From 294d3c1155b3a1c78251c0a4fbf42efde01573cf Mon Sep 17 00:00:00 2001 From: Sharlatan Hellseher Date: Tue, 9 Sep 2025 22:18:05 +0100 Subject: gnu: Add anubis-ai-firewall. * gnu/packages/web.scm (anubis-ai-firewall): New variable. * gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch: New file. * gnu/local.mk (dist_patch_DATA): Register patches. Relates-to: guix/guix!2572 --- gnu/local.mk | 1 + ...bis-use-the-browser-native-web-crypto-api.patch | 60 +++++++++++ gnu/packages/web.scm | 110 +++++++++++++++++++++ 3 files changed, 171 insertions(+) create mode 100644 gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch (limited to 'gnu') diff --git a/gnu/local.mk b/gnu/local.mk index 175028eba06..2728cbc2e87 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1014,6 +1014,7 @@ dist_patch_DATA = \ %D%/packages/patches/amd-smi-newer-libdrm.patch \ %D%/packages/patches/amd-smi-python.patch \ %D%/packages/patches/angband-remove-nonfree-tile-options.patch \ + %D%/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch \ %D%/packages/patches/ibus-anthy-fix-tests.patch \ %D%/packages/patches/ibus-table-paths.patch \ %D%/packages/patches/antiword-CVE-2014-8123.patch \ diff --git a/gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch b/gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch new file mode 100644 index 00000000000..c6bbae2f75f --- /dev/null +++ b/gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch @@ -0,0 +1,60 @@ +From c29172faf8b57450317f6d29ac9ff4c5dfe69d77 Mon Sep 17 00:00:00 2001 +From: Sharlatan Hellseher +Date: Tue, 18 Aug 2026 19:26:53 +0100 +Subject: [PATCH] chore: Use the browser-native Web Crypto API. + +Use the browser-native Web Crypto API instead of @aws-crypto/sha256-js. + +* lib/challenge/preact/js/app.jsx (useEffect): Switch to browser native hasher. +* web/js/worker/sha256-purejs.mjs (calculateSHA256): Likewise. +--- + lib/challenge/preact/js/app.jsx | 7 +++---- + web/js/worker/sha256-purejs.mjs | 10 ++++------ + 2 files changed, 7 insertions(+), 10 deletions(-) + +diff --git a/lib/challenge/preact/js/app.jsx b/lib/challenge/preact/js/app.jsx +index f1321b8..96352b0 100644 +--- a/lib/challenge/preact/js/app.jsx ++++ b/lib/challenge/preact/js/app.jsx +@@ -1,7 +1,6 @@ + import { render, h, Fragment } from 'preact'; + import { useState, useEffect } from 'preact/hooks'; + import { g, j, u, x } from "./xeact.js"; +-import { Sha256 } from '@aws-crypto/sha256-js'; + + /** @jsx h */ + /** @jsxFrag Fragment */ +@@ -24,9 +23,9 @@ const App = () => { + + useEffect(() => { + setImageURL(state.pensive_url); +- const hash = new Sha256(''); +- hash.update(state.challenge); +- setChallenge(toHexString(hash.digestSync())); ++ crypto.subtle ++ .digest("SHA-256", new TextEncoder().encode(state.challenge)) ++ .then((buf) => setChallenge(toHexString(new Uint8Array(buf)))); + }, [state]); + + useEffect(() => { +diff --git a/web/js/worker/sha256-purejs.mjs b/web/js/worker/sha256-purejs.mjs +index 3211b44..08072c6 100644 +--- a/web/js/worker/sha256-purejs.mjs ++++ b/web/js/worker/sha256-purejs.mjs +@@ -1,9 +1,7 @@ +-import { Sha256 } from '@aws-crypto/sha256-js'; +- +-const calculateSHA256 = (text) => { +- const hash = new Sha256(); +- hash.update(text); +- return hash.digest(); ++const calculateSHA256 = async (text) => { ++ return new Uint8Array( ++ await crypto.subtle.digest("SHA-256", ++ new TextEncoder().encode(text))); + }; + + function toHexString(arr) { +-- +2.54.0 + diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm index 369c40606b7..0c2c5b335f9 100644 --- a/gnu/packages/web.scm +++ b/gnu/packages/web.scm @@ -142,6 +142,7 @@ #:use-module (gnu packages golang-build) #:use-module (gnu packages golang-check) #:use-module (gnu packages golang-compression) + #:use-module (gnu packages golang-crypto) #:use-module (gnu packages golang-web) #:use-module (gnu packages golang-xyz) #:use-module (gnu packages gperf) @@ -177,6 +178,7 @@ #:use-module (gnu packages