guix_mirror_bot pushed a commit to branch master
in repository guix.
commit 294d3c1155b3a1c78251c0a4fbf42efde01573cf
Author: Sharlatan Hellseher <[email protected]>
AuthorDate: Tue Sep 9 22:18:05 2025 +0100
gnu: Add anubis-ai-firewall.
* gnu/packages/web.scm (anubis-ai-firewall): New variable.
* gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch:
New file.
* gnu/local.mk (dist_patch_DATA): Register patches.
Relates-to: guix/guix!2572
---
gnu/local.mk | 1 +
...bis-use-the-browser-native-web-crypto-api.patch | 60 +++++++++++
gnu/packages/web.scm | 110 +++++++++++++++++++++
3 files changed, 171 insertions(+)
diff --git a/gnu/local.mk b/gnu/local.mk
index 175028eba0..2728cbc2e8 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1014,6 +1014,7 @@ dist_patch_DATA =
\
%D%/packages/patches/amd-smi-newer-libdrm.patch \
%D%/packages/patches/amd-smi-python.patch \
%D%/packages/patches/angband-remove-nonfree-tile-options.patch \
+ %D%/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch
\
%D%/packages/patches/ibus-anthy-fix-tests.patch \
%D%/packages/patches/ibus-table-paths.patch \
%D%/packages/patches/antiword-CVE-2014-8123.patch \
diff --git
a/gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch
b/gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch
new file mode 100644
index 0000000000..c6bbae2f75
--- /dev/null
+++ b/gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch
@@ -0,0 +1,60 @@
+From c29172faf8b57450317f6d29ac9ff4c5dfe69d77 Mon Sep 17 00:00:00 2001
+From: Sharlatan Hellseher <[email protected]>
+Date: Tue, 18 Aug 2026 19:26:53 +0100
+Subject: [PATCH] chore: Use the browser-native Web Crypto API.
+
+Use the browser-native Web Crypto API instead of @aws-crypto/sha256-js.
+
+* lib/challenge/preact/js/app.jsx (useEffect): Switch to browser native hasher.
+* web/js/worker/sha256-purejs.mjs (calculateSHA256): Likewise.
+---
+ lib/challenge/preact/js/app.jsx | 7 +++----
+ web/js/worker/sha256-purejs.mjs | 10 ++++------
+ 2 files changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/lib/challenge/preact/js/app.jsx b/lib/challenge/preact/js/app.jsx
+index f1321b8..96352b0 100644
+--- a/lib/challenge/preact/js/app.jsx
++++ b/lib/challenge/preact/js/app.jsx
+@@ -1,7 +1,6 @@
+ import { render, h, Fragment } from 'preact';
+ import { useState, useEffect } from 'preact/hooks';
+ import { g, j, u, x } from "./xeact.js";
+-import { Sha256 } from '@aws-crypto/sha256-js';
+
+ /** @jsx h */
+ /** @jsxFrag Fragment */
+@@ -24,9 +23,9 @@ const App = () => {
+
+ useEffect(() => {
+ setImageURL(state.pensive_url);
+- const hash = new Sha256('');
+- hash.update(state.challenge);
+- setChallenge(toHexString(hash.digestSync()));
++ crypto.subtle
++ .digest("SHA-256", new TextEncoder().encode(state.challenge))
++ .then((buf) => setChallenge(toHexString(new Uint8Array(buf))));
+ }, [state]);
+
+ useEffect(() => {
+diff --git a/web/js/worker/sha256-purejs.mjs b/web/js/worker/sha256-purejs.mjs
+index 3211b44..08072c6 100644
+--- a/web/js/worker/sha256-purejs.mjs
++++ b/web/js/worker/sha256-purejs.mjs
+@@ -1,9 +1,7 @@
+-import { Sha256 } from '@aws-crypto/sha256-js';
+-
+-const calculateSHA256 = (text) => {
+- const hash = new Sha256();
+- hash.update(text);
+- return hash.digest();
++const calculateSHA256 = async (text) => {
++ return new Uint8Array(
++ await crypto.subtle.digest("SHA-256",
++ new TextEncoder().encode(text)));
+ };
+
+ function toHexString(arr) {
+--
+2.54.0
+
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 369c40606b..0c2c5b335f 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -142,6 +142,7 @@
#:use-module (gnu packages golang-build)
#:use-module (gnu packages golang-check)
#:use-module (gnu packages golang-compression)
+ #:use-module (gnu packages golang-crypto)
#:use-module (gnu packages golang-web)
#:use-module (gnu packages golang-xyz)
#:use-module (gnu packages gperf)
@@ -177,6 +178,7 @@
#:use-module (gnu packages nettle)
#:use-module (gnu packages networking)
#:use-module (gnu packages node)
+ #:use-module (gnu packages node-xyz)
#:use-module (gnu packages nss)
#:use-module (gnu packages nss)
#:use-module (gnu packages openldap)
@@ -248,6 +250,114 @@
#:use-module (ice-9 match)
#:use-module ((srfi srfi-1) #:select (delete-duplicates)))
+(define-public anubis-ai-firewall
+ (package
+ ;; Name clashes with "anubis" in (gnu packages mail).
