mirror of
https://github.com/alexmi256/rea-agent-docker.git
synced 2026-11-07 09:45:59 -10:00
Hermes Agent
a58f16224c
`make check-updates` failed with BEHIND-REA on both Hopper rows: the vendor's
publisher-signed release feed moved its Ubuntu/Mint entry from Hopper 6.6.1 to
6.6.2 on 2026-11-06 16:22 UTC. REA 6.8.0 admits a Linux Hopper only when the
installed launcher is the feed's *current* main_exe_hash, so the old pin was
already wrong - and the build layer would have refused outright ("Hopper feed
moved: Hopper-6.6.2-Linux-demo.deb is no longer Hopper-6.6.1-Linux-demo.deb").
rea-agents itself is current: 6.8.0 is the newest npm release *and* the newest
github tag (v6.8.0, 2026-10-25), and its release notes list nothing pending for
Hopper beyond the feed-admission rule already implemented. So nothing else moved:
same REA_VERSION, same Node 24.22.1, same bundled skill (v49 / 229 tools), same
Ghidra 12.1.4, same helper tools (unicorn stays held at 2.1.2 because pwntools
4.15.0 excludes 2.1.3/2.1.4; Node 24.22.2, frida 17.26.1, uv 0.13.7,
supergateway 4.2.1, mitmproxy 12.3.1, pwndbg 2026.10.28 and Ghidra 12.2 are
newer upstream but wait for the next REA release per docs/UPDATES.md).
Re-pinned to the feed's row:
HOPPER_DEMO_VERSION 6.6.1 -> 6.6.2
HOPPER_DEB_SHA1 a2c28339..-> 9b46788160ba0b37f9050e0aa23a1372b3ecff53
HOPPER_DEB_BYTES 35749234 -> 35749280
HOPPER_LAUNCHER_SHA256 74b51599..-> 226800f154d766664bad5c45912f3a606ffa894316f97464f3c37f01fab5fb82
None of it was taken on trust: the .deb was downloaded (35,749,280 bytes,
sha1 9b467881...), its detached PGP signature verified against the vendor key
whose primary fingerprint is 7C2D73BAFAF5B9A710A69DA1A26DF815099B1BCD - the one
REA pins as HOPPER_LINUX_PRIMARY_FINGERPRINT - and opt/hopper/bin/Hopper hashed
out of the unpacked package (226800f1...), which is what the feed claims. The
build re-checks all four against the live feed, verifies bytes + SHA-1 and the
installed launcher, and bakes the signed evidence under
/home/rea/.cache/rea/hopper-releases/226800f1.../ (archive, release.json,
public-key.asc) so admission works offline; `rea doctor --provider hopper --json`
reports hopper-version healthy, reported_release_version 6.6.2,
source signed_package_cache.
Verified: scripts/build-all.sh (all four rebuilt; Hopper layer 3 min, the rest
cache hits), scripts/verify-all-engines.sh - all 121/0/3, ghidra 109/0/8, hopper
102/0/7, ida 94/0/11, 0 failures, exit 0 on every image; runs 20261107T091717Z /
20261107T092924Z / 20261107T094115Z / 20261107T094312Z. Counts are identical to
the 6.6.1 round; docs/verify-engines.txt regenerated and the sweep recorded in
docs/VERIFICATION.md. `make check-updates` is back to 0 actionable / 0 unknown /
0 unverifiable.
Docs that name the shipped Hopper build follow the pin (README, ARCHITECTURE,
MULTIARCH, BYO-LICENSES, TROUBLESHOOTING, vendor/README, the checker's header
comment); the 6.6.1 and 6.6.0 records in docs/VERIFICATION.md keep the versions
they actually ran.
vendor/ - bring-your-own artefacts
Anything you drop here is copied into the build context and consumed by the
Dockerfile only when the matching build arg allows it. Nothing in this
directory is ever committed (see .gitignore).
| Path | Consumed by | Effect |
|---|---|---|
vendor/*.deb |
Hopper install step | your licensed Hopper package replaces the public demo |
vendor/ida/*.run |
IDA step (INSTALL_IDA=1) |
unattended install of IDA into /opt/ida |
vendor/ida/*.hexlic |
IDA step | copied to ~/.idapro/ida.hexlic inside the image |
vendor/hopper-state/ |
compose bind mount | Hopper application support (licence/activation state) |
vendor/ida/ (empty) |
compose bind mount | default (empty) IDA install mount at /opt/ida |
Licensed Hopper
# You own a Hopper licence and downloaded the licensed DEB:
cp ~/Downloads/Hopper-6.6.2-Linux.deb vendor/
make build # or: make build-hopper for the Hopper-only image
# (equivalent to scripts/build.sh --engine all, which passes REA_UID/REA_GID too)
The build prints which package it used. Verify with:
docker compose --profile hopper up -d rea-hopper
docker compose exec rea-hopper /opt/hopper/bin/Hopper --version || true
docker compose exec rea-hopper rea doctor --provider hopper --json
Hopper activation on Linux is interactive and operator-owned (REA deliberately
never touches licence credentials). Persist the activation in
vendor/hopper-state/ - see docs/BYO-LICENSES.md.
IDA Pro / IDA Home
Preferred: bind-mount an existing installation instead of baking it in.
echo "IDA_INSTALL_DIR=$HOME/ida-pro-9.4" >> .env
mkdir -p config/ida && cp ~/ida.hexlic config/ida/
make build-ida
docker compose -f docker-compose.yml -f compose.ida.yml --profile ida up -d rea-ida
Baking in is supported for reproducibility, but the resulting image must stay private - Hex-Rays' terms do not allow redistributing IDA:
mkdir -p vendor/ida
cp ~/Downloads/ida-pro_94_x64linux.run vendor/ida/
cp ~/ida.hexlic vendor/ida/
echo "INSTALL_IDA=1" >> .env
make build-ida # or ENGINE=all, which also gains IDA
Which IDA edition can drive REA headlessly (and which cannot) is in
docs/ida-variants.md.