cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

build(baseline): finalize generator (packages as deployed, overrides as files)

Browse Source 
build-baseline.sh: packages/*/ placed as deployed-layout (reconciled to live
bytes at commit-authoring; jmap authors the pristine commit), overrides/ overlaid
as live files. Final out/ = 23578 clean code files; verified against live:
non-malware code residual = 0 (all residual is excluded malware + scan artifacts).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
This commit is contained in:
LÁZÁR Imre AI Agent 2026-07-16 11:41:04 +02:00
parent 4168b737cc
commit 4fa771286f
1 changed files with 16 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
build-baseline.sh
View File

@ -27,18 +27,16 @@ rsync -a \
--exclude='images/joomla_black.png' --exclude='images/powered_by.png' \ --exclude='images/joomla_black.png' --exclude='images/powered_by.png' \
"$ROOT/core/" "$OUT/" "$ROOT/core/" "$OUT/"
# 2) Upstream-package extensions — map the pristine package to deployed paths via # 2) Upstream-package extensions — deployed-layout, byte-reconciled to live.
# the Joomla manifest, then apply the Cadline delta patch (if the module was # In git these are authored as two commits per modified module: (a) the
# legitimately modified). git diff pristine<->patch documents our delta. # pristine upstream package manifest-mapped by lib/jmap.py, (b) the reconcile
for pkg in "$ROOT"/packages/*/; do # to the live bytes (line-endings + install files + Cadline delta). `git diff`
[ -d "$pkg" ] || continue # between those two commits documents exactly how live differs from upstream.
name="$(basename "$pkg")" # At build time the reconciled (live-byte) deployed files are placed directly.
log "package: $name (manifest-map)" for d in "$ROOT"/packages/*/; do
python3 "$JMAP" --package "$pkg/pristine" --out "$OUT" [ -d "$d" ] || continue
if [ -f "$pkg/cadline.patch" ]; then log "package: $(basename "$d")"
log "package: $name (apply Cadline delta)" rsync -a --exclude='.provenance' "$d" "$OUT/"
( cd "$OUT" && patch -p1 --no-backup-if-mismatch < "$pkg/cadline.patch" )
fi
done done
# 3) No-source extensions — vetted deployed files (no obtainable package), # 3) No-source extensions — vetted deployed files (no obtainable package),
@ -56,12 +54,12 @@ for d in "$ROOT"/cadline/*/; do
rsync -a --exclude='.provenance' "$d" "$OUT/" rsync -a --exclude='.provenance' "$d" "$OUT/"
done done
# 5) Cadline core modifications — patches applied on the vanilla core. # 5) Cadline core modifications — live versions overlaid on the package core
for p in "$ROOT"/overrides/*.patch; do # (the ~24 legit customizations); the 3 trojanized core files stay clean.
[ -f "$p" ] || continue if [ -d "$ROOT/overrides" ]; then
log "override: $(basename "$p")" log "overrides: Cadline core modifications"
( cd "$OUT" && patch -p1 --no-backup-if-mismatch < "$p" ) rsync -a --exclude='.gitkeep' "$ROOT/overrides/" "$OUT/"
done fi
# 6) Safety net — malware IOC + scan artifacts must never appear in the baseline # 6) Safety net — malware IOC + scan artifacts must never appear in the baseline
# (the sources above already exclude them; this is defensive, documented in # (the sources above already exclude them; this is defensive, documented in