feat: update skills

skills/builder/scripts/test_verify_deb.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Repro: 755 maintainer scripts must pass; 644 must fail as not executable.
+set -euo pipefail
+
+root=$(cd "$(dirname "$0")" && pwd)
+verify=$root/verify_deb.sh
+scratch=$(mktemp -d)
+trap 'rm -rf -- "$scratch"' EXIT
+
+make_deb_755() {
+	local dest=$1
+	local pkg=$scratch/pkg-755
+	rm -rf "$pkg"
+	mkdir -p "$pkg/DEBIAN" "$pkg/usr/bin"
+	printf '#!/bin/sh\nexit 0\n' >"$pkg/usr/bin/noop"
+	chmod 755 "$pkg/usr/bin/noop"
+	cat >"$pkg/DEBIAN/control" <<'EOF'
+Package: verify-deb-fixture
+Version: 0.0.1
+Architecture: amd64
+Maintainer: test <test@example.com>
+Description: fixture for verify_deb.sh permission check
+EOF
+	printf '#!/bin/sh\nexit 0\n' >"$pkg/DEBIAN/postinst"
+	chmod 755 "$pkg/DEBIAN/postinst"
+	dpkg-deb --build "$pkg" "$dest" >/dev/null
+}
+
+# dpkg-deb --build rejects 644 maintainer scripts; strip the execute bit in the
+# control tarball so verify_deb.sh still sees a real packaged 644 postinst.
+make_deb_644_from() {
+	local src=$1 dest=$2
+	local work=$scratch/mutate
+	rm -rf "$work"
+	mkdir -p "$work/control"
+	cp "$src" "$dest"
+	( cd "$work" && ar x "$dest" )
+	zstd -d -c "$work/control.tar.zst" | tar -C "$work/control" -xf -
+	chmod 644 "$work/control/postinst"
+	tar -C "$work/control" -cf - . | zstd -c >"$work/control.tar.zst"
+	( cd "$work" && ar r "$dest" control.tar.zst )
+}
+
+ok_deb=$scratch/verify-deb-fixture_0.0.1_amd64.deb
+bad_deb=$scratch/verify-deb-fixture-noexec_0.0.1_amd64.deb
+make_deb_755 "$ok_deb"
+make_deb_644_from "$ok_deb" "$bad_deb"
+
+ok_out=$scratch/ok.out
+bad_out=$scratch/bad.out
+set +e
+"$verify" "$ok_deb" 0.0.1 amd64 >"$ok_out" 2>&1
+ok_rc=$?
+"$verify" "$bad_deb" 0.0.1 amd64 >"$bad_out" 2>&1
+bad_rc=$?
+set -e
+
+fail=0
+if [[ $ok_rc -ne 0 ]] || ! grep -q 'VERIFY: OK' "$ok_out"; then
+	echo "FAIL: 755 postinst should be treated as executable" >&2
+	cat "$ok_out" >&2
+	fail=1
+fi
+if [[ $bad_rc -eq 0 ]] || ! grep -q 'not executable' "$bad_out"; then
+	echo "FAIL: 644 postinst should fail as not executable" >&2
+	cat "$bad_out" >&2
+	fail=1
+fi
+if ((fail)); then
+	exit 1
+fi
+echo "test_verify_deb.sh: OK"

skills/builder/scripts/verify_deb.sh

@@ -87,8 +87,10 @@ if dpkg-deb --control "$package" "$control_dir" 2>/dev/null; then
   for script in preinst postinst prerm postrm; do
     if [[ -f "$control_dir/$script" ]]; then
       found_scripts=true
-      mode=$(stat -c '%a' "$control_dir/$script")
-      if [[ $mode =~ .*[2367]$ ]]; then
+      # Use -x: octal last digit [2367] is "other write", so 755 (r-x) was
+      # reported as not executable. 644 still fails because it is not -x.
+      mode=$(stat -c '%a' "$control_dir/$script" 2>/dev/null || stat -f '%OLp' "$control_dir/$script")
+      if [[ -x "$control_dir/$script" ]]; then
         echo "OK: $script mode $mode"
       else
         echo "FAIL: $script not executable (mode $mode)" >&2