refactor: modularize audit and harden build validation

2026-08-31 21:22:16 +03:00
parent bb22ccfafe
commit ac4bc0b2b7
78 changed files with 13598 additions and 13130 deletions
@@ -0,0 +1,98 @@
+#!/bin/sh
+set -eu
+
+BUILDER_DIR="$(CDPATH= cd -- "$(dirname "$0")" && pwd)"
+TEST_ROOT="$(mktemp -d)"
+trap 'rm -rf "$TEST_ROOT"' EXIT INT TERM HUP
+
+PROJECT_VERSION_EFFECTIVE="13.0-test"
+BEE_ISO_VOLUME="EASY_BEE_TEST"
+LOG_DIR="$TEST_ROOT/log"
+mkdir -p "$LOG_DIR"
+
+. "$BUILDER_DIR/lib/iso-validation.sh"
+. "$BUILDER_DIR/lib/bootloader.sh"
+
+literal_template="$TEST_ROOT/literal-template"
+literal_output="$TEST_ROOT/literal-output"
+printf '%s\n' '@VERSION@ @KERNEL@ @APPEND_LIVE@ @INITRD@' > "$literal_template"
+render_bootloader_template "$literal_template" "$literal_output" \
+    '13&0#test' '@KERNEL@' '/live/vmlinuz\\literal' 'boot=live marker=a&b#c\\d' '@INITRD@' '/live/initrd.img'
+literal_expected='13&0#test /live/vmlinuz\\literal boot=live marker=a&b#c\\d /live/initrd.img'
+if [ "$(cat "$literal_output")" != "$literal_expected" ]; then
+    echo "ERROR: bootloader renderer changed literal replacement characters" >&2
+    exit 1
+fi
+
+rendered_grub="$TEST_ROOT/grub.cfg"
+rendered_isolinux="$TEST_ROOT/live.cfg"
+sed \
+    -e 's#@APPEND_LIVE@#boot=live live-media-label=EASY_BEE_TEST#g' \
+    -e 's#@KERNEL_LIVE@#/live/vmlinuz#g' \
+    -e 's#@INITRD_LIVE@#/live/initrd.img#g' \
+    -e 's#@VERSION@#13.0-test#g' \
+    "$BUILDER_DIR/config/bootloaders/grub-efi/grub.cfg" > "$rendered_grub"
+sed \
+    -e 's#@APPEND_LIVE@#boot=live live-media-label=EASY_BEE_TEST#g' \
+    -e 's#@LINUX@#/live/vmlinuz#g' \
+    -e 's#@INITRD@#/live/initrd.img#g' \
+    -e 's#@VERSION@#13.0-test#g' \
+    "$BUILDER_DIR/config/bootloaders/isolinux/live.cfg.in" > "$rendered_isolinux"
+
+validate_live_cmdline_params "$rendered_grub" linux GRUB "$BEE_ISO_VOLUME"
+validate_live_cmdline_params "$rendered_isolinux" append isolinux "$BEE_ISO_VOLUME"
+
+missing_serialization="$TEST_ROOT/missing-serialization.cfg"
+sed 's/ udev\.children_max=1//' "$rendered_grub" > "$missing_serialization"
+if validate_live_cmdline_params "$missing_serialization" linux GRUB "$BEE_ISO_VOLUME" >/dev/null 2>&1; then
+    echo "ERROR: validator accepted a live entry without udev.children_max=1" >&2
+    exit 1
+fi
+
+CACHE_ROOT="$TEST_ROOT/cache"
+BUILD_VARIANT="test"
+BUILD_WORK_DIR="$TEST_ROOT/work"
+OVERLAY_STAGE_DIR="$TEST_ROOT/overlay"
+DEBIAN_KERNEL_ABI="6.1.0-test"
+SQUASHFS_FILENAME="filesystem-v13.0-test.squashfs"
+DIST_DIR="$TEST_ROOT/dist"
+mkdir -p "$BUILD_WORK_DIR/binary/live" "$OVERLAY_STAGE_DIR"
+touch "$BUILD_WORK_DIR/live-image-amd64.hybrid.iso"
+touch "$BUILD_WORK_DIR/binary/live/$SQUASHFS_FILENAME"
+
+. "$BUILDER_DIR/lib/fast-path.sh"
+
+# Isolate the decision test from repository content and GNU find extensions.
+hash_heavy_config() { printf '%s\n' test-heavy-hash; }
+write_overlay_manifest() { find "$OVERLAY_STAGE_DIR" -mindepth 1 -print | sed "s#^$OVERLAY_STAGE_DIR/##" | sort > "$1"; }
+
+printf '%s\n' test-heavy-hash > "$FULL_BUILD_HASH_FILE"
+printf '%s\n' "$DEBIAN_KERNEL_ABI" > "$FULL_BUILD_ABI_FILE"
+write_overlay_manifest "$FULL_BUILD_OVERLAY_MANIFEST"
+touch "$FULL_BUILD_MARKER"
+
+if needs_full_build; then
+    echo "ERROR: fast path was rejected for unchanged valid state" >&2
+    exit 1
+fi
+
+touch "$OVERLAY_STAGE_DIR/added-by-fast-path"
+if needs_full_build; then
+    echo "ERROR: an additive overlay change unnecessarily forced a full build" >&2
+    exit 1
+fi
+write_overlay_manifest "$FULL_BUILD_OVERLAY_MANIFEST"
+rm "$OVERLAY_STAGE_DIR/added-by-fast-path"
+if ! needs_full_build >/dev/null; then
+    echo "ERROR: removal from the latest fast-path overlay was not detected" >&2
+    exit 1
+fi
+touch "$OVERLAY_STAGE_DIR/added-by-fast-path"
+
+printf '%s\n' different-abi > "$FULL_BUILD_ABI_FILE"
+if ! needs_full_build >/dev/null; then
+    echo "ERROR: kernel ABI change did not force a full build" >&2
+    exit 1
+fi
+
+echo "build library tests: OK"