From dcb169e8abb859ad2b71685fc309657b4b23e9e2 Mon Sep 17 00:00:00 2001
From: codex-bot-andresmgsl
 <codex-bot-andresmgsl@noreply.forgejo.heavyduty.builders>
Date: Fri, 4 Sep 2026 02:55:49 +0000
Subject: [PATCH] fix: protect Debian publish credentials

---
 scripts/publish-deb.sh   | 21 ++++++++++++++++-----
 test/publish-deb.test.js |  2 ++
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/scripts/publish-deb.sh b/scripts/publish-deb.sh
index f3b7e66..7feff43 100755
--- a/scripts/publish-deb.sh
+++ b/scripts/publish-deb.sh
@@ -40,11 +40,24 @@ EOF
   exit 1
 fi
 
+if [ -n "${RUNNER_TEMP:-}" ]; then
+  TMP="$(mktemp -d "$RUNNER_TEMP/stoke-publish.XXXXXX")"
+else
+  TMP="$(mktemp -d)"
+fi
+trap 'rm -rf "$TMP"' EXIT
+
+HEADER_FILE="$TMP/authorization-header"
+RESPONSE_FILE="$TMP/response"
+umask 077
+printf 'Authorization: token %s\n' "$TOKEN" >"$HEADER_FILE"
+chmod 0600 "$HEADER_FILE"
+
 URL="$FORGE_URL/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
 echo "Uploading $(basename "$DEB") to $URL"
 
-STATUS="$(curl -sS -o /tmp/stoke-publish-response.$$ -w '%{http_code}' \
-  -X PUT -H "Authorization: token $TOKEN" \
+STATUS="$(curl -sS -o "$RESPONSE_FILE" -w '%{http_code}' \
+  -X PUT -H @"$HEADER_FILE" \
   --upload-file "$DEB" "$URL")"
 
 case "$STATUS" in
@@ -52,9 +65,7 @@ case "$STATUS" in
   409) echo "Already published (409): this exact version already exists in the registry." ;;
   *)
     echo "error: upload failed with HTTP $STATUS" >&2
-    cat /tmp/stoke-publish-response.$$ >&2 || true
-    rm -f /tmp/stoke-publish-response.$$
+    cat "$RESPONSE_FILE" >&2 || true
     exit 1
     ;;
 esac
-rm -f /tmp/stoke-publish-response.$$
diff --git a/test/publish-deb.test.js b/test/publish-deb.test.js
index c2180ba..b1c4561 100644
--- a/test/publish-deb.test.js
+++ b/test/publish-deb.test.js
@@ -70,6 +70,7 @@ process.stdout.write(process.env.CURL_HTTP_STATUS);
     return {
       result,
       call,
+      runnerTemp,
       remainingTempEntries,
       legacyAfter,
       headerExistsAfter: call?.headerFile ? fs.existsSync(call.headerFile) : false,
@@ -110,6 +111,7 @@ test('curl reads a private authorization header file without receiving the token
   assert.equal(scenario.result.status, 0, scenario.result.stderr);
   assert.ok(scenario.call.args.includes('-H'));
   assert.equal(scenario.call.args.every((arg) => !arg.includes(TOKEN)), true);
+  assert.equal(path.dirname(scenario.call.tempDir), scenario.runnerTemp);
   assert.ok(scenario.call.headerFile.startsWith(`${scenario.call.tempDir}${path.sep}`));
   assert.equal(scenario.call.header, `Authorization: token ${TOKEN}\n`);
   assert.equal(scenario.call.headerMode, 0o600);