From 33eb90454d9f1ece028a8dd96df4315aa4457061 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cristian=20Cezar=20Mois=C3=A9s?= Date: Mon, 31 Aug 2026 22:12:31 -0300 Subject: [PATCH] packaging: validate genuine source RPM metadata --- .github/workflows/ci.yml | 6 ++++++ .github/workflows/promote-release.yml | 16 ++++++++++++-- packaging/build-gui-rpm.sh | 31 ++++++++++++++++++++++++--- packaging/build-rpm.sh | 23 ++++++++++++++++++++ 4 files changed, 71 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 45abe02..a04c599 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -469,6 +469,12 @@ jobs: test "$(rpm -qp --qf '%{ARCH}' "$gui_rpm")" = noarch rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $version" test "$(rpm -qp --qf '%{NAME}' "$gui_srpm")" = zupt-gui + test "$(rpm -qp --qf '%{VERSION}-%{RELEASE}' "$gui_srpm")" = "$version-1" + test "$(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm")" = 1 + test "$(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm")" = '(none)' + test "$(rpm -qpl "$gui_srpm" | wc -l)" -eq 2 + rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$version.tar.gz" + rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec - name: Build the matching Fedora CLI RPM run: | version=$(sed -n 's/^#define ZUPT_VERSION_STRING "\([^"]*\)".*/\1/p' include/zupt.h) diff --git a/.github/workflows/promote-release.yml b/.github/workflows/promote-release.yml index e28d6c1..0dc0ec4 100644 --- a/.github/workflows/promote-release.yml +++ b/.github/workflows/promote-release.yml @@ -389,11 +389,17 @@ jobs: [[ $(rpm -qp --qf '%{VERSION}' "$rpm_file") == "$VERSION" ]] [[ $(rpm -qp --qf '%{RELEASE}' "$rpm_file") == 0 ]] [[ $(rpm -qp --qf '%{ARCH}' "$rpm_file") == x86_64 ]] + [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$rpm_file") == '(none)' ]] + [[ $(rpm -qp --qf '%{SOURCERPM}' "$rpm_file") == "$srpm_name" ]] srpm=$asset_dir/$srpm_name [[ $(rpm -qp --qf '%{NAME}' "$srpm") == zupt ]] [[ $(rpm -qp --qf '%{VERSION}' "$srpm") == "$VERSION" ]] [[ $(rpm -qp --qf '%{RELEASE}' "$srpm") == 0 ]] - [[ $(rpm -qp --qf '%{ARCH}' "$srpm") == src ]] + [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$srpm") == 1 ]] + [[ $(rpm -qp --qf '%{SOURCERPM}' "$srpm") == '(none)' ]] + [[ $(rpm -qpl "$srpm" | wc -l) -eq 2 ]] + rpm -qpl "$srpm" | grep -Fx "zupt-$VERSION.tar.gz" + rpm -qpl "$srpm" | grep -Fx zupt.spec gui_deb=$asset_dir/$gui_deb_name dpkg-deb --info "$gui_deb" >/dev/null @@ -406,12 +412,18 @@ jobs: [[ $(rpm -qp --qf '%{VERSION}' "$gui_rpm") == "$VERSION" ]] [[ $(rpm -qp --qf '%{RELEASE}' "$gui_rpm") == 1 ]] [[ $(rpm -qp --qf '%{ARCH}' "$gui_rpm") == noarch ]] + [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_rpm") == '(none)' ]] + [[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_rpm") == "$gui_srpm_name" ]] rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $VERSION" gui_srpm=$asset_dir/$gui_srpm_name [[ $(rpm -qp --qf '%{NAME}' "$gui_srpm") == zupt-gui ]] [[ $(rpm -qp --qf '%{VERSION}' "$gui_srpm") == "$VERSION" ]] [[ $(rpm -qp --qf '%{RELEASE}' "$gui_srpm") == 1 ]] - [[ $(rpm -qp --qf '%{ARCH}' "$gui_srpm") == src ]] + [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm") == 1 ]] + [[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm") == '(none)' ]] + [[ $(rpm -qpl "$gui_srpm" | wc -l) -eq 2 ]] + rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$VERSION.tar.gz" + rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec linux_tar=$asset_dir/$linux_tar_name python3 - "$linux_tar" "zupt-$VERSION-linux-x86_64" <<'PY' diff --git a/packaging/build-gui-rpm.sh b/packaging/build-gui-rpm.sh index 372ae69..cd7e8c8 100755 --- a/packaging/build-gui-rpm.sh +++ b/packaging/build-gui-rpm.sh @@ -124,20 +124,45 @@ mapfile -t source_rpms < <(find "$top/SRPMS" -type f -name "zupt-gui-$version-*. [[ ${#main_rpms[@]} -eq 1 ]] || die "expected one GUI RPM, found ${#main_rpms[@]}" [[ ${#source_rpms[@]} -eq 1 ]] || die "expected one GUI source RPM, found ${#source_rpms[@]}" -rpm -qpl "${main_rpms[0]}" >"$work/contents.txt" +main_rpm=${main_rpms[0]} +source_rpm=${source_rpms[0]} +[[ $(rpm -qp --qf '%{NAME}' "$main_rpm") == zupt-gui ]] || \ + die 'GUI binary RPM name metadata is not zupt-gui' +[[ $(rpm -qp --qf '%{VERSION}' "$main_rpm") == "$version" ]] || \ + die 'GUI binary RPM version metadata does not match the release' +[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$main_rpm") == '(none)' ]] || \ + die 'GUI binary RPM is marked as a source package' +[[ $(rpm -qp --qf '%{SOURCERPM}' "$main_rpm") == "$(basename -- "$source_rpm")" ]] || \ + die 'GUI binary RPM does not reference the matching source RPM' +[[ $(rpm -qp --qf '%{NAME}' "$source_rpm") == zupt-gui ]] || \ + die 'GUI source RPM name metadata is not zupt-gui' +[[ $(rpm -qp --qf '%{VERSION}' "$source_rpm") == "$version" ]] || \ + die 'GUI source RPM version metadata does not match the release' +[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$source_rpm") == 1 ]] || \ + die 'GUI source RPM is not marked as a source package' +[[ $(rpm -qp --qf '%{SOURCERPM}' "$source_rpm") == '(none)' ]] || \ + die 'GUI source RPM unexpectedly references another source RPM' +mapfile -t source_members < <(rpm -qpl "$source_rpm" | sort) +expected_source_members=("zupt-gui-${version}.tar.gz" zupt-gui.spec) +mapfile -t expected_source_members < <(printf '%s\n' "${expected_source_members[@]}" | sort) +[[ ${#source_members[@]} -eq 2 && \ + ${source_members[*]} == "${expected_source_members[*]}" ]] || \ + die 'GUI source RPM payload is not the exact Source0/spec pair' + +rpm -qpl "$main_rpm" >"$work/contents.txt" grep -q '^/usr/bin/zupt-gui$' "$work/contents.txt" || die 'GUI launcher missing from RPM' if grep -Eq '(^/usr/bin/vaptvupt-gui$|\.(o|obj|a|so|so\.[^/]+|dll|dylib|exe)$)' "$work/contents.txt"; then cat "$work/contents.txt" >&2 die 'forbidden compatibility alias or compiled artifact in GUI RPM' fi -(cd -- "$extract" && rpm2cpio "${main_rpms[0]}" | cpio -idm --quiet) +(cd -- "$extract" && rpm2cpio "$main_rpm" | cpio -idm --quiet) PYTHONDONTWRITEBYTECODE=1 python3 - </dev/null rpm -qpl "$main_rpm" > "$work/contents.txt" if grep -Eq '(^/usr/bin/vaptvupt$|\.(o|obj|a|so|so\.[^/]+|dll|dylib)$)' "$work/contents.txt"; then