loop-uh
2ccfe8ce0a
Some checks failed
RKNnoVPN Linux and Android CI / policy-and-go (push) Successful in 14s
RKNnoVPN Linux and Android CI / android-debug (push) Successful in 2m5s
Full build and Forgejo release / Privacy Lint (push) Successful in 3s
Full build and Forgejo release / Local-first Runtime Guardrail (push) Successful in 2s
Full build and Forgejo release / Go Tests (push) Successful in 13s
Full build and Forgejo release / Resolve sing-box release (push) Successful in 1s
Full build and Forgejo release / Resolve Xray-core release (push) Successful in 1s
Full build and Forgejo release / Android Guardrails & Tests (push) Failing after 16s
Full build and Forgejo release / Build APK (push) Has been skipped
Full build and Forgejo release / Build Runtime CLI (arm64) (push) Successful in 11s
Full build and Forgejo release / Build Runtime CLI (armv7) (push) Successful in 11s
Full build and Forgejo release / Build sing-box (arm64) (push) Failing after 2s
Full build and Forgejo release / Build sing-box (armv7) (push) Failing after 2s
Full build and Forgejo release / Build Xray-core (arm64) (push) Failing after 3s
Full build and Forgejo release / Build Xray-core (armv7) (push) Failing after 2s
Full build and Forgejo release / Build Magisk Module (push) Has been skipped
Full build and Forgejo release / Create Release (push) Has been skipped
87 lines
2.5 KiB
Shell
87 lines
2.5 KiB
Shell
#!/usr/bin/env bash
|
|
# Repository-independent Forgejo/local policy check.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
cd "$ROOT"
|
|
|
|
fail() {
|
|
echo "reset.lock contract: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
if grep -En 'rm -f .*reset\.lock|reset\.lock.*rm -f|RESET_LOCK.*rm -f' module/post-fs-data.sh module/service.sh >/tmp/reset-lock-forbidden.$$ 2>/dev/null; then
|
|
cat /tmp/reset-lock-forbidden.$$ >&2
|
|
rm -f /tmp/reset-lock-forbidden.$$
|
|
fail "post-fs-data.sh/service.sh must not remove reset.lock directly; use explicit runtime cleanup"
|
|
fi
|
|
rm -f /tmp/reset-lock-forbidden.$$
|
|
|
|
if grep -En 'rm -f .*run/(active|singbox\.pid|xray\.pid)|run/(active|singbox\.pid|xray\.pid).*rm -f' module/post-fs-data.sh >/tmp/runtime-marker-forbidden.$$ 2>/dev/null; then
|
|
cat /tmp/runtime-marker-forbidden.$$ >&2
|
|
rm -f /tmp/runtime-marker-forbidden.$$
|
|
fail "post-fs-data.sh must leave runtime markers for explicit runtime cleanup"
|
|
fi
|
|
rm -f /tmp/runtime-marker-forbidden.$$
|
|
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
|
|
fakebin="$tmp/bin"
|
|
mkdir -p "$fakebin"
|
|
for cmd in ip iptables ip6tables iptables-nft ip6tables-nft sleep; do
|
|
cat >"$fakebin/$cmd" <<'EOF'
|
|
#!/usr/bin/env sh
|
|
case "${0##*/}" in
|
|
sleep)
|
|
exit 0
|
|
;;
|
|
ip)
|
|
case "$*" in
|
|
*" show "*|*" rule show "*|*" route show "*)
|
|
exit 0
|
|
;;
|
|
*)
|
|
exit 1
|
|
;;
|
|
esac
|
|
;;
|
|
*)
|
|
if [ "$1" = "-w" ]; then
|
|
shift 2
|
|
fi
|
|
case "$*" in
|
|
*" -S"*|"-S"*|*" -t "*"-S"*)
|
|
exit 0
|
|
;;
|
|
*)
|
|
exit 0
|
|
;;
|
|
esac
|
|
;;
|
|
esac
|
|
EOF
|
|
chmod 755 "$fakebin/$cmd"
|
|
done
|
|
|
|
run_rescue() {
|
|
local mode="$1"
|
|
local data="$tmp/data-$mode"
|
|
mkdir -p "$data/bin" "$data/run" "$data/config" "$data/logs"
|
|
PATH="$fakebin:$PATH" RKNNOVPN_DIR="$data" sh module/scripts/rescue_reset.sh "$mode" >/dev/null
|
|
printf '%s\n' "$data"
|
|
}
|
|
|
|
data="$(run_rescue runtime-reset)"
|
|
[ -f "$data/run/reset.lock" ] || fail "runtime-reset must leave reset.lock for the runtime reset window"
|
|
[ -f "$data/config/manual" ] || fail "runtime-reset must leave manual flag"
|
|
|
|
data="$(run_rescue hard-reset)"
|
|
[ ! -e "$data/run/reset.lock" ] || fail "hard-reset must remove reset.lock when cleanup finishes"
|
|
[ -f "$data/config/manual" ] || fail "hard-reset must leave manual flag"
|
|
|
|
data="$(run_rescue uninstall-clean)"
|
|
[ ! -e "$data/run/reset.lock" ] || fail "uninstall-clean must remove reset.lock when cleanup finishes"
|
|
[ ! -e "$data/config/manual" ] || fail "uninstall-clean must not create manual flag"
|
|
|
|
echo "reset.lock contract: ok"
|