diff options
Diffstat (limited to 'packaging')
| -rwxr-xr-x | packaging/build/build-node.sh | 22 | ||||
| -rw-r--r-- | packaging/win/build-node-runtime.ps1 | 15 |
2 files changed, 22 insertions, 15 deletions
diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh index b9d542c..c7e7577 100755 --- a/packaging/build/build-node.sh +++ b/packaging/build/build-node.sh @@ -45,18 +45,22 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node" # --- Node-specific assets ------------------------------------------------- mkdir -p "$ROOT/opt/meshbay-node/share" -# default.env: the shared TMDB token, copied as is from QE/default.env (never -# versioned), one line: MESHBAY_TMDB_DEFAULT_TOKEN=eyJ... The daemon reads it -# beneath <config>/node.env and the operator's own token, so it is only the -# fallback. 0644: a per-user node must read it, and it is the same token in -# every copy of the package. No token, no build: an empty one goes unnoticed. +# default.env: the shared TMDB token, taken from QE/default.env (never +# versioned). Only its first line ships, and only once it is exactly +# MESHBAY_TMDB_DEFAULT_TOKEN=<JWT>: anything else written in that file stays +# out of a public package. The daemon reads it beneath <config>/node.env and +# the operator's own token, so it is only the fallback. 0644: a per-user node +# must read it, and it is the same token in every copy of the package. No +# token, no build: an empty one goes unnoticed. DEFAULT_ENV="$REPO/QE/default.env" -if [ "$(head -c 30 "$DEFAULT_ENV" 2>/dev/null)" != "MESHBAY_TMDB_DEFAULT_TOKEN=eyJ" ]; then - echo "!! $DEFAULT_ENV missing, or not starting with MESHBAY_TMDB_DEFAULT_TOKEN=eyJ... (no BOM)" >&2 +TOKEN_LINE="$(head -n 1 "$DEFAULT_ENV" 2>/dev/null | tr -d '\r')" +if ! [[ "$TOKEN_LINE" =~ ^MESHBAY_TMDB_DEFAULT_TOKEN=eyJ[A-Za-z0-9_.-]+$ ]]; then + echo "!! $DEFAULT_ENV missing, or its first line is not MESHBAY_TMDB_DEFAULT_TOKEN=eyJ... (no BOM)" >&2 exit 1 fi -install -m 644 "$DEFAULT_ENV" "$ROOT/opt/meshbay-node/share/default.env" -echo " default.env copied from QE/" +printf '%s\n' "$TOKEN_LINE" > "$ROOT/opt/meshbay-node/share/default.env" +chmod 644 "$ROOT/opt/meshbay-node/share/default.env" +echo " default.env: token line taken from QE/" # --- Systemd units -------------------------------------------------------- mkdir -p "$ROOT/usr/lib/systemd/system" diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1 index 28b96e8..3d26ec2 100644 --- a/packaging/win/build-node-runtime.ps1 +++ b/packaging/win/build-node-runtime.ps1 @@ -140,8 +140,9 @@ else { } # --- 5. default.env (shared TMDB token) ------------------------------ -# Copied as is from QE\default.env (never versioned), one line: -# MESHBAY_TMDB_DEFAULT_TOKEN=eyJ... Beside the exe, where +# Taken from QE\default.env (never versioned). Only its first line ships, and +# only once it is exactly MESHBAY_TMDB_DEFAULT_TOKEN=<JWT>: anything else +# written in that file stays out of a public package. Beside the exe, where # platform.packaged_default_env() looks for it. The daemon reads it beneath # %LOCALAPPDATA%\meshbay\node.env and the operator's own token, so it is only # the fallback. No token, no build: an empty one goes unnoticed. The check is @@ -150,11 +151,13 @@ $defaultEnv = Join-Path $Repo "QE\default.env" $text = if (Test-Path -LiteralPath $defaultEnv) { [System.Text.Encoding]::ASCII.GetString([System.IO.File]::ReadAllBytes($defaultEnv)) } else { "" } -if (-not $text.StartsWith("MESHBAY_TMDB_DEFAULT_TOKEN=eyJ")) { - throw "$defaultEnv missing, or not starting with MESHBAY_TMDB_DEFAULT_TOKEN=eyJ... (no BOM)" +$tokenLine = ($text -split "`n", 2)[0].TrimEnd("`r") +if ($tokenLine -cnotmatch '^MESHBAY_TMDB_DEFAULT_TOKEN=eyJ[A-Za-z0-9_.-]+$') { + throw "$defaultEnv missing, or its first line is not MESHBAY_TMDB_DEFAULT_TOKEN=eyJ... (no BOM)" } -Copy-Item -LiteralPath $defaultEnv (Join-Path $frozen "default.env") -Step "default.env copied from QE\" +[System.IO.File]::WriteAllText((Join-Path $frozen "default.env"), "$tokenLine`n", + (New-Object System.Text.UTF8Encoding $false)) +Step "default.env: token line taken from QE\" # --- 6. publish ---------------------------------------------------- Move-Item $frozen $OutDir |