117 lines
3 KiB
Shell
Executable file
117 lines
3 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
|
|
fail() {
|
|
printf '%s\n' "$1" >&2
|
|
exit 1
|
|
}
|
|
|
|
awk '
|
|
function verify() {
|
|
if (registry && !checksum) {
|
|
printf "registry package lacks checksum: %s\n", package > "/dev/stderr"
|
|
failed = 1
|
|
}
|
|
}
|
|
/^\[\[package\]\]$/ {
|
|
verify()
|
|
package = "unknown"
|
|
registry = 0
|
|
checksum = 0
|
|
next
|
|
}
|
|
/^name = "/ {
|
|
package = $0
|
|
sub(/^name = "/, "", package)
|
|
sub(/"$/, "", package)
|
|
}
|
|
/^source = "registry\+/ { registry = 1 }
|
|
/^checksum = "/ {
|
|
value = $0
|
|
sub(/^checksum = "/, "", value)
|
|
sub(/"$/, "", value)
|
|
checksum = length(value) == 64 && value !~ /[^0-9a-f]/
|
|
}
|
|
END {
|
|
verify()
|
|
exit failed
|
|
}
|
|
' "$ROOT/Cargo.lock"
|
|
|
|
if rg -q '^source = "git\+' "$ROOT/Cargo.lock"; then
|
|
fail "Cargo.lock contains a Git dependency"
|
|
fi
|
|
|
|
for lock in \
|
|
"$ROOT/contracts/typespec/package-lock.json" \
|
|
"$ROOT/contracts/typespec-rust-emitter/package-lock.json"; do
|
|
if ! jq -e '
|
|
[.packages | to_entries[] |
|
|
select(.key | startswith("node_modules/")) |
|
|
select(.value.link != true) |
|
|
select(.value.integrity == null)] |
|
|
length == 0
|
|
' "$lock" >/dev/null; then
|
|
fail "$lock contains a registry package without integrity"
|
|
fi
|
|
done
|
|
|
|
read -r pnpm_packages pnpm_hashes < <(
|
|
awk '
|
|
BEGIN { packages = 0; hashes = 0; active = 0 }
|
|
/^packages:/ { active = 1; next }
|
|
/^snapshots:/ { active = 0 }
|
|
active && /^ [^ ].*:$/ { packages++ }
|
|
active && /integrity:/ { hashes++ }
|
|
END { print packages, hashes }
|
|
' "$ROOT/web/pnpm-lock.yaml"
|
|
)
|
|
if [[ "$pnpm_packages" != "$pnpm_hashes" ]]; then
|
|
fail "web/pnpm-lock.yaml contains a package without integrity"
|
|
fi
|
|
|
|
pnpm_ref="$(jq -r .packageManager "$ROOT/web/package.json")"
|
|
if [[ ! "$pnpm_ref" =~ ^pnpm@[0-9]+\.[0-9]+\.[0-9]+\+sha512\.[0-9a-f]{128}$ ]]; then
|
|
fail "web/package.json packageManager is not content-pinned"
|
|
fi
|
|
if ! rg -Fq "corepack install --global $pnpm_ref" "$ROOT/Dockerfile.test"; then
|
|
fail "Dockerfile.test does not install the pinned package manager"
|
|
fi
|
|
|
|
while IFS= read -r image; do
|
|
if [[ ! "$image" =~ @sha256:[0-9a-f]{64}$ ]]; then
|
|
fail "fixture image is not digest-pinned: $image"
|
|
fi
|
|
done < <(awk -F= '/_IMAGE=/ { print $2 }' "$ROOT/tests/kind/fixture/versions.env")
|
|
|
|
while IFS= read -r image; do
|
|
if [[ ! "$image" =~ @sha256:[0-9a-f]{64}$ ]]; then
|
|
fail "Docker image default is not digest-pinned: $image"
|
|
fi
|
|
done < <(awk -F= '/^ARG [A-Z_]+_IMAGE=/ { print $2 }' "$ROOT/Dockerfile" "$ROOT/Dockerfile.test")
|
|
|
|
while IFS= read -r command; do
|
|
if [[ "$command" != *--locked* ]]; then
|
|
fail "Cargo dependency command lacks --locked: $command"
|
|
fi
|
|
done < <(
|
|
{
|
|
sed -n '/cargo \(build\|check\|clippy\|install\|nextest\|test\)/p' "$ROOT/Makefile"
|
|
awk '
|
|
{
|
|
line = line $0
|
|
if (sub(/\\$/, "", line)) {
|
|
next
|
|
}
|
|
print line
|
|
line = ""
|
|
}
|
|
' "$ROOT/Dockerfile" "$ROOT/Dockerfile.test" |
|
|
sed 's/&&/\n/g' |
|
|
sed -n '/cargo \(build\|check\|clippy\|install\|nextest\|test\)/p'
|
|
} | sed '/cargo fmt/d'
|
|
)
|
|
|
|
printf 'immutable external reference checks passed\n'
|