mirror of
https://github.com/lucannez64/darling-lol.git
synced 2026-10-26 19:47:42 +00:00
41 lines
2.7 KiB
Python
41 lines
2.7 KiB
Python
#!/usr/bin/env python3
|
|
"""Validate the public source package without launching apps or installing anything."""
|
|
import ast,json,re,subprocess,sys
|
|
from pathlib import Path
|
|
from common import ROOT
|
|
subprocess.run([sys.executable,str(ROOT/'scripts/configure.py')],check=True)
|
|
try:
|
|
files=subprocess.check_output(['git','-C',str(ROOT),'ls-files','-z'],stderr=subprocess.DEVNULL).decode().split('\0')
|
|
except (OSError, subprocess.CalledProcessError):
|
|
files=[str(p.relative_to(ROOT)) for p in ROOT.rglob('*') if p.is_file() and not any(part.startswith('.') or part in ['build','__pycache__'] for part in p.relative_to(ROOT).parts)]
|
|
errors=[]
|
|
secret_patterns=[r'gh[pousr]_[A-Za-z0-9]{30,}',r'AKIA[0-9A-Z]{16}',r'eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}',r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----']
|
|
for name in filter(None,files):
|
|
p=ROOT/name;data=p.read_bytes()
|
|
if data.startswith((b'\x7fELF',b'MZ',b'\xcf\xfa\xed\xfe',b'\xca\xfe\xba\xbe')) or b'\0' in data:
|
|
errors.append(name+': binary content is not part of this source package');continue
|
|
try:text=data.decode()
|
|
except UnicodeDecodeError:errors.append(name+': non-UTF8 content');continue
|
|
if re.search(r'/(?:home|Users)/' + 'hi' + 'rew' + r'(?:/|\b)',text):
|
|
errors.append(name+': development-machine path')
|
|
if any(re.search(pattern,text) for pattern in secret_patterns):errors.append(name+': possible credential; review before publishing')
|
|
if name.split('/')[0] in ['build','logs','Config','Library'] or p.suffix in ['.dylib','.so','.asar','.perf','.zip']:
|
|
errors.append(name+': local artifact')
|
|
for p in list((ROOT/'scripts').glob('*.py'))+list((ROOT/'build/runtime/tools').glob('*.py')):
|
|
try:ast.parse(p.read_text(),filename=str(p))
|
|
except SyntaxError as e:errors.append(p.name+': '+str(e))
|
|
for p in list((ROOT/'scripts').glob('*.sh'))+list((ROOT/'build/runtime/tools').glob('*.sh')):
|
|
result=subprocess.run(['bash','-n',str(p)],capture_output=True,text=True)
|
|
if result.returncode:errors.append(p.name+': shell syntax error')
|
|
manifest=json.loads((ROOT/'upstream/manifest.json').read_text())
|
|
for c in manifest['components']:
|
|
if not re.fullmatch('[0-9a-f]{40}',c['revision']):errors.append(c['path']+': invalid pinned revision')
|
|
if not (ROOT/c['patch']).is_file():errors.append(c['path']+': patch missing')
|
|
else:
|
|
parsed=subprocess.run(['git','apply','--numstat','-'],input=(ROOT/c['patch']).read_text(),
|
|
text=True,capture_output=True)
|
|
if parsed.returncode:errors.append(c['patch']+': '+parsed.stderr.strip())
|
|
if errors:
|
|
print('\n'.join(errors));raise SystemExit(1)
|
|
print('PASS: tracked source audit, rendered Python/shell syntax and',len(manifest['components']),'pinned patch entries')
|