Tony
122 lines
4.5 KiB
Bash
Executable File
122 lines
4.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/open-shorebird-mirror-validator.XXXXXX")"
|
|
trap 'rm -rf "$TMP_DIR"' EXIT
|
|
|
|
"$ROOT/scripts/verify_assemble_artifact_mirror.sh" >/dev/null
|
|
|
|
PYTHON_BIN=python3
|
|
if ! command -v "$PYTHON_BIN" >/dev/null 2>&1; then
|
|
PYTHON_BIN=python
|
|
fi
|
|
|
|
ENGINE_REVISION=engine123
|
|
MIRROR_ROOT="$TMP_DIR/mirror"
|
|
mkdir -p "$MIRROR_ROOT/shorebird/$ENGINE_REVISION"
|
|
cat > "$MIRROR_ROOT/shorebird/$ENGINE_REVISION/artifacts_manifest.yaml" <<EOF
|
|
flutter_engine_revision: 'base-engine'
|
|
storage_bucket: 'shorebird'
|
|
artifact_overrides:
|
|
- 'flutter_infra_release/flutter/\$engine/linux-x64-release/artifacts.zip'
|
|
EOF
|
|
|
|
"$PYTHON_BIN" - "$MIRROR_ROOT/shorebird/$ENGINE_REVISION" <<'PY'
|
|
from pathlib import Path
|
|
import sys
|
|
import zipfile
|
|
|
|
root = Path(sys.argv[1])
|
|
patch_zips = {
|
|
"patch-linux-x64.zip": "patch",
|
|
"patch-darwin-x64.zip": "patch",
|
|
"patch-darwin-arm64.zip": "patch",
|
|
"patch-windows-x64.zip": "patch.exe",
|
|
}
|
|
for zip_name, entry_name in patch_zips.items():
|
|
with zipfile.ZipFile(root / zip_name, "w", zipfile.ZIP_DEFLATED) as archive:
|
|
archive.writestr(entry_name, f"{zip_name}:{entry_name}\n")
|
|
PY
|
|
|
|
mkdir -p "$MIRROR_ROOT/shorebird/flutter_infra_release/flutter/$ENGINE_REVISION/linux-x64-release"
|
|
printf 'linux-engine-artifacts\n' \
|
|
> "$MIRROR_ROOT/shorebird/flutter_infra_release/flutter/$ENGINE_REVISION/linux-x64-release/artifacts.zip"
|
|
|
|
while IFS= read -r -d '' mirror_file; do
|
|
if [[ "$mirror_file" == *.sha256 ]]; then
|
|
continue
|
|
fi
|
|
"$ROOT/scripts/write_sha256.sh" "$mirror_file"
|
|
done < <(find "$MIRROR_ROOT/shorebird" -type f -print0)
|
|
|
|
"$PYTHON_BIN" "$ROOT/scripts/validate_artifact_mirror.py" "$MIRROR_ROOT" >/dev/null
|
|
|
|
UNSAFE_MIRROR_ROOT="$TMP_DIR/unsafe-mirror"
|
|
cp -R "$MIRROR_ROOT" "$UNSAFE_MIRROR_ROOT"
|
|
"$PYTHON_BIN" - "$UNSAFE_MIRROR_ROOT/shorebird/$ENGINE_REVISION/artifacts_manifest.yaml" <<'PY'
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
manifest_path = Path(sys.argv[1])
|
|
manifest_path.write_text(
|
|
"\n".join(
|
|
[
|
|
"flutter_engine_revision: 'base-engine'",
|
|
"storage_bucket: 'shorebird'",
|
|
"artifact_overrides:",
|
|
" - '../outside/artifacts.zip'",
|
|
]
|
|
)
|
|
+ "\n",
|
|
encoding="utf-8",
|
|
)
|
|
PY
|
|
"$ROOT/scripts/write_sha256.sh" \
