Compare commits
No commits in common. "main" and "build/64-auth-state" have entirely different histories.
main
...
build/64-a
9 changed files with 52 additions and 480 deletions
|
|
@ -1 +0,0 @@
|
|||
- Keep Debian registry tokens out of curl process arguments and clean upload credentials and responses on every exit. (#62).
|
||||
|
|
@ -1 +0,0 @@
|
|||
- Normalize Debian package payload modes independently of the builder's umask. (#63).
|
||||
|
|
@ -1 +0,0 @@
|
|||
- Continue batch imports after one repository cannot resolve its source token, while reporting that item as failed. (#65).
|
||||
|
|
@ -67,9 +67,9 @@ EOF
|
|||
# Native package (no Debian revision in the version), so plain changelog.gz.
|
||||
gzip -9n -c "$STAGE/changelog" > "$DOC/changelog.gz"
|
||||
|
||||
# Normalize permissions regardless of the builder's umask: traversable
|
||||
# directories, readable files, and execute bits retained only where intended.
|
||||
chmod -R u+rwX,go=rX "$PKG/usr"
|
||||
# Normalize permissions regardless of the builder's umask: no group/other
|
||||
# write anywhere, executable entry point.
|
||||
chmod -R go-w "$PKG/usr"
|
||||
chmod 0755 "$LIB/src/cli.js"
|
||||
|
||||
# --- control -----------------------------------------------------------------
|
||||
|
|
|
|||
|
|
@ -40,24 +40,11 @@ EOF
|
|||
exit 1
|
||||
fi
|
||||
|
||||
if [ -n "${RUNNER_TEMP:-}" ]; then
|
||||
TMP="$(mktemp -d "$RUNNER_TEMP/stoke-publish.XXXXXX")"
|
||||
else
|
||||
TMP="$(mktemp -d)"
|
||||
fi
|
||||
trap 'rm -rf "$TMP"' EXIT
|
||||
|
||||
HEADER_FILE="$TMP/authorization-header"
|
||||
RESPONSE_FILE="$TMP/response"
|
||||
umask 077
|
||||
printf 'Authorization: token %s\n' "$TOKEN" >"$HEADER_FILE"
|
||||
chmod 0600 "$HEADER_FILE"
|
||||
|
||||
URL="$FORGE_URL/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
|
||||
echo "Uploading $(basename "$DEB") to $URL"
|
||||
|
||||
STATUS="$(curl -sS -o "$RESPONSE_FILE" -w '%{http_code}' \
|
||||
-X PUT -H @"$HEADER_FILE" \
|
||||
STATUS="$(curl -sS -o /tmp/stoke-publish-response.$$ -w '%{http_code}' \
|
||||
-X PUT -H "Authorization: token $TOKEN" \
|
||||
--upload-file "$DEB" "$URL")"
|
||||
|
||||
case "$STATUS" in
|
||||
|
|
@ -65,7 +52,9 @@ case "$STATUS" in
|
|||
409) echo "Already published (409): this exact version already exists in the registry." ;;
|
||||
*)
|
||||
echo "error: upload failed with HTTP $STATUS" >&2
|
||||
cat "$RESPONSE_FILE" >&2 || true
|
||||
cat /tmp/stoke-publish-response.$$ >&2 || true
|
||||
rm -f /tmp/stoke-publish-response.$$
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
rm -f /tmp/stoke-publish-response.$$
|
||||
|
|
|
|||
46
src/cli.js
46
src/cli.js
|
|
@ -655,30 +655,30 @@ repo
|
|||
continue;
|
||||
}
|
||||
|
||||
const service = item.service || 'github';
|
||||
const isPrivate = item.public ? false : Boolean(item.private);
|
||||
const payload = {
|
||||
clone_addr: from,
|
||||
repo_name: name,
|
||||
repo_owner: item.owner || item.repo_owner || config.login,
|
||||
service,
|
||||
description: item.description || undefined,
|
||||
private: isPrivate,
|
||||
issues: normalizeBool(item.issues, true),
|
||||
labels: normalizeBool(item.labels, true),
|
||||
milestones: normalizeBool(item.milestones, true),
|
||||
pull_requests: normalizeBool(item.pull_requests, true),
|
