Add warning about Brave's "referral code" system

[foxt]

Changes proposed in this PR:

Add a warning mentioning Brave's promo code system.

• I have disclosed any relevant conflicts of interest in my post.
• I agree to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute my contribution as part of this project.
• I am the sole author of this work.
• I agree to the Community Code of Conduct.

[netlify]

✅ Deploy Preview for privacyguides ready!

Name	Link
🔨 Latest commit	aa9fed4
🔍 Latest deploy log	https://app.netlify.com/sites/privacyguides/deploys/65378ea7b5980a00081ac10b
😎 Deploy Preview	https://deploy-preview-2271.preview.privacyguides.dev
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	4 paths audited Performance: 84 Accessibility: 91 Best Practices: 98 SEO: 88 PWA: - View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[foxt]

For reference, here's a copy of the postinstall script from the current macOS installer.

#!/bin/bash
# This postinstall script is run on macOS pkg installers

# Extract a referral / promo code from the installer path of the format /dir/path/Setup-Brave-Anything-xxx001.pkg
# where the promo code would be xxx001
installerPath=$1
installationPath=$2

promoCode=""

# Detect if installer contained a referral promotion code within the filename
standardPromoCodeRegex='[a-zA-Z0-9]{3}[0-9]{3}'
installerPathPromoCodeRegex=".+-((${standardPromoCodeRegex})|([a-zA-Z]{1,}-[a-zA-Z]{1,}))([[:blank:]]?\([0-9]+\))?\.pkg$"
if [[ $installerPath =~ $installerPathPromoCodeRegex ]]; then
  n=${#BASH_REMATCH[*]}
  rematch=${BASH_REMATCH[1]}
  if [[ $n -ge 1 && ! ${rematch} =~ ^Browser-.*$ ]]; then
    promoCode=${rematch}
    if [[ $promoCode =~ $standardPromoCodeRegex ]]; then
      promoCode=$(tr a-z A-Z <<< $promoCode)
    fi
    echo "Got promo code: $promoCode"
  fi
fi

# Get a channel-safe version of the application name (based on the
# .pkg file name)
if [ "$promoCode" == "" ]; then
  appName=$(basename "$1" | sed "s/.pkg//" | sed "s/ /\-/g")
else
  appName=$(basename "$1" | sed "s/.pkg//" | sed "s/ /\-/g" | perl -ple "s/-${promoCode}//i")
fi

appNameNoDash=$(echo $appName | sed "s/-/ /g")
installationAppPath="$installationPath/${appNameNoDash}.app"
userDataDir="$HOME/Library/Application Support/BraveSoftware"
appDataDir="$userDataDir/${appName}"
promoCodePath="$appDataDir/promoCode"

# pkg runs this script as root so we need to get current username
userName="$USER"

echo "Installer path is: $installerPath"
echo "Username is: $userName"
echo "Installation app path is: $installationAppPath"

# Fix the permissions on installed .app so that updater has permissions to write new contents.
# By default pkg will install the .app with root:wheel owner and 'drwxr-xr-x' permission.
# We'll allow all admin users of the machine permissions to update the app, as well as the installing-user
# (who may not be an admin).
sudo chmod -R 775 "$installationAppPath"
sudo chown -R $userName "$installationAppPath"
sudo chgrp -R admin "$installationAppPath"

# handle promoCode specific logic (if promoCode was found)
if [ "$promoCode" != "" ]; then
  echo "Writing to user data directory at: $promoCodePath"
  mkdir -p "$appDataDir"
  echo "$promoCode" > "$promoCodePath"
  # fix permissions
  sudo chown -R "$userName" "$userDataDir"
fi

exit 0

I noticed that Brave on macOS is distributed as pkg file, rather than a plain .app in a disk image. This is uncommon. As far as I know the other browser to do this is Microsoft Edge, which used a pkg installer to register its telemetry agent to launch at boot without even opening the browser.

[dngray]

Hmm, I wasn't aware of this. I wonder if this is a bit like what Mozilla do if you download from the website and not the ftp

[jonaharagon]

Approving this now with or without the suggestion in #2271 (comment) (I'll let @dngray decide if he wants to add that note on macOS downloads)

[freddy-m]

LGTM

[privacyguides-bot]

This pull request has been mentioned on Privacy Guides. There might be relevant details there:

https://discuss.privacyguides.net/t/v3-17/15136/1