refactor: modularize audit and harden build validation

2026-08-31 21:22:16 +03:00
parent bb22ccfafe
commit ac4bc0b2b7
78 changed files with 13598 additions and 13130 deletions
@@ -0,0 +1,146 @@
+extract_live_grub_entry() {
+    cfg="$1"
+    live_linux="$(awk '/^[[:space:]]*linux[[:space:]]+\/live\// { print; exit }' "$cfg")"
+    live_initrd="$(awk '/^[[:space:]]*initrd[[:space:]]+\/live\// { print; exit }' "$cfg")"
+    [ -n "$live_linux" ] || return 1
+    [ -n "$live_initrd" ] || return 1
+
+    grub_kernel="$(printf '%s\n' "$live_linux" | awk '{print $2}')"
+    grub_append="$(printf '%s\n' "$live_linux" | cut -d' ' -f3-)"
+    grub_initrd="$(printf '%s\n' "$live_initrd" | awk '{print $2}')"
+    [ -n "$grub_kernel" ] || return 1
+    [ -n "$grub_append" ] || return 1
+    [ -n "$grub_initrd" ] || return 1
+    return 0
+}
+
+load_live_build_append() {
+    lb_dir="$1"
+    binary_cfg="$lb_dir/config/binary"
+    [ -f "$binary_cfg" ] || return 1
+
+    # config/binary is generated by live-build and contains shell variable
+    # assignments such as LB_BOOTAPPEND_LIVE="boot=live ...".
+    # shellcheck disable=SC1090
+    . "$binary_cfg"
+
+    [ -n "${LB_BOOTAPPEND_LIVE:-}" ] || return 1
+    live_build_append="$LB_BOOTAPPEND_LIVE"
+    return 0
+}
+
+extract_live_isolinux_entry() {
+    cfg="$1"
+    isolinux_linux="$(awk '/^[[:space:]]*linux[[:space:]]+\/live\// { print; exit }' "$cfg")"
+    isolinux_initrd="$(awk '/^[[:space:]]*initrd[[:space:]]+\/live\// { print; exit }' "$cfg")"
+    isolinux_append="$(awk '/^[[:space:]]*append[[:space:]]+/ { sub(/^[[:space:]]*append[[:space:]]+/, ""); print; exit }' "$cfg")"
+    [ -n "$isolinux_linux" ] || return 1
+    [ -n "$isolinux_initrd" ] || return 1
+    [ -n "$isolinux_append" ] || return 1
+
+    isolinux_kernel="$(printf '%s\n' "$isolinux_linux" | awk '{print $2}')"
+    isolinux_initrd_path="$(printf '%s\n' "$isolinux_initrd" | awk '{print $2}')"
+    [ -n "$isolinux_kernel" ] || return 1
+    [ -n "$isolinux_initrd_path" ] || return 1
+    return 0
+}
+
+write_canonical_grub_cfg() {
+    cfg="$1"
+    kernel="$2"
+    append_live="$3"
+    initrd="$4"
+    version_label="${PROJECT_VERSION_EFFECTIVE}"
+
+    template="${BUILDER_DIR}/config/bootloaders/grub-efi/grub.cfg"
+    tmp_cfg="${cfg}.new"
+    render_bootloader_template "$template" "$tmp_cfg" \
+        "$version_label" "@KERNEL_LIVE@" "$kernel" "$append_live" "@INITRD_LIVE@" "$initrd"
+    mv "$tmp_cfg" "$cfg"
+}
+
+write_canonical_isolinux_cfg() {
+    cfg="$1"
+    kernel="$2"
+    initrd="$3"
+    append_live="$4"
+    version_label="${PROJECT_VERSION_EFFECTIVE}"
+
+    template="${BUILDER_DIR}/config/bootloaders/isolinux/live.cfg.in"
+    tmp_cfg="${cfg}.new"
+    render_bootloader_template "$template" "$tmp_cfg" \
+        "$version_label" "@LINUX@" "$kernel" "$append_live" "@INITRD@" "$initrd"
+    mv "$tmp_cfg" "$cfg"
+}
+
+# Render literal placeholders without sed replacement-string semantics. Values
+# containing '&', backslashes, or the sed delimiter must be copied unchanged.
+render_bootloader_template() {
+    template="$1"
+    output="$2"
+    version="$3"
+    kernel_placeholder="$4"
+    kernel="$5"
+    append_live="$6"
+    initrd_placeholder="$7"
+    initrd="$8"
+
+    BEE_RENDER_VERSION="$version" \
+    BEE_RENDER_KERNEL_PLACEHOLDER="$kernel_placeholder" \
+    BEE_RENDER_KERNEL="$kernel" \
+    BEE_RENDER_APPEND="$append_live" \
+    BEE_RENDER_INITRD_PLACEHOLDER="$initrd_placeholder" \
+    BEE_RENDER_INITRD="$initrd" \
+    awk '
+        function replace_literal(text, needle, replacement, at) {
+            while ((at = index(text, needle)) != 0) {
+                text = substr(text, 1, at - 1) replacement substr(text, at + length(needle))
+            }
+            return text
+        }
+        {
+            version = ENVIRON["BEE_RENDER_VERSION"]
+            kernel_placeholder = ENVIRON["BEE_RENDER_KERNEL_PLACEHOLDER"]
+            kernel = ENVIRON["BEE_RENDER_KERNEL"]
+            append_live = ENVIRON["BEE_RENDER_APPEND"]
+            initrd_placeholder = ENVIRON["BEE_RENDER_INITRD_PLACEHOLDER"]
+            initrd = ENVIRON["BEE_RENDER_INITRD"]
+            line = replace_literal($0, "@VERSION@", version)
+            line = replace_literal(line, kernel_placeholder, kernel)
+            line = replace_literal(line, "@APPEND_LIVE@", append_live)
+            line = replace_literal(line, initrd_placeholder, initrd)
+            print line
+        }
+    ' "$template" > "$output"
+}
+
+enforce_live_build_bootloader_assets() {
+    lb_dir="$1"
+    grub_cfg="$lb_dir/binary/boot/grub/grub.cfg"
+    grub_dir="$lb_dir/binary/boot/grub"
+    isolinux_cfg="$lb_dir/binary/isolinux/live.cfg"
+
+    if ! load_live_build_append "$lb_dir"; then
+        echo "bootloader sync: WARNING: could not load LB_BOOTAPPEND_LIVE from $lb_dir/config/binary" >&2
+        live_build_append=""
+    fi
+
+    if [ -f "$grub_cfg" ]; then
+        if extract_live_grub_entry "$grub_cfg"; then
+            cp "${BUILDER_DIR}/config/bootloaders/grub-efi/config.cfg" "$grub_dir/config.cfg"
+            write_canonical_grub_cfg "$grub_cfg" "$grub_kernel" "${live_build_append:-$grub_append}" "$grub_initrd"
+            echo "bootloader sync: rewrote binary/boot/grub/grub.cfg with canonical EASY-BEE menu"
+        else
+            echo "bootloader sync: WARNING: could not extract live entry from $grub_cfg" >&2
+        fi
+    fi
+
+    if [ -f "$isolinux_cfg" ]; then
+        if extract_live_isolinux_entry "$isolinux_cfg"; then
+            write_canonical_isolinux_cfg "$isolinux_cfg" "$isolinux_kernel" "$isolinux_initrd_path" "${live_build_append:-$isolinux_append}"
+            echo "bootloader sync: rewrote binary/isolinux/live.cfg with canonical EASY-BEE menu"
+        else
+            echo "bootloader sync: WARNING: could not extract live entry from $isolinux_cfg" >&2
+        fi
+    fi
+}