||||
releases: normalizeBool(item.releases, true),
|
||||
wiki: normalizeBool(item.wiki, true),
|
||||
lfs: normalizeBool(item.lfs, false),
|
||||
auth_token: resolveSourceToken(item.github_token, service),
|
||||
};
|
||||
|
||||
Object.keys(payload).forEach((key) => {
|
||||
if (payload[key] === undefined) delete payload[key];
|
||||
});
|
||||
|
||||
try {
|
||||
const service = item.service || 'github';
|
||||
const isPrivate = item.public ? false : Boolean(item.private);
|
||||
const payload = {
|
||||
clone_addr: from,
|
||||
repo_name: name,
|
||||
repo_owner: item.owner || item.repo_owner || config.login,
|
||||
service,
|
||||
description: item.description || undefined,
|
||||
private: isPrivate,
|
||||
issues: normalizeBool(item.issues, true),
|
||||
labels: normalizeBool(item.labels, true),
|
||||
milestones: normalizeBool(item.milestones, true),
|
||||
pull_requests: normalizeBool(item.pull_requests, true),
|
||||
releases: normalizeBool(item.releases, true),
|
||||
wiki: normalizeBool(item.wiki, true),
|
||||
lfs: normalizeBool(item.lfs, false),
|
||||
auth_token: resolveSourceToken(item.github_token, service),
|
||||
};
|
||||
|
||||
Object.keys(payload).forEach((key) => {
|
||||
if (payload[key] === undefined) delete payload[key];
|
||||
});
|
||||
|
||||
const result = await client.migrateRepo(payload);
|
||||
console.log(`Imported: ${result.full_name} -> ${result.html_url}`);
|
||||
results.push({ name, status: 'ok', url: result.html_url });
|
||||
|
|
|
|||
|
|
@ -1,65 +0,0 @@
|
|||
const { test } = require('node:test');
|
||||
const assert = require('node:assert/strict');
|
||||
const { spawnSync } = require('node:child_process');
|
||||
const fs = require('node:fs');
|
||||
const os = require('node:os');
|
||||
const path = require('node:path');
|
||||
|
||||
const ROOT = path.join(__dirname, '..');
|
||||
|
||||
function copyTree(source, destination) {
|
||||
fs.cpSync(source, destination, { recursive: true });
|
||||
}
|
||||
|
||||
function buildPackage(umask) {
|
||||
const root = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-build-deb-test-'));
|
||||
const bin = path.join(root, 'bin');
|
||||
fs.mkdirSync(path.join(root, 'scripts'));
|
||||
fs.mkdirSync(bin);
|
||||
fs.copyFileSync(path.join(ROOT, 'scripts', 'build-deb.sh'), path.join(root, 'scripts', 'build-deb.sh'));
|
||||
copyTree(path.join(ROOT, 'src'), path.join(root, 'src'));
|
||||
fs.copyFileSync(path.join(ROOT, 'package.json'), path.join(root, 'package.json'));
|
||||
fs.copyFileSync(path.join(ROOT, 'package-lock.json'), path.join(root, 'package-lock.json'));
|
||||
|
||||
const npm = path.join(bin, 'npm');
|
||||
fs.writeFileSync(npm, '#!/usr/bin/env bash\nexit 0\n');
|
||||
fs.chmodSync(npm, 0o755);
|
||||
|
||||
const result = spawnSync(
|
||||
'bash',
|
||||
['-c', 'umask "$1"; exec bash "$2"', 'build-deb-test', umask, path.join(root, 'scripts', 'build-deb.sh')],
|
||||
{
|
||||
encoding: 'utf8',
|
||||
env: { ...process.env, PATH: `${bin}:${process.env.PATH}` },
|
||||
},
|
||||
);
|
||||
assert.equal(result.status, 0, result.stderr);
|
||||
|
||||
const deb = path.join(root, 'dist', 'stoke_1.5.0_all.deb');
|
||||
const listing = spawnSync('dpkg-deb', ['-c', deb], { encoding: 'utf8' });
|
||||
assert.equal(listing.status, 0, listing.stderr);
|
