Martin Vogel
359485b6c2
Every unix build leg of release run 30499236230 died during packaging:
scripts/package-release.sh: line 190: scripts/ci/check-binary-composition.sh: Permission denied
The composition gate was committed 100644 while being invoked as a command. It
passed every local check because my WORKING COPY had the exec bit -- only the
committed mode was wrong, and nothing you can run locally reveals that.
scripts/ci/append-vt-notes.sh had the identical defect waiting in the verify
step, the last step of the release, so this would have failed a second time after
two hours of tests, build, smoke and soak.
Fixed on BOTH sides, because either alone suffices and the pair is mode-proof:
the two scripts are now 100755, and their call sites invoke them through `bash`,
which is what most of this repo already does and which cannot break if a mode bit
is ever lost to a patch application or a non-POSIX checkout.
tests/test_script_exec_bit_contract.sh pins the class: any tracked .sh whose
COMMITTED mode is non-executable must not appear as the first word of a command
in workflows, scripts, test-infrastructure or the Makefiles. Verified in both
directions -- it passes on this tree, and fails on the exact defect when the mode
and the call site are reverted. It also joins backslash continuations before
analysing, because its own first draft reported a false positive on
... && bash \
test-infrastructure/vm/vm-run-tests.sh --soak
and a contract that cries wolf teaches people to ignore contracts.
Product code is untouched: the test phase of the failed run was 27/27 green on
this exact tree, and a file mode cannot change a test outcome.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
30 lines
1.3 KiB
Bash
Executable File
30 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Append the Security Verification section to the release notes: per-binary
|
|
# sha256 + VirusTotal links. This step only runs after check-virustotal.sh
|
|
# passed, and that gate is ZERO tolerance — any detection blocks the release —
|
|
# so "0 detections" here is a verified statement, never an assumption.
|
|
# Expects: GH_TOKEN, VERSION; run from the verify job workspace (binaries/).
|
|
set -euo pipefail
|
|
|
|
TABLE="\n\n## Security Verification\n\n"
|
|
TABLE+="All release binaries scanned with 70+ antivirus engines — **0 detections**.\n\n"
|
|
TABLE+="| Binary | SHA-256 | VirusTotal |\n"
|
|
TABLE+="|--------|---------|------------|\n"
|
|
|
|
for bin in binaries/codebase-memory-mcp-*; do
|
|
[ -f "$bin" ] || continue
|
|
name=$(basename "$bin")
|
|
sha256=$(sha256sum "$bin" 2>/dev/null | awk '{print $1}' \
|
|
|| shasum -a 256 "$bin" | awk '{print $1}')
|
|
label=$(echo "$name" | sed 's/^codebase-memory-mcp-//' | sed 's/\.exe$//')
|
|
short="${sha256:0:20}..."
|
|
vt_url="https://www.virustotal.com/gui/file/${sha256}/detection"
|
|
TABLE+="| \`${label}\` | \`${short}\` | [0 detections ✅](${vt_url}) |\n"
|
|
done
|
|
|
|
CURRENT=$(gh release view "$VERSION" \
|
|
--json body --jq '.body // ""' --repo "$GITHUB_REPOSITORY")
|
|
printf '%s%b' "$CURRENT" "$TABLE" > /tmp/release_notes.md
|
|
gh release edit "$VERSION" \
|
|
--notes-file /tmp/release_notes.md --repo "$GITHUB_REPOSITORY"
|