Fix: Pin runtime and agent artifacts
This commit is contained in:
Gabriel Brown
+271
-80
@@ -107,72 +107,273 @@ install_list() {
|
||||
fi
|
||||
}
|
||||
|
||||
# --- Node and pnpm, through nvm ----------------------------------------------
|
||||
#
|
||||
# nvm is a shell function rather than a binary, so it has to be sourced before
|
||||
# it can be used at all -- and its script reads variables that `set -u` above
|
||||
# treats as fatal, so the strictness is lifted for exactly that source and put
|
||||
# straight back.
|
||||
#
|
||||
# Deliberately not dnf's nodejs: config/bash/shell switches Node per project
|
||||
# from .nvmrc, and a system Node earlier on PATH would win every switch, leaving
|
||||
# `nvm use` looking like it did nothing.
|
||||
#
|
||||
# pnpm goes inside the nvm-managed Node rather than beside it as its own dnf
|
||||
# package, so it travels with the version it belongs to instead of outliving it.
|
||||
setup_node() {
|
||||
if [[ -s /etc/profile.d/nvm.sh ]]; then
|
||||
log "Installing the latest Node LTS through nvm"
|
||||
# --- Reviewed language runtimes and agent tools ------------------------------
|
||||
|
||||
_record_installer_failure() {
|
||||
local component="$1"
|
||||
log "$component install did not complete; continuing"
|
||||
softly_failed+=("$component")
|
||||
return 1
|
||||
}
|
||||
|
||||
_set_artifact_arch() {
|
||||
local machine_arch
|
||||
machine_arch="$(uname -m)" || return 1
|
||||
case "$machine_arch" in
|
||||
x86_64) artifact_arch=X86_64 ;;
|
||||
aarch64) artifact_arch=AARCH64 ;;
|
||||
*) log "Unsupported architecture: $machine_arch"; return 1 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
_archive_member_is_safe() {
|
||||
local member="$1" expected_top="$2"
|
||||
[[ -n "$member" && "$member" != /* && "$member" != *'//'*
|
||||
&& ! "$member" =~ (^|/)\.\.?(/|$)
|
||||
&& ( "$member" == "$expected_top" || "$member" == "$expected_top/" \
|
||||
|| "$member" == "$expected_top/"* ) ]]
|
||||
}
|
||||
|
||||
_tree_links_stay_inside() {
|
||||
local root="$1" link resolved
|
||||
while IFS= read -r -d '' link; do
|
||||
resolved="$(realpath -m -- "$link")" || return 1
|
||||
[[ "$resolved" == "$root" || "$resolved" == "$root/"* ]] || return 1
|
||||
done < <(find "$root" -type l -print0)
|
||||
}
|
||||
|
||||
_atomic_symlink() {
|
||||
local target="$1" destination="$2" directory temporary
|
||||
directory="$(dirname -- "$destination")"
|
||||
mkdir -p -- "$directory" || return 1
|
||||
temporary="$(mktemp "$directory/.$(basename -- "$destination").link.XXXXXX")" || return 1
|
||||
rm -f -- "$temporary" || return 1
|
||||
ln -s -- "$target" "$temporary" || return 1
|
||||
if ! mv -Tf -- "$temporary" "$destination"; then
|
||||
rm -f -- "$temporary"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
_load_nvm() {
|
||||
local nvm_script="$PANAMA_SYSTEM_ETC/profile.d/nvm.sh"
|
||||
[[ -s "$nvm_script" ]] || return 1
|
||||
set +u
|
||||
# shellcheck source=/dev/null
|
||||
source /etc/profile.d/nvm.sh
|
||||
if nvm install --lts >/dev/null 2>&1; then
|
||||
nvm alias default 'lts/*' >/dev/null 2>&1 || true
|
||||
npm install -g pnpm >/dev/null 2>&1 || { log "pnpm did not install"; softly_failed+=("pnpm"); }
|
||||
log "Node $(node --version 2>/dev/null) with pnpm $(pnpm --version 2>/dev/null)"
|
||||
else
|
||||
log "nvm could not install Node; skipping"; softly_failed+=("Node (nvm)")
|
||||
fi
|
||||
source "$nvm_script"
|
||||
set -u
|
||||
else
|
||||
log "nvm is not installed, so Node was not set up"
|
||||
fi
|
||||
declare -F nvm >/dev/null
|
||||
}
|
||||
|
||||
# --- Applications no repository packages -------------------------------------
|
||||
#
|
||||
# Everything else Panama installs comes from dnf or Flathub. These do not
|
||||
# exist in either, so each is an explicit exception with a reason, and each is
|
||||
# skipped when already present so a re-run costs nothing.
|
||||
#
|
||||
# None of them pins a version. sunhat pinned URLs -- upscayl 2.11.5, LACT 0.5.4,
|
||||
# a fedora-40 RPM -- and every one of them was a 404 within a release cycle. An
|
||||
# installer that resolves "latest" keeps working; one that names a version rots.
|
||||
#
|
||||
# A failure here is logged and stepped over rather than aborting: an
|
||||
# unreachable third-party host should not cost the rest of the run.
|
||||
_install_node() {
|
||||
local artifact_arch machine_arch archive_top parent target stage archive extract listing member
|
||||
_set_artifact_arch || return 1
|
||||
_load_nvm || return 1
|
||||
case "$artifact_arch" in
|
||||
X86_64) machine_arch=x64 ;;
|
||||
AARCH64) machine_arch=arm64 ;;
|
||||
esac
|
||||
archive_top="node-v${INSTALLER_PROVENANCE[NODE_VERSION]}-linux-$machine_arch"
|
||||
parent="${NVM_DIR:-$HOME/.nvm}/versions/node"
|
||||
target="$parent/v${INSTALLER_PROVENANCE[NODE_VERSION]}"
|
||||
if [[ -e "$target" || -L "$target" ]]; then
|
||||
[[ -d "$target" && ! -L "$target" && -x "$target/bin/node"
|
||||
&& "$($target/bin/node --version 2>/dev/null)" == "v${INSTALLER_PROVENANCE[NODE_VERSION]}" ]] \
|
||||
|| return 1
|
||||
nvm alias default "${INSTALLER_PROVENANCE[NODE_VERSION]}" >/dev/null 2>&1 || return 1
|
||||
return 0
|
||||
fi
|
||||
mkdir -p -- "$parent" || return 1
|
||||
stage="$(mktemp -d "$parent/.v${INSTALLER_PROVENANCE[NODE_VERSION]}.stage.XXXXXX")" \
|
||||
|| return 1
|
||||
chmod 0700 "$stage"
|
||||
archive="$stage/artifact"
|
||||
extract="$stage/extract"
|
||||
mkdir -m 0700 "$extract" || { rm -rf -- "$stage"; return 1; }
|
||||
if ! download_sha256 "${INSTALLER_PROVENANCE[NODE_${artifact_arch}_URL]}" \
|
||||
"${INSTALLER_PROVENANCE[NODE_${artifact_arch}_SHA256]}" \
|
||||
"${INSTALLER_PROVENANCE[NODE_${artifact_arch}_MAX_BYTES]}" "$archive"; then
|
||||
rm -rf -- "$stage"
|
||||
return 1
|
||||
fi
|
||||
listing="$(tar -tJf "$archive")" || { rm -rf -- "$stage"; return 1; }
|
||||
[[ -n "$listing" ]] || { rm -rf -- "$stage"; return 1; }
|
||||
while IFS= read -r member; do
|
||||
_archive_member_is_safe "$member" "$archive_top" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
done <<<"$listing"
|
||||
tar -xJf "$archive" --no-same-owner --no-same-permissions -C "$extract" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
[[ -d "$extract/$archive_top" && ! -L "$extract/$archive_top"
|
||||
&& -x "$extract/$archive_top/bin/node"
|
||||
&& "$($extract/$archive_top/bin/node --version 2>/dev/null)" \
|
||||
== "v${INSTALLER_PROVENANCE[NODE_VERSION]}" ]] \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
_tree_links_stay_inside "$extract/$archive_top" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
mv -- "$extract/$archive_top" "$target" || { rm -rf -- "$stage"; return 1; }
|
||||
rm -rf -- "$stage"