||||
|
||||
const modes = new Map();
|
||||
for (const line of listing.stdout.trim().split('\n')) {
|
||||
const fields = line.trim().split(/\s+/);
|
||||
const archivePath = fields.find((field) => field.startsWith('./usr/'));
|
||||
if (archivePath && (fields[0].startsWith('d') || fields[0].startsWith('-'))) {
|
||||
modes.set(archivePath, fields[0]);
|
||||
}
|
||||
}
|
||||
return { root, modes };
|
||||
}
|
||||
|
||||
test('Debian payload modes are identical under umask 077 and 022', (t) => {
|
||||
const restrictive = buildPackage('077');
|
||||
const standard = buildPackage('022');
|
||||
t.after(() => {
|
||||
fs.rmSync(restrictive.root, { recursive: true, force: true });
|
||||
fs.rmSync(standard.root, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
assert.deepEqual(restrictive.modes, standard.modes);
|
||||
for (const [archivePath, mode] of restrictive.modes) {
|
||||
assert.equal(mode, archivePath.endsWith('/') ? 'drwxr-xr-x' : archivePath === './usr/lib/stoke/src/cli.js' ? '-rwxr-xr-x' : '-rw-r--r--', archivePath);
|
||||
}
|
||||
});
|
||||
|
|
@ -1,248 +0,0 @@
|
|||
const { test } = require('node:test');
|
||||
const assert = require('node:assert/strict');
|
||||
const { spawn } = require('node:child_process');
|
||||
const fs = require('node:fs');
|
||||
const http = require('node:http');
|
||||
const os = require('node:os');
|
||||
const path = require('node:path');
|
||||
|
||||
const CLI = path.join(__dirname, '..', 'src', 'cli.js');
|
||||
|
||||
function run(args, env = {}) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const childEnv = { ...process.env, ...env };
|
||||
childEnv.NODE_OPTIONS = [
|
||||
childEnv.NODE_OPTIONS,
|
||||
'--disable-warning=ExperimentalWarning',
|
||||
].filter(Boolean).join(' ');
|
||||
const child = spawn(process.execPath, [CLI, ...args], {
|
||||
env: childEnv,
|
||||
});
|
||||
let stdout = '';
|
||||
let stderr = '';
|
||||
child.stdout.setEncoding('utf8');
|
||||
child.stderr.setEncoding('utf8');
|
||||
child.stdout.on('data', (chunk) => { stdout += chunk; });
|
||||
child.stderr.on('data', (chunk) => { stderr += chunk; });
|
||||
child.on('error', reject);
|
||||
child.on('close', (status) => resolve({ status, stdout, stderr }));
|
||||
});
|
||||
}
|
||||
|
||||
async function startMigrationServer() {
|
||||
const requests = [];
|
||||
const server = http.createServer((req, res) => {
|
||||
let body = '';
|
||||
req.setEncoding('utf8');
|
||||
req.on('data', (chunk) => { body += chunk; });
|
||||
req.on('end', () => {
|
||||
const payload = JSON.parse(body);
|
||||
requests.push({ method: req.method, url: req.url, body: payload });
|
||||
res.writeHead(201, { 'Content-Type': 'application/json' });
|
||||
res.end(JSON.stringify({
|
||||
full_name: `destination/${payload.repo_name}`,
|
||||
html_url: `https://forge.test/destination/${payload.repo_name}`,
|
||||
}));
|
||||
});
|
||||
});
|
||||
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
|
||||
return { server, requests };
|
||||
}
|
||||
|
||||
test('repo import-batch continues after one item has no source token', async () => {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-import-batch-'));
|
||||
const configFile = path.join(dir, 'config.json');
|
||||
const manifestFile = path.join(dir, 'manifest.json');
|
