Skip to content

Commit 18b9fba

Browse files
author
Marco Napetti
committed
fix(installer): deliver secret shims in private target bundles
1 parent 03033d4 commit 18b9fba

4 files changed

Lines changed: 709 additions & 40 deletions

File tree

‎.github/workflows/installer-smoke.yml‎

Lines changed: 94 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,25 @@ jobs:
3636
./install.sh --install-dir "${INSTALL_DIR}"
3737
"${INSTALL_DIR}/firma" --version
3838
"${INSTALL_DIR}/firma" help config
39-
test -x "${INSTALL_DIR}/firma-secret-shim"
39+
case "$(uname -m)" in
40+
x86_64) SHIM_TARGET=x86_64-unknown-linux-musl ;;
41+
arm64 | aarch64) SHIM_TARGET=aarch64-unknown-linux-musl ;;
42+
*) exit 1 ;;
43+
esac
44+
SHIM="${INSTALL_DIR}/libexec/openfirma/secret-shims/${SHIM_TARGET}/firma-secret-shim"
45+
test -x "${SHIM}"
46+
test "$(uname -s)" = Linux || file "${SHIM}" | grep -F ELF
47+
case "${SHIM_TARGET}" in
48+
x86_64-*) file "${SHIM}" | grep -F 'x86-64' ;;
49+
aarch64-*) file "${SHIM}" | grep -E 'aarch64|ARM64' ;;
50+
esac
51+
if stat -c '%a' "${SHIM}" >/dev/null 2>&1; then
52+
test "$(stat -c '%a' "${SHIM}")" = 755
53+
else
54+
test "$(stat -f '%Lp' "${SHIM}")" = 755
55+
fi
56+
test ! -x "${INSTALL_DIR}/firma-secret-shim"
57+
! PATH="${INSTALL_DIR}:${PATH}" command -v firma-secret-shim
4058
- name: Re-run (already installed exit path)
4159
env:
4260
FIRMA_NO_BREW: '1'
@@ -48,17 +66,87 @@ jobs:
4866
INSTALL_DIR="${RUNNER_TEMP}/firma-bin"
4967
PATH="${INSTALL_DIR}:${PATH}" ./install.sh --install-dir "${INSTALL_DIR}" | tee out.log
5068
grep -F 'already installed' out.log
51-
- name: Install legacy release
69+
- name: Run mocked compatibility and transaction smoke
70+
if: runner.os == 'Linux'
71+
run: sh scripts/test-install-sh.sh
72+
73+
homebrew:
74+
name: install.sh controlled Homebrew (${{ matrix.runner }})
75+
runs-on: ${{ matrix.runner }}
76+
strategy:
77+
fail-fast: false
78+
matrix:
79+
runner: [macos-15-intel, macos-14]
80+
steps:
81+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
82+
with:
83+
persist-credentials: false
84+
- name: Seed a release binary and verified guest shim
5285
env:
5386
FIRMA_NO_BREW: '1'
5487
FIRMA_NO_INIT: '1'
5588
FIRMA_NO_MODIFY_PATH: '1'
5689
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
90+
run: ./install.sh --install-dir "${RUNNER_TEMP}/seed/bin"
91+
- name: Run controlled Homebrew branch
92+
env:
93+
FIRMA_NO_INIT: '1'
94+
FIRMA_NO_MODIFY_PATH: '1'
95+
FIRMA_BREW_FIXTURE_BINARY: ${{ runner.temp }}/seed/bin/firma
96+
FIXTURE_PREFIX: ${{ runner.temp }}/brew-fixture
97+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5798
run: |
5899
set -eu
59-
INSTALL_DIR="${RUNNER_TEMP}/firma-legacy-bin"
60-
./install.sh --version v0.1.2 --install-dir "${INSTALL_DIR}"
61-
"${INSTALL_DIR}/firma" --version | grep -F '0.1.2'
100+
FIXTURE_BIN="${RUNNER_TEMP}/brew-fixture-tools"
101+
mkdir -p "${FIXTURE_BIN}"
102+
cat > "${FIXTURE_BIN}/brew" <<'EOF'
103+
#!/bin/sh
104+
set -eu
105+
case "$1" in
106+
info)
107+
printf '%s\n' '{"formulae":[{"versions":{"stable":"fixture"}}]}'
108+
;;
109+
ruby)
110+
cat >/dev/null
111+
"${FIRMA_BREW_FIXTURE_BINARY}" --version | awk '{print $2}'
112+
;;
113+
install)
114+
dest="${FIXTURE_PREFIX}/Cellar/firma/fixture/bin/firma"
115+
mkdir -p "$(dirname "${dest}")"
116+
cp "${FIRMA_BREW_FIXTURE_BINARY}" "${dest}"
117+
chmod 0755 "${dest}"
118+
;;
119+
list)
120+
exit 99
121+
;;
122+
--prefix)
123+
printf '%s\n' "${FIXTURE_PREFIX}"
124+
;;
125+
*) exit 1 ;;
126+
esac
127+
EOF
128+
chmod 0755 "${FIXTURE_BIN}/brew"
129+
130+
PATH="${FIXTURE_BIN}:/usr/bin:/bin:/usr/sbin:/sbin" \
131+
./install.sh --install-dir "${RUNNER_TEMP}/unused-bin"
132+
133+
case "$(uname -m)" in
134+
x86_64) SHIM_TARGET=x86_64-unknown-linux-musl ;;
135+
arm64 | aarch64) SHIM_TARGET=aarch64-unknown-linux-musl ;;
136+
*) exit 1 ;;
137+
esac
138+
BREW_BIN="${FIXTURE_PREFIX}/Cellar/firma/fixture/bin"
139+
VERSION=$("${BREW_BIN}/firma" --version | awk '{print $2}')
140+
SHIM="${FIXTURE_PREFIX}/var/openfirma/secret-shims/${VERSION}/${SHIM_TARGET}/firma-secret-shim"
141+
SEED_SHIM="${RUNNER_TEMP}/seed/bin/libexec/openfirma/secret-shims/${SHIM_TARGET}/firma-secret-shim"
142+
test -x "${BREW_BIN}/firma"
143+
test -x "${SHIM}"
144+
test ! -e "${BREW_BIN}/libexec"
145+
file "${SHIM}" | grep -F ELF
146+
test "$(shasum -a 256 "${SHIM}" | awk '{print $1}')" = \
147+
"$(shasum -a 256 "${SEED_SHIM}" | awk '{print $1}')"
148+
test ! -e "${FIXTURE_PREFIX}/bin/firma-secret-shim"
149+
! PATH="${BREW_BIN}:/usr/bin:/bin" command -v firma-secret-shim
62150
63151
windows:
64152
name: install.ps1 (${{ matrix.runner }})
@@ -82,7 +170,7 @@ jobs:
82170
.\install.ps1 -InstallDir $dir
83171
& (Join-Path $dir 'firma.exe') --version
84172
& (Join-Path $dir 'firma.exe') help config
85-
if (-not (Test-Path (Join-Path $dir 'firma-secret-shim.exe'))) { exit 1 }
173+
if (Test-Path (Join-Path $dir 'firma-secret-shim.exe')) { Write-Host 'shim must not be a user-facing command'; exit 1 }
86174
- name: Re-run (already installed exit path)
87175
shell: pwsh
88176
env:

