32 lines
1.0 KiB
Bash
32 lines
1.0 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
fail=0
|
|
for name in .DS_Store __MACOSX .git; do
|
|
if find . -name "$name" -print | grep -q .; then
|
|
echo "[fail] found forbidden metadata: $name"
|
|
fail=1
|
|
fi
|
|
done
|
|
|
|
if find . -type f \( -name '*.key' -o -name '*.pem' -o -name '*.p12' -o -name '*.pfx' -o -name '*.dylib' -o -name '*.exe' \) -print | grep -q .; then
|
|
echo '[fail] found a forbidden secret or binary file type'
|
|
fail=1
|
|
fi
|
|
|
|
if find . -path './tools/v' -prune -o -path './verify.sh' -prune -o -type f -print0 | xargs -0 grep -IlE 'BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY|api[_-]?key[[:space:]]*=|secret[[:space:]]*=' 2>/dev/null | grep -q .; then
|
|
echo '[fail] possible credential material detected outside third-party source'
|
|
fail=1
|
|
fi
|
|
|
|
if find . -path './verify.sh' -prune -o -type f -print0 | xargs -0 grep -IlE 'agila_arch_idt|idt_common_handler|idt_dispatch' 2>/dev/null | grep -q .; then
|
|
echo '[fail] proprietary kernel-IDT material detected'
|
|
fail=1
|
|
fi
|
|
|
|
if [ "$fail" -ne 0 ]; then
|
|
exit 1
|
|
fi
|
|
|
|
echo '[ok] public-release checks passed'
|