73 lines
2.0 KiB
Bash
Executable File
73 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Repro: 755 maintainer scripts must pass; 644 must fail as not executable.
|
|
set -euo pipefail
|
|
|
|
root=$(cd "$(dirname "$0")" && pwd)
|
|
verify=$root/verify_deb.sh
|
|
scratch=$(mktemp -d)
|
|
trap 'rm -rf -- "$scratch"' EXIT
|
|
|
|
make_deb_755() {
|
|
local dest=$1
|
|
local pkg=$scratch/pkg-755
|
|
rm -rf "$pkg"
|
|
mkdir -p "$pkg/DEBIAN" "$pkg/usr/bin"
|
|
printf '#!/bin/sh\nexit 0\n' >"$pkg/usr/bin/noop"
|
|
chmod 755 "$pkg/usr/bin/noop"
|
|
cat >"$pkg/DEBIAN/control" <<'EOF'
|
|
Package: verify-deb-fixture
|
|
Version: 0.0.1
|
|
Architecture: amd64
|
|
Maintainer: test <test@example.com>
|
|
Description: fixture for verify_deb.sh permission check
|
|
EOF
|
|
printf '#!/bin/sh\nexit 0\n' >"$pkg/DEBIAN/postinst"
|
|
chmod 755 "$pkg/DEBIAN/postinst"
|
|
dpkg-deb --build "$pkg" "$dest" >/dev/null
|
|
}
|
|
|
|
# dpkg-deb --build rejects 644 maintainer scripts; strip the execute bit in the
|
|
# control tarball so verify_deb.sh still sees a real packaged 644 postinst.
|
|
make_deb_644_from() {
|
|
local src=$1 dest=$2
|
|
local work=$scratch/mutate
|
|
rm -rf "$work"
|
|
mkdir -p "$work/control"
|
|
cp "$src" "$dest"
|
|
( cd "$work" && ar x "$dest" )
|
|
zstd -d -c "$work/control.tar.zst" | tar -C "$work/control" -xf -
|
|
chmod 644 "$work/control/postinst"
|
|
tar -C "$work/control" -cf - . | zstd -c >"$work/control.tar.zst"
|
|
( cd "$work" && ar r "$dest" control.tar.zst )
|
|
}
|
|
|
|
ok_deb=$scratch/verify-deb-fixture_0.0.1_amd64.deb
|
|
bad_deb=$scratch/verify-deb-fixture-noexec_0.0.1_amd64.deb
|
|
make_deb_755 "$ok_deb"
|
|
make_deb_644_from "$ok_deb" "$bad_deb"
|
|
|
|
ok_out=$scratch/ok.out
|
|
bad_out=$scratch/bad.out
|
|
set +e
|
|
"$verify" "$ok_deb" 0.0.1 amd64 >"$ok_out" 2>&1
|
|
ok_rc=$?
|
|
"$verify" "$bad_deb" 0.0.1 amd64 >"$bad_out" 2>&1
|
|
bad_rc=$?
|
|
set -e
|
|
|
|
fail=0
|
|
if [[ $ok_rc -ne 0 ]] || ! grep -q 'VERIFY: OK' "$ok_out"; then
|
|
echo "FAIL: 755 postinst should be treated as executable" >&2
|
|
cat "$ok_out" >&2
|
|
fail=1
|
|
fi
|
|
if [[ $bad_rc -eq 0 ]] || ! grep -q 'not executable' "$bad_out"; then
|
|
echo "FAIL: 644 postinst should fail as not executable" >&2
|
|
cat "$bad_out" >&2
|
|
fail=1
|
|
fi
|
|
if ((fail)); then
|
|
exit 1
|
|
fi
|
|
echo "test_verify_deb.sh: OK"
|