fix: validate zi repository identity before destructive git operations; automate checksum generation

.github/workflows/check-linux.yml

@@ -47,6 +47,8 @@ jobs:
  run: |
  sudo apt-get update
  sudo apt-get install -y zsh
+ - name: "⚙️ Generate checksums"
+ run: sh ./public/sh/generate-checksums.sh
  - name: "⚙️ Check: unit fixtures"
  run: sh ./tests/installers.sh
  - name: "⚙️ Check: install.sh -- -i skip"

.github/workflows/check-macos.yml

@@ -47,6 +47,8 @@ jobs:
  - name: ⚙️ Prepare dependencies
  run: |
  brew install zsh
+ - name: "⚙️ Generate checksums"
+ run: sh ./public/sh/generate-checksums.sh
  - name: "⚙️ Check: unit fixtures"
  run: sh ./tests/installers.sh
  - name: "⚙️ Check: install.sh -- -i skip"

.github/workflows/checksum.yml

@@ -3,6 +3,7 @@ name: Checksum
 on:
  push:
  paths:
+ - "public/sh/generate-checksums.sh"
  - "public/sh/install_zpmod.sh"
  - "public/sh/install.sh"
  - "public/sh/sync-init.sh"
@@ -25,14 +26,7 @@ jobs:
  steps:
  - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
  - name: "🆗 Generate checksum"
- uses: jmgilman/actions-generate-checksum@3ea6dc9bf8eecf28e2ecc982fab683484a1a8561 # v1.0.1
- with:
- patterns: |
- public/sh/install_zpmod.sh
- public/sh/install.sh
- public/sh/sync-init.sh
- public/zsh/init.zsh
- - run: mv checksum.txt public/
+ run: sh ./public/sh/generate-checksums.sh
  - name: "🆗 Commit"
  uses: z-shell/.github/actions/commit@3222f53692e448ed6e2caf8b8722e74fb2ca2461 # v1.1.1
  with:

public/checksum.txt

@@ -1,4 +1,4 @@
 0140801e80b2d8767e95d215850b6feab3642ee2b6fd70fbf4aab09afcfe7fca public/sh/install_zpmod.sh
-0cca0bb9f95101b4bf392d6aa3c23123602d99a7cbb0decacaa72973e016d89d public/sh/install.sh
+f9d8ef697ba682bdfe66fdd67d4517caa4e62bb8baf2868ec8ed9932809b76aa public/sh/install.sh
 08cc893ceb982fc99d17db1966c6c30790cc571e16e4f5392352d995f5252952 public/sh/sync-init.sh
 5c7af31d7fc848d80f9fedf69c75e6844503f550a3d5e020bc7cdfdaca624763 public/zsh/init.zsh

public/sh/generate-checksums.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env sh
+# -*- mode: sh; sh-indentation: 2; indent-tabs-mode: nil; sh-basic-offset: 2; -*-
+# vim: ft=sh sw=2 ts=2 et
+#
+# generate-checksums.sh — regenerate public/checksum.txt
+#
+# Usage (from any directory):
+# sh public/sh/generate-checksums.sh
+#
+# This script is also invoked by the CI workflows before running
+# tests/installers.sh so that public/checksum.txt is always current.
+
+set -eu
+
+ROOT="$(
+ unset CDPATH
+ cd "$(dirname "$0")/../.." 2>/dev/null && pwd
+)" || { printf '%s\n' "generate-checksums: cannot determine repository root" >&2; exit 1; }
+
+CHECKSUM_FILE="${ROOT}/public/checksum.txt"
+
+sha256_file() {
+ if command -v sha256sum >/dev/null 2>&1; then
+ sha256sum "$1" | awk '{print $1}'
+ elif command -v shasum >/dev/null 2>&1; then
+ shasum -a 256 "$1" | awk '{print $1}'
+ else
+ printf '%s\n' "generate-checksums: sha256sum or shasum is required" >&2
+ exit 1
+ fi
+}
+
+# Clear (or create) the checksum file before writing fresh entries with `: > file`.
+: > "${CHECKSUM_FILE}"
+for f in \
+ public/sh/install_zpmod.sh \
+ public/sh/install.sh \
+ public/sh/sync-init.sh \
+ public/zsh/init.zsh
+do
+ hash="$(sha256_file "${ROOT}/${f}")"
+ printf '%s %s\n' "${hash}" "${f}" >> "${CHECKSUM_FILE}"
+done
+
+printf '%s\n' "Checksums written to ${CHECKSUM_FILE}"

public/sh/install.sh

@@ -36,6 +36,17 @@ while getopts ":i:a:b:" opt; do
 done
 shift $((OPTIND - 1))
 
