UpdatePage.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "UpdatePage.hpp"
#include "SafeProcess.hpp"
#include <filesystem>
#include <unistd.h>
#include <system_error>
#include <cstring>
#include "Resource.hpp"
#include <glibmm/spawn.h>
#include <glibmm/i18n.h>
#include <giomm.h>
#include <fstream>
#include <thread>
#include <utility>
#include <random>
#include <sstream>
#include <vector>
#include <thread>
 
extern "C" {
    #include <libsecret/secret.h>
}
 
static const SecretSchema BastionGuard_SCHEMA = {
    "org.BastionGuard.source",
    SECRET_SCHEMA_NONE,
    {
        { "secret_key", SECRET_SCHEMA_ATTRIBUTE_STRING },
        { NULL,        SECRET_SCHEMA_ATTRIBUTE_STRING }
    }
};
 
UpdatePage::UpdatePage()
: Gtk::Box(Gtk::Orientation::VERTICAL, 12),
  updateButton(_("Aggiorna firme (freshclam)")),
  serviceSwitch(),
  addSourceButton(_("Aggiungi sorgente")),
  saveSourcesButton(_("Salva sorgenti")),
  sourcesLabel(_("Sorgenti aggiuntive"))
{
    buffer = Gtk::TextBuffer::create();
    outputView.set_buffer(buffer);
    outputView.set_editable(false);
    outputView.set_monospace(true);
 
    updateButton.signal_clicked().connect(sigc::mem_fun(*this, &UpdatePage::onUpdateClicked));
 
    serviceSwitch.set_active(checkServiceStatus());
    serviceSwitch.property_active().signal_changed().connect(sigc::mem_fun(*this, &UpdatePage::onServiceToggled));
 
    auto serviceBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto serviceLabel = Gtk::make_managed<Gtk::Label>(_("Servizio automatico Freshclam:"));
    serviceBox->append(*serviceLabel);
    serviceBox->append(serviceSwitch);
    auto saneSwitchLabel = Gtk::make_managed<Gtk::Label>(
    _("Aggiorna automaticamente le firme SaneSecurity (ogni 2 ore):")
    );
    saneAutoSwitch.set_active(checkSaneTimer());
    saneAutoSwitch.property_active().signal_changed().connect(
        sigc::mem_fun(*this, &UpdatePage::onSaneAutoToggled)
    );
 
    auto saneBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    saneBox->append(*saneSwitchLabel);
    saneBox->append(saneAutoSwitch);
    append(*saneBox);
    addSourceButton.signal_clicked().connect(sigc::mem_fun(*this, &UpdatePage::onAddSourceClicked));
    saveSourcesButton.signal_clicked().connect(sigc::mem_fun(*this, &UpdatePage::onSaveSourcesClicked));
 
    sourcesBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 4);
    loadSources();
 
    auto sourcesFrame = Gtk::make_managed<Gtk::Frame>();
    sourcesFrame->set_label(_("Sorgenti di aggiornamento aggiuntive"));
    sourcesFrame->set_child(*sourcesBox);
 
    auto controlBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    controlBox->append(addSourceButton);
    controlBox->append(saveSourcesButton);
    auto scrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrolled->set_child(outputView);
    scrolled->set_expand(true);
 
    append(updateButton);
    append(*serviceBox);
    append(sourcesLabel);
    append(*sourcesFrame);
    append(*controlBox);
    append(*scrolled);
}
 
bool UpdatePage::checkServiceStatus() {
    return bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                            "--system", "is-active", "clamav-freshclam.service"}).ok();
}
 
void UpdatePage::onServiceToggled() {
    bool enable = serviceSwitch.get_active();
    buffer->insert(buffer->end(), (enable ? _("Abilito") : _("Disabilito")) + std::string(" il servizio freshclam...\n"));
    const auto result = bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service",
            "--system", enable ? "enable" : "disable", "--now", "clamav-freshclam.service"}, true);
    buffer->insert(buffer->end(), result.output + (result.ok() ? "\n" : _("Errore modifica servizio.\n")));
}
 