||||
const emptyPath = path.join(dir, 'bin');
|
||||
const forgeToken = 'forge-token-must-not-be-printed';
|
||||
const { server, requests } = await startMigrationServer();
|
||||
fs.mkdirSync(emptyPath);
|
||||
fs.writeFileSync(configFile, JSON.stringify({
|
||||
url: `http://127.0.0.1:${server.address().port}`,
|
||||
login: 'destination',
|
||||
token: forgeToken,
|
||||
}));
|
||||
fs.writeFileSync(manifestFile, JSON.stringify([
|
||||
{ name: 'missing-token', from: 'https://github.com/source/first.git', service: 'github' },
|
||||
{ name: 'imported-second', from: 'https://git.example/source/second.git', service: 'git' },
|
||||
]));
|
||||
|
||||
try {
|
||||
const result = await run(
|
||||
['--config', configFile, 'repo', 'import-batch', '--file', manifestFile],
|
||||
{ PATH: emptyPath, GITHUB_TOKEN: undefined },
|
||||
);
|
||||
|
||||
assert.equal(result.status, 1);
|
||||
assert.match(result.stderr, /Failed to import missing-token: No GitHub token found\./);
|
||||
assert.equal(result.stdout,
|
||||
'Imported: destination/imported-second -> https://forge.test/destination/imported-second\n'
|
||||
+ '\nBatch complete: 1/2 imported.\n');
|
||||
assert.deepEqual(requests, [{
|
||||
method: 'POST',
|
||||
url: '/api/v1/repos/migrate',
|
||||
body: {
|
||||
clone_addr: 'https://git.example/source/second.git',
|
||||
repo_name: 'imported-second',
|
||||
repo_owner: 'destination',
|
||||
service: 'git',
|
||||
private: false,
|
||||
issues: true,
|
||||
labels: true,
|
||||
milestones: true,
|
||||
pull_requests: true,
|
||||
releases: true,
|
||||
wiki: true,
|
||||
lfs: false,
|
||||
},
|
||||
}]);
|
||||
assert.doesNotMatch(result.stdout + result.stderr, new RegExp(forgeToken));
|
||||
} finally {
|
||||
await new Promise((resolve) => server.close(resolve));
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test('repo import-batch preserves successful batch output', async () => {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-import-batch-success-'));
|
||||
const configFile = path.join(dir, 'config.json');
|
||||
const manifestFile = path.join(dir, 'manifest.json');
|
||||
const { server, requests } = await startMigrationServer();
|
||||
fs.writeFileSync(configFile, JSON.stringify({
|
||||
url: `http://127.0.0.1:${server.address().port}`,
|
||||
login: 'destination',
|
||||
token: 'forge-token-must-not-be-printed',
|
||||
}));
|
||||
fs.writeFileSync(manifestFile, JSON.stringify([
|
||||
{ name: 'first', from: 'https://git.example/source/first.git', service: 'git' },
|
||||
{ name: 'second', from: 'https://git.example/source/second.git', service: 'git' },
|
||||
]));
|
||||
|
||||
try {
|
||||
const result = await run(['--config', configFile, 'repo', 'import-batch', '--file', manifestFile]);
|
||||
|
||||
assert.equal(result.status, 0, result.stderr);
|
||||
assert.equal(result.stderr, '');
|
||||
assert.equal(result.stdout,
|
||||
'Imported: destination/first -> https://forge.test/destination/first\n'
|
||||
+ 'Imported: destination/second -> https://forge.test/destination/second\n'
|
||||
+ '\nBatch complete: 2/2 imported.\n');
|
||||
assert.deepEqual(requests.map(({ body }) => body.repo_name), ['first', 'second']);
|
||||
} finally {
|
||||
await new Promise((resolve) => server.close(resolve));
