BrowserBox Distribution

BrowserBox/BrowserBox-distribution is the public packaging surface for BrowserBox.

It is intentionally not a second build system and not a second release authority. The only upstream binary source is BrowserBox/BrowserBox.

What This Repo Owns

• Generated package-manager metadata for:
  • Homebrew cask
  • Chocolatey package scaffold
  • Nix package scaffold
  • Linux deb and rpm package builders
• Workflows that track the latest public BrowserBox release whose public saga passed
• Manual fallback entrypoints when the upstream release pipeline needs operator intervention

What This Repo Does Not Own

• BrowserBox binary builds
• The browserbox.io/install.sh and browserbox.io/install.ps1 flows
• Install CI across package managers
• Publication into third-party ecosystems such as homebrew/cask, Chocolatey Community, or nixpkgs

Automation Boundary

The sync workflow only advances package surfaces to the newest BrowserBox/BrowserBox release whose bbx Saga Test Suite (Public Release) workflow succeeded.

That means:

• a newer public release can exist upstream and still be ignored here
• manual workflow_dispatch can pin a specific tag when needed
• repository_dispatch is supported for future precise upstream-to-downstream handoff

Integrity And Full Install Policy

BrowserBox binaries require release.manifest.json and release.manifest.json.sig at runtime for release-artifact integrity verification.

This repo therefore treats release-manifest distribution as part of every package surface, not as optional metadata.

Current approach by surface:

• deb / rpm: ship the binary plus manifest files inside the package and install a wrapper that sets BBX_RELEASE_MANIFEST_PATH
• Nix: ship the binary plus manifest files inside the derivation and wrap browserbox with BBX_RELEASE_MANIFEST_PATH
• Homebrew: install the binary, then fetch and verify the release manifest into ~/.config/dosaygo/bbpro/
• Chocolatey: install the binary, then fetch and verify the release manifest into %ProgramData%\dosaygo\bbpro\ or the user config fallback

browserbox --full-install <hostname> <email> remains the real machine-setup path. This repo still does not force every package manager transaction to become an interactive privileged setup run.

Instead:

• deb / rpm post-install scripts invoke --full-install only when BROWSERBOX_HOSTNAME and BROWSERBOX_EMAIL are provided
• Chocolatey invokes --full-install only when /Hostname: and /Email: package parameters are provided
• Homebrew and Nix install the binary and manifest path, then print the explicit next-step command

That split is deliberate. Package managers want noninteractive, idempotent transactions. BrowserBox machine setup wants explicit operator intent.

Current Seed State

The initial scaffold is seeded from the latest public BrowserBox release that also has a successful public saga:

• v16.2.8

See packages/release/current-release.json.

Next Steps

• Production path: docs/production-readiness.md
• Automation notes: docs/automation.md
• Package manager behavior: docs/package-manager-notes.md