static const std::vector<std::string> sane_files = {
    "junk.ndb",
    "jurlbl.ndb",
    "jurlbla.ndb",
    "jurlwr.ndb",
    "jurlsb.ndb",
    "lott.ndb",
    "phishtank.ndb",
    "scam.ndb",
    "rogue.hdb",
    "spamattach.hdb",
    "winnow_extended.hdb",
    "winnow_malware.hdb",
    "winnow_phish_complete.ndb",
    "bytecode.cdb"
};
 
 
void UpdatePage::onUpdateClicked() {
    buffer->set_text(_("🔄 Avvio aggiornamento delle firme...\n"));
    updateButton.set_sensitive(false);
    std::thread([this, alive = alive_]() {
        std::string out, err;
        int exit_status = -1;
 
        try {
            logSafe(_("⏸️ Arresto servizio clamav-freshclam...\n"));
            (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "stop", "clamav-freshclam.service"}).exit_code);
            logSafe(_("🚀 Avvio aggiornamento con pkexec freshclam...\n"));
            try {
                Glib::spawn_command_line_sync("pkexec freshclam", &out, &err, &exit_status);
            } catch (const Glib::Error& ex) {
                logSafe(std::string(_("❌ Errore freshclam: ")) + ex.what() + "\n");
            }
            if (!out.empty())
                logSafe("\n" + out + "\n");
            if (!err.empty()) {
                logSafe("\n--- STDERR ---\n");
                logSafe(err + "\n");
            }
            logSafe(Glib::ustring::compose(_("\n🧾 Codice di uscita: %1\n"), exit_status));
            logSafe(_("▶️ Riavvio del servizio clamav-freshclam...\n"));
            (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "start", "clamav-freshclam.service"}).exit_code);
 
            logSafe(_("\n🔽 Scarico firme aggiuntive dalle sorgenti configurate...\n"));
            if (!alive->load()) return;
            updateFromExtraSources();
 
            logSafe(_("🔐 Aggiornamento firme SaneSecurity...\n"));
            if (!alive->load()) return;
            updateSaneSecurity();
 
            logSafe(_("🔁 Ricarico clamd (clamav-daemon)...\n"));
            int reload_status = (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "try-reload-or-restart", "clamav-daemon.service"}).exit_code);
            if (reload_status != 0) {
                logSafe(_("⚠ Reload clamav-daemon fallito (codice non zero).\n"));
            }
            Glib::signal_idle().connect_once([this, alive]() {
                BastionGuard::if_alive(alive, [this]() {
                    buffer->insert(buffer->end(), _("✅ Aggiornamento completato con successo.\n"));
                    updateButton.set_sensitive(true);
                });
            });
 
        } catch (const Glib::Error& ex) {
            Glib::signal_idle().connect_once([this, alive, ex]() {
                BastionGuard::if_alive(alive, [this, &ex]() {
                    buffer->insert(buffer->end(),
                        Glib::ustring::compose(_("❌ Errore durante l'aggiornamento: %1\n"), ex.what()));
                    updateButton.set_sensitive(true);
                });
            });
        }
 
    }).detach();
}
 
void UpdatePage::updateFromExtraSources() {
    auto alive = alive_;
    buffer->insert(buffer->end(), _("\n🔽 Scarico firme aggiuntive dalle sorgenti configurate...\n"));
 