+ (name "anubis-ai-firewall")
+ (version "1.22.0")
+ (source
+ (origin
+ (method git-fetch)
+ (uri (git-reference
+ (url "https://github.com/TecharoHQ/anubis";)
+ (commit (string-append "v" version))))
+ (file-name (git-file-name name version))
+ (patches
+ (search-patches "anubis-use-the-browser-native-web-crypto-api.patch"))
+ (sha256
+ (base32 "1vaj78727ndzsxydhdgwr9w0p9ykg73nkrbbiijh5l7lvabh3ric"))))
+ (build-system go-build-system)
+ (arguments
+ (list
+ ;; TODO: Enable some of them
+ #:tests? #f
+ ;; TODO: some JS work is required as app.js could not be found
+ #:install-source? #f
+ #:embed-files #~(list ".version"
+ ".*\\.tmpl"
+ ".*\\.js"
+ ".*\\.jsx"
+ ".*\\.mjs"
+ ".*\\.sh"
+ ".*\\.css"
+ "nodes"
+ "text"
+ "children")
+ #:import-path "github.com/TecharoHQ/anubis/cmd/anubis"
+ #:unpack-path "github.com/TecharoHQ/anubis"
+ #:phases
+ #~(modify-phases %standard-phases
+ (add-after 'unpack 'patch-usr-bin-env-shebangs
+ (lambda* (#:key unpack-path #:allow-other-keys)
+ (with-directory-excursion (string-append "src/" unpack-path)
+ (substitute* (find-files "." "\\.sh$")
+ (("#!/usr/bin/env bash")
+ (string-append "#!" (which "bash")))))))
+ (add-after 'patch-usr-bin-env-shebangs 'generate-code
+ (lambda* (#:key unpack-path #:allow-other-keys)
+ (with-directory-excursion (string-append "src/" unpack-path)
+ (for-each make-file-writable
+ (find-files "." "(_templ\\.go|_string\\.go)$"))
+ (invoke "templ" "generate")
+ (with-directory-excursion "internal/dnsbl"
+ (invoke "stringer" "-type=DroneBLResponse")))))
+ (add-after 'generate-code 'make-assets
+ (lambda* (#:key inputs unpack-path #:allow-other-keys)
+ (with-directory-excursion (string-append "src/" unpack-path)
+ (substitute* "xess/xess.go"
+ (("if anubis.Version != \"devel\" \\{")
+ "if false {"))
+ ;; Let esbuild resolve 'preact' and 'preact/hooks'.
+ (setenv "NODE_PATH"
+ (string-append (assoc-ref inputs "node-preact")
+ "/lib/node_modules"))
+ (invoke "./web/build.sh")
+ (invoke "./lib/challenge/preact/build.sh")))))))
+ (native-inputs
+ (list brotli
+ esbuild
+ go-github-com-a-h-templ
+ go-github-com-cespare-xxhash-v2
+ go-github-com-facebookgo-flagenv
+ go-github-com-gaissmai-bart
+ go-github-com-golang-jwt-jwt-v5
+ go-github-com-google-cel-go
+ go-github-com-google-uuid
+ go-github-com-grpc-ecosystem-go-grpc-middleware-providers-prometheus
+ go-github-com-grpc-ecosystem-go-grpc-middleware-v2
+ go-github-com-joho-godotenv
+ go-github-com-lum8rjack-go-ja4h
+ go-github-com-nicksnyder-go-i18n-v2
+ go-github-com-prometheus-client-golang
+ go-github-com-redis-go-redis-v9
+ go-github-com-sebest-xff
+ go-github-com-shirou-gopsutil-v4
+ go-github-com-techarohq-thoth-proto
+ go-go-etcd-io-bbolt
+ go-golang-org-x-net
+ go-golang-org-x-text
+ go-google-golang-org-grpc
+ go-gopkg-in-yaml-v3
+ go-k8s-io-apimachinery
+ go-sigs-k8s-io-yaml
+ go-tools
+ gzip
+ node-preact
+ templ
+ zstd))
+ (home-page "https://github.com/TecharoHQ/anubis";)
+ (synopsis "Weighs the soul of incoming HTTP requests to stop AI crawlers")
+ (description
+ "Anubis is a Web AI Firewall Utility that weighs the soul of your
+connection using one or more challenges in order to protect upstream resources
+from scraper bots.
+
+This program is designed to help protect the small internet from the endless
+storm of requests that flood in from AI companies. Anubis is as lightweight as
+possible to ensure that everyone can afford to protect the communities closest
+to them.")
+ (license license:expat)))
+
(define-public qhttp
(package
(name "qhttp")