|
|
"$UNSAFE_MIRROR_ROOT/shorebird/$ENGINE_REVISION/artifacts_manifest.yaml" \
|
|
"$UNSAFE_MIRROR_ROOT/shorebird/$ENGINE_REVISION/artifacts_manifest.yaml.sha256"
|
|
if "$PYTHON_BIN" "$ROOT/scripts/validate_artifact_mirror.py" \
|
|
"$UNSAFE_MIRROR_ROOT" >"$TMP_DIR/unsafe-mirror.log" 2>&1; then
|
|
echo "validate_artifact_mirror.py unexpectedly accepted an unsafe manifest override" >&2
|
|
exit 70
|
|
fi
|
|
grep -q "unsafe artifact override path" "$TMP_DIR/unsafe-mirror.log"
|
|
|
|
SYMLINK_MIRROR_ROOT="$TMP_DIR/symlink-mirror"
|
|
cp -R "$MIRROR_ROOT" "$SYMLINK_MIRROR_ROOT"
|
|
rm "$SYMLINK_MIRROR_ROOT/shorebird/$ENGINE_REVISION/patch-linux-x64.zip"
|
|
ln -s "$MIRROR_ROOT/shorebird/$ENGINE_REVISION/patch-linux-x64.zip" \
|
|
"$SYMLINK_MIRROR_ROOT/shorebird/$ENGINE_REVISION/patch-linux-x64.zip"
|
|
if "$PYTHON_BIN" "$ROOT/scripts/validate_artifact_mirror.py" \
|
|
"$SYMLINK_MIRROR_ROOT" >"$TMP_DIR/symlink-mirror.log" 2>&1; then
|
|
echo "validate_artifact_mirror.py unexpectedly accepted a symlink artifact" >&2
|
|
exit 70
|
|
fi
|
|
grep -q "symlink entries are not allowed" "$TMP_DIR/symlink-mirror.log"
|
|
|
|
EMPTY_OVERRIDE_ROOT="$TMP_DIR/empty-override-mirror"
|
|
cp -R "$MIRROR_ROOT" "$EMPTY_OVERRIDE_ROOT"
|
|
"$PYTHON_BIN" - "$EMPTY_OVERRIDE_ROOT/shorebird/flutter_infra_release/flutter/$ENGINE_REVISION/linux-x64-release/artifacts.zip" <<'PY'
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
Path(sys.argv[1]).write_bytes(b"")
|
|
PY
|
|
"$ROOT/scripts/write_sha256.sh" \
|
|
"$EMPTY_OVERRIDE_ROOT/shorebird/flutter_infra_release/flutter/$ENGINE_REVISION/linux-x64-release/artifacts.zip" \
|
|
"$EMPTY_OVERRIDE_ROOT/shorebird/flutter_infra_release/flutter/$ENGINE_REVISION/linux-x64-release/artifacts.zip.sha256"
|
|
if "$PYTHON_BIN" "$ROOT/scripts/validate_artifact_mirror.py" \
|
|
"$EMPTY_OVERRIDE_ROOT" >"$TMP_DIR/empty-override-mirror.log" 2>&1; then
|
|
echo "validate_artifact_mirror.py unexpectedly accepted an empty manifest override artifact" >&2
|
|
exit 70
|
|
fi
|
|
grep -q "artifact override is empty" "$TMP_DIR/empty-override-mirror.log"
|
|
|
|
printf 'tampered\n' >> "$MIRROR_ROOT/shorebird/$ENGINE_REVISION/patch-linux-x64.zip"
|
|
if "$PYTHON_BIN" "$ROOT/scripts/validate_artifact_mirror.py" "$MIRROR_ROOT" >/dev/null 2>&1; then
|
|
echo "validate_artifact_mirror.py unexpectedly accepted a stale sidecar" >&2
|
|
exit 70
|
|
fi
|
|
|
|
echo "validate_artifact_mirror.py smoke test passed"
|