    // Snapshot the GTK widget values on the UI thread before starting a worker.
    // A deferred idle callback here would capture a dead stack reference and
    // race with the worker's copy of the source list.
    std::vector<SourceItem> sources;
    for (auto child : sourcesBox->get_children()) {
        auto frame = dynamic_cast<Gtk::Frame*>(child);
        if (!frame) continue;
        auto section = dynamic_cast<Gtk::Box*>(frame->get_child());
        if (!section) continue;
        auto section_children = section->get_children();
        if (section_children.size() < 2) continue;
        auto revealer = dynamic_cast<Gtk::Revealer*>(section_children[1]);
        if (!revealer) continue;
        auto inner = dynamic_cast<Gtk::Box*>(revealer->get_child());
        if (!inner) continue;
        auto entries = inner->get_children();
        if (entries.size() < 4) continue;
        auto name = dynamic_cast<Gtk::Entry*>(entries[0]);
        auto url = dynamic_cast<Gtk::Entry*>(entries[1]);
        auto auth = dynamic_cast<Gtk::CheckButton*>(entries[2]);
        auto username = dynamic_cast<Gtk::Entry*>(entries[3]);
        if (!name || !url || !auth || !username) continue;
 
        SourceItem source;
        source.name = name->get_text();
        source.url = url->get_text();
        source.requires_auth = auth->get_active();
        source.username = username->get_text();
        if (!source.url.empty()) sources.push_back(std::move(source));
    }
 
    if (sources.empty()) {
        buffer->insert(buffer->end(), _("Nessuna sorgente aggiuntiva configurata.\n"));
        return;
    }
 
    std::thread([this, alive, sources = std::move(sources)]() {
        bool all_ok = true;
        for (const auto& src : sources) {
            // Never allow an untrusted URL to select a local-file or other
            // potentially unsafe curl protocol. No URL reaches a shell.
            if (src.url.rfind("https://", 0) != 0) {
                all_ok = false;
                Glib::signal_idle().connect_once([this, alive, url = src.url]() {
                    BastionGuard::if_alive(alive, [this, &url]() {
                        buffer->insert(buffer->end(), _("⚠ Sorgente non HTTPS ignorata: ") + url + "\n");
                    });
                });
                continue;
            }
 
            std::string pw;
            if (src.requires_auth)
                pw = lookupPassword("BastionGuard:" + src.name);
 
            std::vector<std::string> argv = {
                "curl", "-f", "--proto", "=https", "--proto-redir", "=https"
            };
            if (src.requires_auth) {
                argv.push_back("-u");
                argv.push_back(src.username + ":" + pw);
            }
            argv.insert(argv.end(), {
                "-O", "--output-dir", "/var/lib/clamav",
                "--url", src.url
            });
 
            std::string out, err;
            int status = -1;
            try {
                Glib::spawn_sync("", argv, Glib::SpawnFlags::SEARCH_PATH,
                                 {}, &out, &err, &status);
            } catch (const Glib::Error& ex) {
                err = ex.what();
            }
            const bool ok = status == 0;
            if (!ok) all_ok = false;
            if (!alive->load()) return;
 
            Glib::signal_idle().connect_once([this, alive, src, out, err, ok]() {
                BastionGuard::if_alive(alive, [this, &src, &out, &err, ok]() {
                    buffer->insert(buffer->end(),
                        (ok ? _("⬇️  Scarico da: ") : _("❌ Download fallito: ")) + src.url + "\n");
                    if (!out.empty()) buffer->insert(buffer->end(), out + "\n");
                    if (!err.empty()) buffer->insert(buffer->end(), err + "\n");
                });
            });
        }
 
        Glib::signal_idle().connect_once([this, alive, all_ok]() {
            BastionGuard::if_alive(alive, [this, all_ok]() {
                buffer->insert(buffer->end(), all_ok
                    ? _("\n✅ Aggiornamento firme extra completato.\n")
                    : _("\n⚠ Aggiornamento firme extra incompleto: controllare gli errori.\n"));
            });
        });
    }).detach();
}
 
 
void UpdatePage::onAddSourceClicked() {
    createSourceRow();
}
 
void UpdatePage::createSourceRow(const SourceItem& src) {
    auto frame = Gtk::make_managed<Gtk::Frame>();
    frame->set_hexpand(true);
    frame->set_margin(4);
    frame->set_valign(Gtk::Align::START);
 
