59 lines
2.4 KiB
Bash
Executable File
59 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")/.."
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
|
|
|
|
. ./deploy/vector/secret-policy.sh
|
|
|
|
: >"$tmp/empty"
|
|
printf 'has newline\n' >"$tmp/newline"
|
|
printf 'has space' >"$tmp/space"
|
|
printf 'safe-quoted-\047-dollar-$' >"$tmp/valid"
|
|
printf 'docker-secret' >"$tmp/docker"
|
|
printf 'owner-readonly' >"$tmp/readonly"
|
|
printf 'too-open' >"$tmp/open"
|
|
printf '# comment\n\nTHT_VECTOR_READER_PASSWORD=reader\nTHT_VECTOR_WRITER_PASSWORD=writer\n' >"$tmp/bundle"
|
|
printf 'THT_VECTOR_READER_PASSWORD=reader\nTHT_VECTOR_WRITER_PASSWORD=writer\nTHT_DWH_API_KEY=one\nTHT_DWH_API_KEY=two\n' >"$tmp/duplicate-bundle"
|
|
printf 'THT_VECTOR_READER_PASSWORD=reader\r\nTHT_VECTOR_WRITER_PASSWORD=writer\r\n' >"$tmp/crlf-bundle"
|
|
awk 'BEGIN { printf "THT_VECTOR_READER_PASSWORD="; for (i = 1; i <= 16385; i++) printf "x"; print "" }' >"$tmp/long-line-bundle"
|
|
awk 'BEGIN { for (i = 1; i <= 70000; i++) print "# filler" }' >"$tmp/large-bundle"
|
|
chmod 0600 "$tmp/valid"
|
|
chmod 0444 "$tmp/docker"
|
|
chmod 0400 "$tmp/readonly"
|
|
chmod 0640 "$tmp/open"
|
|
chmod 0600 "$tmp/bundle" "$tmp/duplicate-bundle" "$tmp/crlf-bundle" "$tmp/long-line-bundle" "$tmp/large-bundle"
|
|
|
|
for invalid in empty newline space; do
|
|
if validate_secret_file "$tmp/$invalid" "$invalid" >/dev/null 2>&1; then
|
|
echo "secret policy accepted $invalid" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
validate_secret_file "$tmp/valid" valid
|
|
validate_secret_file "$tmp/readonly" readonly
|
|
if validate_secret_file "$tmp/docker" docker >/dev/null 2>&1; then
|
|
echo "secret policy accepted world-readable host secret" >&2
|
|
exit 1
|
|
fi
|
|
if validate_secret_file "$tmp/open" open >/dev/null 2>&1; then
|
|
echo "secret policy accepted group-readable host secret" >&2
|
|
exit 1
|
|
fi
|
|
test "$(read_secret_file "$tmp/valid" valid)" = "safe-quoted-'-dollar-$"
|
|
test "$(read_bundle_secret "$tmp/bundle" THT_VECTOR_READER_PASSWORD)" = reader
|
|
test "$(read_bundle_secret "$tmp/crlf-bundle" THT_VECTOR_READER_PASSWORD)" = reader
|
|
if read_bundle_secret "$tmp/duplicate-bundle" THT_VECTOR_READER_PASSWORD >/dev/null 2>&1; then
|
|
echo "secret policy accepted a duplicate unrelated bundle key" >&2
|
|
exit 1
|
|
fi
|
|
for invalid_bundle in long-line-bundle large-bundle; do
|
|
if read_bundle_secret "$tmp/$invalid_bundle" THT_VECTOR_READER_PASSWORD >/dev/null 2>&1; then
|
|
echo "secret policy accepted oversized $invalid_bundle" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
echo "shared vector secret policy contracts passed."
|