KNEL/football
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
174 Commits 1 Branch 0 Tags
6c5ba3d8c6ce216c0ef11dc04baec847b55b2bc1
Commit Graph
3 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
reachableceo 6c5ba3d8c6 feat: restore test-iso.sh with fixes for local libvirt execution 
Restore the libvirt/virsh ISO testing script that was deleted in commit
c1d8c5d ("will fold into run.sh" but never was). run.sh still references
test-iso.sh via the test:iso command, so it must exist.

The original script had several issues preventing it from running on
this host. This commit restores it from git history (commit 241510c)
with the following fixes:

- Disk path: Changed from /var/lib/libvirt/images/ (root-owned) to
  ./tmp/ (writable by user), avoiding permission denied errors
- CPU model: Changed from deprecated "host" to "host-model" per
  virt-install warning
- Graphics: Simplified from Spice with channel to plain VNC, fixing
  "virtio-serial-bus: A port already exists" error
- Networking: Removed --network flag (no libvirt default network
  available on this host; not needed for ISO boot testing)
- Sudo: Removed unnecessary sudo from qemu-img and rm commands
  (user is in libvirt group and disk is in local tmp/)
- Startup: Removed redundant virsh start after virt-install (which
  already starts the domain), fixing "Domain is already active" error

Commands:
  ./run.sh test:iso create    Create and boot test VM from ISO
  ./run.sh test:iso console   Connect to VM serial console
  ./run.sh test:iso status    Show VM status
  ./run.sh test:iso destroy   Stop and remove VM

Tested: VM boots successfully from the 450M ISO artifact.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>
 2026-04-27 13:10:07 -05:00
reachableceo 821622d12b test: add comprehensive test suites for all source scripts 
Add new BATS test files covering firewall-setup, security-hardening,
build-iso execution, and configuration hooks. These complement the
existing test files and bring total test count to 235.

New test files:

tests/unit/firewall-setup_comprehensive_test.bats (42 tests)
- parse_wg_endpoint: config parsing, missing file, malformed config
- generate_nftables_rules: rule generation, port/ip extraction
- apply_firewall: WireGuard present/absent/default deny fallback
- main: execution flow, argument passthrough

tests/unit/security-hardening_comprehensive_test.bats (90 tests)
- create_wifi_blacklist: module coverage, output path, file creation
- create_bluetooth_blacklist: module coverage, output path
- configure_ssh: Protocol 2, root login disabled, MaxAuthTries, etc.
- configure_password_policy: minlen=14, character class requirements,
  dictionary check, username check, bad words, enforcing mode
- configure_system_limits: core dump disabled, nproc limits
- configure_audit_rules: passwd/shadow/sshd/wireguard/audit monitoring
- apply_security_hardening: calls all sub-functions, progress output
- main: execution flow, start/completion messages

tests/unit/execution_comprehensive_test.bats (28 tests)
- Script execution guards (set -euo pipefail, shebang)
- Sourceability without execution
- Function existence checks

tests/unit/build-iso_comprehensive_test.bats (expanded to 39 tests)
- Docker volume mounts, environment variables, build timeouts
- live-build configuration parameters
- Error handling and cleanup

tests/integration/hooks_comprehensive_test.bats (36 tests)
- All hooks have proper shebangs and error handling
- Hooks reference correct source files
- Configuration files exist and are well-formed
- Encryption hooks present and executable

All 235 tests pass: ./run.sh test

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>
 2026-04-27 13:10:07 -05:00
reachableceo 7545a164e5 fix: resolve all shellcheck warnings in source scripts and hooks 
This commit addresses every shellcheck warning (severity: warning and
above) across the project's shell scripts. Only SC1091 info-level
notices remain (sourced files not available during static analysis),
which is expected and unavoidable in the Docker build workflow.

Changes by file:

src/build-iso.sh
- Replace Unicode checkmark/cross characters (✓, ✗) with ASCII
  equivalents (PASS:, FAIL:) to eliminate commitBuffer encoding errors
- Replace useless `cat | cut` pipeline with direct file redirect
  (`cut -d' ' -f1 < file`), resolving SC2002

src/security-hardening.sh
- Pass optional arguments through the function call chain in
  apply_security_hardening() to resolve SC2119/SC2120 (functions
  reference $1 but are called without arguments)

src/firewall-setup.sh
- Pass optional arguments through apply_firewall() in main() to
  resolve SC2119/SC2120

config/hooks/installed/encryption-setup.sh
- Consolidate four individual `echo >> file` redirects into a single
  `{ cmd1; cmd2; } >> file` block, resolving SC2129
- Add shellcheck disable directive for intentional SC2016 in sed
  command (single quotes are required by sed, not a mistake)

config/hooks/installed/encryption-validation.sh
- Replace remaining Unicode checkmark characters with ASCII

Verification:
  shellcheck --severity=warning src/*.sh config/hooks/**/*.sh
  => zero warnings, zero errors

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>
 2026-04-27 13:09:39 -05:00