‎install.ps1‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -216,26 +216,35 @@ function Install-FirmaBinary ($TmpDir) {
216216
}
217217
if ($DryRun) {
218218
$binarySrc = Join-Path $extractDir 'firma.exe'
219-
$shimSrc = Join-Path $extractDir 'firma-secret-shim.exe'
220219
} else {
221220
$binarySrc = (Get-ChildItem -Path $extractDir -Filter 'firma.exe' -Recurse | Select-Object -First 1).FullName
222221
if (-not $binarySrc) { Stop-Install "could not find firma.exe inside $script:ArchiveName" }
223-
$shimSrc = (Get-ChildItem -Path $extractDir -Filter 'firma-secret-shim.exe' -Recurse | Select-Object -First 1).FullName
224-
if (-not $shimSrc) { Stop-Install "could not find firma-secret-shim.exe inside $script:ArchiveName; CLI secret mediation requires it next to firma.exe" }
225222
}
226223
Invoke-Step "New-Item -Path $InstallDir" {
227224
New-Item -ItemType Directory -Path $InstallDir -Force | Out-Null
228225
}
229226
$dest = Join-Path $InstallDir 'firma.exe'
230-
$shimDest = Join-Path $InstallDir 'firma-secret-shim.exe'
231227
Invoke-Step "Move-Item $binarySrc -> $dest" {
232228
Move-Item -Force -Path $binarySrc -Destination $dest
233229
}
234-
Invoke-Step "Move-Item $shimSrc -> $shimDest" {
235-
Move-Item -Force -Path $shimSrc -Destination $shimDest
230+
231+
# Copy private shim artifacts into libexec if present in the archive.
232+
# These are not user-facing commands and must not appear on PATH.
233+
if (-not $DryRun) {
234+
$shimSrc = (Get-ChildItem -Path $extractDir -Filter 'firma-secret-shim.exe' -Recurse | Select-Object -First 1).FullName
235+
if ($shimSrc) {
236+
$libexecDir = Join-Path $InstallDir 'libexec\openfirma\secret-shims'
237+
Invoke-Step "New-Item -Path $libexecDir" {
238+
New-Item -ItemType Directory -Path $libexecDir -Force | Out-Null
239+
}
240+
$shimDest = Join-Path $libexecDir 'firma-secret-shim.exe'
241+
Invoke-Step "Move-Item $shimSrc -> $shimDest" {
242+
Move-Item -Force -Path $shimSrc -Destination $shimDest
243+
}
244+
}
236245
}
246+
237247
Write-Info "installed: $dest"
238-
Write-Info "installed: $shimDest"
239248
}
240249

241250
function Add-FirmaToPath {

0 commit comments

Comments
 (0)