mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-14 22:50:58 +01:00
Krzysztof kuhy Rudnicki
4f2b0ccdf7
Two levels of pure taxonomy carrying no information, and a 2-directory
cap leaves no room for them. Categories now sit directly under
linux_configuration/: features, fixes, utils, misc, fresh-install,
installers, diagnostics, gaming, boot_recovery, periodic_background, lib,
meta, tests. A script's own lib/ and tests/ are exempt from the cap, so
those stay put.
Depth violations 248 -> 139; roughly 40 of the remainder are inside
digital_wellbeing and hosts, deferred until the guard-lib repoint.
The moves are the easy half. What breaks is every path that counted
levels, and three classes of it had to be found by resolving paths rather
than reading diffs:
- 52 relative `source` lines for lib/common.sh and lib/android.sh. The
correct prefix differs per file: 40 were ../../ and 12 were ../../../,
so a blanket replace would have fixed one set and broken the other.
- REPO_ROOT in 7 fixes/lib/tests harnesses and setup_syncyomi_guard.sh,
each walking up four levels from a directory now two levels shallower.
This caused a real regression -- the fixes suite went red with
"log_warn: command not found" -- caught by running it and comparing
against the pre-move baseline worktree.
- conftest.py's sys.path entries, which took the pytest gate down with
14 collection errors, and the `# shellcheck source=` directives, which
took shellcheck down with SC1091.
16 symlinks in $HOME broke, including the entire i3blocks bar. All
repointed, and cpu_monitor/memory/disk/time/volume were run to confirm
they emit real output rather than merely resolving.
Verified: 1798 tests pass at 100% coverage, 8 of 9 lib/tests suites pass
(the ninth needs the coverage jail, identically at baseline), pre-commit
is clean, and the two untracked secret configs are still ignored after
their gitignore paths changed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
131 lines
4.5 KiB
Bash
Executable File
131 lines
4.5 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Re-run with sudo if not root
|
|
if [[ $EUID -ne 0 ]]; then
|
|
exec sudo -E bash "$0" "$@"
|
|
fi
|
|
|
|
# Options
|
|
# Default: do NOT flush DNS caches unless explicitly requested
|
|
FLUSH_DNS=0
|
|
|
|
# Parse CLI flags
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--flush-dns)
|
|
FLUSH_DNS=1
|
|
;;
|
|
--no-flush-dns)
|
|
FLUSH_DNS=0
|
|
;;
|
|
-h | --help)
|
|
echo "Usage: $0 [--flush-dns|--no-flush-dns]"
|
|
exit 0
|
|
;;
|
|
esac
|
|
done
|
|
|
|
# Each phase of the install lives in a lib beside this file; this script
|
|
# keeps the flag parsing, the protection-check gates and the order the
|
|
# phases run in.
|
|
LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib"
|
|
# shellcheck source=lib/hosts_protect_custom.sh
|
|
. "$LIB_DIR/hosts_protect_custom.sh"
|
|
# shellcheck source=lib/hosts_protect_unblock.sh
|
|
. "$LIB_DIR/hosts_protect_unblock.sh"
|
|
# shellcheck source=lib/hosts_guard.sh
|
|
. "$LIB_DIR/hosts_guard.sh"
|
|
# shellcheck source=lib/hosts_cache.sh
|
|
. "$LIB_DIR/hosts_cache.sh"
|
|
# shellcheck source=lib/hosts_write.sh
|
|
. "$LIB_DIR/hosts_write.sh"
|
|
# shellcheck source=lib/hosts_browser_doh.sh
|
|
. "$LIB_DIR/hosts_browser_doh.sh"
|
|
|
|
# ============================================================================
|
|
# CUSTOM ENTRIES PROTECTION MECHANISM
|
|
# ============================================================================
|
|
# This prevents easy removal of custom blocked entries by requiring that:
|
|
# 1. New installation has AT LEAST as many custom entries as before, OR
|
|
# 2. Any removed entries are replaced by NEW entries not previously blocked
|
|
# If neither condition is met, installation is blocked.
|
|
# ============================================================================
|
|
|
|
CUSTOM_ENTRIES_STATE_FILE="/etc/hosts.custom-entries.state"
|
|
UNBLOCK_STATE_FILE="/etc/hosts.unblock-entries.state"
|
|
|
|
# Run the protection check
|
|
if ! check_custom_entries_protection; then
|
|
exit 1
|
|
fi
|
|
|
|
# ============================================================================
|
|
# UNBLOCK ENTRIES PROTECTION MECHANISM
|
|
# ============================================================================
|
|
# This prevents silently expanding the whitelist (i.e. adding MORE domains to
|
|
# the sed unblock list) by tracking which domains are whitelisted. Adding a
|
|
# new domain here requires manually clearing the state file first.
|
|
# ============================================================================
|
|
#
|
|
# PROTECTED_UNBLOCK_LIST_START
|
|
# 4chan.com
|
|
# www.4chan.com
|
|
# 4chan.org
|
|
# boards.4chan.org
|
|
# sys.4chan.org
|
|
# www.4chan.org
|
|
# facebook.com
|
|
# www.facebook.com
|
|
# m.facebook.com
|
|
# messenger.com
|
|
# fbcdn.net
|
|
# facebook.net
|
|
# delio.com.pl
|
|
# loverslab.com
|
|
# linkedin.com
|
|
# licdn.com
|
|
# PROTECTED_UNBLOCK_LIST_END
|
|
|
|
# Run the unblock protection check
|
|
if ! check_unblock_entries_protection; then
|
|
exit 1
|
|
fi
|
|
|
|
# Source and local cache configuration
|
|
URL="https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn-social/hosts"
|
|
# Cache stores the RAW upstream file (without our custom modifications)
|
|
LOCAL_CACHE="/etc/hosts.stevenblack"
|
|
|
|
# NOTE: this used to `chattr +i` its own source and generate_hosts_file.sh
|
|
# ("lock against silent edits"). Do NOT reintroduce that: making a git-tracked
|
|
# file immutable breaks git tooling. `pre-commit run --all-files` (which the
|
|
# pre-push ci-mirror gate runs) opens every file rb+ via end-of-file-fixer and
|
|
# dies with "PermissionError: Operation not permitted", so no push from a normal
|
|
# checkout can ever succeed. It also breaks pre-commit's stash of unstaged
|
|
# changes (`git checkout -- .` cannot unlink an immutable file), which silently
|
|
# reverts unrelated unstaged edits.
|
|
#
|
|
# Enforcement does not depend on these sources being immutable: /etc/hosts
|
|
# itself is chattr +i, guard-lib's "hosts" file-guard instance (guardctl
|
|
# file-guard status hosts) watches and re-enforces it against its canonical
|
|
# snapshot, and the same instance's bind mount pins it. Editing these sources
|
|
# changes nothing until install.sh is re-run as root, which regenerates the
|
|
# guarded artifacts.
|
|
# ============================================================================
|
|
|
|
# ============================================================================
|
|
# MAIN
|
|
# ============================================================================
|
|
# The phases above are defined in the order they run, and run here in that same
|
|
# order. Split out of a single top-level block so the file fits the 250-line
|
|
# cap; the sequence is unchanged, including the guard being taken down before
|
|
# the write and restarted immediately after it.
|
|
enable_resolved_reads_hosts
|
|
stop_hosts_guard
|
|
refresh_upstream_cache
|
|
write_hosts_file
|
|
restart_hosts_guard
|
|
save_protection_state
|
|
disable_browser_doh
|
|
restart_browsers
|