58e13cd079
* Prevent empty drive encryption passwords * Use sudo, quote the confirmation compare, and cover mismatches in test The unquoted [[ $new_password == $confirmation ]] made the confirmation a glob pattern, so a confirmation like * matched any password. And pkexec brought nothing over the repo-standard sudo here while failing outright in sessions without a polkit agent. Verified against a loopback LUKS device: new key lands from stdin without a trailing newline while the current passphrase is prompted on the tty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: mplaczek99 <mplaczek99@gmail.com> Co-authored-by: David Heinemeier Hansson <david@hey.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
50 lines
1.6 KiB
Bash
50 lines
1.6 KiB
Bash
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
|
|
|
|
tmp_dir=$(mktemp -d)
|
|
trap 'rm -r "$tmp_dir"' EXIT
|
|
|
|
cat >"$tmp_dir/blkid" <<'EOF'
|
|
#!/bin/bash
|
|
echo /dev/test-luks
|
|
EOF
|
|
|
|
cat >"$tmp_dir/gum" <<'EOF'
|
|
#!/bin/bash
|
|
head -n 1 "$TEST_INPUTS"
|
|
sed -i '1d' "$TEST_INPUTS"
|
|
EOF
|
|
|
|
cat >"$tmp_dir/sudo" <<'EOF'
|
|
#!/bin/bash
|
|
printf '%s\n' "$@" >"$TEST_ARGS"
|
|
cat >"$TEST_STDIN"
|
|
EOF
|
|
|
|
chmod +x "$tmp_dir/blkid" "$tmp_dir/gum" "$tmp_dir/sudo"
|
|
export PATH="$tmp_dir:$ROOT/bin:$PATH"
|
|
export TEST_ARGS="$tmp_dir/args" TEST_INPUTS="$tmp_dir/inputs" TEST_STDIN="$tmp_dir/stdin"
|
|
|
|
printf '\n' >"$TEST_INPUTS"
|
|
if "$ROOT/bin/omarchy-drive-password" >/dev/null; then
|
|
fail "drive password rejects an empty passphrase"
|
|
fi
|
|
[[ ! -e $TEST_ARGS ]] || fail "drive password does not run cryptsetup for an empty passphrase"
|
|
|
|
printf 'secret123\n*\n' >"$TEST_INPUTS"
|
|
if "$ROOT/bin/omarchy-drive-password" >/dev/null; then
|
|
fail "drive password rejects a mismatched confirmation"
|
|
fi
|
|
[[ ! -e $TEST_ARGS ]] || fail "drive password does not run cryptsetup for a mismatched confirmation"
|
|
|
|
printf 'new password\nnew password\n' >"$TEST_INPUTS"
|
|
"$ROOT/bin/omarchy-drive-password" >/dev/null
|
|
|
|
[[ $(<"$TEST_STDIN") == "new password" ]] || fail "drive password passes the validated passphrase without a newline"
|
|
grep -F 'cryptsetup luksChangeKey' "$TEST_ARGS" >/dev/null || fail "drive password changes the LUKS key"
|
|
grep -Fx /dev/test-luks "$TEST_ARGS" >/dev/null || fail "drive password targets the selected drive"
|
|
pass "drive password rejects empty and mismatched passphrases and passes validated input to cryptsetup"
|