chore(archive): preserve KNELServerBuild remainder + layout notes [#474]

Archive the non-ported remainder of the legacy KNELServerBuild repo under archive/KNELServerBuild/ with its original structure intact, completing the legacy repo merge for everything except the live LibreNMS patterns (ported in the previous commit). Exclusions: - .git history (superseded; legacy repo remains at its original path) - ported files (Agents/librenms, Modules/OAM/oam-librenms.sh, ConfigFiles/SNMP/snmp-sudo.conf) - vendored KNELShellFramework tree (byte-identical duplicate of the copy already vendored at vendor/ in this repo) - SSH authorized-keys files (live access-control material; carrying them in an archive invites drift — key policy lives elsewhere) The whole tree is skip-listed in tests/shellcheck.sh (archived legacy code, not maintained — same standing as vendor/); check-rules.sh already prunes archive/. Rule 9 (conflict markers) now also excludes archive/ staged files: preserved-verbatim legacy scripts contain decorative "====" banners that false-positive as conflict markers (same archive exclusion precedent as rule 11). AGENTS.md: note archive/KNELServerBuild and oam/librenms-agent in the Repository Layout, and fix the stale KNELIAC path to /home/reachableceo/projects/KNEL/KNELIAC. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
2026-08-28 06:12:05 -05:00
parent 75de9d7104
commit 39bb855a98
89 changed files with 8589 additions and 3 deletions
@@ -0,0 +1,148 @@
+#!/bin/bash
+
+# HTTPS Enforcement Security Test
+# Validates that all scripts use HTTPS instead of HTTP
+
+set -euo pipefail
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+FRAMEWORK_INCLUDES="$PROJECT_ROOT/vendor/git@git.knownelement.com/29418/KNEL/KNELShellFramework/Framework-Includes"
+
+function test_no_http_urls() {
+    echo "🔍 Checking for HTTP URLs in scripts..."
+    
+    local http_violations=0
+    local script_dirs=("$PROJECT_ROOT/ProjectCode" "$FRAMEWORK_INCLUDES" "$PROJECT_ROOT/Project-Includes")
+
+    for dir in "${script_dirs[@]}"; do
+        if [[ -d "$dir" ]]; then
+            # Find HTTP URLs in shell scripts (excluding comments)
+            while IFS= read -r -d '' file; do
+                # grep -n prefixes "linenum:", so the comment filter must allow
+                # for that prefix before the leading '#' of a comment line.
+                if grep -n "http://" "$file" | grep -vE '^[0-9]+:[[:space:]]*#' | grep -v "schema.org" | grep -v "xmlns"; then
+                    echo "❌ HTTP URL found in: $file"
+                    ((++http_violations))
+                fi
+            done < <(find "$dir" -name "*.sh" -type f -print0)
+        fi
+    done
+    
+    if [[ $http_violations -eq 0 ]]; then
+        echo "✅ No HTTP URLs found in active scripts"
+        return 0
+    else
+        echo "❌ Found $http_violations HTTP URL violations"
+        return 1
+    fi
+}
+
+function test_https_urls_valid() {
+    echo "🔍 Validating HTTPS URLs are accessible..."
+    
+    local script_dirs=("$PROJECT_ROOT/ProjectCode" "$FRAMEWORK_INCLUDES" "$PROJECT_ROOT/Project-Includes")
+    local https_failures=0
+
+    # Extract HTTPS URLs from scripts
+    for dir in "${script_dirs[@]}"; do
+        if [[ -d "$dir" ]]; then
+            while IFS= read -r -d '' file; do
+                # Extract HTTPS URLs from non-comment lines
+                grep -o "https://[^[:space:]\"']*" "$file" | grep -v "schema.org" | while read -r url; do
+                    # Test connectivity with timeout
+                    if timeout 30 curl -s --head --fail "$url" >/dev/null 2>&1; then
+                        echo "✅ HTTPS URL accessible: $url"
+                    else
+                        echo "❌ HTTPS URL not accessible: $url"
+                        ((++https_failures))
+                    fi
+                done
+            done < <(find "$dir" -name "*.sh" -type f -print0)
+        fi
+    done
+    
+    return $https_failures
+}
+
+function test_ssl_certificate_validation() {
+    echo "🔍 Testing SSL certificate validation..."
+    
+    local test_urls=(
+        "https://archive.ubuntu.com"
+        "https://linux.dell.com"
+        "https://download.proxmox.com"
+    )
+    
+    local ssl_failures=0
+    
+    for url in "${test_urls[@]}"; do
+        # Verify TLS is required and the certificate chain is valid. Do NOT use
+        # --cert-status: that requires OCSP stapling, which many valid CDNs do
+        # not provide, producing false negatives for otherwise-valid certs.
+        if curl -s --fail --ssl-reqd "$url" >/dev/null 2>&1; then
+            echo "✅ SSL certificate valid: $url"
+        else
+            echo "❌ SSL certificate validation failed: $url"
+            ((++ssl_failures))
+        fi
+    done
+    
+    return $ssl_failures
+}
+
+function test_deployment_security() {
+    echo "🔍 Testing deployment method security..."
+    
+    local readme_file="$PROJECT_ROOT/README.md"
+    
+    if [[ -f "$readme_file" ]]; then
+        # Check for insecure curl | bash patterns
+        if grep -q "curl.*|.*bash" "$readme_file" || grep -q "wget.*|.*bash" "$readme_file"; then
+            echo "❌ Insecure deployment method found in README.md"
+            return 1
+        else
+            echo "✅ Secure deployment method in README.md"
+        fi
+        
+        # Check for git clone method
+        if grep -q "git clone" "$readme_file"; then
+            echo "✅ Git clone deployment method found"
+            return 0
+        else
+            echo "⚠️  No git clone method found in README.md"
+            return 1
+        fi
+    else
+        echo "❌ README.md not found"
+        return 1
+    fi
+}
+
+# Main test execution
+function main() {
+    echo "🔒 Running HTTPS Enforcement Security Tests"
+    echo "=========================================="
+    
+    local total_failures=0
+    
+    # Run all security tests
+    test_no_http_urls || ((total_failures++))
+    test_https_urls_valid || ((total_failures++))
+    test_ssl_certificate_validation || ((total_failures++))
+    test_deployment_security || ((total_failures++))
+    
+    echo "=========================================="
+    
+    if [[ $total_failures -eq 0 ]]; then
+        echo "✅ All HTTPS enforcement security tests passed"
+        exit 0
+    else
+        echo "❌ $total_failures HTTPS enforcement security tests failed"
+        exit 1
+    fi
+}
+
+# Run main if executed directly
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    main "$@"
+fi