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test('repo import-batch sends an explicit GitHub token without printing it', async () => {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-import-batch-token-'));
|
||||
const configFile = path.join(dir, 'config.json');
|
||||
const manifestFile = path.join(dir, 'manifest.json');
|
||||
const emptyPath = path.join(dir, 'bin');
|
||||
const sourceToken = 'github-token-must-not-be-printed';
|
||||
const { server, requests } = await startMigrationServer();
|
||||
fs.mkdirSync(emptyPath);
|
||||
fs.writeFileSync(configFile, JSON.stringify({
|
||||
url: `http://127.0.0.1:${server.address().port}`,
|
||||
login: 'destination',
|
||||
token: 'forge-token-must-not-be-printed',
|
||||
}));
|
||||
fs.writeFileSync(manifestFile, JSON.stringify([{
|
||||
name: 'from-github',
|
||||
from: 'https://github.com/source/repository.git',
|
||||
service: 'github',
|
||||
github_token: sourceToken,
|
||||
}]));
|
||||
|
||||
try {
|
||||
const result = await run(
|
||||
['--config', configFile, 'repo', 'import-batch', '--file', manifestFile],
|
||||
{ PATH: emptyPath, GITHUB_TOKEN: undefined },
|
||||
);
|
||||
|
||||
assert.equal(result.status, 0, result.stderr);
|
||||
assert.equal(result.stderr, '');
|
||||
assert.equal(result.stdout,
|
||||
'Imported: destination/from-github -> https://forge.test/destination/from-github\n'
|
||||
+ '\nBatch complete: 1/1 imported.\n');
|
||||
assert.deepEqual(requests, [{
|
||||
method: 'POST',
|
||||
url: '/api/v1/repos/migrate',
|
||||
body: {
|
||||
clone_addr: 'https://github.com/source/repository.git',
|
||||
repo_name: 'from-github',
|
||||
repo_owner: 'destination',
|
||||
service: 'github',
|
||||
private: false,
|
||||
issues: true,
|
||||
labels: true,
|
||||
milestones: true,
|
||||
pull_requests: true,
|
||||
releases: true,
|
||||
wiki: true,
|
||||
lfs: false,
|
||||
auth_token: sourceToken,
|
||||
},
|
||||
}]);
|
||||
assert.doesNotMatch(result.stdout + result.stderr, new RegExp(sourceToken));
|
||||
} finally {
|
||||
await new Promise((resolve) => server.close(resolve));
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test('repo import-batch keeps file and JSON errors at batch level', async () => {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-import-batch-invalid-'));
|
||||
const configFile = path.join(dir, 'config.json');
|
||||
const missingFile = path.join(dir, 'missing.json');
|
||||
const malformedFile = path.join(dir, 'malformed.json');
|
||||
fs.writeFileSync(configFile, JSON.stringify({
|
||||
url: 'https://forge.test',
|
||||
login: 'destination',
|
||||
token: 'forge-token-must-not-be-printed',
|
||||
}));
|
||||
fs.writeFileSync(malformedFile, '{not json');
|
||||
|
||||
try {
|
||||
const missing = await run(['--config', configFile, 'repo', 'import-batch', '--file', missingFile]);
|
||||
const malformed = await run(['--config', configFile, 'repo', 'import-batch', '--file', malformedFile]);
|
||||
|
||||
assert.equal(missing.status, 1);
|
||||
assert.match(missing.stderr, /^Batch import failed: ENOENT:/);
|
||||
assert.equal(missing.stdout, '');
|
||||
assert.equal(malformed.status, 1);
|
||||
assert.match(malformed.stderr, /^Batch import failed: /);
|
||||
assert.match(malformed.stderr, /JSON/);
|
||||
assert.equal(malformed.stdout, '');
|
||||
