# Linux Dependencies

> **Status — 1.3.0:** The Linux x64 binary (`libfexcore.so`) is **not shipped**
> in 1.3.0 — it is deferred to a 1.3.x patch release. This document describes
> the runtime dependencies that the patch release will require; nothing in the
> 1.3.0 SDK package will load against these instructions today.

FEX Core (`libfexcore.so`) is compiled with Delphi for Linux and links against glibc. This document covers dependency requirements for native Linux and Docker deployments.

## Quick Install (Ubuntu 24.04)

```bash
# Install all runtime dependencies
sudo apt update
sudo apt install -y \
    libsqlite3-0 \
    libsnappy1v5 \
    libarchive13 \
    libyara10 \
    libraptor2-0 \
    libicu74 \
    libpcre2-16-0

# OpenSSL 1.1 requires manual installation (see below)
```

## Dependency Table

### Direct Dependencies

| Library | APT Package | Version (Ubuntu 24.04) | Purpose |
|---------|-------------|------------------------|---------|
| `libsqlite3.so.0` | `libsqlite3-0` | 3.45.1 | Database format parsing |
| `libsnappy.so.1` | `libsnappy1v5` | 1.1.10 | Fast compression/decompression |
| `libarchive.so.13` | `libarchive13` | 3.7.2 | Archive formats (TAR, GZIP, BZIP2, XZ) |
| `libyara.so.10` | `libyara10` | 4.5.0 | Pattern matching / file type detection |
| `libraptor2.so.0` | `libraptor2-0` | 2.0.16 | RDF/metadata parsing (AFF4 format) |
| `libicuuc.so.74` | `libicu74` | 74.2 | Unicode support (Delphi RTL) |
| `libpcre2-16.so.0` | `libpcre2-16-0` | 10.42 | Regular expressions |
| `libcrypto.so.1.1` | *See below* | 1.1.1f | OpenSSL cryptography |

### Indirect Dependencies (auto-installed)

These are pulled in as dependencies of the packages above:

| Library | Purpose |
|---------|---------|
| `libz.so.1` | GZIP compression |
| `liblzma.so.5` | LZMA/XZ compression |
| `libbz2.so.1.0` | BZIP2 compression |
| `libstdc++.so.6` | C++ standard library |
| `libc.so.6` | C standard library (glibc) |
| `libxml2.so.2` | XML parsing (via libraptor2) |
| `libicui18n.so.74` | ICU internationalization |
| `libicudata.so.74` | ICU data |

## OpenSSL 1.1

Ubuntu 24.04 ships with OpenSSL 3.x, but FEX Core was compiled against OpenSSL 1.1. The `libcrypto.so.1.1` library is not available in Ubuntu 24.04 repositories.

### Solution: Install from Ubuntu 20.04 Package

```bash
wget -q http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb
dpkg-deb -x libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb /tmp/openssl11
sudo cp /tmp/openssl11/usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 /usr/local/lib/
sudo cp /tmp/openssl11/usr/lib/x86_64-linux-gnu/libssl.so.1.1 /usr/local/lib/
sudo ldconfig
rm -rf /tmp/openssl11 libssl1.1_*.deb
```

### Security Note

OpenSSL 1.1 is end-of-life. The bundled library is used only for forensic image decryption (E01/EWF format). A future FEX Core release will migrate to OpenSSL 3.x.

## ICU and PCRE2 Symlinks

Delphi's runtime loads ICU and PCRE2 by unversioned names. Create symlinks:

```bash
sudo ln -sf /usr/lib/x86_64-linux-gnu/libicuuc.so.74 /usr/local/lib/libicuuc.so
sudo ln -sf /usr/lib/x86_64-linux-gnu/libicui18n.so.74 /usr/local/lib/libicui18n.so
sudo ln -sf /usr/lib/x86_64-linux-gnu/libicudata.so.74 /usr/local/lib/libicudata.so
sudo ln -sf /lib/x86_64-linux-gnu/libpcre2-8.so.0 /usr/local/lib/libpcre2-8.so
sudo ln -sf /lib/x86_64-linux-gnu/libpcre2-16.so.0 /usr/local/lib/libpcre2-16.so
sudo ldconfig
```

## Locale Configuration

FEX Core requires UTF-8 locale support:

```bash
sudo apt install locales
sudo sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen
sudo locale-gen

export LANG=en_US.UTF-8
export LC_ALL=en_US.UTF-8
```

## Verification

After installing all dependencies:

```bash
# Check all libraries resolve
ldd /usr/local/lib/libfexcore.so | grep "not found"
# Should produce no output

# Quick load test with Python
python3 -c "
import ctypes
lib = ctypes.CDLL('/usr/local/lib/libfexcore.so')
print('Library loaded successfully')
print(f'InitLibrary: {lib.InitLibrary}')
"
```

## Docker (Recommended for Linux)

The simplest way to run FEX Core on Linux is via Docker. Pre-built images include all dependencies:

```bash
docker pull getdataforensics/fexcore-slim:1.3.0
docker run --rm -v /path/to/images:/data getdataforensics/fexcore-slim:1.3.0 \
    python3 /app/fex_viewer.py /data/evidence.E01 info
```

See the [Docker Guide](../docker/README.md) for full documentation.
