mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-04 10:48:20 +00:00
Martin Vogel
83df500364
Two CI failures on the integration-asset change, both build/gate plumbing, not the architecture: 1. scripts/gen-integrations-hash.sh was committed 100644 while Makefile.cbm invoked it directly, so a fresh CI checkout died with "Permission denied" building the hash header — which failed EVERY test leg at step 0, since the contract step builds first. It passed locally only because the generated header was already cached, so make never re-ran the generator. Fixed both ways: the recipe now runs it via `sh` (mode-independent, cannot regress from a checkout mode), and the file is committed 100755 to match its siblings. Note: test_script_exec_bit_contract.sh scans shell call sites, not Makefile recipes, so it did not catch this — the `sh` prefix is the durable guard. 2. The license gate (ScanCode) flagged scripts/package-release.sh with the SPDX 'JSON' license. The archive member lists place 'cbm-integrations.json' and 'LICENSE' adjacently, and ScanCode reads the '.json LICENSE' token adjacency as a JSON-license reference. The order is not free to change — the Windows single-binary contract locks the exact member sequence — so this is a genuine false positive on a first-party MIT build script. Added it to the policy's ignored_paths with the same justification the six existing first-party entries carry (the gate scripts, provenance auditor, and discover.c all name licenses for legitimate reasons). No allow-listed SPDX id was added; the JSON license is NOT now permitted anywhere else. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
55 lines
1.7 KiB
Bash
Executable File
55 lines
1.7 KiB
Bash
Executable File
#!/bin/sh
|
|
# gen-integrations-hash.sh — emit the build-time integrity constant for
|
|
# assets/cbm-integrations.json.
|
|
#
|
|
# The binary embeds exactly ONE fact about the integration templates: the
|
|
# SHA-256 of the shipped asset file. Verifying the file against this constant
|
|
# before use preserves the tamper-evidence the templates had while they were
|
|
# compiled in — moving them out of the binary (AV-surface reduction) must not
|
|
# turn them into unauthenticated code the installer happily writes to disk.
|
|
#
|
|
# Generated, never hand-maintained: a stale constant is exactly the silent
|
|
# drift this step exists to prevent, so the header is a build product with a
|
|
# real dependency on the JSON file.
|
|
set -eu
|
|
|
|
if [ "$#" -ne 2 ]; then
|
|
echo "usage: gen-integrations-hash.sh <asset.json> <out-header.h>" >&2
|
|
exit 2
|
|
fi
|
|
asset="$1"
|
|
out="$2"
|
|
|
|
[ -f "$asset" ] || { echo "gen-integrations-hash: missing $asset" >&2; exit 1; }
|
|
|
|
if command -v sha256sum >/dev/null 2>&1; then
|
|
hash=$(sha256sum "$asset" | cut -d' ' -f1)
|
|
elif command -v shasum >/dev/null 2>&1; then
|
|
hash=$(shasum -a 256 "$asset" | cut -d' ' -f1)
|
|
else
|
|
echo "gen-integrations-hash: neither sha256sum nor shasum available" >&2
|
|
exit 1
|
|
fi
|
|
|
|
case "$hash" in
|
|
*[!0-9a-f]* | "")
|
|
echo "gen-integrations-hash: bad digest '$hash'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
if [ "${#hash}" -ne 64 ]; then
|
|
echo "gen-integrations-hash: bad digest length for '$hash'" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$(dirname "$out")"
|
|
tmp="$out.tmp.$$"
|
|
{
|
|
echo "/* Generated by scripts/gen-integrations-hash.sh — do not edit. */"
|
|
echo "#ifndef CBM_INTEGRATIONS_HASH_H"
|
|
echo "#define CBM_INTEGRATIONS_HASH_H"
|
|
echo "#define CBM_INTEGRATIONS_SHA256 \"$hash\""
|
|
echo "#endif"
|
|
} >"$tmp"
|
|
mv "$tmp" "$out"
|