|
||||
nvm alias default "${INSTALLER_PROVENANCE[NODE_VERSION]}" >/dev/null 2>&1
|
||||
}
|
||||
|
||||
install_node() {
|
||||
_install_node || _record_installer_failure Node
|
||||
}
|
||||
|
||||
# Kept as the call-site name used by the desktop-first ordering contract.
|
||||
setup_node() {
|
||||
install_node
|
||||
}
|
||||
|
||||
install_pnpm() {
|
||||
if sudo dnf install -y pnpm >/dev/null; then
|
||||
return 0
|
||||
fi
|
||||
_record_installer_failure pnpm
|
||||
}
|
||||
|
||||
_install_bun() {
|
||||
local artifact_arch archive_top target bin_link parent stage archive listing
|
||||
local staged_binary version_dir
|
||||
_set_artifact_arch || return 1
|
||||
case "$artifact_arch" in
|
||||
X86_64) archive_top=bun-linux-x64 ;;
|
||||
AARCH64) archive_top=bun-linux-aarch64 ;;
|
||||
esac
|
||||
version_dir="$HOME/.bun/versions/${INSTALLER_PROVENANCE[BUN_VERSION]}"
|
||||
target="$version_dir/bin/bun"
|
||||
bin_link="$HOME/.bun/bin/bun"
|
||||
if [[ -e "$version_dir" || -L "$version_dir" ]]; then
|
||||
[[ -d "$version_dir" && ! -L "$version_dir" && -x "$target"
|
||||
&& "$($target --version 2>/dev/null)" == "${INSTALLER_PROVENANCE[BUN_VERSION]}" ]] \
|
||||
|| return 1
|
||||
[[ -L "$bin_link" && "$(readlink -- "$bin_link")" == "$target" ]] \
|
||||
|| _atomic_symlink "$target" "$bin_link"
|
||||
return
|
||||
fi
|
||||
parent="$HOME/.bun/versions"
|
||||
mkdir -p -- "$parent" || return 1
|
||||
stage="$(mktemp -d "$parent/.${INSTALLER_PROVENANCE[BUN_VERSION]}.stage.XXXXXX")" \
|
||||
|| return 1
|
||||
chmod 0700 "$stage"
|
||||
archive="$stage/artifact"
|
||||
if ! download_sha256 "${INSTALLER_PROVENANCE[BUN_${artifact_arch}_URL]}" \
|
||||
"${INSTALLER_PROVENANCE[BUN_${artifact_arch}_SHA256]}" \
|
||||
"${INSTALLER_PROVENANCE[BUN_${artifact_arch}_MAX_BYTES]}" "$archive"; then
|
||||
rm -rf -- "$stage"
|
||||
return 1
|
||||
fi
|
||||
listing="$(unzip -Z1 "$archive")" || { rm -rf -- "$stage"; return 1; }
|
||||
[[ "$listing" == "$archive_top/bun" ]] || { rm -rf -- "$stage"; return 1; }
|
||||
_archive_member_is_safe "$listing" "$archive_top" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
mkdir -m 0700 "$stage/extract" "$stage/version" "$stage/version/bin" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
unzip -q "$archive" -d "$stage/extract" || { rm -rf -- "$stage"; return 1; }
|
||||
staged_binary="$stage/extract/$archive_top/bun"
|
||||
[[ -f "$staged_binary" && ! -L "$staged_binary" && -x "$staged_binary"
|
||||
&& "$($staged_binary --version 2>/dev/null)" == "${INSTALLER_PROVENANCE[BUN_VERSION]}" ]] \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
mv -- "$staged_binary" "$stage/version/bin/bun" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
mv -- "$stage/version" "$version_dir" || { rm -rf -- "$stage"; return 1; }
|
||||
rm -rf -- "$stage"
|
||||
_atomic_symlink "$target" "$bin_link"
|
||||
}
|
||||
|
||||
# Bun: the JavaScript runtime and package manager. No RPM, no flatpak.
|
||||
install_bun() {
|
||||
if [[ -x "$HOME/.bun/bin/bun" ]]; then
|
||||
log "Bun already installed at \"$HOME/.bun/bin/bun\""
|
||||
else
|
||||
log "Installing Bun via curl..."
|
||||
curl -fsSL https://bun.sh/install | bash > /dev/null 2>&1 || { log "Bun install failed; skipping"; softly_failed+=("Bun"); }
|
||||
fi
|
||||
_install_bun || _record_installer_failure Bun
|
||||
}
|
||||
|
||||
# Codex: OpenAI's CLI. Distributed through npm, which is why this runs after
|
||||
# setup_node -- the nvm-managed Node is the one it should land in.
|
||||
install_codex() {
|
||||
if command -v codex >/dev/null 2>&1; then
|
||||
log "Codex already installed at \"$(command -v codex)\""
|
||||
elif command -v npm >/dev/null 2>&1; then
|
||||
log "Installing Codex via npm..."
