88 lines
3.3 KiB
Bash
88 lines
3.3 KiB
Bash
#!/bin/sh
|
|
# Actual pinned Forgejo image, no host data/config mounts or network.
|
|
set +vx
|
|
set -eu
|
|
case=$1
|
|
area=/tmp/control
|
|
mkdir -p "$area"
|
|
cp /original/before-hook "$area/before"
|
|
cp /original/after-hook "$area/after"
|
|
before=$(sha256sum "$area/before" | cut -d ' ' -f 1)
|
|
after=$(sha256sum "$area/after" | cut -d ' ' -f 1)
|
|
first=/data/git/gitea-repositories/coulomb/first.git/hooks/pre-receive.d/10-custodian-secret-scan
|
|
second=/data/git/gitea-repositories/coulomb/second.git/hooks/pre-receive.d/10-custodian-secret-scan
|
|
for path in "$first" "$second"; do
|
|
mkdir -p "${path%/*}"
|
|
cp "$area/before" "$path"
|
|
chmod 755 "$path"
|
|
printf '%s\n' "$path" >> "$area/paths"
|
|
printf 'unchanged generated dispatcher\n' > "${path%/pre-receive.d/*}/pre-receive"
|
|
chmod 755 "${path%/pre-receive.d/*}/pre-receive"
|
|
done
|
|
chmod 775 "$second"
|
|
protected=${first%/pre-receive.d/*}/pre-receive
|
|
protected_sum=$(sha256sum "$protected" | cut -d ' ' -f 1)
|
|
run_hooks() { sh /scripts/hooks.sh "$area" "$1" "$before" "$after"; }
|
|
if test "$case" = old-counterexample; then
|
|
if sh /original/hooks.sh "$area" apply "$before" "$after" > /tmp/old.out 2>/tmp/old.err; then exit 80; fi
|
|
grep -qi 'reference' /tmp/old.err
|
|
printf '{"case":"old-counterexample","unsupported_reference_reproduced":true}\n'
|
|
exit 0
|
|
fi
|
|
case "$case" in
|
|
roundtrip)
|
|
run_hooks apply
|
|
test "$(stat -c %a "$first")" = 755
|
|
test "$(stat -c %a "$second")" = 775
|
|
run_hooks rollback
|
|
test "$(sha256sum "$first" | cut -d ' ' -f 1)" = "$before"
|
|
test "$(stat -c %a "$first")" = 755
|
|
test "$(stat -c %a "$second")" = 775
|
|
;;
|
|
complete-scope-refusal)
|
|
printf 'owner drift\n' > "$second"
|
|
if run_hooks apply >/dev/null 2>&1; then exit 81; fi
|
|
test "$(sha256sum "$first" | cut -d ' ' -f 1)" = "$before"
|
|
;;
|
|
partial-failure)
|
|
chmod 555 "${second%/*}"
|
|
if run_hooks apply >/dev/null 2>&1; then exit 82; fi
|
|
test "$(sha256sum "$first" | cut -d ' ' -f 1)" = "$before"
|
|
test "$(stat -c %a "$first")" = 755
|
|
;;
|
|
symlink-refusal)
|
|
rm "$second";ln -s "$first" "$second"
|
|
if run_hooks apply >/dev/null 2>&1; then exit 83; fi
|
|
test "$(sha256sum "$first" | cut -d ' ' -f 1)" = "$before"
|
|
;;
|
|
fsgroup-modes|mode-drift|hash-drift)
|
|
run_hooks apply >/dev/null
|
|
printf '755\t%s\t%s\n' "$after" "$first" > "$area/modes"
|
|
printf '775\t%s\t%s\n' "$after" "$second" >> "$area/modes"
|
|
printf '755\t%s\t%s\n' "$protected_sum" "$protected" >> "$area/modes"
|
|
chmod g+w "$first" "$protected"
|
|
if test "$case" = mode-drift; then
|
|
chmod 777 "$second"
|
|
if sh /scripts/restore_modes.sh "$area/modes" >/dev/null 2>&1; then exit 84; fi
|
|
test "$(stat -c %a "$first")" = 775
|
|
elif test "$case" = hash-drift; then
|
|
printf 'owner content drift\n' > "$protected"
|
|
if sh /scripts/restore_modes.sh "$area/modes" >/dev/null 2>&1; then exit 85; fi
|
|
test "$(stat -c %a "$first")" = 775
|
|
else
|
|
sh /scripts/restore_modes.sh "$area/modes"
|
|
test "$(stat -c %a "$first")" = 755
|
|
test "$(stat -c %a "$second")" = 775
|
|
test "$(stat -c %a "$protected")" = 755
|
|
test "$(sha256sum "$protected" | cut -d ' ' -f 1)" = "$protected_sum"
|
|
run_hooks rollback >/dev/null
|
|
fi
|
|
;;
|
|
*) exit 86;;
|
|
esac
|
|
# Hash drift fixture deliberately changes protected content; all others preserve it.
|
|
if test "$case" != hash-drift; then
|
|
test "$(sha256sum "$protected" | cut -d ' ' -f 1)" = "$protected_sum"
|
|
fi
|
|
test -z "$(find /data -name '.custodian-*' -print -quit)"
|
|
printf '{"case":"%s","passed":true}\n' "$case"
|