Prepare Sandwich Hime v1 release candidate source
This commit is contained in:
Executable
+278
@@ -0,0 +1,278 @@
|
||||
#!/usr/bin/env bash
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
project_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
# shellcheck source=public-snapshot-lib.sh
|
||||
source "$project_root/scripts/public-snapshot-lib.sh"
|
||||
exporter=$project_root/scripts/export-public-snapshot.sh
|
||||
temporary=$(mktemp -d)
|
||||
cleanup() {
|
||||
rm -rf -- "$temporary"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
bash -n "$project_root/scripts/public-snapshot-lib.sh" "$exporter"
|
||||
if grep -Eq 'git[[:space:]]+(init|commit|tag|push|remote)([[:space:]]|$)' "$exporter"; then
|
||||
echo "exporter contains a forbidden Git mutation command" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for required in COPYRIGHT OUTPUT_EXCEPTION.md sando/COPYRIGHT; do
|
||||
grep -Fxq "$required" "$project_root/scripts/public-snapshot.allow" || {
|
||||
echo "required legal boundary is absent from public allowlist: $required" >&2
|
||||
exit 1
|
||||
}
|
||||
done
|
||||
|
||||
snapshot_status_is_clean ""
|
||||
if snapshot_status_is_clean " M reviewed.go"; then
|
||||
echo "dirty status was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
snapshot_path_is_at_or_below /var/tmp / || {
|
||||
echo "filesystem-root boundary did not contain an absolute path" >&2
|
||||
exit 1
|
||||
}
|
||||
if snapshot_path_is_at_or_below /safe-ish /safe; then
|
||||
echo "path boundary accepted a sibling prefix" >&2
|
||||
exit 1
|
||||
fi
|
||||
for path in .gitea/workflows/verify.yml .github/workflows/verify.yml private/notes.md \
|
||||
internal/integration/product/test.go go.work build/output.exe data/private.db history/prototype.go; do
|
||||
if ! snapshot_forbidden_path "$path"; then
|
||||
echo "private/build path was not rejected: $path" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
snapshot_forbidden_path README.md && { echo "safe path was rejected" >&2; exit 1; }
|
||||
|
||||
# Exercise the scanner against the complete proposed policy, including these
|
||||
# uncommitted exporter files, so the next clean commit cannot reveal a
|
||||
# self-triggering detector or a missing reviewed path.
|
||||
proposed_tree=$temporary/proposed
|
||||
mkdir -p "$proposed_tree"
|
||||
while IFS= read -r line || [[ -n $line ]]; do
|
||||
[[ -n $line && ${line:0:1} != '#' ]] || continue
|
||||
[[ -f $project_root/$line && ! -L $project_root/$line ]] || {
|
||||
echo "reviewed allowlist path is missing or not regular: $line" >&2
|
||||
exit 1
|
||||
}
|
||||
mkdir -p "$proposed_tree/$(dirname -- "$line")"
|
||||
cp -p -- "$project_root/$line" "$proposed_tree/$line"
|
||||
done <"$project_root/scripts/public-snapshot.allow"
|
||||
snapshot_validate_export_tree "$proposed_tree"
|
||||
(cd "$proposed_tree" && bash scripts/check-licenses.sh)
|
||||
private_home_pattern='/'home'/'cole
|
||||
private_commit_pattern='80bed136''75e8'
|
||||
private_tag_pattern='prototype-''2025'
|
||||
if LC_ALL=C grep -IRq -e "$private_home_pattern" -e "$private_commit_pattern" -e "$private_tag_pattern" "$proposed_tree"; then
|
||||
echo "public allowlist contains a private path or history identifier" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
safe_tree=$temporary/safe
|
||||
mkdir -p "$safe_tree"
|
||||
printf 'ordinary reviewed source\n' >"$safe_tree/source.go"
|
||||
snapshot_validate_export_tree "$safe_tree"
|
||||
|
||||
empty_tree=$temporary/empty
|
||||
mkdir -p "$empty_tree"
|
||||
: >"$empty_tree/empty.txt"
|
||||
snapshot_validate_export_tree "$empty_tree"
|
||||
|
||||
symlink_tree=$temporary/symlink
|
||||
mkdir -p "$symlink_tree"
|
||||
printf 'target\n' >"$symlink_tree/target"
|
||||
ln -s target "$symlink_tree/link"
|
||||
if snapshot_validate_export_tree "$symlink_tree" >/dev/null 2>&1; then
|
||||
