From 4b6797f6f21d4a5a65c061e73c23a0f0167b7ada Mon Sep 17 00:00:00 2001
From: agw <cla@weircon.dk>
Date: Thu, 1 Oct 2026 18:25:52 +0200
Subject: [PATCH] Keep the GitHub token out of the JASP binary

JASP's Tools/CMake/Config.cmake uses GITHUB_PAT as the default token compiled
into the application (Desktop/gui/githubpat.h) whenever GITHUB_PAT_DEF is
empty. The build container receives GITHUB_PAT from the start, so the build
token was compiled into bin/JASP and shipped in the published tarballs.

The token is now removed from the environment until the R module build, the
only step that needs it, GITHUB_PAT_DEF is pinned empty, and staging fails if
the token, or anything shaped like a GitHub token, is found in the package.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
---
 build/build-jasp.sh | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/build/build-jasp.sh b/build/build-jasp.sh
index aabc42d..cd28238 100755
--- a/build/build-jasp.sh
+++ b/build/build-jasp.sh
@@ -39,6 +39,16 @@ R_HOME_DIR="${PREFIX}/R"
 
 mkdir -p "$OUT_DIR" /build
 
+# Take the GitHub token out of the environment until the R module build, the
+# only step that needs it. JASP's Tools/CMake/Config.cmake bakes GITHUB_PAT into
+# the application (Desktop/gui/githubpat.h, the default token for its update
+# check) whenever GITHUB_PAT_DEF is empty, so a token visible at configure time
+# ships inside bin/JASP of the public tarball. That happened once and leaked the
+# build token. GITHUB_PAT_DEF is pinned empty for the same reason.
+BUILD_GITHUB_PAT="${GITHUB_PAT:-}"
+unset GITHUB_PAT GITHUB_TOKEN
+export GITHUB_PAT_DEF=""
+
 log() { echo "::  $* "; }
 
 # ------------------------------------------------------------- build caches
@@ -204,6 +214,7 @@ ninja -C "$BUILD_DIR" -j"$JOBS"
 # install_github('jasp-stats/jaspModuleTools'), and anonymous GitHub API rate
 # limits make that fail. When it fails, no bundles are produced at all and the
 # build otherwise looks successful.
+GITHUB_PAT="${BUILD_GITHUB_PAT}"
 if [[ -z "${GITHUB_PAT:-}" ]]; then
   echo "error: GITHUB_PAT is required — jaspModuleTools is installed from GitHub" >&2
   echo "       without it the module build silently produces nothing" >&2
@@ -555,6 +566,17 @@ bash /work/build/bundle-libs.sh "$STAGE_DIR" "$PREFIX"
 # Final sanity check on what is about to be shipped. Each of these has already
 # been shipped missing once.
 log "verifying the staged tree"
+# The token must never reach the package (see the top of this script). Check
+# for its exact value and for anything shaped like a GitHub token.
+if [[ -n "${BUILD_GITHUB_PAT}" ]] && grep -rlaF -- "${BUILD_GITHUB_PAT}" "$STAGE_DIR" >/dev/null 2>&1; then
+  echo "error: the build's GitHub token is embedded in the staged tree:" >&2
+  grep -rlaF -- "${BUILD_GITHUB_PAT}" "$STAGE_DIR" | sed "s|^$STAGE_DIR||" >&2
+  exit 1
+fi
+if grep -rlaE 'github_pat_[A-Za-z0-9_]{60,}|gh[pousr]_[A-Za-z0-9]{36}' "$STAGE_DIR/opt/jasp-desktop/bin" >/dev/null 2>&1; then
+  echo "error: something shaped like a GitHub token is in the JASP binaries" >&2
+  exit 1
+fi
 staged_r="$STAGE_DIR$PREFIX/R/lib/R/lib"
 for lib in libR.so libRblas.so libRlapack.so; do
   [[ -f "$staged_r/$lib" ]] || { echo "error: staged tree lacks $lib" >&2; exit 1; }