monkeygold
571a7743ae
Stage ProjectDiscovery binaries before installing them into /usr/local/bin, run the tools image as the existing Kali operator identity, preserve runtime access to Foundry tools, and cover the non-root Dockerfile and smoke-test contracts.
60 lines
2.0 KiB
JavaScript
60 lines
2.0 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* Regression guard for the tools image's non-root runtime contract.
|
|
*
|
|
* Python packages install console scripts in /usr/local/bin (including httpx).
|
|
* Go tools must therefore be built in a staging directory before installation,
|
|
* otherwise `go install` refuses to overwrite the existing Python script.
|
|
*/
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
const here = path.dirname(fileURLToPath(import.meta.url));
|
|
const dockerfile = fs.readFileSync(path.join(here, '..', 'tools', 'Dockerfile'), 'utf8');
|
|
const smokeScript = fs.readFileSync(path.join(here, 'check-tools-image.sh'), 'utf8');
|
|
|
|
let passed = 0;
|
|
let failed = 0;
|
|
|
|
function check(label, condition) {
|
|
if (condition) {
|
|
passed += 1;
|
|
console.log(` ok ${label}`);
|
|
} else {
|
|
failed += 1;
|
|
console.error(` FAIL ${label}`);
|
|
}
|
|
}
|
|
|
|
check(
|
|
'Go binaries are not built directly into /usr/local/bin',
|
|
!/export\s+GOBIN=\/usr\/local\/bin/.test(dockerfile),
|
|
);
|
|
check(
|
|
'Go binaries use a staging directory',
|
|
/export\s+GOBIN=\/tmp\/projectdiscovery-bin/.test(dockerfile),
|
|
);
|
|
check(
|
|
'staged Go binaries are installed into /usr/local/bin',
|
|
/install\s+-m\s+0755\s+"\$GOBIN"\/\*\s+\/usr\/local\/bin\//.test(dockerfile),
|
|
);
|
|
check(
|
|
'Go staging directory is removed',
|
|
/rm\s+-rf\s+"\$GOBIN"/.test(dockerfile),
|
|
);
|
|
check(
|
|
'operator user reuses the existing Kali operator group',
|
|
/useradd\s+--gid\s+operator\s+--create-home\s+--shell\s+\/bin\/bash\s+operator/.test(dockerfile),
|
|
);
|
|
check('image runtime user is operator', /^USER operator$/m.test(dockerfile));
|
|
check('image runtime workdir is /work', /^WORKDIR \/work$/m.test(dockerfile));
|
|
check(
|
|
'tools smoke avoids a login shell whose logout hook can mask success',
|
|
/docker run .* "\$IMAGE" bash -c '/.test(smokeScript) &&
|
|
!/docker run .* "\$IMAGE" bash -lc '/.test(smokeScript),
|
|
);
|
|
|
|
console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: ${passed} passed, ${failed} failed`);
|
|
process.exit(failed === 0 ? 0 : 1);
|