mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-02 09:41:37 +00:00
d4a9bbbe87
* ci(testbox): provision pinned TruffleHog * fix(ci): preserve existing TruffleHog bin directory * test(ci): cover TruffleHog target routing
125 lines
3.3 KiB
Bash
Executable File
125 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
trufflehog_version="3.95.9"
|
|
trufflehog_bin_dir="${OPENCLAW_TRUFFLEHOG_BIN_DIR:-/usr/local/bin}"
|
|
|
|
log() {
|
|
printf 'trufflehog-install: %s\n' "$*" >&2
|
|
}
|
|
|
|
run_as_root() {
|
|
local writable_ancestor="$trufflehog_bin_dir"
|
|
while [[ ! -e "$writable_ancestor" && "$writable_ancestor" != "/" ]]; do
|
|
writable_ancestor="$(dirname "$writable_ancestor")"
|
|
done
|
|
if [[ "$(id -u)" -eq 0 || -w "$trufflehog_bin_dir" || -w "$writable_ancestor" ]]; then
|
|
"$@"
|
|
return
|
|
fi
|
|
if ! command -v sudo >/dev/null 2>&1; then
|
|
log "sudo is required to install into $trufflehog_bin_dir"
|
|
return 1
|
|
fi
|
|
sudo "$@"
|
|
}
|
|
|
|
ensure_trufflehog_bin_dir() {
|
|
if [[ -d "$trufflehog_bin_dir" ]]; then
|
|
return 0
|
|
fi
|
|
if [[ -e "$trufflehog_bin_dir" ]]; then
|
|
log "install path exists but is not a directory: $trufflehog_bin_dir"
|
|
return 1
|
|
fi
|
|
run_as_root install -d -m 0755 "$trufflehog_bin_dir"
|
|
}
|
|
|
|
trufflehog_arch() {
|
|
case "$1" in
|
|
x86_64 | amd64) printf '%s\n' "amd64" ;;
|
|
aarch64 | arm64) printf '%s\n' "arm64" ;;
|
|
*)
|
|
log "unsupported Linux architecture: $1"
|
|
return 1
|
|
;;
|
|
esac
|
|
}
|
|
|
|
trufflehog_sha256() {
|
|
case "$1" in
|
|
amd64) printf '%s\n' "f6d1106b85107d79527ed7a5b98b592beadd8b770dc3c9e8c1ad99e1b2cf127e" ;;
|
|
arm64) printf '%s\n' "9d9c2ec4ea36a089a9c5aaafe1969d176013ddf9f44d68e8cd75291aed8c83ed" ;;
|
|
*)
|
|
log "unsupported TruffleHog architecture: $1"
|
|
return 1
|
|
;;
|
|
esac
|
|
}
|
|
|
|
trufflehog_binary_ready() {
|
|
local binary="$1"
|
|
[[ -x "$binary" ]] &&
|
|
"$binary" --no-update --version 2>/dev/null |
|
|
awk -v version="$trufflehog_version" '
|
|
{
|
|
for (field = 1; field <= NF; field++) {
|
|
if ($field == version) {
|
|
found = 1
|
|
}
|
|
}
|
|
}
|
|
END { exit found ? 0 : 1 }
|
|
'
|
|
}
|
|
|
|
install_trufflehog() {
|
|
local arch archive candidate checksum target tmp_dir url
|
|
|
|
if [[ "$(uname -s)" != "Linux" ]]; then
|
|
log "this installer supports Linux Testbox environments only"
|
|
return 1
|
|
fi
|
|
|
|
target="$trufflehog_bin_dir/trufflehog"
|
|
if trufflehog_binary_ready "$target"; then
|
|
log "TruffleHog $trufflehog_version is already installed"
|
|
return 0
|
|
fi
|
|
|
|
arch="$(trufflehog_arch "$(uname -m)")"
|
|
checksum="$(trufflehog_sha256 "$arch")"
|
|
archive="trufflehog_${trufflehog_version}_linux_${arch}.tar.gz"
|
|
url="https://github.com/trufflesecurity/trufflehog/releases/download/v${trufflehog_version}/${archive}"
|
|
tmp_dir="$(mktemp -d)"
|
|
|
|
if ! curl -fsSL --retry 3 --output "$tmp_dir/$archive" "$url" ||
|
|
! (
|
|
cd "$tmp_dir"
|
|
printf '%s %s\n' "$checksum" "$archive" | sha256sum -c -
|
|
) ||
|
|
! tar --no-same-owner -xzf "$tmp_dir/$archive" -C "$tmp_dir" trufflehog; then
|
|
rm -rf "$tmp_dir"
|
|
return 1
|
|
fi
|
|
|
|
ensure_trufflehog_bin_dir
|
|
candidate="$(run_as_root mktemp "${target}.tmp.XXXXXX")"
|
|
if ! run_as_root install -m 0755 "$tmp_dir/trufflehog" "$candidate" ||
|
|
! trufflehog_binary_ready "$candidate" ||
|
|
! run_as_root mv -f "$candidate" "$target"; then
|
|
run_as_root rm -f "$candidate" || true
|
|
rm -rf "$tmp_dir"
|
|
return 1
|
|
fi
|
|
|
|
rm -rf "$tmp_dir"
|
|
log "installed TruffleHog $trufflehog_version at $target"
|
|
}
|
|
|
|
if [[ "${OPENCLAW_TRUFFLEHOG_SOURCE_ONLY:-0}" == "1" ]]; then
|
|
return 0 2>/dev/null || exit 0
|
|
fi
|
|
|
|
install_trufflehog
|