mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 20:07:04 +01:00
Krzysztof kuhy Rudnicki
4eedc17b17
The 316-line installer was 66 over the 250-line cap. The managed-copy helpers, the /usr/local/bin install step, the integrity + drift manifest, and the immutability/LeechBlock/VirtualBox payloads move into a sibling lib/, leaving a 128-line entry. What stays in the entry is chosen by what the harness can execute, not by taste. `--bind-abs /usr/bin` removes the directory bwrap needs to exec anything, so the trace stops at `ln -sf ... /usr/bin/pacman` with exit 1 on EPERM. That line onwards, plus the `if [ ! -L /usr/bin/pacman ]` backup branch whose guard is false on this machine, therefore never run under trace — moving them would have shipped code no diff could check. They stay put. Everything else is proven: the before/after traces are identical, including all 16 generated-file hashes. pacman_wrapper at 548fc2b53ee4cea6 is the one that matters most — it is post-`sed -i`, so it catches a reorder of the rewrite relative to the copy. The path definitions stay in the entry too, for a linter reason rather than a runtime one: a definitions-only lib assigns without referencing, which is SC2034 on 36 variables, and suppressions are not allowed. Libs that only reference globals are fine. `export` would have silenced it while leaking 40 variables into every child process, which the trace cannot see. Eight assertions across two test libs grep the installer's source text; five needed widening to search entry+lib/. TEST 9's `chattr +i` grep caught the move as a genuine failure first, which is what prompted enumerating the rest. No assertion was weakened. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
71 lines
2.5 KiB
Bash
Executable File
71 lines
2.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Pacman wrapper security: makepkg capped runner, mkpkg helper and installer hardening (tests 13-19).
|
|
# Sourced by test_pacman_wrapper_security.sh; inherits its strict mode
|
|
# (set -e) and its SCRIPT_DIR / WRAPPER_DIR / VBOX_DIR paths.
|
|
|
|
pac_tests_makepkg_and_installer() {
|
|
# Test 13: Verify makepkg capped wrapper script syntax
|
|
echo "[TEST 13] Checking makepkg capped wrapper syntax..."
|
|
if bash -n "$WRAPPER_DIR/makepkg_capped.sh"; then
|
|
echo "✓ makepkg capped wrapper syntax is valid"
|
|
else
|
|
echo "✗ makepkg capped wrapper has syntax errors"
|
|
exit 1
|
|
fi
|
|
|
|
# Test 14: Verify pacman wrapper exposes makepkg capped command
|
|
echo "[TEST 14] Verifying pacman wrapper supports --makepkg-capped..."
|
|
if grep -q -- "--makepkg-capped" "$WRAPPER_DIR/pacman_wrapper.sh"; then
|
|
echo "✓ pacman wrapper makepkg capped command found"
|
|
else
|
|
echo "✗ pacman wrapper makepkg capped command missing"
|
|
exit 1
|
|
fi
|
|
|
|
# Test 15: Verify installer deploys makepkg capped wrapper
|
|
echo "[TEST 15] Verifying installer deploys makepkg capped wrapper..."
|
|
if grep -qr "MAKEPKG_CAPPED" "$WRAPPER_DIR/install_pacman_wrapper.sh" "$WRAPPER_DIR/lib"; then
|
|
echo "✓ Installer includes makepkg capped deployment"
|
|
else
|
|
echo "✗ Installer does not include makepkg capped deployment"
|
|
exit 1
|
|
fi
|
|
|
|
# Test 16: Verify mkpkg helper script syntax
|
|
echo "[TEST 16] Checking mkpkg helper script syntax..."
|
|
if bash -n "$WRAPPER_DIR/mkpkg.sh"; then
|
|
echo "✓ mkpkg helper script syntax is valid"
|
|
else
|
|
echo "✗ mkpkg helper script has syntax errors"
|
|
exit 1
|
|
fi
|
|
|
|
# Test 17: Verify installer deploys mkpkg helper
|
|
echo "[TEST 17] Verifying installer deploys mkpkg helper..."
|
|
if grep -qr "MKPKG" "$WRAPPER_DIR/install_pacman_wrapper.sh" "$WRAPPER_DIR/lib"; then
|
|
echo "✓ Installer includes mkpkg helper deployment"
|
|
else
|
|
echo "✗ Installer does not include mkpkg helper deployment"
|
|
exit 1
|
|
fi
|
|
|
|
# Test 18: Verify installer runs in strict mode
|
|
echo "[TEST 18] Verifying installer uses strict shell mode..."
|
|
if grep -q "set -euo pipefail" "$WRAPPER_DIR/install_pacman_wrapper.sh"; then
|
|
echo "✓ Installer strict mode enabled"
|
|
else
|
|
echo "✗ Installer strict mode not enabled"
|
|
exit 1
|
|
fi
|
|
|
|
# Test 19: Verify installer handles immutable files during updates
|
|
echo "[TEST 19] Verifying installer unlocks immutable files before copy/write..."
|
|
if grep -qr "unlock_immutable_file_if_needed" "$WRAPPER_DIR/install_pacman_wrapper.sh" "$WRAPPER_DIR/lib"; then
|
|
echo "✓ Installer immutable-file handling found"
|
|
else
|
|
echo "✗ Installer immutable-file handling missing"
|
|
exit 1
|
|
fi
|
|
|
|
}
|