LÁZÁR Imre AI Agent
34c233950a
The developer-controlled Cadline repos (cadcommonlib, maintenance) become git submodules so updates flow through: git submodule update --remote -> build -> commit new pointers. Pinned to their authoritative HEADs. build-baseline.sh inits the submodules and normalizes their CRLF to LF (the deploy transform) so the assembled baseline byte-matches the deployed form. constants.php (live-only config, not in the repo; carries a DB credential tracked in the credential inventory) is kept as an overlay (overrides/) per instruction — removal happens at source later. Signed-off-by: LÁZÁR Imre <imre@illusion.hu> Assisted-by: claude-code@claude-opus-4-8
94 lines
4.0 KiB
Bash
Executable File
94 lines
4.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# build-baseline.sh — reproducibly assemble the www.archline.hu clean CODE baseline.
|
|
#
|
|
# Output (out/) = the deployed docroot (code only), which the operator's HIDS
|
|
# baseline-diff verifies the live server against.
|
|
#
|
|
# The repo stores the baseline CONSTITUENTS, not the deployed tree; this script
|
|
# performs the deterministic "deployment" (Joomla manifest-mapping for packaged
|
|
# extensions, direct placement for no-source ones), per RUNBOOK.md.
|
|
#
|
|
# Usage: ./build-baseline.sh [OUT_DIR] (default: ./out)
|
|
set -euo pipefail
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
OUT="${1:-$ROOT/out}"
|
|
JMAP="$ROOT/lib/jmap.py"
|
|
log(){ printf '[build] %s\n' "$*"; }
|
|
|
|
rm -rf "$OUT"; mkdir -p "$OUT"
|
|
|
|
# Ensure the developer-controlled submodules are populated (cadcommonlib, maintenance).
|
|
git -C "$ROOT" submodule update --init \
|
|
cadline/backend/common_cadline_libraries cadline/backend/maintenance >/dev/null 2>&1 || \
|
|
log "WARN: submodule update failed — common_cadline_libraries/maintenance may be empty"
|
|
|
|
# 1) Joomla core — official 3.8.11 package (deployed form), minus demo assets and
|
|
# runtime data dirs (cache/tmp/logs/images are data, not verified code).
|
|
log "core: Joomla 3.8.11 (official package)"
|
|
rsync -a \
|
|
--exclude='cache/' --exclude='tmp/' --exclude='logs/' \
|
|
--exclude='images/sampledata/' --exclude='images/banners/' --exclude='images/headers/' \
|
|
--exclude='images/joomla_black.png' --exclude='images/powered_by.png' \
|
|
"$ROOT/core/" "$OUT/"
|
|
|
|
# 2) Upstream-package extensions — deployed-layout, byte-reconciled to live.
|
|
# In git these are authored as two commits per modified module: (a) the
|
|
# pristine upstream package manifest-mapped by lib/jmap.py, (b) the reconcile
|
|
# to the live bytes (line-endings + install files + Cadline delta). `git diff`
|
|
# between those two commits documents exactly how live differs from upstream.
|
|
# At build time the reconciled (live-byte) deployed files are placed directly.
|
|
for d in "$ROOT"/packages/*/; do
|
|
[ -d "$d" ] || continue
|
|
log "package: $(basename "$d")"
|
|
rsync -a --exclude='.provenance' "$d" "$OUT/"
|
|
done
|
|
|
|
# 3) No-source extensions — vetted deployed files (no obtainable package),
|
|
# placed directly (already in deployed layout).
|
|
for d in "$ROOT"/deployed/*/; do
|
|
[ -d "$d" ] || continue
|
|
log "deployed: $(basename "$d")"
|
|
rsync -a --exclude='.provenance' "$d" "$OUT/"
|
|
done
|
|
|
|
# 4) Cadline own-code (components/modules/plugins/templates/docroot apps).
|
|
for d in "$ROOT"/cadline/*/; do
|
|
[ -d "$d" ] || continue
|
|
log "cadline: $(basename "$d")"
|
|
rsync -a --exclude='.provenance' --exclude='.git' "$d" "$OUT/"
|
|
done
|
|
|
|
# 5) Cadline core modifications — live versions overlaid on the package core
|
|
# (the ~24 legit customizations); the 3 trojanized core files stay clean.
|
|
if [ -d "$ROOT/overrides" ]; then
|
|
log "overrides: Cadline core modifications"
|
|
rsync -a --exclude='.gitkeep' "$ROOT/overrides/" "$OUT/"
|
|
fi
|
|
|
|
# 5b) Deploy transform for the submodule-sourced dirs: the developer repos
|
|
# (cadcommonlib, maintenance) store CRLF line-endings; the deployed live form
|
|
# is LF. Normalize the text files to LF so the baseline byte-matches deployment.
|
|
log "normalize: line-endings (common_cadline_libraries, maintenance) -> LF"
|
|
for dir in "$OUT/common_cadline_libraries" "$OUT/maintenance"; do
|
|
[ -d "$dir" ] || continue
|
|
find "$dir" -type f 2>/dev/null | while IFS= read -r f; do
|
|
grep -Iq . "$f" 2>/dev/null && sed -i 's/\r$//' "$f"
|
|
done
|
|
done
|
|
|
|
# 6) Safety net — malware IOC + scan artifacts must never appear in the baseline
|
|
# (the sources above already exclude them; this is defensive, documented in
|
|
# malware-iocs.md / malware-iocs.paths).
|
|
log "exclude: malware IOC + scan artifacts"
|
|
find "$OUT" \( -name '*.php.json' -o -name '*.phtml.json' -o -name 'h3x_*' -o -name '_h3x_*' \) -delete 2>/dev/null || true
|
|
if [ -f "$ROOT/malware-iocs.paths" ]; then
|
|
while IFS= read -r ioc; do
|
|
[ -z "$ioc" ] && continue
|
|
case "$ioc" in \#*) continue;; esac
|
|
rm -rf "${OUT:?}/$ioc"
|
|
done < "$ROOT/malware-iocs.paths"
|
|
fi
|
|
|
|
log "baseline built at: $OUT ($(find "$OUT" -type f | wc -l) files)"
|