf with the command : LibreWolf.AppImage, as
### well as associate this command with a keyboard shortcut. Or with firejail
### for sandboxing :
### firejail --appimage --private --net=usb0 --dns=9.9.9.9 --profile=librewolf
### ~/.local/bin/LibreWolf.AppImage

Options :
 -h or --help to display this text
 -f or --force to download and install LibreWolf AppImage even if the version
 online is the same or older as yours. If used with -d option, this option
 forces desktop file to be written as well, even if a desktop file already
 exists.
 -d or --desktop to make a desktop file in your ~/.local/share/application
 folder, then the script stops.
 -r or --replace to make the script to delete previous LibreWolf.AppImage file
 with the new downloaded file. Default behaviour is to save the previous
 LibreWolf.AppImage with the name LibreWolf-version number.x86_64.AppImage. You
 can then manually delete the older files when you want.
 -j or --firejail to launch LibreWolf.AppImage through firejail for sandboxing.
 You need to have installed firejail, more info on https://firejail.wordpress.com/.
 Default setting use 9.9.9.9 as DNS. To be used with -d option (no effect without
 -d option).

"
exit

	elif [[ $1 = "-f" || $1 = "--force" ]] ; then FORCE=1 ; shift
	elif [[ $1 = "-d" || $1 = "--desktop" ]] ; then MAKEDESKTOP=1 ; shift
	elif [[ $1 = "-r" || $1 = "--replace" ]] ; then REPLACE=1 ; shift
	elif [[ $1 = "-j" || $1 = "--firejail" ]] ; then FIREJAIL=1 ; shift
fi

done

trap 'rm -f "$LWPATH/LWtemp" "$LWPATH/LibreWolf.zip" ' EXIT


if [[ $FIREJAIL == 1 ]] ; then DESKTOPTEXT=$DESKTOPTEXT2 ; fi

function MAKEDESKTOPfile () {
	echo "echo -e $SEP\n"Writing a desktop file for LibreWolf and getting logo online if needed..."\n$SEP\n\n"
	if [[ ! -f $HOME/.local/share/applications/LibreWolf.desktop ]] || [[ $FORCE == 1 ]] ; then
		echo -e $DESKTOPTEXT >$HOME/.local/share/applications/LibreWolf.desktop
		if [[ ! -f "$LWPATH/LibreWolf-logo.png" ]] ; then wget --quiet --timestamping $LOGOSOURCE -O $LWPATH/LibreWolf-logo.png --timeout=10 ; fi
		echo -e "\nA desktop file has been written in $HOME/.local/share/applications/LibreWolf.desktop.\n\n"
	else echo -e "\nA desktop file already exists in $HOME/.local/share/applications/LibreWolf.desktop, so the script did nothing. \n\n"
	fi
}

### If the user wants only to create a desktop file, with -d option
#########################################################################

if [[ $MAKEDESKTOP -eq 1 ]] ; then $(MAKEDESKTOPfile) ; exit 0 ; fi

### Beginning of the install or update script
#########################################################################

echo "
$SEP
Checking LibreWolf versions online and onboard...
$SEP
"

### Check online version, and stop if no result
#########################################################################

#wget --spider --quiet -S --timeout=10 -o $LWPATH/LWtemp https://gitlab.com/librewolf-community/browser/appimage/-/jobs/artifacts/master/download?job=appimage_x86_64
#versionA=$( grep "filename=" $LWPATH/LWtemp | sed 's/.*filename="[lL]ibre[wW]olf-//g' | sed 's/-.*//' )

wget --spider --quiet -S --timeout=10 -o "$LWPATH/LWtemp" $SOURCE

nameA=$(grep "filename=" $LWPATH/LWtemp | sed 's/.*filename="//g' | sed 's/";.*//' | sed 's/-AppImage-/./' | sed 's/.zip/.AppImage/' | sed 's/Librewolf/LibreWolf/' )

versionA=$( : ${nameA/Libre[Ww]olf-/} ; echo ${_%%-*} )

if [[ $versionA = "" ]] ; then echo -e "The script tried to find the last online version but did not succeed.\nPlease check your internet connection or the URL used in the script to check online version.\nScript exiting." ; exit 0 ; fi