nettle) #:use-module (gnu packages networking) #:use-module (gnu packages node) + #:use-module (gnu packages node-xyz) #:use-module (gnu packages nss) #:use-module (gnu packages nss) #:use-module (gnu packages openldap) @@ -248,6 +250,114 @@ #:use-module (ice-9 match) #:use-module ((srfi srfi-1) #:select (delete-duplicates))) +(define-public anubis-ai-firewall + (package + ;; Name clashes with "anubis" in (gnu packages mail). + (name "anubis-ai-firewall") + (version "1.22.0") + (source + (origin + (method git-fetch) + (uri (git-reference + (url "https://github.com/TecharoHQ/anubis") + (commit (string-append "v" version)))) + (file-name (git-file-name name version)) + (patches + (search-patches "anubis-use-the-browser-native-web-crypto-api.patch")) + (sha256 + (base32 "1vaj78727ndzsxydhdgwr9w0p9ykg73nkrbbiijh5l7lvabh3ric")))) + (build-system go-build-system) + (arguments + (list + ;; TODO: Enable some of them + #:tests? #f + ;; TODO: some JS work is required as app.js could not be found + #:install-source? #f + #:embed-files #~(list ".version" + ".*\\.tmpl" + ".*\\.js" + ".*\\.jsx" + ".*\\.mjs" + ".*\\.sh" + ".*\\.css" + "nodes" + "text" + "children") + #:import-path "github.com/TecharoHQ/anubis/cmd/anubis" + #:unpack-path "github.com/TecharoHQ/anubis" + #:phases + #~(modify-phases %standard-phases + (add-after 'unpack 'patch-usr-bin-env-shebangs + (lambda* (#:key unpack-path #:allow-other-keys) + (with-directory-excursion (string-append "src/" unpack-path) + (substitute* (find-files "." "\\.sh$") + (("#!/usr/bin/env bash") + (string-append "#!" (which "bash"))))))) + (add-after 'patch-usr-bin-env-shebangs 'generate-code + (lambda* (#:key unpack-path #:allow-other-keys) + (with-directory-excursion (string-append "src/" unpack-path) + (for-each make-file-writable + (find-files "." "(_templ\\.go|_string\\.go)$")) + (invoke "templ" "generate") + (with-directory-excursion "internal/dnsbl" + (invoke "stringer" "-type=DroneBLResponse"))))) + (add-after 'generate-code 'make-assets + (lambda* (#:key inputs unpack-path #:allow-other-keys) + (with-directory-excursion (string-append "src/" unpack-path) + (substitute* "xess/xess.go" + (("if anubis.Version != \"devel\" \\{") + "if false {")) + ;; Let esbuild resolve 'preact' and 'preact/hooks'. + (setenv "NODE_PATH" + (string-append (assoc-ref inputs "node-preact") + "/lib/node_modules")) + (invoke "./web/build.sh") + (invoke "./lib/challenge/preact/build.sh"))))))) + (native-inputs + (list brotli + esbuild + go-github-com-a-h-templ + go-github-com-cespare-xxhash-v2 + go-github-com-facebookgo-flagenv + go-github-com-gaissmai-bart + go-github-com-golang-jwt-jwt-v5 + go-github-com-google-cel-go + go-github-com-google-uuid + go-github-com-grpc-ecosystem-go-grpc-middleware-providers-prometheus + go-github-com-grpc-ecosystem-go-grpc-middleware-v2 + go-github-com-joho-godotenv + go-github-com-lum8rjack-go-ja4h + go-github-com-nicksnyder-go-i18n-v2 + go-github-com-prometheus-client-golang + go-github-com-redis-go-redis-v9 + go-github-com-sebest-xff + go-github-com-shirou-gopsutil-v4 + go-github-com-techarohq-thoth-proto + go-go-etcd-io-bbolt + go-golang-org-x-net + go-golang-org-x-text + go-google-golang-org-grpc + go-gopkg-in-yaml-v3 + go-k8s-io-apimachinery + go-sigs-k8s-io-yaml + go-tools + gzip + node-preact + templ + zstd)) + (home-page "https://github.com/TecharoHQ/anubis") + (synopsis "Weighs the soul of incoming HTTP requests to stop AI crawlers") + (description + "Anubis is a Web AI Firewall Utility that weighs the soul of your +connection using one or more challenges in order to protect upstream resources +from scraper bots. + +This program is designed to help protect the small internet from the endless +storm of requests that flood in from AI companies. Anubis is as lightweight as +possible to ensure that everyone can afford to protect the communities closest +to them.") + (license license:expat))) + (define-public qhttp (package (name "qhttp") -- cgit v1.2.3