} finally {
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test('repo import-batch excludes skipped invalid entries from the summary', async () => {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-import-batch-skip-'));
|
||||
const configFile = path.join(dir, 'config.json');
|
||||
const manifestFile = path.join(dir, 'manifest.json');
|
||||
const { server, requests } = await startMigrationServer();
|
||||
fs.writeFileSync(configFile, JSON.stringify({
|
||||
url: `http://127.0.0.1:${server.address().port}`,
|
||||
login: 'destination',
|
||||
token: 'forge-token-must-not-be-printed',
|
||||
}));
|
||||
fs.writeFileSync(manifestFile, JSON.stringify([
|
||||
{ name: 'missing-source' },
|
||||
{ name: 'valid', from: 'https://git.example/source/valid.git', service: 'git' },
|
||||
]));
|
||||
|
||||
try {
|
||||
const result = await run(['--config', configFile, 'repo', 'import-batch', '--file', manifestFile]);
|
||||
|
||||
assert.equal(result.status, 0, result.stderr);
|
||||
assert.equal(result.stderr, 'Skipping invalid manifest entry: {"name":"missing-source"}\n');
|
||||
assert.match(result.stdout, /Batch complete: 1\/1 imported\./);
|
||||
assert.deepEqual(requests.map(({ body }) => body.repo_name), ['valid']);
|
||||
} finally {
|
||||
await new Promise((resolve) => server.close(resolve));
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
|
@ -7,152 +7,51 @@ const path = require('node:path');
|
|||
|
||||
const ROOT = path.join(__dirname, '..');
|
||||
const SCRIPT = path.join(ROOT, 'scripts', 'publish-deb.sh');
|
||||
const TOKEN = 'deb-token-that-must-not-enter-argv';
|
||||
const UPLOAD_LINE = 'Uploading stoke_2.0.0_all.deb to https://forge.example.test/api/packages/heavy-duty/debian/pool/stable/main/upload\n';
|
||||
const TOKEN = 'deb-token-that-must-not-appear-in-output';
|
||||
|
||||
function runScenario({ token = '', httpStatus = 201, responseBody = '', curlStatus = 0 } = {}) {
|
||||
function runScenario({ token = '' } = {}) {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-publish-deb-test-'));
|
||||
const home = path.join(dir, 'home');
|
||||
const bin = path.join(dir, 'bin');
|
||||
const runnerTemp = path.join(dir, 'runner-temp');
|
||||
const log = path.join(dir, 'curl.json');
|
||||
const deb = path.join(dir, 'stoke_2.0.0_all.deb');
|
||||
const legacyBefore = new Set(fs.readdirSync(os.tmpdir()).filter((name) => name.startsWith('stoke-publish-response.')));
|
||||
let call = null;
|
||||
let result;
|
||||
|
||||
try {
|
||||
const home = path.join(dir, 'home');
|
||||
const bin = path.join(dir, 'bin');
|
||||
const deb = path.join(dir, 'stoke_2.0.0_all.deb');
|
||||
fs.mkdirSync(home);
|
||||
fs.mkdirSync(bin);
|
||||
fs.mkdirSync(runnerTemp);
|
||||
fs.writeFileSync(deb, 'package');
|
||||
fs.writeFileSync(path.join(bin, 'curl'), `#!/usr/bin/env node
|
||||
const fs = require('node:fs');
|
||||
const path = require('node:path');
|
||||
const args = process.argv.slice(2);
|
||||
const headerArg = args[args.indexOf('-H') + 1];
|
||||
const headerFile = headerArg && headerArg.startsWith('@') ? headerArg.slice(1) : null;
|
||||
const responseFile = args[args.indexOf('-o') + 1];
|
||||
const record = { args, headerFile, responseFile };
|
||||
if (headerFile) {
|
||||
record.header = fs.readFileSync(headerFile, 'utf8');
