mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 17:14:08 +01:00
Krzysztof kuhy Rudnicki
0c28f9988f
is_blocked_package_name compared raw pacman -U <file>.pkg.tar.zst arguments against whitelist entries, which never matched since yay always installs AUR packages this way. Added strip_pkgfile_suffix() to derive the bare package name first, plus a regression test. Also swaps the browser whitelist entries to ungoogled-chromium (Chromium 151 dropped MV2, breaking uBlock Origin's full/classic build). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015yfDYbaw1D1WhVMqWhsSDA
35 lines
2.4 KiB
JSON
35 lines
2.4 KiB
JSON
{
|
|
"intent": "Fix pacman_wrapper.sh so whitelist/blocklist matching works for `pacman -U <file>.pkg.tar.zst` installs, which yay always uses — previously a whitelisted package installed via -U could be misidentified because the check compared raw filenames instead of bare package names.",
|
|
"scope": [
|
|
"linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh",
|
|
"linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/pacman_whitelist.txt",
|
|
"linux_configuration/tests/test_pacman_wrapper_security.sh",
|
|
"Non-goal: no change to blocklist policy content beyond the ungoogled-chromium/plain-chromium swap needed for the browser migration"
|
|
],
|
|
"changes": [
|
|
"Added strip_pkgfile_suffix() to pacman_wrapper.sh to derive a bare package name from a -U <file>.pkg.tar.zst argument before whitelist/blocklist matching",
|
|
"Updated pacman_whitelist.txt: added ungoogled-chromium, ungoogled-chromium-bin, ungoogled-chromium-bin-debug; removed stale chromium/ublock-origin entries (Chromium 151 dropped MV2, package was uninstalled)",
|
|
"Added a regression test to test_pacman_wrapper_security.sh covering strip_pkgfile_suffix + is_blocked_package_name against -U package-file arguments"
|
|
],
|
|
"verification": [
|
|
{
|
|
"command": "bash tests/test_pacman_wrapper_security.sh",
|
|
"result": "pass",
|
|
"evidence": "=== All Tests Passed! === including new TEST: 'Verifying strip_pkgfile_suffix + is_blocked_package_name handle -U package-file arguments' -> strip_pkgfile_suffix bares -U filenames; whitelisted packages are allowed via -U, non-whitelisted blocked keywords still blocked"
|
|
},
|
|
{
|
|
"command": "shellcheck pacman/pacman_wrapper.sh && shfmt -d pacman/pacman_wrapper.sh",
|
|
"result": "pass",
|
|
"evidence": "shellcheck exit 0, shfmt reported no diff"
|
|
}
|
|
],
|
|
"risks": [
|
|
"strip_pkgfile_suffix uses a regex/glob to strip the pkg.tar.zst suffix and arch/version fields — a package name containing unusual characters could in theory mismatch, but the whitelist only contains conventional pacman package names",
|
|
"Whitelist changes remove blanket chromium/ublock-origin entries — any script still assuming those names are whitelisted will now be blocked by the wrapper until updated"
|
|
],
|
|
"rollback": [
|
|
"git revert this commit",
|
|
"Re-run bash tests/test_pacman_wrapper_security.sh after rollback to confirm no residual state from the new test"
|
|
]
|
|
}
|