bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix(hlcc): persist sandbox-compatible shared mode

Browse source
This commit is contained in:
冰朔 2026-08-06 16:28:56 +08:00
commit 612e0b810d
5 changed files with 107 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

24
server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py
View file

@ -482,8 +482,9 @@ def seed_fifth_domain_channel(binary: pathlib.Path) -> str:
def configure_shared_channel_repository(
repository: pathlib.Path = CHANNEL_REPOSITORY_PATH,
generated_hook: pathlib.Path | None = None,
) -> str:
"""Use Git's native shared-repository mode instead of a post-receive chmod."""
"""Use sandbox-compatible native sharing instead of post-receive chmod."""
if not repository.is_dir():
raise RuntimeError("channel repository path unavailable")
@ -494,7 +495,7 @@ def configure_shared_channel_repository(
str(repository),
"config",
"core.sharedRepository",
"group",
"0660",
],
check=True,
capture_output=True,
@ -513,7 +514,7 @@ def configure_shared_channel_repository(
capture_output=True,
text=True,
).stdout.strip()
if configured not in {"1", "group"}:
if configured != "0660":
raise RuntimeError("shared repository configuration verification failed")
obsolete_hook = (
@ -530,6 +531,23 @@ def configure_shared_channel_repository(
raise RuntimeError("obsolete sharing hook identity mismatch")
obsolete_hook.unlink()
generated_hook = generated_hook or (
STATE_ROOT / "data" / "data" / "home" / "hooks" / "post-receive"
)
if not generated_hook.is_file() or generated_hook.is_symlink():
raise RuntimeError("generated post-receive hook path unavailable")
generated_text = generated_hook.read_text(encoding="utf-8")
unsafe_test = 'if [ $(basename "${hook}") != "gitea" ]; then'
safe_test = 'if [ "$(basename "${hook}")" != "gitea" ]; then'
if unsafe_test in generated_text:
generated_hook.write_text(
generated_text.replace(unsafe_test, safe_test, 1),
encoding="utf-8",
)
generated_hook.chmod(0o700)
elif safe_test not in generated_text:
raise RuntimeError("generated post-receive hook identity mismatch")
return "configured"

4
server-tools/hololake-code-channel/jd-candidate/native.test.js
View file

@ -48,8 +48,10 @@ assert.match(bootstrap, /access_tokens_migrated": False/);
assert.match(bootstrap, /repositories_migrated": False/);
assert.match(bootstrap, /delete from access_token/);
assert.match(bootstrap, /core\.sharedRepository/);
assert.match(bootstrap, /"group"/);
assert.match(bootstrap, /"0660"/);
assert.match(bootstrap, /obsolete sharing hook identity mismatch/);
assert.match(bootstrap, /generated post-receive hook identity mismatch/);
assert.match(bootstrap, /basename "\$\{hook\}"/);
assert.match(bootstrap, /configure_shared_channel_repository\(\)/);
assert.doesNotMatch(
bootstrap,

20
server-tools/hololake-code-channel/jd-candidate/test_owner_migration.py
View file

@ -150,9 +150,14 @@ class SharedRepositoryTests(unittest.TestCase):
"#!/bin/sh\nprintf '%s\\n' post_receive_permissions_reconciled\n",
encoding="utf-8",
)
generated_hook = pathlib.Path(temporary) / "generated-post-receive"
generated_hook.write_text(
'#!/usr/bin/env bash\nif [ $(basename "${hook}") != "gitea" ]; then\n :\nfi\n',
encoding="utf-8",
)
self.assertEqual(
MODULE.configure_shared_channel_repository(repository),
MODULE.configure_shared_channel_repository(repository, generated_hook),
"configured",
)
configured = subprocess.run(
@ -168,8 +173,12 @@ class SharedRepositoryTests(unittest.TestCase):
capture_output=True,
text=True,
).stdout.strip()
self.assertIn(configured, {"1", "group"})
self.assertEqual(configured, "0660")
self.assertFalse(hook.exists())
self.assertIn(
'if [ "$(basename "${hook}")" != "gitea" ]; then',
generated_hook.read_text(encoding="utf-8"),
)
def test_refuses_unknown_hook_content(self) -> None:
with tempfile.TemporaryDirectory() as temporary:
@ -178,9 +187,14 @@ class SharedRepositoryTests(unittest.TestCase):
hook = repository / "hooks" / "post-receive.d" / "guanghu-ice-heart-share"
hook.parent.mkdir(parents=True)
hook.write_text("#!/bin/sh\nexit 0\n", encoding="utf-8")
generated_hook = pathlib.Path(temporary) / "generated-post-receive"
generated_hook.write_text(
'#!/usr/bin/env bash\nif [ $(basename "${hook}") != "gitea" ]; then\n :\nfi\n',
encoding="utf-8",
)
with self.assertRaisesRegex(RuntimeError, "identity mismatch"):
MODULE.configure_shared_channel_repository(repository)
MODULE.configure_shared_channel_repository(repository, generated_hook)
self.assertTrue(hook.exists())