fix: protect Debian publish credentials

scripts/publish-deb.sh

@@ -40,11 +40,24 @@ EOF
   exit 1
 fi
 
+if [ -n "${RUNNER_TEMP:-}" ]; then
+  TMP="$(mktemp -d "$RUNNER_TEMP/stoke-publish.XXXXXX")"
+else
+  TMP="$(mktemp -d)"
+fi
+trap 'rm -rf "$TMP"' EXIT
+
+HEADER_FILE="$TMP/authorization-header"
+RESPONSE_FILE="$TMP/response"
+umask 077
+printf 'Authorization: token %s\n' "$TOKEN" >"$HEADER_FILE"
+chmod 0600 "$HEADER_FILE"
+
 URL="$FORGE_URL/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
 echo "Uploading $(basename "$DEB") to $URL"
 
-STATUS="$(curl -sS -o /tmp/stoke-publish-response.$$ -w '%{http_code}' \
-  -X PUT -H "Authorization: token $TOKEN" \
+STATUS="$(curl -sS -o "$RESPONSE_FILE" -w '%{http_code}' \
+  -X PUT -H @"$HEADER_FILE" \
   --upload-file "$DEB" "$URL")"
 
 case "$STATUS" in
@@ -52,9 +65,7 @@ case "$STATUS" in
   409) echo "Already published (409): this exact version already exists in the registry." ;;
   *)
     echo "error: upload failed with HTTP $STATUS" >&2
-    cat /tmp/stoke-publish-response.$$ >&2 || true
-    rm -f /tmp/stoke-publish-response.$$
+    cat "$RESPONSE_FILE" >&2 || true
     exit 1
     ;;
 esac
-rm -f /tmp/stoke-publish-response.$$

test/publish-deb.test.js

@@ -70,6 +70,7 @@ process.stdout.write(process.env.CURL_HTTP_STATUS);
     return {
       result,
       call,
+      runnerTemp,
       remainingTempEntries,
       legacyAfter,
       headerExistsAfter: call?.headerFile ? fs.existsSync(call.headerFile) : false,
@@ -110,6 +111,7 @@ test('curl reads a private authorization header file without receiving the token
   assert.equal(scenario.result.status, 0, scenario.result.stderr);
   assert.ok(scenario.call.args.includes('-H'));
   assert.equal(scenario.call.args.every((arg) => !arg.includes(TOKEN)), true);
+  assert.equal(path.dirname(scenario.call.tempDir), scenario.runnerTemp);
   assert.ok(scenario.call.headerFile.startsWith(`${scenario.call.tempDir}${path.sep}`));
   assert.equal(scenario.call.header, `Authorization: token ${TOKEN}\n`);
   assert.equal(scenario.call.headerMode, 0o600);