From 5949532e6450d1aebc681caa8db2192a43b11f12 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:24:25 +0200 Subject: fix(packaging): ship only the TMDB token line of QE/default.env build-node.sh and build-node-runtime.ps1 copied QE/default.env whole into every deb, rpm and Windows build after checking only its first 30 bytes. The file is unversioned and sits beside other QE notes, so any line added to it later would have gone out publicly. Only its first line ships now, and only once it is exactly MESHBAY_TMDB_DEFAULT_TOKEN=; a missing file, a BOM, a token not on the first line or an empty one still stop the build. The Linux step is run by a test against a scratch repo; the PowerShell one has the same rule and was not run here. Co-Authored-By: Claude Opus 5.5 --- .../tests/test_packaging_default_env.py | 74 ++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 packages/meshbay-node/tests/test_packaging_default_env.py (limited to 'packages/meshbay-node') diff --git a/packages/meshbay-node/tests/test_packaging_default_env.py b/packages/meshbay-node/tests/test_packaging_default_env.py new file mode 100644 index 0000000..60bbb78 --- /dev/null +++ b/packages/meshbay-node/tests/test_packaging_default_env.py @@ -0,0 +1,74 @@ +""" +What the Linux packages ship of QE/default.env. + +The file is unversioned and lives beside other QE notes; the packages are +public. build-node.sh once copied it whole after checking only its first 30 +bytes, so any line added to it later would have gone out in every deb and rpm. +Only the validated token line may ship. + +These run the build step itself (the lines from `DEFAULT_ENV=` to its echo) +under bash against a scratch repo, rather than reading its text. +""" + +import shutil +import subprocess +from pathlib import Path + +import pytest + +ROOT = Path(__file__).resolve().parents[3] +BUILD_NODE = ROOT / "packaging" / "build" / "build-node.sh" + +pytestmark = [ + pytest.mark.skipif(not BUILD_NODE.exists(), reason="packaging not present"), + pytest.mark.skipif(shutil.which("bash") is None, reason="no bash"), +] + +TOKEN = "MESHBAY_TMDB_DEFAULT_TOKEN=eyJhbGciOi.eyJzdWIi-x_y" + + +def _step() -> str: + lines = BUILD_NODE.read_text(encoding="utf-8").splitlines() + start = next(i for i, l in enumerate(lines) if l.startswith("DEFAULT_ENV=")) + end = next(i for i in range(start, len(lines)) if "default.env:" in lines[i] and lines[i].lstrip().startswith("echo")) + return "\n".join(lines[start : end + 1]) + "\n" + + +def _build(tmp_path: Path, content: bytes | None) -> Path | None: + (tmp_path / "QE").mkdir() + share = tmp_path / "root" / "opt" / "meshbay-node" / "share" + share.mkdir(parents=True) + if content is not None: + (tmp_path / "QE" / "default.env").write_bytes(content) + script = tmp_path / "step.sh" + script.write_text(_step(), encoding="utf-8") + run = subprocess.run( + ["bash", str(script)], + env={"REPO": str(tmp_path), "ROOT": str(tmp_path / "root"), "PATH": "/usr/bin:/bin"}, + capture_output=True, + ) + out = share / "default.env" + return out if run.returncode == 0 else None + + +def test_only_the_token_line_ships(tmp_path): + out = _build(tmp_path, (TOKEN + "\r\nANOTHER_SECRET=hunter2\n# a note\n").encode()) + assert out is not None + assert out.read_bytes() == (TOKEN + "\n").encode() + assert out.stat().st_mode & 0o777 == 0o644 + + +@pytest.mark.parametrize( + "content", + [ + None, + b"", + b"\xef\xbb\xbf" + TOKEN.encode() + b"\n", + b"# token below\n" + TOKEN.encode() + b"\n", + b"MESHBAY_TMDB_DEFAULT_TOKEN=eyJ\n", + b"MESHBAY_TMDB_DEFAULT_TOKEN=eyJa b\n", + ], + ids=["missing", "empty", "bom", "not-first", "no-token", "space"], +) +def test_no_valid_token_line_no_build(tmp_path, content): + assert _build(tmp_path, content) is None -- cgit v1.2.3