|
||||
record.headerMode = fs.statSync(headerFile).mode & 0o777;
|
||||
record.tempDir = path.dirname(headerFile);
|
||||
}
|
||||
fs.writeFileSync(responseFile, process.env.CURL_RESPONSE_BODY);
|
||||
fs.writeFileSync(process.env.CURL_CALL_LOG, JSON.stringify(record));
|
||||
if (Number(process.env.CURL_STATUS)) process.exit(Number(process.env.CURL_STATUS));
|
||||
process.stdout.write(process.env.CURL_HTTP_STATUS);
|
||||
`);
|
||||
fs.writeFileSync(path.join(bin, 'curl'), '#!/usr/bin/env bash\nprintf 201\n');
|
||||
fs.chmodSync(path.join(bin, 'curl'), 0o755);
|
||||
|
||||
result = spawnSync('bash', [SCRIPT, deb], {
|
||||
return spawnSync('bash', [SCRIPT, deb], {
|
||||
encoding: 'utf8',
|
||||
env: {
|
||||
HOME: home,
|
||||
PATH: `${bin}:${process.env.PATH}`,
|
||||
RUNNER_TEMP: runnerTemp,
|
||||
STOKE_CONFIG_FILE: path.join(dir, 'missing-config.json'),
|
||||
STOKE_TOKEN: token,
|
||||
FORGE_URL: 'https://forge.example.test',
|
||||
CURL_CALL_LOG: log,
|
||||
CURL_HTTP_STATUS: String(httpStatus),
|
||||
CURL_RESPONSE_BODY: responseBody,
|
||||
CURL_STATUS: String(curlStatus),
|
||||
},
|
||||
});
|
||||
call = fs.existsSync(log) ? JSON.parse(fs.readFileSync(log, 'utf8')) : null;
|
||||
const remainingTempEntries = fs.readdirSync(runnerTemp);
|
||||
const legacyAfter = fs.readdirSync(os.tmpdir()).filter(
|
||||
(name) => name.startsWith('stoke-publish-response.') && !legacyBefore.has(name),
|
||||
);
|
||||
|
||||
return {
|
||||
result,
|
||||
call,
|
||||
runnerTemp,
|
||||
remainingTempEntries,
|
||||
legacyAfter,
|
||||
headerExistsAfter: call?.headerFile ? fs.existsSync(call.headerFile) : false,
|
||||
responseExistsAfter: call?.responseFile ? fs.existsSync(call.responseFile) : false,
|
||||
};
|
||||
} finally {
|
||||
if (call?.responseFile && !call.responseFile.startsWith(`${dir}${path.sep}`)) {
|
||||
fs.rmSync(call.responseFile, { force: true });
|
||||
}
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
}
|
||||
|
||||
function assertCleaned(scenario) {
|
||||
assert.deepEqual(scenario.remainingTempEntries, []);
|
||||
assert.deepEqual(scenario.legacyAfter, []);
|
||||
assert.equal(scenario.headerExistsAfter, false);
|
||||
assert.equal(scenario.responseExistsAfter, false);
|
||||
}
|
||||
|
||||
test('empty token identifies the CI secret before offering the local remedy', () => {
|
||||
const scenario = runScenario();
|
||||
const result = runScenario();
|
||||
|
||||
assert.equal(scenario.result.status, 1);
|
||||
assert.equal(scenario.result.stdout, '');
|
||||
assert.match(scenario.result.stderr, /^error: no token\./);
|
||||
assert.match(scenario.result.stderr, /STOKE_TOKEN/);
|
||||
assert.match(scenario.result.stderr, /RELEASE_TOKEN/);
|
||||
assert.match(scenario.result.stderr, /empty value.*secret/is);
|
||||
assert.ok(scenario.result.stderr.indexOf('RELEASE_TOKEN') < scenario.result.stderr.indexOf('stoke auth login'));
|
||||
assert.equal(scenario.call, null);
|
||||
assertCleaned(scenario);
|
||||
assert.equal(result.status, 1);
|
||||
assert.equal(result.stdout, '');
|
||||
assert.match(result.stderr, /^error: no token\./);
|
||||
assert.match(result.stderr, /STOKE_TOKEN/);
|
||||
assert.match(result.stderr, /RELEASE_TOKEN/);
|
||||
assert.match(result.stderr, /empty value.*secret/is);
|
||||