|
||||
npm install -g @openai/codex >/dev/null 2>&1 || { log "Codex install failed; skipping"; softly_failed+=("Codex"); }
|
||||
else
|
||||
log "npm is not available, so Codex was not installed"; softly_failed+=("Codex")
|
||||
_codex_version_matches() {
|
||||
local binary="$1" output version_pattern
|
||||
output="$($binary --version 2>/dev/null)" || return 1
|
||||
version_pattern="${INSTALLER_PROVENANCE[CODEX_VERSION]//./\\.}"
|
||||
[[ "$output" =~ (^|[^0-9])${version_pattern}([^0-9]|$) ]]
|
||||
}
|
||||
|
||||
_install_codex() {
|
||||
local artifact_arch machine_arch archive_name version_dir target bin_link parent
|
||||
local stage archive listing staged_binary
|
||||
_set_artifact_arch || return 1
|
||||
case "$artifact_arch" in
|
||||
X86_64) machine_arch=x86_64 ;;
|
||||
AARCH64) machine_arch=aarch64 ;;
|
||||
esac
|
||||
archive_name="codex-$machine_arch-unknown-linux-musl"
|
||||
version_dir="$HOME/.local/lib/panama/codex/${INSTALLER_PROVENANCE[CODEX_VERSION]}"
|
||||
target="$version_dir/codex"
|
||||
bin_link="$HOME/.local/bin/codex"
|
||||
if [[ -e "$version_dir" || -L "$version_dir" ]]; then
|
||||
[[ -d "$version_dir" && ! -L "$version_dir" && -x "$target" ]] || return 1
|
||||
_codex_version_matches "$target" || return 1
|
||||
[[ -L "$bin_link" && "$(readlink -- "$bin_link")" == "$target" ]] \
|
||||
|| _atomic_symlink "$target" "$bin_link"
|
||||
return
|
||||
fi
|
||||
parent="$HOME/.local/lib/panama/codex"
|
||||
mkdir -p -- "$parent" || return 1
|
||||
stage="$(mktemp -d "$parent/.${INSTALLER_PROVENANCE[CODEX_VERSION]}.stage.XXXXXX")" \
|
||||
|| return 1
|
||||
chmod 0700 "$stage"
|
||||
archive="$stage/artifact"
|
||||
if ! download_sha256 "${INSTALLER_PROVENANCE[CODEX_${artifact_arch}_URL]}" \
|
||||
"${INSTALLER_PROVENANCE[CODEX_${artifact_arch}_SHA256]}" \
|
||||
"${INSTALLER_PROVENANCE[CODEX_${artifact_arch}_MAX_BYTES]}" "$archive"; then
|
||||
rm -rf -- "$stage"
|
||||
return 1
|
||||
fi
|
||||
listing="$(tar -tzf "$archive")" || { rm -rf -- "$stage"; return 1; }
|
||||
[[ "$listing" == "$archive_name" ]] || { rm -rf -- "$stage"; return 1; }
|
||||
[[ "$listing" != /* && ! "$listing" =~ (^|/)\.\.?(/|$) ]] \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
mkdir -m 0700 "$stage/extract" "$stage/version" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
tar -xzf "$archive" --no-same-owner --no-same-permissions -C "$stage/extract" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
staged_binary="$stage/extract/$archive_name"
|
||||
[[ -f "$staged_binary" && ! -L "$staged_binary" && -x "$staged_binary" ]] \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
_codex_version_matches "$staged_binary" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
mv -- "$staged_binary" "$stage/version/codex" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
mv -- "$stage/version" "$version_dir" || { rm -rf -- "$stage"; return 1; }
|
||||
rm -rf -- "$stage"
|
||||
_atomic_symlink "$target" "$bin_link"
|
||||
}
|
||||
|
||||
install_codex() {
|
||||
_install_codex || _record_installer_failure Codex
|
||||
}
|
||||
|
||||
_install_rustdesk() {
|
||||
local artifact_arch installed_version="" work rpm_path status=0
|
||||
_set_artifact_arch || return 1
|
||||
if [[ "$artifact_arch" == AARCH64 ]]; then
|
||||
log "RustDesk ${INSTALLER_PROVENANCE[RUSTDESK_VERSION]} has no reviewed aarch64 RPM"
|
||||
return 1
|
||||
fi
|
||||
installed_version="$(rpm -q --queryformat '%{VERSION}' rustdesk 2>/dev/null)" || true
|
||||
if [[ "$installed_version" == "${INSTALLER_PROVENANCE[RUSTDESK_VERSION]}" ]]; then
|
||||
return 0
|
||||
fi
|
||||
work="$(mktemp -d)" || return 1
|
||||
chmod 0700 "$work"
|
||||
rpm_path="$work/rustdesk.rpm"
|
||||
if ! download_sha256 "${INSTALLER_PROVENANCE[RUSTDESK_X86_64_URL]}" \
|
||||
"${INSTALLER_PROVENANCE[RUSTDESK_X86_64_SHA256]}" \
|
||||
"${INSTALLER_PROVENANCE[RUSTDESK_X86_64_MAX_BYTES]}" "$rpm_path"; then
|
||||
rm -rf -- "$work"
|
||||
return 1
|
||||
fi
|
||||
sudo dnf install -y --setopt=localpkg_gpgcheck=1 "$rpm_path" >/dev/null || status=$?
|
||||
rm -rf -- "$work"
|
||||
return "$status"
|
||||
}
|
||||
|
||||
install_rustdesk() {
|
||||
_install_rustdesk || _record_installer_failure RustDesk
|
||||
}
|
||||
|
||||
# --- What was stepped over ---------------------------------------------------
|
||||
@@ -713,7 +914,7 @@ ensure_flathub_remote() {
|
||||
return "$status"
|
||||
}
|
||||
|
||||
install_claude_code() {
|
||||
_install_claude_code() {
|
||||
local work staged_key staged_repo status
|
||||
if command -v claude >/dev/null 2>&1; then
|
||||
log "Claude Code already installed at \"$(command -v claude)\""
|
||||
@@ -750,6 +951,10 @@ install_claude_code() {
|
||||
return "$status"
|
||||
}
|
||||
|
||||
install_claude_code() {
|
||||
_install_claude_code || _record_installer_failure "Claude Code"
|
||||
}
|
||||
|
||||
_claude_desktop_manual() {
|
||||
log "Claude Desktop is optional; configure its reviewed local-key repository manually to install it"
|
||||
}
|
||||
@@ -811,10 +1016,13 @@ if [[ "$ROLE" == server ]]; then
|
||||
sudo dnf update -y --refresh > /dev/null
|
||||
install_list core-packages "Core"
|
||||
install_list server-packages "Server"
|
||||
set +e
|
||||
setup_node
|
||||
install_pnpm
|
||||
install_bun
|
||||
install_claude_code
|
||||
install_codex
|
||||
set -e
|
||||
report_soft_failures
|
||||
exit 0
|
||||
fi
|
||||
@@ -931,10 +1139,13 @@ else
|
||||
log "Package list was not in specified path: $DEV_FILE"
|
||||
fi
|
||||
|
||||
set +e
|
||||
setup_node
|
||||
install_pnpm
|
||||
install_bun
|
||||
install_claude_code
|
||||
install_codex
|
||||
set -e
|
||||
|
||||
# Claude Desktop remains optional. Panama never downloads its community setup
|
||||
# script; only a repository an operator has already configured with the exact
|
||||
@@ -944,29 +1155,9 @@ if ! install_claude_desktop_if_trusted; then
|
||||
softly_failed+=("Claude Desktop")
|
||||
fi
|
||||
|
||||
# RustDesk: remote desktop. The flatpak cannot register the root-owned system
|
||||
# service that unattended access needs -- see panama-doctor's rustdesk check --
|
||||
# so this takes the RPM. The download URL is resolved from the latest release
|
||||
# rather than written down, so it does not go stale.
|
||||
if rpm -q rustdesk >/dev/null 2>&1; then
|
||||
log "RustDesk already installed"
|
||||
else
|
||||
log "Resolving the latest RustDesk release..."
|
||||
# `|| true` because a failed curl -- unauthenticated GitHub API calls get
|
||||
# rate-limited -- would otherwise trip set -e and kill the stage before the
|
||||
# empty-result fallback below could do its job.
|
||||
rustdesk_url="$(curl -fsSL https://api.github.com/repos/rustdesk/rustdesk/releases/latest 2>/dev/null \
|
||||
| jq -r --arg arch "$(uname -m)" '.assets[].browser_download_url | select(test($arch + "\\.rpm$")) | select(test("suse") | not)' \
|
||||
| head -1 || true)"
|
||||
if [[ -n "$rustdesk_url" ]]; then
|
||||
log "Installing RustDesk from $rustdesk_url"
|
||||
# The RPM ships rustdesk.service already enabled, which is what provides
|
||||
# unattended access; Panama deliberately does not start it a second time.
|
||||
sudo dnf install -y "$rustdesk_url" > /dev/null || { log "RustDesk install failed; skipping"; softly_failed+=("RustDesk"); }
|
||||
else
|
||||
log "Could not resolve a RustDesk release; skipping"; softly_failed+=("RustDesk")
