From 02f62b08d60b3dcefa85e7b535bdc46d06440ea1 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 14:29:03 -1000 Subject: Check which library cgit logs as missing The cgit-level check accepted any line starting "[cgit] ", the prefix of cgit's own messages too, as proof that the filter logged a missing module. The guarded copy also kept the system secret path, so on a host with luaossl and a readable secret but no luaposix the form would be signed and the test would fail. --- tests/t0505-auth.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'tests') diff --git a/tests/t0505-auth.sh b/tests/t0505-auth.sh index 81666d5..579bf0f 100755 --- a/tests/t0505-auth.sh +++ b/tests/t0505-auth.sh @@ -102,13 +102,17 @@ test_expect_success CGIT_LUA 'an unedited copy protects nothing' ' grep ">guarded commit" tmp ' +# The secret has to be one not made yet, or a host secret already readable +# would sign the form wherever luaposix alone is missing. test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository stays closed' ' cat >protect.awk <<-\EOF && + /^local secret_filename = / { print "local secret_filename = \"" secret "\""; next } { print } /^local protected_repos = [{]$/ { print "\t[\"authy\"] = { alice = true }," } EOF - awk -f protect.awk "$EXTENSIONS_DIRECTORY/auth-inline.lua" >guarded.lua && + awk -v secret="$PWD/guarded-secret" -f protect.awk "$EXTENSIONS_DIRECTORY/auth-inline.lua" >guarded.lua && grep "\"authy\"" guarded.lua && + grep "guarded-secret" guarded.lua && cat >guardedrc <<-EOF && virtual-root=/ cache-size=0 @@ -119,7 +123,7 @@ test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository cgit_rc guardedrc "url=authy/log/" >tmp 2>err && ! grep "guarded commit" tmp && grep "

Logins are unavailable" tmp && - grep "^\[cgit\] " err + grep -E "^\[cgit\] .*module .(openssl\.rand|openssl\.hmac|posix\.sys\.stat|posix\.unistd). not found" err ' # A login through cgit itself, from the form to the protected repository's -- cgit 2.12.1