61 lines
2.5 KiB
PowerShell
61 lines
2.5 KiB
PowerShell
$ErrorActionPreference = "Stop"
|
|
$installer = Join-Path (Split-Path $PSScriptRoot -Parent) "install.ps1"
|
|
$tokens = $null
|
|
$parseErrors = $null
|
|
[System.Management.Automation.Language.Parser]::ParseFile(
|
|
$installer, [ref]$tokens, [ref]$parseErrors
|
|
) | Out-Null
|
|
if ($parseErrors.Count -gt 0) {
|
|
throw "install.ps1 parser errors: $($parseErrors.Message -join '; ')"
|
|
}
|
|
|
|
$source = Get-Content -LiteralPath $installer -Raw
|
|
function Assert-SourceContains {
|
|
param([Parameter(Mandatory)][string]$Pattern, [Parameter(Mandatory)][string]$Message)
|
|
if ($source -notmatch $Pattern) { throw $Message }
|
|
}
|
|
|
|
$runtimeMatch = [regex]::Match(
|
|
$source,
|
|
'(?s)\$RuntimeFiles\s*=\s*@\((?<files>.*?)\)'
|
|
)
|
|
if (!$runtimeMatch.Success) { throw "Runtime file allowlist was not found." }
|
|
$runtimeFiles = $runtimeMatch.Groups["files"].Value
|
|
foreach ($forbidden in @("agent-config.json", "agent-state.json", "logs", "backups")) {
|
|
if ($runtimeFiles -match [regex]::Escape($forbidden)) {
|
|
throw "$forbidden must not be a managed deployment target."
|
|
}
|
|
}
|
|
|
|
$preflight = $source.IndexOf('# Validate the complete source')
|
|
$firstTargetChange = $source.IndexOf('New-Item -ItemType Directory')
|
|
if ($preflight -lt 0 -or $preflight -gt $firstTargetChange) {
|
|
throw "Source preflight must happen before target changes."
|
|
}
|
|
|
|
Assert-SourceContains 'if \(\$null -ne \(Get-MinerOpsScheduledTask' `
|
|
"Existing task preservation guard is missing."
|
|
Assert-SourceContains 'Preserving existing Scheduled Task' `
|
|
"Existing task preservation is not explicit."
|
|
Assert-SourceContains 'ExtraArguments\s*=\s*"-Limit 0 -TimeoutMs 8000"' `
|
|
"Fresh enrichment task arguments are missing."
|
|
Assert-SourceContains 'Stop-MinerOpsScheduledTaskForUpgrade' `
|
|
"Bounded main Agent stop behavior is missing."
|
|
Assert-SourceContains '\$mainTaskWasRunning' `
|
|
"Main Agent prior running state is not represented."
|
|
Assert-SourceContains 'Copy-Item[^\r\n]*\(Join-Path \$Backup \$name\)' `
|
|
"Rollback does not restore managed files from backup."
|
|
Assert-SourceContains 'Unregister-ScheduledTask' `
|
|
"Rollback does not remove tasks created by a failed install."
|
|
Assert-SourceContains 'could not restart restored MinerOpsAgent' `
|
|
"Rollback restart failure is not surfaced."
|
|
|
|
if ($source -match 'Register-ScheduledTask[^\r\n]*-Force') {
|
|
throw "Installer must not force-overwrite Scheduled Tasks."
|
|
}
|
|
if ($source -match '(?i)agent_secret|api3_password|api3_account') {
|
|
throw "Installer must not inspect or print credentials."
|
|
}
|
|
|
|
Write-Host "MinerOps installer source safety tests passed."
|