43 lines
2.1 KiB
Bash
43 lines
2.1 KiB
Bash
#!/bin/sh
|
|
# Caller owns a unique temporary directory and removes it by marker afterwards.
|
|
set +vx
|
|
set -eu
|
|
base=$1
|
|
dispatcher=$2
|
|
cd "$base"
|
|
umask 077
|
|
export HOME="$base" GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0
|
|
git -c include.path=/data/home/.gitconfig init -q --bare server.git
|
|
git init -q -b main client
|
|
git -C client config core.hooksPath "$base/no-hooks"
|
|
git -C client config user.name 'Custodian isolated receive probe'
|
|
git -C client config user.email 'probe@example.test'
|
|
test -x server.git/hooks/pre-receive.d/10-custodian-secret-scan
|
|
cp "$dispatcher" server.git/hooks/pre-receive
|
|
chmod 755 server.git/hooks/pre-receive
|
|
# No production database identity: native dispatcher with only the inherited scan hook.
|
|
printf 'clean baseline\n' > client/source.txt
|
|
git -C client add source.txt
|
|
git -C client commit -qm 'isolated clean baseline'
|
|
git -C client push "$base/server.git" HEAD:refs/heads/main > clean.out 2>&1
|
|
grep -q '"status":"clean"' clean.out
|
|
initial=$(git -C client rev-parse HEAD)
|
|
ssh-keygen -q -t ed25519 -N '' -f "$base/synthetic-key" >/dev/null 2>&1
|
|
cp synthetic-key client/fixture.txt
|
|
git -C client add fixture.txt
|
|
git -C client commit -qm 'isolated synthetic fixture'
|
|
rejected=$(git -C client rev-parse HEAD)
|
|
git -C client rm -q fixture.txt
|
|
git -C client commit -qm 'remove fixture from final tree'
|
|
if git -C client push "$base/server.git" HEAD:refs/heads/main > blocked.out 2>&1; then exit 22; fi
|
|
grep -q '"status":"blocked"' blocked.out
|
|
if grep -q 'BEGIN OPENSSH PRIVATE KEY' blocked.out; then exit 23; fi
|
|
if git -C server.git cat-file -e "$rejected" >/dev/null 2>&1; then exit 24; fi
|
|
test "$(git -C server.git rev-parse refs/heads/main)" = "$initial"
|
|
git -C client checkout -qb recovery "$initial"
|
|
printf 'clean recovery\n' > client/source.txt
|
|
git -C client add source.txt
|
|
git -C client commit -qm 'isolated clean recovery'
|
|
git -C client push "$base/server.git" HEAD:refs/heads/main > recovered.out 2>&1
|
|
grep -q '"status":"clean"' recovered.out
|
|
printf '{"inherited_installed_hook":true,"clean_push":true,"intermediate_secret_refused":true,"quarantine_discarded":true,"clean_recovery":true,"builtin_authorization_excluded":true}\n'
|