    auto headerBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto titleLabel = Gtk::make_managed<Gtk::Label>(
        src.name.empty() ? _("➕ Nuova sorgente") : ("📦 " + src.name));
    titleLabel->set_xalign(0);
    titleLabel->add_css_class(src.name.empty() ? "suggested-action" : "highlight");
 
    auto expandIcon = Gtk::make_managed<Gtk::Label>("▼");
    expandIcon->set_margin_start(6);
    expandIcon->set_css_classes({ "expand-icon" });
 
    headerBox->append(*titleLabel);
    headerBox->append(*expandIcon);
    headerBox->set_margin(6);
    headerBox->set_css_classes({ "source-header" });
 
    auto innerBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    innerBox->set_css_classes({ "revealer-content" });
 
 
    auto nameEntry = Gtk::make_managed<Gtk::Entry>();
    nameEntry->set_placeholder_text(_("Nome sorgente (es. Sanesecurity)"));
    nameEntry->set_text(src.name);
 
    auto urlEntry = Gtk::make_managed<Gtk::Entry>();
    urlEntry->set_placeholder_text(_("https://example.com/firme.cvd"));
    urlEntry->set_text(src.url);
 
    auto authSwitch = Gtk::make_managed<Gtk::CheckButton>(_("_Richiede autenticazione"), true);
    authSwitch->set_active(src.requires_auth);
 
    auto usernameEntry = Gtk::make_managed<Gtk::Entry>();
    usernameEntry->set_placeholder_text(_("Username"));
    usernameEntry->set_text(src.username);
 
    auto passwordEntry = Gtk::make_managed<Gtk::PasswordEntry>();
    passwordEntry->property_placeholder_text() = _("Password");
    passwordEntry->set_text(lookupPassword("BastionGuard:" + src.name));
 
    auto buttonBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
    auto testButton = Gtk::make_managed<Gtk::Button>(_("_Test connessione"), true);
    auto saveButton = Gtk::make_managed<Gtk::Button>(_("_Salva sorgente"), true);
    auto deleteButton = Gtk::make_managed<Gtk::Button>(_("_Elimina sorgente"), true);
    deleteButton->add_css_class("btn-danger");
 
    buttonBox->append(*testButton);
    buttonBox->append(*saveButton);
    buttonBox->append(*deleteButton);
 
    innerBox->append(*nameEntry);
    innerBox->append(*urlEntry);
    innerBox->append(*authSwitch);
    innerBox->append(*usernameEntry);
    innerBox->append(*passwordEntry);
    innerBox->append(*buttonBox);
 
    auto revealer = Gtk::make_managed<Gtk::Revealer>();
    revealer->set_transition_type(Gtk::RevealerTransitionType::SLIDE_DOWN);
    revealer->set_transition_duration(200);
    revealer->set_reveal_child(false);
    revealer->set_child(*innerBox);
 
    auto sectionBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 0);
    sectionBox->append(*headerBox);
    sectionBox->append(*revealer);
    frame->set_child(*sectionBox);
    sourcesBox->append(*frame);
 
    auto click = Gtk::GestureClick::create();
    click->signal_pressed().connect([this, revealer, expandIcon](int n_press, double, double) {
        if (n_press != 1) return;
 
        bool currentlyOpen = revealer->get_reveal_child();
 
        for (auto child : sourcesBox->get_children()) {
            if (auto f = dynamic_cast<Gtk::Frame*>(child)) {
                if (auto box = dynamic_cast<Gtk::Box*>(f->get_child())) {
                    auto children = box->get_children();
                    if (children.size() >= 2) {
                        if (auto r = dynamic_cast<Gtk::Revealer*>(children[1])) {
                            r->set_reveal_child(false);
                            if (auto hBox = dynamic_cast<Gtk::Box*>(children[0])) {
                                for (auto& c : hBox->get_children()) {
                                    if (auto lbl = dynamic_cast<Gtk::Label*>(c)) {
                                        if (lbl->get_text() == "▲" || lbl->get_text() == "▼")
                                            lbl->set_text("▼");
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
 
        revealer->set_reveal_child(!currentlyOpen);
        expandIcon->set_text(!currentlyOpen ? "▲" : "▼");
        if (auto header = dynamic_cast<Gtk::Widget*>(expandIcon->get_parent())) {
            if (!currentlyOpen)
                header->add_css_class("open");
            else
                header->remove_css_class("open");
        }
 