|
||||
fi
|
||||
fi
|
||||
# The RPM ships rustdesk.service already enabled, which is what provides
|
||||
# unattended access; Panama deliberately does not start it a second time.
|
||||
install_rustdesk || true
|
||||
|
||||
# --- Install Flatpak Packages ---
|
||||
FLATPAK_FILE="$PANAMA_PATH/setup/packages/flatpak-packages"
|
||||
|
||||
@@ -36,7 +36,7 @@ SHELL_WORDS='^(if|then|else|elif|fi|for|while|until|do|done|case|esac|in|functio
|
||||
# authselect is on the list for the same reason: it manages Fedora's PAM and
|
||||
# nsswitch profiles and arrives with fprintd-pam, realmd and nss-mdns, so the
|
||||
# fingerprint aliases in config/bash can rely on it without declaring it.
|
||||
BASELINE='^(sh|bash|cat|cut|sed|awk|gawk|grep|egrep|head|tail|sort|uniq|tr|wc|find|xargs|basename|dirname|mkdir|rm|cp|mv|ln|chmod|chown|stat|df|du|date|sleep|env|id|tee|touch|mktemp|readlink|realpath|seq|comm|join|paste|od|file|nl|fold|column|tput|timeout|flock|install|sha256sum|md5sum|base64|nproc|uptime|free|uname|hostname|whoami|ps|pgrep|pkill|kill|killall|lsblk|mount|umount|sudo|su|rpm|dnf|flatpak|git|python3|ss|ip|ls|rfkill|lsof|authselect|setsid|nohup|grub2-mkconfig|sysctl)$'
|
||||
BASELINE='^(sh|bash|cat|cut|sed|awk|gawk|grep|egrep|head|tail|sort|uniq|tr|wc|find|xargs|basename|dirname|mkdir|rm|cp|mv|ln|chmod|chown|stat|df|du|date|sleep|env|id|tee|touch|mktemp|readlink|realpath|seq|comm|join|paste|od|file|nl|fold|column|tput|timeout|flock|install|tar|sha256sum|md5sum|base64|nproc|uptime|free|uname|hostname|whoami|ps|pgrep|pkill|kill|killall|lsblk|mount|umount|sudo|su|rpm|dnf|flatpak|git|python3|ss|ip|ls|rfkill|lsof|authselect|setsid|nohup|grub2-mkconfig|sysctl)$'
|
||||
|
||||
# bootctl and coredumpctl ship in systemd-udev, which every Fedora install
|
||||
# carries -- it is the udev half of systemd, not an optional tool. Declaring
|
||||
@@ -45,10 +45,10 @@ BASELINE='^(sh|bash|cat|cut|sed|awk|gawk|grep|egrep|head|tail|sort|uniq|tr|wc|fi
|
||||
SESSION='^(systemctl|busctl|journalctl|loginctl|hostnamectl|localectl|systemd-inhibit|systemd-run|udevadm|bootctl|coredumpctl|gsettings|dconf|dbus-send|dbus-monitor|hyprctl|qs|quickshell|gnf|panama|wl-copy|wl-paste)$'
|
||||
|
||||
# Installed by install-packages itself rather than by a package list. Two
|
||||
# reasons, both deliberate: bun, claude and codex have no RPM or flatpak at
|
||||
# all (codex comes through npm), and node, npm and pnpm come from nvm on
|
||||
# purpose -- a dnf nodejs earlier on PATH would win every per-project
|
||||
# `nvm use`, which is the whole point of having nvm.
|
||||
# reasons, both deliberate: bun and codex use reviewed release archives,
|
||||
# Claude Code and pnpm use signed DNF repositories, and node/npm use a reviewed
|
||||
# Node archive inside nvm's version directory. A system nodejs earlier on PATH
|
||||
# would win every per-project `nvm use`, which is the whole point of having nvm.
|
||||
# Anything added here needs a matching install block and a stated reason.
|
||||
SELF_INSTALLED='^(bun|claude|codex|node|npm|pnpm)$'
|
||||
|
||||
|
||||
@@ -106,6 +106,28 @@ before_system_flathub_key="$(snapshot_file_state /var/lib/flatpak/repo/flathub.t
|
||||
before_user_flatpak="$(snapshot_file_state "$HOME/.local/share/flatpak/repo/config")"
|
||||
before_bashrc="$(snapshot_file_state "$HOME/.bashrc")"
|
||||
|
||||
# Runtime and agent installs must consume the reviewed provenance table. Keep
|
||||
# this scan at the public script boundary because a command hidden elsewhere in
|
||||
# the installer can bypass every archive-level test below.
|
||||
installer="$repo_dir/setup/scripts/install-packages"
|
||||
unsafe_installers=()
|
||||
for forbidden in \
|
||||
'curl[^|]*\|[[:space:]]*bash' \
|
||||
'nvm[[:space:]]+install[[:space:]]+--lts' \
|
||||
'npm[[:space:]]+install[[:space:]]+-g[[:space:]]+pnpm' \
|
||||
'npm[[:space:]]+install[[:space:]]+-g[[:space:]]+@openai/codex' \
|
||||
'releases/latest' \
|
||||
'api\.github\.com/.*/releases/latest'; do
|
||||
while IFS= read -r finding; do
|
||||
[[ -n "$finding" ]] && unsafe_installers+=("$finding")
|
||||
done < <(grep -nE "$forbidden" "$installer" || true)
|
||||
done
|
||||
if (( ${#unsafe_installers[@]} > 0 )); then
|
||||
printf 'package provenance contract: moving or piped installer inputs:\n' >&2
|
||||
printf ' %s\n' "${unsafe_installers[@]}" >&2
|
||||
fail 'replace each finding with a reviewed, verified installation path'