### Check onboard version, and ask for a confirmation (or stop if update seems useless)
#########################################################################

if [[ -e "$LWPATH/$LWNAME" ]] ; then
	versionB=$( $LWPATH/$LWNAME -v | sed 's/^[a-zA-Z ]*//' )

	else echo -e "$SEP
LibreWolf is not installed in path $LWPATH or the file is not named $LWNAME.\nYou can install LibreWolf AppImage yourself and set the path and the name in this script...\nor install it through this script. In this last case the file $LWNAME will be installed in $LWPATH. Do you want this script to install LibreWolf AppImage ? (y/n)
$SEP
	"
	read ANSWER1
	if [[ $ANSWER1 != [yYoO] ]] ; then echo "Script exiting." ; exit 0 ; fi
	MAKEDESKTOP=1
	versionB=0

fi

echo "The last LibreWolf version online is $versionA, your installed version is $versionB"

if [[ $versionA < $versionB ]] || [[ $versionA = $versionB ]] && [[ $FORCE -eq 0 ]] ; then echo -e "The online version is the same as yours (or older than yours), the script won't update LibreWolf.\nIf you want to force re-install, launch this script with -f or --force option." ; exit 0 ; fi

echo "
Do you want to update with online last version ? (y/n)
"
read ANSWER2

if [[ $ANSWER2 != [yYoO] ]] ; then echo "You choose to stop update process, script exiting" ; exit 0 ; fi

### Getting online version and writing the file in the defined path
#########################################################################

echo "
$SEP
Launching wget to download LibreWolf...
$SEP
"

wget $SOURCE -O $LWPATH/LibreWolf.zip --timeout=10

echo "$SEP
Uncompressing the downloaded archive, changing file name and giving execution permission...
$SEP
"

if [[ -e $LWPATH/LibreWolf.zip ]] ; then 7z e  $LWPATH/LibreWolf.zip *.AppImage -o$LWPATH ; fi

if [[ $REPLACE == 0 ]] && [[ -e "$LWPATH/$LWNAME" ]] ; then mv "$LWPATH/$LWNAME" "$LWPATH/LibreWolf-$versionB.x86_64.AppImage" ; fi

mv "$LWPATH/$nameA" "$LWPATH/$LWNAME"

chmod a+x "$LWPATH/$LWNAME"

echo "
$SEP
LibreWolf has been installed or updated. Enjoy !
$SEP
"

### If first installation, create a desktop file
#########################################################################

if [[ $MAKEDESKTOP == 1 ]] ; then
	echo -e "The script will now create a desktop file (to have LibreWolf in your menu). Do you want it the usual way ("LibreWolf" command), or do you use firejail and are interested to launch LibreWolf through firejail ("$COMMAND" command) ? Press "n" if you don't want any desktop file, "f" if you want a "firejail" destkop file, and any other key to create a "usual" desktop file."
	read ANSWER3
		if [[ $ANSWER3 == [fF] ]] ; then DESKTOPTEXT=$DESKTOPTEXT2
		elif [[ $ANSWER3 == [nN] ]] ; then exit 0
		fi
	$(MAKEDESKTOPfile)
fi

exit 0

[TTwrs]

Thanks for this. I only occassionally use LW so I would rather not 'install' it. This script will keep the AppImage up-to-date.

An wondering if this script could be made more 'universal' so it could be used with other AppImages.

[Girafenaine]

Hello @TTwrs,

I guess every one can adapt this script to one's needs, but when doing it manually, the main point is to find the correct URL :
- to know about the latest release version number (to compare it to the one actually installed)
- to download this latest release

Actually, many AppImage can be automatically updated thanks to a "Appimage updater" script (https://github.com/AppImage/AppImageUpdate). I didn't try myself, but I read that LibreWolf.AppImage may be udpated this way (on LibreWolf matrix channel). This "AppImage updater" is more universal that my little script which just fit my need with LibreWolf. However as I understand it only some AppImage can bu updated this way, as the developper has to give special files ("diff files" to describe what is to be updated in the AppImage).

[davidy]

Yeah, librewolf uses some lame mitmdetection.services.mozilla.com url that it tries to connect to as soon as you open it. I completely block it with opensnitch. Plus it has a few entries in about:config that are either locked or not entirely secure at all imo.