echo "symlink tree was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
oversized_tree=$temporary/oversized
|
||||
mkdir -p "$oversized_tree"
|
||||
printf '123456789\n' >"$oversized_tree/large.txt"
|
||||
if SNAPSHOT_MAX_FILE_BYTES=8 snapshot_validate_export_tree "$oversized_tree" >/dev/null 2>&1; then
|
||||
echo "oversized file was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
binary_tree=$temporary/binary
|
||||
mkdir -p "$binary_tree"
|
||||
printf 'text\000binary\n' >"$binary_tree/blob.dat"
|
||||
if snapshot_validate_export_tree "$binary_tree" >/dev/null 2>&1; then
|
||||
echo "binary file was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
private_tree=$temporary/private
|
||||
mkdir -p "$private_tree"
|
||||
printf '/%s/%s/project/private.db\n' home developer >"$private_tree/path.txt"
|
||||
if snapshot_validate_export_tree "$private_tree" >/dev/null 2>&1; then
|
||||
echo "private filesystem path was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
private_commit_tree=$temporary/private-commit
|
||||
mkdir -p "$private_commit_tree"
|
||||
printf 'Private development source: %040d\n' 0 >"$private_commit_tree/ledger.txt"
|
||||
if snapshot_validate_export_tree "$private_commit_tree" >/dev/null 2>&1; then
|
||||
echo "private commit identifier was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
private_repository_tree=$temporary/private-repository
|
||||
mkdir -p "$private_repository_tree"
|
||||
printf 'gamertan/%s%s\n' 'sandwich-hime-' 'dev' >"$private_repository_tree/source.txt"
|
||||
if snapshot_validate_export_tree "$private_repository_tree" >/dev/null 2>&1; then
|
||||
echo "private repository identifier was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
credential_tree=$temporary/credential
|
||||
mkdir -p "$credential_tree"
|
||||
printf '%s%s\n' '-----BEGIN ' 'PRIVATE KEY-----' >"$credential_tree/secret.txt"
|
||||
if snapshot_validate_export_tree "$credential_tree" >/dev/null 2>&1; then
|
||||
echo "private key indicator was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Until these new exporter files themselves are committed, construct a
|
||||
# review-only policy containing the intersection of the reviewed policy and
|
||||
# the selected committed source ref. No repository or Git object is mutated.
|
||||
review_policy=$temporary/review.allow
|
||||
while IFS= read -r line || [[ -n $line ]]; do
|
||||
[[ -n $line && ${line:0:1} != '#' ]] || continue
|
||||
if git -C "$project_root" cat-file -e "HEAD:$line" 2>/dev/null &&
|
||||
git -C "$project_root" diff --quiet HEAD -- "$line"; then
|
||||
printf '%s\n' "$line" >>"$review_policy"
|
||||
fi
|
||||
done <"$project_root/scripts/public-snapshot.allow"
|
||||
|
||||
# A destination beneath the source worktree (including .git) must fail before
|
||||
# staging creation. This test never removes anything from the source tree.
|
||||
inside_name=himesan-export-must-not-exist-$$
|
||||
inside_destination=$project_root/.git/$inside_name
|
||||
[[ ! -e $inside_destination && ! -L $inside_destination ]] || {
|
||||
echo "in-worktree destination unexpectedly exists before test" >&2
|
||||
exit 1
|
||||
}
|
||||
if "$exporter" --source "$project_root" --ref HEAD --mode review \
|
||||
--allowlist "$review_policy" --destination "$inside_destination" >/dev/null 2>&1; then
|
||||
echo "exporter accepted a destination inside the source worktree" >&2
|
||||
exit 1
|
||||
fi
|
||||
[[ ! -e $inside_destination && ! -L $inside_destination ]] || {
|
||||
echo "failed in-worktree export created its destination" >&2
|
||||
exit 1
|
||||
}
|
||||
if find "$project_root/.git" -maxdepth 1 -name ".${inside_name}.himesan-public-export.*" -print -quit | grep -q .; then
|
||||
echo "failed in-worktree export created a staging directory" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# A linked worktree stores its private Git directory and shared common Git