|
||||
fi
|
||||
|
||||
# This must be the only production file sourced by the contract.
|
||||
# shellcheck source=../../setup/lib/artifact-provenance
|
||||
source "$repo_dir/setup/lib/artifact-provenance"
|
||||
@@ -228,6 +250,22 @@ expect_failure rpm_signature_matches \
|
||||
"$test_tmp/wrong-signer-fixture.rpm" "$test_tmp/combined-key.asc" "$fixture_fingerprint"
|
||||
expect_success load_installer_provenance "$config"
|
||||
[[ "${INSTALLER_PROVENANCE[BUN_VERSION]:-}" == '1.4.0' ]] || fail 'valid provenance was not loaded'
|
||||
for reviewed_value in \
|
||||
'NODE_VERSION 24.20.0' \
|
||||
'NODE_X86_64_SHA256 2f2c0da162318f0de47665410c7c8c2ed3d36c8f3105de4bbc61176c70a7cbf2' \
|
||||
'NODE_AARCH64_SHA256 5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7' \
|
||||
'BUN_VERSION 1.4.0' \
|
||||
'BUN_X86_64_SHA256 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
|
||||
'BUN_AARCH64_SHA256 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e' \
|
||||
'CODEX_VERSION 0.150.1' \
|
||||
'CODEX_X86_64_SHA256 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
|
||||
'CODEX_AARCH64_SHA256 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \
|
||||
'RUSTDESK_VERSION 1.4.9' \
|
||||
'RUSTDESK_X86_64_SHA256 eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
|
||||
read -r name expected <<<"$reviewed_value"
|
||||
[[ "${INSTALLER_PROVENANCE[$name]:-}" == "$expected" ]] \
|
||||
|| fail "$name does not match the reviewed release"
|
||||
done
|
||||
for key_spec in \
|
||||
'terra44 TERRA_FINGERPRINT' \
|
||||
'claude-code CLAUDE_CODE_FINGERPRINT' \
|
||||
@@ -286,11 +324,67 @@ cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/
|
||||
sed '/^# --- The server path/,$d' "$repo_dir/setup/scripts/install-packages" \
|
||||
> "$installer_fixture/setup/scripts/install-packages"
|
||||
|
||||
artifact_root="$test_tmp/runtime-artifacts"
|
||||
mkdir -p "$artifact_root/build"
|
||||
for arch_spec in \
|
||||
'x86_64 x64 x64' \
|
||||
'aarch64 arm64 aarch64'; do
|
||||
read -r machine node_arch bun_arch <<<"$arch_spec"
|
||||
node_top="node-v24.20.0-linux-$node_arch"
|
||||
mkdir -p "$artifact_root/build/$node_top/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "v24.20.0\\n"\n' \
|
||||
> "$artifact_root/build/$node_top/bin/node"
|
||||
chmod +x "$artifact_root/build/$node_top/bin/node"
|
||||
tar -C "$artifact_root/build" -cJf "$artifact_root/node-$machine.tar.xz" "$node_top"
|
||||
rm -rf -- "$artifact_root/build/$node_top"
|
||||
|
||||
bun_top="bun-linux-$bun_arch"
|
||||
mkdir -p "$artifact_root/build/$bun_top"
|
||||
printf '#!/usr/bin/env bash\nprintf "1.4.0\\n"\n' \
|
||||
> "$artifact_root/build/$bun_top/bun"
|
||||
chmod +x "$artifact_root/build/$bun_top/bun"
|
||||
(cd "$artifact_root/build" && zip -q "$artifact_root/bun-$machine.zip" "$bun_top/bun")
|
||||
rm -rf -- "$artifact_root/build/$bun_top"
|
||||
|
||||
codex_name="codex-$machine-unknown-linux-musl"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' \
|
||||
> "$artifact_root/build/$codex_name"
|
||||
chmod +x "$artifact_root/build/$codex_name"
|
||||
tar -C "$artifact_root/build" -czf "$artifact_root/codex-$machine.tar.gz" "$codex_name"
|
||||
rm -f -- "$artifact_root/build/$codex_name"
|
||||
done
|
||||
mkdir -p "$artifact_root/build/wrong-node/bin" "$artifact_root/build/wrong-codex"
|
||||
printf '#!/usr/bin/env bash\nprintf "v24.20.0\\n"\n' > "$artifact_root/build/wrong-node/bin/node"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' > "$artifact_root/build/wrong-codex/codex"
|
||||
chmod +x "$artifact_root/build/wrong-node/bin/node" "$artifact_root/build/wrong-codex/codex"
|
||||
tar -C "$artifact_root/build" -cJf "$artifact_root/node-bad.tar.xz" wrong-node
|
||||
tar -C "$artifact_root/build" -czf "$artifact_root/codex-bad.tar.gz" wrong-codex/codex
|
||||
mkdir -p "$artifact_root/build/bun-linux-x64"
|
||||
printf '#!/usr/bin/env bash\nprintf "1.4.0\\n"\n' > "$artifact_root/build/bun-linux-x64/bun"
|
||||
printf 'unexpected\n' > "$artifact_root/build/bun-linux-x64/extra"
|
||||
chmod +x "$artifact_root/build/bun-linux-x64/bun"
|
||||
(cd "$artifact_root/build" && zip -q "$artifact_root/bun-bad.zip" \
|
||||
bun-linux-x64/bun bun-linux-x64/extra)
|
||||
printf 'reviewed rustdesk fixture\n' > "$artifact_root/rustdesk.rpm"
|
||||
rm -rf -- "$artifact_root/build"
|
||||
|
||||
make_stub_commands() {
|
||||
local case_root="$1"
|
||||
mkdir -p "$case_root/bin" "$case_root/home" "$case_root/tmp" "$case_root/etc/yum.repos.d" \
|
||||
mkdir -p "$case_root/bin" "$case_root/home" "$case_root/tmp" \
|
||||
"$case_root/etc/profile.d" "$case_root/etc/yum.repos.d" \
|
||||
"$case_root/etc/pki/rpm-gpg" "$case_root/flatpak-repo"
|
||||
|
||||
cat > "$case_root/etc/profile.d/nvm.sh" <<'STUB'
|
||||
nvm() {
|
||||
printf 'nvm:%s\n' "$*" >> "$COMMAND_LOG"
|
||||
}
|
||||
STUB
|
||||
|
||||
cat > "$case_root/bin/uname" <<'STUB'
|
||||
#!/usr/bin/env bash
|
||||
printf '%s\n' "${STUB_ARCH:-x86_64}"
|
||||
STUB
|
||||
|
||||
cat > "$case_root/bin/rpm" <<'STUB'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
@@ -298,10 +392,15 @@ if [[ "$*" == '-E %fedora' ]]; then
|
||||
printf 'rpm:release\n' >> "$COMMAND_LOG"
|
||||
printf '%s\n' "${STUB_FEDORA_RELEASE:-44}"
|
||||
elif [[ "${1:-}" == -q ]]; then
|
||||
printf 'rpm:query:%s\n' "${2:-}" >> "$COMMAND_LOG"
|
||||
case "${2:-}" in
|
||||
package="${!#}"
|
||||
printf 'rpm:query:%s\n' "$package" >> "$COMMAND_LOG"
|
||||
case "$package" in
|
||||
terra-release) [[ "${STUB_TERRA_INSTALLED:-0}" == 1 ]] ;;
|
||||
claude-desktop-extra) [[ "${STUB_CLAUDE_DESKTOP_INSTALLED:-0}" == 1 ]] ;;
|
||||
rustdesk)
|
||||
[[ -n "${STUB_RUSTDESK_VERSION:-}" ]] || exit 1
|
||||
[[ "$*" != *--queryformat* ]] || printf '%s' "$STUB_RUSTDESK_VERSION"
|
||||
;;
|
||||
*) exit 1 ;;
|
||||
esac
|
||||
else
|
||||
@@ -328,12 +427,60 @@ output_name="$(basename "$output")"
|
||||
output_name="${output_name#.}"
|
||||
output_name="${output_name%.part.*}"
|
||||
printf 'curl:%s:max=%s:output=%s\n' "$url" "$max_filesize" "$output_name" >> "$COMMAND_LOG"
|
||||
if [[ "${STUB_DOWNLOAD_INTERRUPT:-}" == 1 ]]; then
|
||||
printf 'partial' > "$output"
|
||||
exit 42
|
||||
fi
|
||||
case "$url" in
|
||||
*rpmfusion-free*) cp "$SIGNED_RPM" "$output" ;;
|
||||
*rpmfusion-nonfree*) cp "$SIGNED_RPM" "$output" ;;
