gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: update plan 16 sec14-26

Browse Source
This commit is contained in:
thanhnv
2026-07-07 15:46:36 +09:00
parent 0c60ed33e9
commit ae4fc7112c
64 changed files with 2231 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/tests/phase-sec15-tests.sh
+9 -3
View File
@@ -37,11 +37,17 @@ grep -q "typosquat" "$WORK/r.json" \
|| pass "legit distant package not false-flagged (levenshtein sentinel fixed)"
# ---- tool-exec fail-closed when no timeout backend ----
# PATH=/bin has bash but not perl/timeout (both in /usr/bin) → no-backend branch.
[[ "$(set +e; PATH=/bin CASAN_TOOL_EXEC_STRICT=1 /bin/bash "$S/tool-exec.sh" 2 -- echo hi >/dev/null 2>&1; echo $?)" -eq 2 ]] \
# Hermetic: build a PATH that contains ONLY bash (no timeout, no perl) so the
# no-backend branch is reached regardless of the host's /usr layout. On
# merged-/usr systems /bin is a symlink to /usr/bin, so PATH=/bin would still
# find timeout/perl — the old heuristic only worked on split-/usr (e.g. macOS).
ONLYBIN="$WORK/onlybin"; mkdir -p "$ONLYBIN"
BASH_BIN="$(command -v bash)"
ln -sf "$BASH_BIN" "$ONLYBIN/bash"
[[ "$(set +e; PATH="$ONLYBIN" CASAN_TOOL_EXEC_STRICT=1 "$BASH_BIN" "$S/tool-exec.sh" 2 -- echo hi >/dev/null 2>&1; echo $?)" -eq 2 ]] \
&& pass "tool-exec refuses (fail-closed) with no timeout backend in enforced mode" \
|| fail "tool-exec did not fail closed without a timeout backend"
[[ "$(set +e; PATH=/bin /bin/bash "$S/tool-exec.sh" 2 -- echo hi >/dev/null 2>&1; echo $?)" -eq 0 ]] \
[[ "$(set +e; PATH="$ONLYBIN" "$BASH_BIN" "$S/tool-exec.sh" 2 -- echo hi >/dev/null 2>&1; echo $?)" -eq 0 ]] \
&& pass "tool-exec dev: runs without backend (backward compatible)" \
|| fail "tool-exec dev mode broke"