63 lines
3.2 KiB
Bash
63 lines
3.2 KiB
Bash
#!/bin/sh
|
|
# Disposable bare repositories only; caller owns admission and exact cleanup.
|
|
set +vx
|
|
set -eu
|
|
base=$1
|
|
cd "$base"
|
|
umask 077
|
|
export HOME="$base/home" GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0
|
|
mkdir home
|
|
trap 'chmod 755 "$base/gitleaks" >/dev/null 2>&1 || :' 0
|
|
sha256sum -c SHA256SUMS >/dev/null 2>&1
|
|
chmod 755 receive-secret-scan gitleaks
|
|
/usr/bin/git init -q --bare server.git
|
|
/usr/bin/git init -q -b main client
|
|
/usr/bin/git -C server.git config core.hooksPath "$base/server.git/hooks"
|
|
/usr/bin/git -C client config core.hooksPath "$base/no-client-hooks"
|
|
/usr/bin/git -C client config user.name 'Custodian disposable probe'
|
|
/usr/bin/git -C client config user.email 'probe@example.test'
|
|
mkdir server.git/hooks/pre-receive.d
|
|
cp pre-receive.fixture server.git/hooks/pre-receive
|
|
chmod 755 server.git/hooks/pre-receive
|
|
cat > server.git/hooks/pre-receive.d/gitea <<STUB
|
|
#!/bin/sh
|
|
cat >/dev/null
|
|
printf 'invoked\n' >> '$base/stub-calls'
|
|
STUB
|
|
cat > server.git/hooks/pre-receive.d/secret-scan <<HOOK
|
|
#!/bin/sh
|
|
exec '$base/receive-secret-scan' --scanner '$base/gitleaks'
|
|
HOOK
|
|
chmod 755 server.git/hooks/pre-receive.d/gitea server.git/hooks/pre-receive.d/secret-scan
|
|
printf 'clean baseline\n' > client/source.txt
|
|
/usr/bin/git -C client add source.txt
|
|
/usr/bin/git -C client commit -qm 'disposable clean baseline'
|
|
if ! /usr/bin/git -C client push "$base/server.git" HEAD:refs/heads/main > clean.out 2>&1; then exit 21; fi
|
|
grep -q '"status":"clean"' clean.out
|
|
initial=$(/usr/bin/git -C client rev-parse HEAD)
|
|
cp fixture-key client/secret.txt
|
|
/usr/bin/git -C client add secret.txt
|
|
/usr/bin/git -C client commit -qm 'disposable detector fixture'
|
|
rejected=$(/usr/bin/git -C client rev-parse HEAD)
|
|
/usr/bin/git -C client rm -q secret.txt
|
|
/usr/bin/git -C client commit -qm 'remove fixture from final tree'
|
|
if /usr/bin/git -C client push "$base/server.git" HEAD:refs/heads/main > blocked.out 2>&1; then exit 22; fi
|
|
grep -q '"status":"blocked"' blocked.out
|
|
if grep -q 'BEGIN OPENSSH PRIVATE KEY' blocked.out; then exit 23; fi
|
|
if /usr/bin/git -C server.git cat-file -e "$rejected" >/dev/null 2>&1; then exit 24; fi
|
|
test "$(/usr/bin/git -C server.git rev-parse refs/heads/main)" = "$initial"
|
|
/usr/bin/git -C client checkout -qb clean-retry "$initial"
|
|
printf 'clean recovery\n' > client/source.txt
|
|
/usr/bin/git -C client add source.txt
|
|
/usr/bin/git -C client commit -qm 'disposable clean recovery'
|
|
chmod 644 gitleaks
|
|
if /usr/bin/git -C client push "$base/server.git" HEAD:refs/heads/main > unavailable.out 2>&1; then exit 25; fi
|
|
grep -q '"status":"unverified"' unavailable.out
|
|
grep -q '"reason":"scanner-file-refused"' unavailable.out
|
|
chmod 755 gitleaks
|
|
if ! /usr/bin/git -C client push "$base/server.git" HEAD:refs/heads/main > recovered.out 2>&1; then exit 26; fi
|
|
grep -q '"status":"clean"' recovered.out
|
|
test "$(/usr/bin/git -C server.git rev-parse refs/heads/main)" = "$(/usr/bin/git -C client rev-parse HEAD)"
|
|
test "$(wc -l < stub-calls | tr -d ' ')" = 4
|
|
cmp pre-receive.fixture server.git/hooks/pre-receive
|
|
printf '{"clean_push":true,"intermediate_secret_refused":true,"quarantine_discarded":true,"scanner_unavailable_refused":true,"clean_after_recovery":true,"dispatcher_preserved":true,"other_hook_invocations":4,"builtin_authorization_stubbed":true}\n'
|