|
||||
*flathub.flatpakrepo) cp "$FLATHUB_DESCRIPTOR" "$output" ;;
|
||||
*node-v24.20.0-linux-x64.tar.xz)
|
||||
cp "$ARTIFACT_ROOT/${STUB_BAD_LAYOUT:+node-bad.tar.xz}" "$output" 2>/dev/null \
|
||||
|| cp "$ARTIFACT_ROOT/node-x86_64.tar.xz" "$output"
|
||||
;;
|
||||
*node-v24.20.0-linux-arm64.tar.xz) cp "$ARTIFACT_ROOT/node-aarch64.tar.xz" "$output" ;;
|
||||
*bun-linux-x64.zip)
|
||||
cp "$ARTIFACT_ROOT/${STUB_BAD_LAYOUT:+bun-bad.zip}" "$output" 2>/dev/null \
|
||||
|| cp "$ARTIFACT_ROOT/bun-x86_64.zip" "$output"
|
||||
;;
|
||||
*bun-linux-aarch64.zip) cp "$ARTIFACT_ROOT/bun-aarch64.zip" "$output" ;;
|
||||
*codex-package-x86_64-unknown-linux-musl.tar.gz)
|
||||
cp "$ARTIFACT_ROOT/${STUB_BAD_LAYOUT:+codex-bad.tar.gz}" "$output" 2>/dev/null \
|
||||
|| cp "$ARTIFACT_ROOT/codex-x86_64.tar.gz" "$output"
|
||||
;;
|
||||
*codex-package-aarch64-unknown-linux-musl.tar.gz) cp "$ARTIFACT_ROOT/codex-aarch64.tar.gz" "$output" ;;
|
||||
*rustdesk-1.4.9-0.x86_64.rpm) cp "$ARTIFACT_ROOT/rustdesk.rpm" "$output" ;;
|
||||
*) exit 66 ;;
|
||||
esac
|
||||
STUB
|
||||
|
||||
cat > "$case_root/bin/sha256sum" <<'STUB'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
file="${!#}"
|
||||
if [[ "${STUB_DIGEST_MISMATCH:-}" == 1 ]]; then
|
||||
printf '%064d %s\n' 0 "$file"
|
||||
exit 0
|
||||
fi
|
||||
for spec in \
|
||||
'node-x86_64.tar.xz 2f2c0da162318f0de47665410c7c8c2ed3d36c8f3105de4bbc61176c70a7cbf2' \
|
||||
'node-aarch64.tar.xz 5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7' \
|
||||
'node-bad.tar.xz 2f2c0da162318f0de47665410c7c8c2ed3d36c8f3105de4bbc61176c70a7cbf2' \
|
||||
'bun-x86_64.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
|
||||
'bun-aarch64.zip 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e' \
|
||||
'bun-bad.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
|
||||
'codex-x86_64.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
|
||||
'codex-aarch64.tar.gz 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \
|
||||
'codex-bad.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
|
||||
'rustdesk.rpm eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
|
||||
read -r fixture digest <<<"$spec"
|
||||
if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then
|
||||
printf '%s %s\n' "$digest" "$file"
|
||||
exit 0
|
||||
fi
|
||||
done
|
||||
/usr/bin/sha256sum "$@"
|
||||
STUB
|
||||
|
||||
cat > "$case_root/bin/gpg" <<'STUB'
|
||||
@@ -418,6 +565,7 @@ for argument in "$@"; do
|
||||
case "$(basename "$argument")" in
|
||||
rpmfusion-free-release.rpm) logged+=(RPMFUSION_FREE) ;;
|
||||
rpmfusion-nonfree-release.rpm) logged+=(RPMFUSION_NONFREE) ;;
|
||||
rustdesk.rpm) logged+=(RUSTDESK_LOCAL) ;;
|
||||
flathub-key.asc) logged+=(FLATHUB_KEY) ;;
|
||||
*) logged+=("$argument") ;;
|
||||
esac
|
||||
@@ -588,6 +736,73 @@ run_installer_function() {
|
||||
: > "$case_root/commands.log"
|
||||
printf '0\n' > "$case_root/install-counter"
|
||||
printf 'preserved\n' > "$case_root/flatpak-state"
|
||||
: > "$case_root/softly-failed"
|
||||
case "${STUB_SEED_OLD:-}" in
|
||||
Node)
|
||||
mkdir -p "$case_root/home/.nvm/versions/node/v23.0.0/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "v23.0.0\\n"\n' \
|
||||
> "$case_root/home/.nvm/versions/node/v23.0.0/bin/node"
|
||||
chmod +x "$case_root/home/.nvm/versions/node/v23.0.0/bin/node"
|
||||
;;
|
||||
Bun)
|
||||
mkdir -p "$case_root/home/.bun/versions/1.3.0/bin" "$case_root/home/.bun/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "1.3.0\\n"\n' \
|
||||
> "$case_root/home/.bun/versions/1.3.0/bin/bun"
|
||||
chmod +x "$case_root/home/.bun/versions/1.3.0/bin/bun"
|
||||
ln -s "$case_root/home/.bun/versions/1.3.0/bin/bun" "$case_root/home/.bun/bin/bun"
|
||||
;;
|
||||
Codex)
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.149.0" "$case_root/home/.local/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.149.0\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.149.0/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.149.0/codex"
|
||||
ln -s "$case_root/home/.local/lib/panama/codex/0.149.0/codex" \
|
||||
"$case_root/home/.local/bin/codex"
|
||||
;;
|
||||
esac
|
||||
case "${STUB_SEED_EXACT:-}" in
|
||||
Node)
|
||||
mkdir -p "$case_root/home/.nvm/versions/node/v24.20.0/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "v24.20.0\\n"\n' \
|
||||
> "$case_root/home/.nvm/versions/node/v24.20.0/bin/node"
|
||||
chmod +x "$case_root/home/.nvm/versions/node/v24.20.0/bin/node"
|
||||
;;
|
||||
Bun)
|
||||
mkdir -p "$case_root/home/.bun/versions/1.4.0/bin" "$case_root/home/.bun/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "1.4.0\\n"\n' \
|
||||
> "$case_root/home/.bun/versions/1.4.0/bin/bun"
|
||||
chmod +x "$case_root/home/.bun/versions/1.4.0/bin/bun"
|
||||
ln -s "$case_root/home/.bun/versions/1.4.0/bin/bun" "$case_root/home/.bun/bin/bun"
|
||||
;;
|
||||
Codex)
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1" "$case_root/home/.local/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
ln -s "$case_root/home/.local/lib/panama/codex/0.150.1/codex" \
|
||||
"$case_root/home/.local/bin/codex"
|
||||
;;
|
||||
esac
|
||||
case "${STUB_SEED_COLLISION:-}" in
|
||||
Node)
|
||||
mkdir -p "$case_root/home/.nvm/versions/node/v24.20.0/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "v0.0.0\\n"\n' \
|
||||
> "$case_root/home/.nvm/versions/node/v24.20.0/bin/node"
|
||||
chmod +x "$case_root/home/.nvm/versions/node/v24.20.0/bin/node"
|
||||
;;
|
||||
Bun)
|
||||
mkdir -p "$case_root/home/.bun/versions/1.4.0/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "0.0.0\\n"\n' \
|
||||
> "$case_root/home/.bun/versions/1.4.0/bin/bun"
|
||||
chmod +x "$case_root/home/.bun/versions/1.4.0/bin/bun"
|
||||
;;
|
||||
Codex)
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 10.150.10\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
;;
|
||||
esac
|
||||
write_flathub_descriptor "$case_root/flathub.flatpakrepo" \
|
||||
"${STUB_FLATHUB_KEY_FILE:-$installer_fixture/setup/provenance/keys/flathub.asc}" \
|
||||
"${STUB_FLATHUB_VERIFY_LINE:-}" "${STUB_FLATHUB_URL:-https://dl.flathub.org/repo/}"
|
||||
@@ -685,6 +900,8 @@ run_installer_function() {
|
||||
esac
|
||||
|
||||
COMMAND_LOG="$case_root/commands.log" \
|
||||
SOFT_LOG="$case_root/softly-failed" \
|
||||