    });
    headerBox->add_controller(click);
 
    // --- Aggiorna titolo dinamico ---
    nameEntry->signal_changed().connect([titleLabel, nameEntry]() {
        std::string newName = nameEntry->get_text();
        if (newName.empty()) {
            titleLabel->set_text(_("➕ Nuova sorgente"));
            titleLabel->remove_css_class("highlight");
            titleLabel->add_css_class("suggested-action");
        } else {
            titleLabel->set_text("📦 " + newName);
            titleLabel->remove_css_class("suggested-action");
            titleLabel->add_css_class("highlight");
        }
    });
 
    testButton->signal_clicked().connect([this, nameEntry, urlEntry, authSwitch, usernameEntry, passwordEntry]() {
        std::string pw = passwordEntry->get_text();
        if (!pw.empty())
            storePassword("BastionGuard:" + nameEntry->get_text(), pw);
        testConnection(nameEntry->get_text(), urlEntry->get_text(),
                       authSwitch->get_active(), usernameEntry->get_text());
    });
 
    saveButton->signal_clicked().connect([this, nameEntry, passwordEntry]() {
        std::string key = "BastionGuard:" + nameEntry->get_text();
        storePassword(key, passwordEntry->get_text());
        buffer->insert(buffer->end(), _("💾 Sorgente salvata.\n"));
    });
 
    deleteButton->signal_clicked().connect([this, frame]() {
        sourcesBox->remove(*frame);
        buffer->insert(buffer->end(), _("❌ Sorgente rimossa.\n"));
    });
    for (auto child : sourcesBox->get_children()) {
        if (auto f = dynamic_cast<Gtk::Frame*>(child)) {
            if (auto box = dynamic_cast<Gtk::Box*>(f->get_child())) {
                auto children = box->get_children();
                if (children.size() >= 2) {
                    if (auto r = dynamic_cast<Gtk::Revealer*>(children[1])) {
                        r->set_reveal_child(false);
                    }
                }
            }
        }
    }
 
    revealer->set_reveal_child(true);
    expandIcon->set_text("▲");
}
 
 
 
void UpdatePage::onSaveSourcesClicked() {
    saveSources();
    buffer->insert(buffer->end(), _("Sorgenti salvate in ~/.config/BastionGuard/sources.conf\n"));
}
 
void UpdatePage::saveSources() {
    std::string cfgPath = Glib::get_home_dir() + "/.config/BastionGuard";
    auto dirFile = Gio::File::create_for_path(cfgPath);
    if (!dirFile->query_exists()) {
        dirFile->make_directory_with_parents();
    }
 
    std::ofstream file(cfgPath + "/sources.conf");
    if (!file) return;
 
    for (auto child : sourcesBox->get_children()) {
        if (auto frame = dynamic_cast<Gtk::Frame*>(child)) {
            auto inner = dynamic_cast<Gtk::Box*>(frame->get_child());
            if (!inner) continue;
 
            auto entries = inner->get_children();
            if (entries.size() < 5) continue;
 
            auto nameEntry = dynamic_cast<Gtk::Entry*>(entries[0]);
            auto urlEntry  = dynamic_cast<Gtk::Entry*>(entries[1]);
            auto authSwitch= dynamic_cast<Gtk::CheckButton*>(entries[2]);
            auto userEntry = dynamic_cast<Gtk::Entry*>(entries[3]);
 