+# Validate BOPT to prevent sed delimiter injection when building init.zsh.
+# | is the sed delimiter used in the substitution; \ and & are special in
+# sed replacement expressions. The *[\\]* pattern matches a single backslash.
+case "${BOPT}" in
+ # [\\] is a bracket expression for a literal backslash.
+ *'|'* | *[\\]* | *'&'* )
+ printf '%s\n' "-- ERROR -- Invalid -b value: branch name must not contain '|', '\\', or '&'." >&2
+ exit 1
+ ;;
+esac
+
 SCRIPT_DIR=""
 LOCAL_INIT_ZSH=""
 LOCAL_INSTALL_ZPMOD=""
@@ -147,6 +158,20 @@ fi
 command chmod a+x /tmp/zi/git-process-output.zsh
 
 if test -d "${ZI_HOME}/${ZI_BIN_DIR_NAME}/.git"; then
+ _zi_valid=0
+ if test -f "${ZI_HOME}/${ZI_BIN_DIR_NAME}/zi.zsh"; then
+ # Canonical zi remote URLs (HTTPS and SSH, with and without .git suffix)
+ case "$(command git -C "${ZI_HOME}/${ZI_BIN_DIR_NAME}" remote get-url origin 2>/dev/null || true)" in
+ https://github.com/z-shell/zi | https://github.com/z-shell/zi.git \
+ | git@github.com:z-shell/zi | git@github.com:z-shell/zi.git)
+ _zi_valid=1 ;;
+ esac
+ fi
+ if [ "${_zi_valid}" -ne 1 ]; then
+ printf '%s\n' "▓▒░ ${ZI_HOME}/${ZI_BIN_DIR_NAME} contains a .git directory but does not appear to be a zi repository." >&2
+ printf '%s\n' "▓▒░ Expected zi.zsh and a z-shell/zi remote origin. Unset ZI_HOME/ZI_BIN_DIR_NAME or remove the directory to install fresh." >&2
+ exit 1
+ fi
  cd "${ZI_HOME}/${ZI_BIN_DIR_NAME}" || exit 1
  printf '%s\n' "▓▒░ Updating (z-shell/zi) plugin manager at ${ZI_HOME}/${ZI_BIN_DIR_NAME}"
  command git clean -d -f -f

tests/installers.sh

@@ -139,6 +139,12 @@ EOF
 #!/usr/bin/env sh
 set -eu
 
+# Strip -C <dir> flag if present (used by install.sh to check remote URL)
+if [ "${1:-}" = "-C" ]; then
+ [ -n "${2:-}" ] || { printf '%s\n' "installers.sh git test double: -C requires a directory argument" >&2; exit 64; }
+ shift 2
+fi
+
 cmd="${1:-}"
 [ "$#" -gt 0 ] && shift
 
@@ -148,7 +154,7 @@ case "${cmd}" in
  for arg do
  dest="${arg}"
  done
- [ -n "${dest}" ] || { printf '%s\n' "git test double: missing clone destination" >&2; exit 64; }
+ [ -n "${dest}" ] || { printf '%s\n' "installers.sh git test double: missing clone destination" >&2; exit 64; }
  mkdir -p "${dest}/.git" "${dest}/lib"
  printf '%s\n' '# fake zi.zsh' > "${dest}/zi.zsh"
  printf '%s\n' '# fake _zi completion' > "${dest}/lib/_zi"
@@ -158,8 +164,21 @@ case "${cmd}" in
  log)
  printf '%s\n' 'abcdef0 - fake zi commit (now) <test>'
  ;;
+ remote)
+ # After -C strip (if any) and cmd shift, $1/$2 hold the remote subcommand args
+ if [ "${1:-}" != "get-url" ]; then
+ printf '%s\n' "installers.sh git test double: expected remote subcommand 'get-url', got '${1:-<missing>}'" >&2
+ exit 65
+ fi
+ if [ "${2:-}" != "origin" ]; then
+ printf '%s\n' "installers.sh git test double: expected remote name 'origin', got '${2:-<missing>}'" >&2
+ exit 65
+ fi
+ # Return a zi remote URL; override via ZI_SRC_TEST_FAKE_REMOTE env var
+ printf '%s\n' "${ZI_SRC_TEST_FAKE_REMOTE:-https://github.com/z-shell/zi}"
+ ;;
  *)
- printf '%s\n' "git test double: unexpected command ${cmd}" >&2
+ printf '%s\n' "installers.sh git test double: unexpected command ${cmd}" >&2
  exit 65
  ;;
 esac
@@ -226,6 +245,70 @@ test_standalone_zpmod_delegation() {
  pass "standalone install.sh fetches zpmod helper"
 }
 
