Prepare Sandwich Hime v1 release candidate source

2026-08-23 16:25:02 -04:00
parent c11552b87a
commit efd5b997ed
64 changed files with 5276 additions and 156 deletions
@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+
+# Sourced validation helpers for export-public-snapshot.sh and its focused
+# tests. This file deliberately leaves the caller's shell options unchanged.
+
+snapshot_status_is_clean() {
+	[[ -z $1 ]]
+}
+
+snapshot_path_is_at_or_below() {
+	local candidate=$1
+	local boundary=$2
+
+	[[ $boundary == / || $candidate == "$boundary" || $candidate == "$boundary/"* ]]
+}
+
+snapshot_realpath_existing() {
+	local path=$1
+	local directory base
+	if [[ -d $path ]]; then
+		(CDPATH= cd -- "$path" && pwd -P)
+		return
+	fi
+	if [[ -f $path ]]; then
+		directory=$(dirname -- "$path")
+		base=$(basename -- "$path")
+		directory=$(CDPATH= cd -- "$directory" && pwd -P) || return 1
+		printf '%s/%s\n' "$directory" "$base"
+		return
+	fi
+	return 1
+}
+
+snapshot_forbidden_path() {
+	local path=$1
+	local lower
+	lower=$(printf '%s' "$path" | LC_ALL=C tr '[:upper:]' '[:lower:]')
+
+	[[ $path != /* && $path != *\\* && $path != *//* ]] || return 0
+	[[ $path != . && $path != .. && $path != ../* && $path != */../* && $path != */.. ]] || return 0
+	[[ $path != *$'\n'* && $path != *$'\r'* && $path != *$'\t'* ]] || return 0
+
+	case "/$lower/" in
+	*/.git/* | */.gitea/* | */.github/* | */private/* | */prototype/* | */prototypes/* | */history/* | */legacy/* | */vendor/* | */bin/* | */dist/* | */coverage/* | */cmd/himetest/* | */cmd/himework/* | */internal/himesan/* | */internal/integration/* | */templates/*)
+		return 0
+		;;
+	esac
+	case $lower in
+	go.work | go.work.sum | .env | .env.* | */.env | */.env.* | *.db | *.db-* | *.sqlite | *.sqlite3 | *.pem | *.key | *.p12 | *.pfx | */id_rsa | */id_ed25519 | *credentials* | *.exe | *.dll | *.dylib | *.so | *.a | *.o | *.test | *.prof | *.cover | *.zip | *.tar | *.tar.gz | *.tgz)
+		return 0
+		;;
+	esac
+	return 1
+}
+
+snapshot_validate_export_tree() {
+	local root=$1
+	local marker=${2:-}
+	local max_file_bytes=${SNAPSHOT_MAX_FILE_BYTES:-1048576}
+	local max_total_bytes=${SNAPSHOT_MAX_TOTAL_BYTES:-16777216}
+	local max_files=${SNAPSHOT_MAX_FILES:-2000}
+	local total=0
+	local count=0
+	local file rel size
+	local users_word=Users
+	local private_unix="/(home|${users_word})/[^/[:space:]]+"
+	local private_windows='[A-Za-z]:[\\/]+Users[\\/]'
+	local private_wsl="/mnt/[a-zA-Z]/${users_word}/"
+	local pem_begin='-----BEGIN '
+	local private_key="${pem_begin}([A-Z0-9]+ )?PRIVATE KEY-----|${pem_begin}PGP PRIVATE KEY BLOCK-----"
+	local provider_token='AKIA[0-9A-Z]{16}|(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}|glpat-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}'
+	local private_commit_id='(private development (source|baseline)|private (development )?(commit|source))[^[:cntrl:]]*[0-9a-f]{12,64}'
+	local private_repository='sandwich-hime-''dev'
+
+	if find "$root" -type l -print -quit | grep -q .; then
+		echo "public snapshot: symbolic links are forbidden" >&2
+		return 1
+	fi
+
+	while IFS= read -r -d '' file; do
+		rel=${file#"$root"/}
+		[[ -z $marker || $rel != "$marker" ]] || continue
+		if snapshot_forbidden_path "$rel"; then
+			echo "public snapshot: forbidden path: $rel" >&2
+			return 1
+		fi
+		size=$(wc -c <"$file")
+		size=${size//[[:space:]]/}
+		if ((size > max_file_bytes)); then
+			echo "public snapshot: oversized file: $rel ($size bytes)" >&2
+			return 1
+		fi
+		total=$((total + size))
+		count=$((count + 1))
+		if ((total > max_total_bytes || count > max_files)); then
+			echo "public snapshot: export exceeds aggregate size/count limits" >&2
+			return 1
+		fi
+		if [[ -s $file ]] && ! LC_ALL=C grep -Iq . "$file"; then
+			echo "public snapshot: binary file rejected: $rel" >&2
+			return 1
+		fi
+		if LC_ALL=C grep -Eq "$private_unix|$private_windows|$private_wsl" "$file"; then
+			echo "public snapshot: private filesystem path indicator in $rel" >&2
+			return 1
+		fi
+		if LC_ALL=C grep -Eq -- "$private_key|$provider_token" "$file"; then
+			echo "public snapshot: key or credential indicator in $rel" >&2
+			return 1
+		fi
+		if LC_ALL=C grep -Eiq -- "$private_commit_id" "$file"; then
+			echo "public snapshot: private commit identifier in $rel" >&2
+			return 1
+		fi
+		if LC_ALL=C grep -Fq -- "$private_repository" "$file"; then
+			echo "public snapshot: private repository indicator in $rel" >&2
+			return 1
+		fi
+	done < <(find "$root" -type f -print0 | LC_ALL=C sort -z)
+}