            file << nameEntry->get_text() << "|"
                 << urlEntry->get_text()  << "|"
                 << (authSwitch->get_active() ? "1" : "0") << "|"
                 << userEntry->get_text() << "\n";
        }
    }
}
 
void UpdatePage::loadSources() {
    std::ifstream file(Glib::get_home_dir() + "/.config/BastionGuard/sources.conf");
    std::string line;
    while (std::getline(file, line)) {
        SourceItem src;
        std::stringstream ss(line);
        std::getline(ss, src.name, '|');
        std::getline(ss, src.url,  '|');
        std::string auth;
        std::getline(ss, auth,     '|');
        src.requires_auth = (auth == "1");
        std::getline(ss, src.username, '|');
        createSourceRow(src);
    }
}
 
void UpdatePage::testConnection(const std::string& name, const std::string& url, bool auth, const std::string& user) {
    if (url.empty()) {
        buffer->insert(buffer->end(), _("⚠ Nessun URL specificato per ") + name + "\n");
        return;
    }
 
    buffer->insert(buffer->end(), _("🔍 Test connessione a ") + url + "...\n");
    std::string out, err;
 
    std::vector<std::string> argv = {
        "curl", "-I", "-s", "-o", "/dev/null", "-w", "%{http_code}"
    };
    if (auth) {
        std::string pw = lookupPassword("BastionGuard:" + name);
        if (pw.empty()) {
            buffer->insert(buffer->end(), _("⚠ Nessuna password trovata per ") + name + "\n");
            return;
        }
        argv.push_back("-u");
        argv.push_back(user + ":" + pw);
    }
    argv.push_back("--url");
    argv.push_back(url);
 
    int status = -1;
    Glib::spawn_sync("", argv, Glib::SpawnFlags::SEARCH_PATH,
                     {}, &out, &err, &status);
    if (!err.empty())
        buffer->insert(buffer->end(), _("Errore: ") + err + "\n");
 
    if (!out.empty()) {
        buffer->insert(buffer->end(), _("Risposta HTTP: ") + out + "\n");
        if (out.find("200") != std::string::npos)
            buffer->insert(buffer->end(), _("✅ Connessione riuscita.\n"));
        else
            buffer->insert(buffer->end(), _("❌ Connessione fallita o accesso negato.\n"));
    }
}
 
bool UpdatePage::storePassword(const std::string& key, const std::string& password) {
    GError *error = nullptr;
    gboolean res = secret_password_store_sync(
        &BastionGuard_SCHEMA, SECRET_COLLECTION_DEFAULT,
        ("BastionGuard source " + key).c_str(),
        password.c_str(),
        nullptr, &error,
        "secret_key", key.c_str(),
        nullptr
    );
    if (error) g_error_free(error);
    return res == TRUE;
}
 
std::string UpdatePage::lookupPassword(const std::string& key) {
    GError *error = nullptr;
    gchar *pw = secret_password_lookup_sync(
        &BastionGuard_SCHEMA, nullptr, &error,
        "secret_key", key.c_str(),
        nullptr
    );
    std::string result;
    if (pw) {
        result = pw;
        secret_password_free(pw);
    }
    if (error) g_error_free(error);
    return result;
}
 
std::string UpdatePage::generateSecretKey() {
    std::random_device rd;
    std::mt19937 gen(rd());
    std::uniform_int_distribution<> dis(0, 15);
    std::ostringstream oss;
    for (int i = 0; i < 12; ++i) oss << std::hex << dis(gen);
    return "BastionGuard:" + oss.str();
}
 
