f26af3adba
* feat(safety): add baked safety profiles Co-authored-by: Drew Burchfield <1084679+drewburchfield@users.noreply.github.com> * fix(safety): narrow readonly profile parent allows * fix(safety): verify basename safe-build outputs * fix(backup): promote Gmail checkpoints into final manifest * docs(safety): explain baked safety profiles * feat(safety): filter profiled help and schema * fix(safety): avoid help filter shadow warnings * fix(backup): make plaintext export resilient * docs(changelog): mention safety help filtering * fix(backup): satisfy export lint checks --------- Co-authored-by: Drew Burchfield <1084679+drewburchfield@users.noreply.github.com>
80 lines
1.7 KiB
Bash
Executable File
80 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")"
|
|
|
|
usage() {
|
|
cat >&2 <<'USAGE'
|
|
Usage: ./build-safe.sh <profile.yaml> [-o output]
|
|
|
|
Examples:
|
|
./build-safe.sh safety-profiles/readonly.yaml
|
|
./build-safe.sh safety-profiles/agent-safe.yaml -o /usr/local/bin/gog-safe
|
|
USAGE
|
|
}
|
|
|
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
|
usage
|
|
exit 0
|
|
fi
|
|
|
|
if [[ -z "${1:-}" || "${1:-}" == -* ]]; then
|
|
usage
|
|
exit 2
|
|
fi
|
|
|
|
PROFILE="$1"
|
|
shift
|
|
|
|
OUTPUT="bin/gog-safe"
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
-o|--output)
|
|
if [[ -z "${2:-}" ]]; then
|
|
echo "error: $1 requires a path" >&2
|
|
exit 2
|
|
fi
|
|
OUTPUT="$2"
|
|
shift 2
|
|
;;
|
|
-h|--help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "error: unknown flag: $1" >&2
|
|
usage
|
|
exit 2
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [[ ! -f "$PROFILE" ]]; then
|
|
echo "error: profile not found: $PROFILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
GEN_FILE="internal/cmd/safety_profile_baked_gen.go"
|
|
cleanup() {
|
|
rm -f "$GEN_FILE"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
cleanup
|
|
go run ./cmd/bake-safety-profile "$PROFILE" "$GEN_FILE"
|
|
|
|
VERSION=$(git describe --tags --always --dirty 2>/dev/null || echo dev)
|
|
COMMIT=$(git rev-parse --short=12 HEAD 2>/dev/null || echo "")
|
|
DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
LDFLAGS="-X github.com/steipete/gogcli/internal/cmd.version=${VERSION}-safe -X github.com/steipete/gogcli/internal/cmd.commit=${COMMIT} -X github.com/steipete/gogcli/internal/cmd.date=${DATE}"
|
|
|
|
mkdir -p "$(dirname "$OUTPUT")"
|
|
go build -tags safety_profile -ldflags "$LDFLAGS" -o "$OUTPUT" ./cmd/gog
|
|
RUN_OUTPUT="$OUTPUT"
|
|
if [[ "$RUN_OUTPUT" != */* ]]; then
|
|
RUN_OUTPUT="./$RUN_OUTPUT"
|
|
fi
|
|
"$RUN_OUTPUT" --version
|
|
|
|
echo "built $OUTPUT with baked safety profile $PROFILE"
|