+test_update_valid_zi_clone() {
+ home="${TMP_ROOT}/update-valid-home"
+ data="${TMP_ROOT}/update-valid-data"
+ zi_bin="${data}/zi/bin"
+ command mkdir -p "${home}" "${zi_bin}/.git"
+ printf '%s\n' '# fake zi.zsh' >"${zi_bin}/zi.zsh"
+
+ HOME="${home}" \
+ ZDOTDIR="${home}" \
+ XDG_DATA_HOME="${data}" \
+ ZI_SRC_TEST_ROOT="${ROOT}" \
+ PATH="${FAKE_BIN}:${PATH}" \
+ sh "${ROOT}/public/sh/install.sh" -i skip >/dev/null
+
+ pass "update path accepts a valid zi clone"
+}
+
+test_update_rejects_foreign_repo() {
+ home="${TMP_ROOT}/update-foreign-home"
+ data="${TMP_ROOT}/update-foreign-data"
+ zi_bin="${data}/zi/bin"
+ command mkdir -p "${home}" "${zi_bin}/.git"
+ # Deliberately no zi.zsh: this simulates an unrelated git repo
+ err="${TMP_ROOT}/update-foreign-err"
+
+ set +e
+ HOME="${home}" \
+ ZDOTDIR="${home}" \
+ XDG_DATA_HOME="${data}" \
+ ZI_SRC_TEST_ROOT="${ROOT}" \
+ PATH="${FAKE_BIN}:${PATH}" \
+ sh "${ROOT}/public/sh/install.sh" -i skip >/dev/null 2>"${err}"
+ exit_code="$?"
+ set -e
+
+ [ "${exit_code}" -ne 0 ] || fail "install.sh should have rejected a foreign git repository"
+ contains "${err}" "does not appear to be a zi repository"
+ pass "update path rejects an unrecognised git repository"
+}
+
+test_update_rejects_wrong_remote() {
+ home="${TMP_ROOT}/update-wrong-remote-home"
+ data="${TMP_ROOT}/update-wrong-remote-data"
+ zi_bin="${data}/zi/bin"
+ command mkdir -p "${home}" "${zi_bin}/.git"
+ printf '%s\n' '# fake zi.zsh' >"${zi_bin}/zi.zsh"
+ err="${TMP_ROOT}/update-wrong-remote-err"
+
+ set +e
+ HOME="${home}" \
+ ZDOTDIR="${home}" \
+ XDG_DATA_HOME="${data}" \
+ ZI_SRC_TEST_ROOT="${ROOT}" \
+ ZI_SRC_TEST_FAKE_REMOTE="https://github.com/unrelated/project" \
+ PATH="${FAKE_BIN}:${PATH}" \
+ sh "${ROOT}/public/sh/install.sh" -i skip >/dev/null 2>"${err}"
+ exit_code="$?"
+ set -e
+
+ [ "${exit_code}" -ne 0 ] || fail "install.sh should have rejected a repo with a non-zi remote"
+ contains "${err}" "does not appear to be a zi repository"
+ pass "update path rejects a repository with a non-zi remote origin"
+}
+
 test_sync_init() {
  local_file="${TMP_ROOT}/local-init.zsh"
  remote_file="${TMP_ROOT}/remote-init.zsh"
@@ -265,4 +348,7 @@ write_fake_tools
 test_loader_install
 test_xdg_data_home_install
 test_standalone_zpmod_delegation
+test_update_valid_zi_clone
+test_update_rejects_foreign_repo
+test_update_rejects_wrong_remote
 test_sync_init