assert.ok(result.stderr.indexOf('RELEASE_TOKEN') < result.stderr.indexOf('stoke auth login'));
|
||||
});
|
||||
|
||||
test('curl reads a private authorization header file without receiving the token in argv', () => {
|
||||
const scenario = runScenario({ token: TOKEN });
|
||||
test('non-empty environment token passes the guard without exposing the token', () => {
|
||||
const result = runScenario({ token: TOKEN });
|
||||
|
||||
assert.equal(scenario.result.status, 0, scenario.result.stderr);
|
||||
assert.ok(scenario.call.args.includes('-H'));
|
||||
assert.equal(scenario.call.args.every((arg) => !arg.includes(TOKEN)), true);
|
||||
assert.equal(path.dirname(scenario.call.tempDir), scenario.runnerTemp);
|
||||
assert.ok(scenario.call.headerFile.startsWith(`${scenario.call.tempDir}${path.sep}`));
|
||||
assert.equal(scenario.call.header, `Authorization: token ${TOKEN}\n`);
|
||||
assert.equal(scenario.call.headerMode, 0o600);
|
||||
assert.equal(path.dirname(scenario.call.responseFile), scenario.call.tempDir);
|
||||
assert.doesNotMatch(scenario.result.stdout, new RegExp(TOKEN));
|
||||
assert.doesNotMatch(scenario.result.stderr, new RegExp(TOKEN));
|
||||
assertCleaned(scenario);
|
||||
});
|
||||
|
||||
test('201 response preserves the success transcript and removes temporary files', () => {
|
||||
const scenario = runScenario({ token: TOKEN, httpStatus: 201 });
|
||||
|
||||
assert.equal(scenario.result.status, 0, scenario.result.stderr);
|
||||
assert.equal(scenario.result.stdout, `${UPLOAD_LINE}Published.\n`);
|
||||
assert.equal(scenario.result.stderr, '');
|
||||
assertCleaned(scenario);
|
||||
});
|
||||
|
||||
test('409 response preserves the already-published transcript and removes temporary files', () => {
|
||||
const scenario = runScenario({ token: TOKEN, httpStatus: 409 });
|
||||
|
||||
assert.equal(scenario.result.status, 0, scenario.result.stderr);
|
||||
assert.equal(scenario.result.stdout, `${UPLOAD_LINE}Already published (409): this exact version already exists in the registry.\n`);
|
||||
assert.equal(scenario.result.stderr, '');
|
||||
assertCleaned(scenario);
|
||||
});
|
||||
|
||||
test('HTTP failure preserves the response body on stderr and removes temporary files', () => {
|
||||
const scenario = runScenario({ token: TOKEN, httpStatus: 500, responseBody: 'registry rejected\n' });
|
||||
|
||||
assert.equal(scenario.result.status, 1);
|
||||
assert.equal(scenario.result.stdout, UPLOAD_LINE);
|
||||
assert.equal(scenario.result.stderr, 'error: upload failed with HTTP 500\nregistry rejected\n');
|
||||
assertCleaned(scenario);
|
||||
});
|
||||
|
||||
test('curl failure propagates its status and still removes temporary files', () => {
|
||||
const scenario = runScenario({ token: TOKEN, curlStatus: 7, responseBody: 'transport failed\n' });
|
||||
|
||||
assert.equal(scenario.result.status, 7);
|
||||
assert.equal(scenario.result.stdout, UPLOAD_LINE);
|
||||
assert.equal(scenario.result.stderr, '');
|
||||
assertCleaned(scenario);
|
||||
assert.equal(result.status, 0, result.stderr);
|
||||
assert.match(result.stdout, /Published\./);
|
||||
assert.doesNotMatch(result.stdout, new RegExp(TOKEN));
|
||||
assert.doesNotMatch(result.stderr, new RegExp(TOKEN));
|
||||
});
|
||||
|
|
|
|||
Loading…
Reference in a new issue