ARTIFACT_ROOT="$artifact_root" \
|
||||
FIXTURE_ROOT="$installer_fixture" \
|
||||
REVIEWED_KEYS="$repo_dir/setup/provenance/keys" \
|
||||
SIGNED_RPM="$test_tmp/signed-fixture.rpm" \
|
||||
@@ -695,10 +912,11 @@ run_installer_function() {
|
||||
STUB_INSTALL_COUNTER="$case_root/install-counter" \
|
||||
LC_ALL="${STUB_CALLER_LOCALE:-C}" \
|
||||
HOME="$case_root/home" \
|
||||
NVM_DIR="$case_root/home/.nvm" \
|
||||
TMPDIR="$case_root/tmp" \
|
||||
PANAMA_PATH="$installer_fixture" \
|
||||
PATH="$case_root/bin:/usr/bin:/bin" \
|
||||
bash -c 'source "$PANAMA_PATH/setup/scripts/install-packages"; PANAMA_SYSTEM_ETC="$STUB_ETC"; PANAMA_SYSTEM_FLATPAK_REPO="$STUB_FLATPAK_REPO"; declare -F "$1" >/dev/null; "$1"' \
|
||||
bash -c 'source "$PANAMA_PATH/setup/scripts/install-packages"; PANAMA_SYSTEM_ETC="$STUB_ETC"; PANAMA_SYSTEM_FLATPAK_REPO="$STUB_FLATPAK_REPO"; declare -F "$1" >/dev/null; status=0; "$1" || status=$?; (( ${#softly_failed[@]} == 0 )) || printf "%s\n" "${softly_failed[@]}" > "$SOFT_LOG"; exit "$status"' \
|
||||
bash "$function_name" > "$case_root/output" 2>&1
|
||||
}
|
||||
|
||||
@@ -712,6 +930,222 @@ assert_log() {
|
||||
}
|
||||
}
|
||||
|
||||
assert_soft_failure() {
|
||||
local name="$1" component="$2"
|
||||
[[ "$(<"$test_tmp/cases/$name/softly-failed")" == "$component" ]] \
|
||||
|| fail "$name did not record exactly one $component soft failure"
|
||||
}
|
||||
|
||||
assert_no_download() {
|
||||
local name="$1"
|
||||
[[ "$(<"$test_tmp/cases/$name/commands.log")" != *'curl:'* ]] \
|
||||
|| fail "$name reached curl"
|
||||
}
|
||||
|
||||
assert_no_runtime_staging() {
|
||||
local name="$1"
|
||||
[[ -z "$(find "$test_tmp/cases/$name/home" "$test_tmp/cases/$name/tmp" \
|
||||
\( -name '*.part.*' -o -name '*.stage.*' -o -name '*.link.*' \) -print -quit)" ]] \
|
||||
|| fail "$name left private runtime staging behind"
|
||||
}
|
||||
|
||||
assert_old_runtime_preserved() {
|
||||
local name="$1" component="$2" home="$test_tmp/cases/$name/home"
|
||||
case "$component" in
|
||||
Node)
|
||||
[[ "$($home/.nvm/versions/node/v23.0.0/bin/node --version)" == v23.0.0 ]] \
|
||||
|| fail "$name changed the known-good Node"
|
||||
;;
|
||||
Bun)
|
||||
[[ "$(readlink "$home/.bun/bin/bun")" == \
|
||||
"$home/.bun/versions/1.3.0/bin/bun" ]] \
|
||||
|| fail "$name changed the active Bun link"
|
||||
[[ "$($home/.bun/bin/bun --version)" == 1.3.0 ]] \
|
||||
|| fail "$name changed the known-good Bun"
|
||||
;;
|
||||
Codex)
|
||||
[[ "$(readlink "$home/.local/bin/codex")" == \
|
||||
"$home/.local/lib/panama/codex/0.149.0/codex" ]] \
|
||||
|| fail "$name changed the active Codex link"
|
||||
[[ "$($home/.local/bin/codex --version)" == 'codex-cli 0.149.0' ]] \
|
||||
|| fail "$name changed the known-good Codex"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Each supported architecture selects its own reviewed URL, digest and archive
|
||||
# layout. Successful activation leaves no private download or extraction tree.
|
||||
for runtime_case in \
|
||||
'node-x86_64 x86_64 install_node Node https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz 67108864' \
|
||||
'node-aarch64 aarch64 install_node Node https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz 67108864' \
|
||||
'bun-x86_64 x86_64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip 67108864' \
|
||||
'bun-aarch64 aarch64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip 67108864' \
|
||||
'codex-x86_64 x86_64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz 134217728' \
|
||||
'codex-aarch64 aarch64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz 134217728'; do
|
||||
read -r name arch function_name component url max_bytes <<<"$runtime_case"
|
||||
reset_installer_fixture
|
||||
if ! STUB_ARCH="$arch" run_installer_function "$name" "$function_name"; then
|
||||
tail -n 120 "$test_tmp/cases/$name/output" >&2
|
||||
fail "expected successful $name activation"
|
||||
fi
|
||||
grep -qFx "curl:$url:max=$max_bytes:output=artifact" \
|
||||
"$test_tmp/cases/$name/commands.log" \
|
||||
|| { sed -n '1,80p' "$test_tmp/cases/$name/output" >&2; sed -n '1,80p' "$test_tmp/cases/$name/commands.log" >&2; fail "$name did not select its reviewed artifact"; }
|
||||
[[ ! -s "$test_tmp/cases/$name/softly-failed" ]] \
|
||||
|| fail "$name recorded a soft failure after successful activation"
|
||||
assert_no_runtime_staging "$name"
|
||||
done
|
||||
|
||||
[[ "$($test_tmp/cases/node-x86_64/home/.nvm/versions/node/v24.20.0/bin/node --version)" \
|
||||
== v24.20.0 ]] || fail 'x86_64 Node activation has the wrong version'
|
||||
grep -qFx 'nvm:alias default 24.20.0' "$test_tmp/cases/node-x86_64/commands.log" \
|
||||
|| fail 'Node did not set the exact nvm default alias'
|
||||
[[ "$($test_tmp/cases/bun-x86_64/home/.bun/bin/bun --version)" == 1.4.0 ]] \
|
||||
|| fail 'x86_64 Bun activation has the wrong version'
|
||||
[[ "$(readlink "$test_tmp/cases/bun-x86_64/home/.bun/bin/bun")" == \
|
||||
"$test_tmp/cases/bun-x86_64/home/.bun/versions/1.4.0/bin/bun" ]] \
|
||||
|| fail 'Bun did not atomically activate the reviewed version path'
|
||||
[[ "$($test_tmp/cases/codex-x86_64/home/.local/bin/codex --version)" == \
|
||||
'codex-cli 0.150.1' ]] || fail 'x86_64 Codex activation has the wrong version'
|
||||
[[ "$(readlink "$test_tmp/cases/codex-x86_64/home/.local/bin/codex")" == \
|
||||
"$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.150.1/codex" ]] \
|
||||
|| fail 'Codex did not atomically activate the reviewed version path'
|
||||
|
||||
# Unsupported CPUs stop before curl. RustDesk's reviewed RPM is x86_64-only,
|
||||
# so aarch64 is also an intentional, recorded soft failure without a download.
|
||||
for unsupported_case in \
|
||||
'node-unsupported install_node Node riscv64' \
|
||||
'bun-unsupported install_bun Bun riscv64' \
|
||||
'codex-unsupported install_codex Codex riscv64' \
|
||||
'rustdesk-unsupported install_rustdesk RustDesk riscv64' \
|
||||
'rustdesk-aarch64 install_rustdesk RustDesk aarch64'; do
|
||||
read -r name function_name component arch <<<"$unsupported_case"
|
||||
reset_installer_fixture
|
||||
STUB_ARCH="$arch" expect_failure run_installer_function "$name" "$function_name"
|
||||
assert_no_download "$name"
|
||||
assert_soft_failure "$name" "$component"