UpdatePage::~UpdatePage() {
    // Invalida i lambda async in volo.
    if (alive_) alive_->store(false, std::memory_order_release);
 
    if (sourcesNotebook) {
        sourcesNotebook->set_visible(false);
        sourcesNotebook = nullptr;
    }
}
 
void UpdatePage::updateSaneSecurity() {
    auto push = [this, alive = alive_](const std::string& msg) {
        Glib::signal_idle().connect_once([this, alive, msg]() {
            BastionGuard::if_alive(alive, [this, &msg]() {
                buffer->insert(buffer->end(), msg);
            });
        });
    };
 
    push(_("🌐 Aggiornamento database SaneSecurity (mirror sicuro)...\n"));
 
    namespace fs = std::filesystem;
    // Keep the sync unprivileged. mkdtemp ensures an exclusive 0700 directory.
    char tmpl[] = "/tmp/bastionguard-sanesecurity-XXXXXX";
    char* created = ::mkdtemp(tmpl);
    if (!created) {
        push(_("❌ Impossibile creare la directory temporanea di staging.\n"));
        return;
    }
    const fs::path staging(created);
    struct StagingGuard {
        fs::path path;
        ~StagingGuard() { std::error_code ec; fs::remove_all(path, ec); }
    } cleanup{staging};
 
    const auto sync = bg_process::run({"rsync", "-av", "--",
        "rsync://rsync.sanesecurity.net/sanesecurity/", staging.string() + "/"},
        true, 4U * 1024U * 1024U);
    if (!sync.ok()) {
        push(_("❌ Download SaneSecurity fallito. Nessun database modificato.\n"));
        return;
    }
 
    const std::vector<std::string> extensions = {
        ".ndb", ".hdb", ".ldb", ".yar", ".yara", ".ign2", ".txt"
    };
    std::size_t installed = 0;
    std::error_code ec;
    for (fs::directory_iterator it(staging, fs::directory_options::skip_permission_denied, ec),
                                end; !ec && it != end; it.increment(ec)) {
        const fs::path path = it->path();
        // Do not follow symlinks, directories, or special devices from a mirror.
        if (!it->is_regular_file(ec) || it->is_symlink(ec)) { ec.clear(); continue; }
        const std::string extension = path.extension().string();
        if (std::find(extensions.begin(), extensions.end(), extension) == extensions.end())
            continue;
        const auto install = bg_process::run({"pkexec", "/usr/bin/install", "-m", "0644", "--",
            path.string(), (fs::path("/var/lib/clamav") / path.filename()).string()}, true);
        if (install.ok()) ++installed;
        else push(_("⚠ Installazione firma fallita: ") + path.filename().string() + "\n");
    }
    if (installed == 0) push(_("⚠ Nessuna firma SaneSecurity installata.\n"));
    else push(_("📦 Firme SaneSecurity installate: ") + std::to_string(installed) + "\n");
}
 
 
 
 
void UpdatePage::logSafe(const std::string& msg) {
    auto alive = alive_;
    Glib::signal_idle().connect_once([this, alive, msg]() {
        BastionGuard::if_alive(alive, [this, &msg]() {
            buffer->insert(buffer->end(), msg);
        });
    });
}
 
bool UpdatePage::checkSaneTimer() {
    std::string out;
    int status = -1;
 
    try {
        Glib::spawn_command_line_sync(
            "/usr/libexec/bastionguard/bastionguard-service --system is-enabled bastionguard-sanesecurity.timer",
            &out, nullptr, &status
        );
        return out.find("enabled") != std::string::npos;
    }
    catch (...) {
        return false;
    }
}
 
void UpdatePage::onSaneAutoToggled() {
    bool enable = saneAutoSwitch.get_active();
 
    buffer->insert(buffer->end(),
        enable ?
        _("⏱️ Attivo aggiornamento automatico SaneSecurity ogni 2 ore...\n" ):
        _("⏸️ Disattivo aggiornamento automatico SaneSecurity...\n")
    );
 
    const auto result = bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service",
            "--system", enable ? "enable" : "disable", "--now", "bastionguard-sanesecurity.timer"}, true);
    buffer->insert(buffer->end(), result.output + (result.ok() ? "\n" : _("Errore modifica timer.\n")));
}