From 6f80f672f28b4e7673847b8fde2f889faf42ad5a Mon Sep 17 00:00:00 2001 From: yukkop Date: Tue, 8 Sep 2026 10:36:38 +0000 Subject: [PATCH] rework: fix all vulnerabilities --- .gitea/workflows/runner-nix-smoke.yaml | 11 +++++--- package/db-tool/default.nix | 20 +++++++------- package/default.nix | 10 ++----- package/deploy/default.nix | 3 ++- package/hemar/parser/default.nix | 3 ++- package/hemar/parser/hemar.sh | 12 ++++----- package/linux-devshell/default.nix | 2 +- package/merge-archive/default.nix | 6 ++--- package/migrator/default.nix | 3 ++- package/slpt.nix | 13 +++++---- package/windows-devshell/default.nix | 32 ++++++----------------- test/package/db-tool/default.nix | 4 +-- test/package/hemar/default.nix | 2 +- test/package/linux-devshell/default.nix | 6 ++--- test/package/migrator/default.nix | 4 +-- test/package/sentinèlla/default.nix | 2 +- test/package/windows-devshell/default.nix | 2 +- 17 files changed, 62 insertions(+), 73 deletions(-) diff --git a/.gitea/workflows/runner-nix-smoke.yaml b/.gitea/workflows/runner-nix-smoke.yaml index 423c07ab..bc19c4ef 100644 --- a/.gitea/workflows/runner-nix-smoke.yaml +++ b/.gitea/workflows/runner-nix-smoke.yaml @@ -10,10 +10,15 @@ on: - flake.lock - flake.nix - infra/gitea-runners/** + - lib/** + - legacy/** + - nixos/** + - package/** + - test/** jobs: smoke: - name: nix label smoke + name: nix label and flake smoke runs-on: nix steps: - name: Checkout repository @@ -26,7 +31,7 @@ jobs: nix config show substituters nix config show trusted-public-keys - - name: Repository flake metadata + - name: Repository flake evaluation run: | set -eu - nix flake metadata --no-write-lock-file + nix --option eval-cache false flake check --no-build --no-write-lock-file diff --git a/package/db-tool/default.nix b/package/db-tool/default.nix index da755cea..86968d6d 100644 --- a/package/db-tool/default.nix +++ b/package/db-tool/default.nix @@ -16,16 +16,16 @@ let "errexit" "nounset" ]; - excludeShellChecks = [ "SC2209" ]; + excludeShellChecks = [ "SC1091" "SC2209" ]; name = "database"; runtimeInputs = [ hectic.migrator hectic.parse-uri postgresql neovim openssh coreutils gawk ]; text = '' - ${builtins.readFile hectic.helpers.posix-shell.log} - ${builtins.readFile hectic.helpers.posix-shell.change_namespace} - ${builtins.readFile hectic.helpers.posix-shell.quote} - ${builtins.readFile hectic.helpers.posix-shell.pager_or_cat} - ${builtins.readFile hectic.helpers.posix-shell.with_closed_fds} + . ${hectic.helpers.posix-shell.log}/bin/log.sh + . ${hectic.helpers.posix-shell.change_namespace}/bin/change_namespace.sh + . ${hectic.helpers.posix-shell.quote}/bin/quote.sh + . ${hectic.helpers.posix-shell.pager_or_cat}/bin/pager_or_cat.sh + . ${hectic.helpers.posix-shell.with_closed_fds}/bin/with_closed_fds.sh ${applyBundle} ${builtins.readFile ./db-dev.sh} ''; @@ -44,13 +44,13 @@ let "errexit" "nounset" ]; - excludeShellChecks = [ "SC2209" ]; + excludeShellChecks = [ "SC1091" "SC2209" ]; name = "db-ops"; runtimeInputs = [ postgresql coreutils ]; text = '' - ${builtins.readFile hectic.helpers.posix-shell.log} - ${builtins.readFile hectic.helpers.posix-shell.change_namespace} + . ${hectic.helpers.posix-shell.log}/bin/log.sh + . ${hectic.helpers.posix-shell.change_namespace}/bin/change_namespace.sh ${applyBundle} ${builtins.readFile ./db-ops.sh} ''; @@ -70,7 +70,7 @@ let runtimeInputs = [ postgresql coreutils ]; text = '' - ${builtins.readFile hectic.helpers.posix-shell.with_closed_fds} + . ${hectic.helpers.posix-shell.with_closed_fds}/bin/with_closed_fds.sh ${builtins.readFile ./postgres-init.sh} ''; diff --git a/package/default.nix b/package/default.nix index 5c7ba5e0..9384e916 100644 --- a/package/default.nix +++ b/package/default.nix @@ -10,15 +10,9 @@ }; }; buildPostgresqlExtension = - pkgs: pkgs.callPackage (import (builtins.path { - name = "extension-builder"; - path = ./buildPostgresqlExtension.nix; - })); + pkgs: pkgs.callPackage ./buildPostgresqlExtension.nix; buildPgrxExtension = pkgs: - pkgs.callPackage (import (builtins.path { - name = "extension-builder"; - path = ./buildPgrxExtension.nix; - })) { + pkgs.callPackage ./buildPgrxExtension.nix { cargo-pgrx = pkgs.cargo-pgrx_0_12_6; inherit (pkgs.darwin.apple_sdk.frameworks) Security; }; diff --git a/package/deploy/default.nix b/package/deploy/default.nix index ed6c9836..cc056059 100644 --- a/package/deploy/default.nix +++ b/package/deploy/default.nix @@ -8,6 +8,7 @@ let deploy = hectic.writeShellApplication { inherit shell bashOptions; + excludeShellChecks = [ "SC1091" "SC2034" ]; name = "deploy"; runtimeInputs = [ ssh-to-age @@ -15,7 +16,7 @@ let ]; text = '' - ${builtins.readFile hectic.helpers.posix-shell.log} + . ${hectic.helpers.posix-shell.log}/bin/log.sh ${builtins.readFile ./deploy.sh} ''; }; diff --git a/package/hemar/parser/default.nix b/package/hemar/parser/default.nix index 0858b6f2..a002f096 100644 --- a/package/hemar/parser/default.nix +++ b/package/hemar/parser/default.nix @@ -8,13 +8,14 @@ let hemar = hectic.writeShellApplication { inherit shell bashOptions; + excludeShellChecks = [ "SC1091" ]; name = "hemar"; runtimeInputs = [ yq-go ]; text = '' # shellcheck disable=SC2034 WORKSPACE=${./.} - ${builtins.readFile hectic.helpers.posix-shell.log} + . ${hectic.helpers.posix-shell.log}/bin/log.sh ${builtins.readFile ./hemar.sh} ''; }; diff --git a/package/hemar/parser/hemar.sh b/package/hemar/parser/hemar.sh index 04630150..ee5c1ed7 100644 --- a/package/hemar/parser/hemar.sh +++ b/package/hemar/parser/hemar.sh @@ -299,7 +299,7 @@ parse_tag() { log trace "tag in ws -> type: \`${TAG_type:-}\`" case "${TAG_type:-unknown}" in unknown) finalize_first_arg ;; - for) + 'for') # NOTE: # grammar: for i in key."subkey" ; so we know # 1st argument after `for` - string (name of variable) @@ -427,13 +427,13 @@ finish() { unknown) finish_interpolation_tag ;; - done) + 'done') finish_done_tag ;; '{[') finish_bracket_tag ;; - for) ;; + 'for') ;; *) log panic 'unexpected TAG_type on finish'; exit 13; ;; esac } @@ -442,14 +442,14 @@ finalize_first_arg() { log trace "finalize first arg" log trace "buffer: $(cat "$CURRENT_STAGE_BUFFER")" case "$(cat "$CURRENT_STAGE_BUFFER")" in - for) + 'for') TAG_type='for' # NOTE: we know that next argument after `for` is string TAG_grammar_mode=string log error 'for unimplemented' exit 13 ;; - done) + 'done') finish_done_tag ;; '{[') @@ -651,4 +651,4 @@ if [ -z "${AS_LIBRARY+x}" ]; then # return the output # shellcheck disable=SC2086 yq ${OUTPUT_ARGS:-} -o j "$AST" -fi \ No newline at end of file +fi diff --git a/package/linux-devshell/default.nix b/package/linux-devshell/default.nix index 53185ca0..0182276f 100644 --- a/package/linux-devshell/default.nix +++ b/package/linux-devshell/default.nix @@ -13,7 +13,7 @@ let inherit shell bashOptions; name = "linux-devshell"; runtimeInputs = [ curl coreutils gawk procps ]; - excludeShellChecks = [ "SC2034" "SC1090" ]; + excludeShellChecks = [ "SC1090" "SC1091" "SC2034" ]; text = '' ${logHelpers} diff --git a/package/merge-archive/default.nix b/package/merge-archive/default.nix index f51971ec..c3f04ea0 100644 --- a/package/merge-archive/default.nix +++ b/package/merge-archive/default.nix @@ -8,13 +8,13 @@ hectic.writeShellApplication { "errexit" "nounset" ]; - excludeShellChecks = [ "SC2209" ]; + excludeShellChecks = [ "SC1091" "SC2209" ]; name = "merge-archive"; runtimeInputs = [ git gnutar gzip bzip2 xz unzip coreutils file ]; text = '' - ${builtins.readFile hectic.helpers.posix-shell.log} - ${builtins.readFile hectic.helpers.posix-shell.pager_or_cat} + . ${hectic.helpers.posix-shell.log}/bin/log.sh + . ${hectic.helpers.posix-shell.pager_or_cat}/bin/pager_or_cat.sh ${builtins.readFile ./merge-archive.sh} ''; diff --git a/package/migrator/default.nix b/package/migrator/default.nix index 81df4873..879cc7d9 100644 --- a/package/migrator/default.nix +++ b/package/migrator/default.nix @@ -10,11 +10,12 @@ let migrator = hectic.writeShellApplication { inherit shell bashOptions; + excludeShellChecks = [ "SC1091" ]; name = "migrator"; runtimeInputs = [ sqlite postgresql_17 gawk coreutils ]; text = '' - ${builtins.readFile hectic.helpers.posix-shell.log} + . ${hectic.helpers.posix-shell.log}/bin/log.sh ${applyBundle} ${builtins.readFile ./migrator.sh} ''; diff --git a/package/slpt.nix b/package/slpt.nix index 59a67a29..275f52d2 100644 --- a/package/slpt.nix +++ b/package/slpt.nix @@ -1,12 +1,15 @@ -{ lib, writeShellScriptBin, fetchFromGitHub, pkgs }: let +{ lib, fetchFromGitHub, runCommand, makeWrapper, jq }: let src = fetchFromGitHub { owner = "nativerv"; repo = "slpt"; rev = "8d70db4d8dfcd624ed49b9e6fb0ad449b6f25b89"; hash = "sha256-sCHZsf7Y36iAesh7BeSxy9WhE/uQv13/VWmjlaVSEcU="; }; -in writeShellScriptBin "slpt" '' - #!${pkgs.runtimeShell} - PATH=${lib.makeBinPath [ pkgs.jq ]}:$PATH - ${builtins.readFile "${src}/slpt"} +in runCommand "slpt" { + inherit src; + nativeBuildInputs = [ makeWrapper ]; +} '' + install -Dm755 "$src/slpt" "$out/bin/slpt" + patchShebangs "$out/bin/slpt" + wrapProgram "$out/bin/slpt" --prefix PATH : "${lib.makeBinPath [ jq ]}" '' diff --git a/package/windows-devshell/default.nix b/package/windows-devshell/default.nix index 562bd1e9..e31e7b4b 100644 --- a/package/windows-devshell/default.nix +++ b/package/windows-devshell/default.nix @@ -1,26 +1,10 @@ -{ pkgs, writeTextFile, lib, linux-devshell-standalone }: -let - psScriptTemplate = builtins.readFile ./windows-devshell.ps1; - - # Get the linux-devshell standalone script content and base64 encode it - linuxDevShellBase64 = lib.removeSuffix "\n" - (builtins.readFile - (pkgs.runCommand "base64-linux-devshell" {} - '' - ${pkgs.coreutils}/bin/base64 -w 0 ${linux-devshell-standalone} > $out - '')); - - # Standalone PowerShell script (single file for Windows) - windowsDevShellStandalone = writeTextFile { - name = "windows-devshell.ps1"; - executable = false; - text = lib.replaceStrings ["@LINUX_DEVSHELL_BASE64@"] [linuxDevShellBase64] psScriptTemplate; - meta = { - description = "Standalone windows-devshell PowerShell script (single file)"; - }; - }; - -in +{ pkgs, linux-devshell-standalone }: { - windows-devshell-standalone = windowsDevShellStandalone; + windows-devshell-standalone = pkgs.runCommand "windows-devshell.ps1" { + meta.description = "Standalone windows-devshell PowerShell script (single file)"; + } '' + linux_dev_shell_base64=$(${pkgs.coreutils}/bin/base64 -w 0 ${linux-devshell-standalone}) + ${pkgs.gnused}/bin/sed "s|@LINUX_DEVSHELL_BASE64@|$linux_dev_shell_base64|g" \ + ${./windows-devshell.ps1} > "$out" + ''; } diff --git a/test/package/db-tool/default.nix b/test/package/db-tool/default.nix index 0ed03998..514adc0b 100644 --- a/test/package/db-tool/default.nix +++ b/test/package/db-tool/default.nix @@ -51,7 +51,7 @@ nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ]; buildInputs = [ database dbOps postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash ]; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh test=${testDrv} export HECTIC_LOG=trace set -eu @@ -67,7 +67,7 @@ nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ]; buildInputs = [ database dbOps postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash pkgs.netcat-openbsd ]; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh test=${testDrv} export HECTIC_LOG=trace set -eu diff --git a/test/package/hemar/default.nix b/test/package/hemar/default.nix index 94426377..0d5bf8b3 100644 --- a/test/package/hemar/default.nix +++ b/test/package/hemar/default.nix @@ -37,7 +37,7 @@ nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ]; buildInputs = [ hemar pkgs.yq-go pkgs.which ]; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh test=${testDrv} ${builtins.readFile ./lauch.sh} diff --git a/test/package/linux-devshell/default.nix b/test/package/linux-devshell/default.nix index 104fb537..92a9185d 100644 --- a/test/package/linux-devshell/default.nix +++ b/test/package/linux-devshell/default.nix @@ -47,7 +47,7 @@ linuxDevShell = linuxDevShell; linuxDevShellStandalone = linuxDevShellStandalone; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh export HECTIC_LOG=trace test=${testDrv} linuxDevShell="${linuxDevShell}" @@ -64,7 +64,7 @@ linuxDevShellStandalone = linuxDevShellStandalone; archBootstrap = archBootstrap; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh export HECTIC_LOG=trace log notice "test case: ''${WHITE}arch ${name}" @@ -156,7 +156,7 @@ linuxDevShellStandalone = linuxDevShellStandalone; ubuntuBootstrap = ubuntuBootstrap; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh export HECTIC_LOG=trace log notice "test case: ''${WHITE}ubuntu ${name}" diff --git a/test/package/migrator/default.nix b/test/package/migrator/default.nix index 2f1709c5..5bb548a1 100644 --- a/test/package/migrator/default.nix +++ b/test/package/migrator/default.nix @@ -41,7 +41,7 @@ nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ]; buildInputs = [ pkgs.which migrator pkgs.postgresql ]; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh test=${testDrv} export HECTIC_LOG=trace ${builtins.readFile ./util.sh} @@ -57,7 +57,7 @@ nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ]; buildInputs = [ pkgs.which migrator pkgs.sqlite ]; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh test=${testDrv} export HECTIC_LOG=trace ${builtins.readFile ./util.sh} diff --git a/test/package/sentinèlla/default.nix b/test/package/sentinèlla/default.nix index f0a8d8cd..bcf21fde 100644 --- a/test/package/sentinèlla/default.nix +++ b/test/package/sentinèlla/default.nix @@ -34,7 +34,7 @@ nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ]; buildInputs = [ sentinella pkgs.curl pkgs.jq pkgs.socat ]; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh export HECTIC_LOG=trace test=${testDrv} ${builtins.readFile ./launch.sh} diff --git a/test/package/windows-devshell/default.nix b/test/package/windows-devshell/default.nix index 235ba8c0..980213a8 100644 --- a/test/package/windows-devshell/default.nix +++ b/test/package/windows-devshell/default.nix @@ -9,7 +9,7 @@ let nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep ]; windowsDevShellStandalone = windowsDevShellStandalone; } '' - ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log} + . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh test=${testDrv} ${builtins.readFile ./launch.sh} mkdir -p "$out"