|
||||
done
|
||||
|
||||
# A bad digest or interrupted transfer cannot replace the previously active
|
||||
# tool and cannot leave reusable bytes behind.
|
||||
for failure_mode in digest interrupted; do
|
||||
for component_spec in \
|
||||
'Node install_node' \
|
||||
'Bun install_bun' \
|
||||
'Codex install_codex'; do
|
||||
read -r component function_name <<<"$component_spec"
|
||||
name="${component,,}-$failure_mode"
|
||||
reset_installer_fixture
|
||||
if [[ "$failure_mode" == digest ]]; then
|
||||
STUB_SEED_OLD="$component" STUB_DIGEST_MISMATCH=1 \
|
||||
expect_failure run_installer_function "$name" "$function_name"
|
||||
else
|
||||
STUB_SEED_OLD="$component" STUB_DOWNLOAD_INTERRUPT=1 \
|
||||
expect_failure run_installer_function "$name" "$function_name"
|
||||
fi
|
||||
assert_soft_failure "$name" "$component"
|
||||
assert_old_runtime_preserved "$name" "$component"
|
||||
assert_no_runtime_staging "$name"
|
||||
done
|
||||
|
||||
name="rustdesk-$failure_mode"
|
||||
reset_installer_fixture
|
||||
if [[ "$failure_mode" == digest ]]; then
|
||||
STUB_RUSTDESK_VERSION=1.4.8 STUB_DIGEST_MISMATCH=1 \
|
||||
expect_failure run_installer_function "$name" install_rustdesk
|
||||
else
|
||||
STUB_RUSTDESK_VERSION=1.4.8 STUB_DOWNLOAD_INTERRUPT=1 \
|
||||
expect_failure run_installer_function "$name" install_rustdesk
|
||||
fi
|
||||
assert_soft_failure "$name" RustDesk
|
||||
[[ "$(<"$test_tmp/cases/$name/commands.log")" != *'sudo:'* ]] \
|
||||
|| fail "$name reached DNF with an unverified RPM"
|
||||
assert_no_runtime_staging "$name"
|
||||
done
|
||||
|
||||
# Successful updates keep the old version directory and switch only the active
|
||||
# symlink after the replacement binary has passed its version check.
|
||||
for component_spec in 'Bun install_bun .bun/bin/bun .bun/versions/1.4.0/bin/bun' \
|
||||
'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.150.1/codex'; do
|
||||
read -r component function_name active_relative target_relative <<<"$component_spec"
|
||||
name="${component,,}-atomic-update"
|
||||
reset_installer_fixture
|
||||
STUB_SEED_OLD="$component" expect_success run_installer_function "$name" "$function_name"
|
||||
[[ "$(readlink "$test_tmp/cases/$name/home/$active_relative")" == \
|
||||
"$test_tmp/cases/$name/home/$target_relative" ]] \
|
||||
|| fail "$name did not atomically replace the active symlink"
|
||||
if [[ "$component" == Bun ]]; then
|
||||
[[ "$($test_tmp/cases/$name/home/.bun/versions/1.3.0/bin/bun --version)" == 1.3.0 ]] \
|
||||
|| fail "$name removed the prior version directory"
|
||||
else
|
||||
[[ "$($test_tmp/cases/$name/home/.local/lib/panama/codex/0.149.0/codex --version)" \
|
||||
== 'codex-cli 0.149.0' ]] || fail "$name removed the prior version directory"
|
||||
fi
|
||||
done
|
||||
|
||||
# A reviewed digest does not excuse a malformed archive. Reject the wrong top
|
||||
# level or any extra member before a version path or active link appears.
|
||||
for layout_case in \
|
||||
'node-layout install_node Node .nvm/versions/node/v24.20.0' \
|
||||
'bun-layout install_bun Bun .bun/versions/1.4.0' \
|
||||
'codex-layout install_codex Codex .local/lib/panama/codex/0.150.1'; do
|
||||
read -r name function_name component relative_target <<<"$layout_case"
|
||||
reset_installer_fixture
|
||||
STUB_BAD_LAYOUT=1 expect_failure run_installer_function "$name" "$function_name"
|
||||
assert_soft_failure "$name" "$component"
|
||||
[[ ! -e "$test_tmp/cases/$name/home/$relative_target" ]] \
|
||||
|| fail "$name activated an archive with an unexpected layout"
|
||||
assert_no_runtime_staging "$name"
|
||||
done
|
||||
|
||||
# A valid collision is a no-download no-op. An invalid collision is preserved
|
||||
# and reported instead of being deleted and recreated.
|
||||
for collision_mode in exact collision; do
|
||||
for component_spec in \
|
||||
'Node install_node' \
|
||||
'Bun install_bun' \
|
||||
'Codex install_codex'; do
|
||||
read -r component function_name <<<"$component_spec"
|
||||
name="${component,,}-$collision_mode"
|
||||
reset_installer_fixture
|
||||
if [[ "$collision_mode" == exact ]]; then
|
||||
STUB_SEED_EXACT="$component" expect_success \
|
||||
run_installer_function "$name" "$function_name"
|
||||
[[ ! -s "$test_tmp/cases/$name/softly-failed" ]] \
|
||||
|| fail "$name reported a failure for the exact installed version"
|
||||
else
|
||||
STUB_SEED_COLLISION="$component" expect_failure \
|
||||
run_installer_function "$name" "$function_name"
|
||||
assert_soft_failure "$name" "$component"
|
||||
fi
|
||||
assert_no_download "$name"
|
||||
done
|
||||
done
|
||||
|
||||
reset_installer_fixture
|
||||
STUB_ARCH=x86_64 STUB_RUSTDESK_VERSION=1.4.8 \
|
||||
expect_success run_installer_function rustdesk-x86_64 install_rustdesk
|
||||
assert_log rustdesk-x86_64 "$(cat <<'EXPECTED'
|
||||
rpm:query:rustdesk
|
||||
curl:https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm:max=134217728:output=rustdesk.rpm
|
||||
sudo:dnf install -y --setopt=localpkg_gpgcheck=1 RUSTDESK_LOCAL
|
||||
EXPECTED
|
||||
)"
|
||||
assert_no_runtime_staging rustdesk-x86_64
|
||||
|
||||
reset_installer_fixture
|
||||
STUB_ARCH=x86_64 STUB_RUSTDESK_VERSION=1.4.9 \
|
||||
expect_success run_installer_function rustdesk-exact install_rustdesk
|
||||
assert_log rustdesk-exact 'rpm:query:rustdesk'
|
||||
|
||||
reset_installer_fixture
|
||||
expect_success run_installer_function pnpm install_pnpm
|
||||
assert_log pnpm 'sudo:dnf install -y pnpm'
|
||||
|
||||
reset_installer_fixture
|
||||
STUB_DNF_FAIL_MATCH=pnpm expect_failure run_installer_function pnpm-failure install_pnpm
|
||||
assert_soft_failure pnpm-failure pnpm
|
||||
|
||||
reset_installer_fixture
|
||||
expect_success run_installer_function rpmfusion install_rpmfusion_repositories
|
||||
assert_log rpmfusion "$(cat <<'EXPECTED'
|
||||
@@ -999,6 +1433,9 @@ for function_name in install_rpmfusion_repositories install_terra_repository \
|
||||
name="wrong-fedora-${function_name}"
|
||||
STUB_FEDORA_RELEASE=45 expect_failure run_installer_function "$name" "$function_name"
|
||||
assert_log "$name" 'rpm:release'
|
||||
if [[ "$function_name" == install_claude_code ]]; then
|
||||
assert_soft_failure "$name" 'Claude Code'
|
||||
fi
|
||||
done
|
||||
|
||||
reset_installer_fixture
|
||||
|
||||
Reference in New Issue
Block a user