This is an about:config recommends for security I got from an xda-dev thread: some are set some aren't in librewolf:
about:config
beacon.enabled = false
browser.safebrowsing.downloads.remote.enabled = false
browser.send_pings = false
browser.sessionstore.privacy_level = 2
browser.urlbar.speculativeConnect.enabled = false
dom.event.clipboardevents.enabled = false
media.eme.enabled = false
media.gmp-widevinecdm.enabled = false
media.navigator.enabled = false
media.peerconnection.enabled = false
media.peerconnection.identity.timeout = 1
media.peerconnection.turn.disable = true
media.peerconnection.use_document_iceservers = false
media.peerconnection.video.enabled = false
network.cookie.cookieBehavior = 1
network.dns.disablePrefetchFromHTTPS = true
network.http.referer.XOriginPolicy = 2
network.http.referer.XOriginTrimmingPolicy = 2
privacy.resistFingerprinting = true
privacy.trackingprotection.cryptomining.enabled = true
privacy.interconnection.enabled = true
privacy.trackingprotection.fingerprinting.enabled = true
webgl.disabled = true

I also pay attention to browser certificates. I delete all the china, GB, German, India, etc ones as well as comodo's, chamber of commerce, incl. MS's.
I noticed that there is now a section that mixes both US and GB certificates (what a shock!). I deleted them.
If a site is unreachable I use tor-browser or falkon instead.
Basically what I'm saying is mozilla I do not trust and browsers are using all sorts of tricks they don't bother to mention because most people never look beyond the page they want to look at. I have found (opensnitch) with some websites the page will connect to urls that have nothing to do with the content you're after.
Certs are important as they are like the ACTUAL security of your browsing and unfortunately with as many bad actors as exist, trusting certs they control is not smart imo. Certs used to include AOL, Visa, and Wells Fargo (good riddance-I would have deleted them anyways). I deleted google's (GTS) section too just because.
Reminds me of the guy on youtube (Braxman?) who recommends and sells "de-googled" (his favorite phrase) phones, but who also is never logged out of google it seems yet wants to give advice on how to do so. too funny.

There's this guy who runs like 30 different VM's just for firefox so that there is no ability for one site to know he's been on another. overkill? yeah I think so. They have this thing now called private windows and sandboxing is all that is.
Librewolf's about doesn't even correspond to the appimage number (???). Putting an appimage in your panel is trifling.
I just figured out how to put a shortcut in the panel but open it as root simply by looking at other aps which ask for the password. Answer? "su-to-root -X -c <name of ap>"

I tried the appimage updater thingy but couldn't make it work either. It's not exactly user friendly.

[Girafenaine]

Hello,

Don't understand your post. You dont talk about the script that I put forward to install and update LibreWolf, you juste share some random and confused thoughts about this browser, certificates and other points... Hard to follow and of little help.

If you need some help to have the script to work i will be glad to help (works perfectly for me).

[Somewhat Reticent]

… opensnitch. …
This is an about:config recommends for security I got from an xda-dev thread: some are set some aren't in librewolf:
…
… certificates…
If a site is unreachable I use tor-browser or falkon instead.
… private windows and sandboxing …
… Putting an appimage in your panel is trifling.
…

Browser seem to want to be a separate OS; it is aggravating.
A full VM seems a bit much. What about jailed in a container or such?

---

Perhaps you could offer a (nicely-documented) demo spin for live use?

(Trying to address target problem - generalization?)

[Girafenaine]

Hello,

I have to share some news from Librewolf team, since there are two more robust options to use Librewolf on MX linux now :

First, a deb.librewolf.net repository to use on Debian 11 (so MX 21 should be OK). Here is the how-to.
(I did not try yet as I don't really need it, and like the way the AppImage works, and my script doing the update management...).

Second, a way to use AppImage through the AppimageLauncher tool. This tool allows to install and find the AppImage as a "normal" program on your app launcher. It can manage update obviously. So probably more robust and easy that my script ! Here is the how-to.

[Somewhat Reticent]

Would AppImageLauncher regular or Lite work on MX-19?

[Girafenaine]

Hello @Somewhat Reticent ,

Yes it should work well, but I cannot swear as I did not try.

On the release page https://github.com/TheAssassin/AppImage ... r/releases, you can test the " appimagelauncher_2.2.0-travis995.0f91801.bionic_amd64.deb " file (xenial is the ubuntu version based on Debian Stretch, the same as MX 19).

You can install such a deb file with "sudo dpkg -i appimagelauncher_2.2.0-travis995.0f91801.bionic_amd64.deb"

[Mauser]

"davidy" Thank you for posting the security advice. I would like to point out that in my experience with changing the settings of the following from 0 to 2 for both will break some sites. network.http.referer.XOriginPolicy = 2
network.http.referer.XOriginTrimmingPolicy = 2