|
||||
# directory outside that worktree root. Neither metadata location may become
|
||||
# an export destination. The isolated repositories live entirely in $temporary.
|
||||
linked_main=$temporary/linked-main
|
||||
linked_worktree=$temporary/linked-worktree
|
||||
git init -q "$linked_main"
|
||||
printf 'reviewed linked-worktree source\n' >"$linked_main/source.go"
|
||||
git -C "$linked_main" add source.go
|
||||
git -C "$linked_main" -c user.name='Snapshot Test' -c user.email='snapshot@example.invalid' \
|
||||
commit -qm 'seed isolated exporter test'
|
||||
git -C "$linked_main" worktree add -q --detach "$linked_worktree" HEAD
|
||||
linked_policy=$temporary/linked.allow
|
||||
printf 'source.go\n' >"$linked_policy"
|
||||
linked_git_dir=$(git -C "$linked_worktree" rev-parse --absolute-git-dir)
|
||||
linked_common_dir=$(git -C "$linked_worktree" rev-parse --git-common-dir)
|
||||
if [[ $linked_common_dir != /* ]]; then
|
||||
linked_common_dir=$linked_worktree/$linked_common_dir
|
||||
fi
|
||||
linked_common_dir=$(snapshot_realpath_existing "$linked_common_dir")
|
||||
|
||||
assert_metadata_destination_rejected() {
|
||||
local label=$1
|
||||
local parent=$2
|
||||
local name=$3
|
||||
local rejected_destination=$parent/$name
|
||||
[[ ! -e $rejected_destination && ! -L $rejected_destination ]] || {
|
||||
echo "$label destination unexpectedly exists before test" >&2
|
||||
exit 1
|
||||
}
|
||||
if "$exporter" --source "$linked_worktree" --ref HEAD --mode review \
|
||||
--allowlist "$linked_policy" --destination "$rejected_destination" >/dev/null 2>&1; then
|
||||
echo "exporter accepted destination inside $label" >&2
|
||||
exit 1
|
||||
fi
|
||||
[[ ! -e $rejected_destination && ! -L $rejected_destination ]] || {
|
||||
echo "failed $label export created its destination" >&2
|
||||
exit 1
|
||||
}
|
||||
if find "$parent" -maxdepth 1 -name ".${name}.himesan-public-export.*" -print -quit | grep -q .; then
|
||||
echo "failed $label export created a staging directory" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
assert_metadata_destination_rejected 'linked-worktree Git directory' "$linked_git_dir" linked-private-destination
|
||||
assert_metadata_destination_rejected 'shared Git common directory' "$linked_common_dir" linked-common-destination
|
||||
|
||||
first=$temporary/public-one
|
||||
second=$temporary/public-two
|
||||
"$exporter" --source "$project_root" --ref HEAD --mode review \
|
||||
--allowlist "$review_policy" --destination "$first" >/dev/null
|
||||
"$exporter" --source "$project_root" --ref HEAD --mode review \
|
||||
--allowlist "$review_policy" --destination "$second" >/dev/null
|
||||
diff -r --no-dereference "$first" "$second" >/dev/null
|
||||
(cd "$first" && sha256sum -c PUBLIC-SNAPSHOT.sha256 >/dev/null)
|
||||
|
||||
for excluded in .git .gitea .github private history internal/integration go.work; do
|
||||
[[ ! -e $first/$excluded && ! -L $first/$excluded ]] || {
|
||||
echo "excluded path reached snapshot: $excluded" >&2
|
||||
exit 1
|
||||
}
|
||||
done
|
||||
[[ -f $first/sando/component.go ]] || { echo "reviewed runtime source was not exported" >&2; exit 1; }
|
||||
[[ -f $first/PUBLIC-SNAPSHOT.json && -f $first/PUBLIC-SNAPSHOT.sha256 ]] || {
|
||||
echo "public provenance files are missing" >&2
|
||||
exit 1
|
||||
}
|
||||
grep -q '"schema_version":2' "$first/PUBLIC-SNAPSHOT.json"
|
||||
grep -q '"export_mode":"review"' "$first/PUBLIC-SNAPSHOT.json"
|
||||
if grep -Fq "$project_root" "$first/PUBLIC-SNAPSHOT.json" \
|
||||
|| grep -Fq "$project_root" "$first/PUBLIC-SNAPSHOT.sha256" \
|
||||
|| grep -q '@' "$first/PUBLIC-SNAPSHOT.json" \
|
||||
|| grep -Eq '"(commit|tree|source_date_epoch)"' "$first/PUBLIC-SNAPSHOT.json"; then
|
||||
echo "public provenance exposed a checkout path or email" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
occupied=$temporary/occupied
|
||||
mkdir -p "$occupied"
|
||||
printf 'do not delete\n' >"$occupied/owner-marker"
|
||||
if "$exporter" --source "$project_root" --ref HEAD --mode review \
|
||||
--allowlist "$review_policy" --destination "$occupied" >/dev/null 2>&1; then
|
||||
echo "exporter accepted an existing destination" >&2
|
||||
exit 1
|
||||
fi
|
||||
grep -q 'do not delete' "$occupied/owner-marker"
|
||||
|
||||
status=$(git -C "$project_root" status --porcelain=v1 --untracked-files=all)
|
||||
release_destination=$temporary/release
|
||||
if snapshot_status_is_clean "$status"; then
|
||||
"$exporter" --source "$project_root" --ref HEAD --mode release \
|
||||
--destination "$release_destination" >/dev/null
|
||||
else
|
||||
if "$exporter" --source "$project_root" --ref HEAD --mode release \
|
||||
--destination "$release_destination" >"$temporary/release.log" 2>&1; then
|
||||
echo "release export accepted a dirty source" >&2
|
||||
exit 1
|
||||
fi
|
||||
grep -q 'release source worktree is dirty' "$temporary/release.log"
|
||||
[[ ! -e $release_destination ]] || { echo "failed release created a destination" >&2; exit 1; }
|
||||
fi
|
||||
|
||||
echo "public snapshot export checks passed"
|
||||
Reference in New Issue
Block a user