agw/jasp-desktop-bin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep the GitHub token out of the JASP binary

Browse Source 
JASP's Tools/CMake/Config.cmake uses GITHUB_PAT as the default token compiled
into the application (Desktop/gui/githubpat.h) whenever GITHUB_PAT_DEF is
empty. The build container receives GITHUB_PAT from the start, so the build
token was compiled into bin/JASP and shipped in the published tarballs.

The token is now removed from the environment until the R module build, the
only step that needs it, GITHUB_PAT_DEF is pinned empty, and staging fails if
the token, or anything shaped like a GitHub token, is found in the package.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
This commit is contained in:
agw
2026-10-01 18:25:52 +02:00
parent 9670afa6d4
commit 4b6797f6f2
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build/build-jasp.sh
+22
View File
@@ -39,6 +39,16 @@ R_HOME_DIR="${PREFIX}/R"
mkdir -p "$OUT_DIR" /build
# Take the GitHub token out of the environment until the R module build, the
# only step that needs it. JASP's Tools/CMake/Config.cmake bakes GITHUB_PAT into
# the application (Desktop/gui/githubpat.h, the default token for its update
# check) whenever GITHUB_PAT_DEF is empty, so a token visible at configure time
# ships inside bin/JASP of the public tarball. That happened once and leaked the
# build token. GITHUB_PAT_DEF is pinned empty for the same reason.
BUILD_GITHUB_PAT="${GITHUB_PAT:-}"
unset GITHUB_PAT GITHUB_TOKEN
export GITHUB_PAT_DEF=""
log() { echo ":: $* "; }
# ------------------------------------------------------------- build caches
@@ -204,6 +214,7 @@ ninja -C "$BUILD_DIR" -j"$JOBS"
# install_github('jasp-stats/jaspModuleTools'), and anonymous GitHub API rate
# limits make that fail. When it fails, no bundles are produced at all and the
# build otherwise looks successful.
GITHUB_PAT="${BUILD_GITHUB_PAT}"
if [[ -z "${GITHUB_PAT:-}" ]]; then
echo "error: GITHUB_PAT is required — jaspModuleTools is installed from GitHub" >&2
echo " without it the module build silently produces nothing" >&2
@@ -555,6 +566,17 @@ bash /work/build/bundle-libs.sh "$STAGE_DIR" "$PREFIX"
# Final sanity check on what is about to be shipped. Each of these has already
# been shipped missing once.
log "verifying the staged tree"
# The token must never reach the package (see the top of this script). Check
# for its exact value and for anything shaped like a GitHub token.
if [[ -n "${BUILD_GITHUB_PAT}" ]] && grep -rlaF -- "${BUILD_GITHUB_PAT}" "$STAGE_DIR" >/dev/null 2>&1; then
echo "error: the build's GitHub token is embedded in the staged tree:" >&2
grep -rlaF -- "${BUILD_GITHUB_PAT}" "$STAGE_DIR" | sed "s|^$STAGE_DIR||" >&2
exit 1
fi
if grep -rlaE 'github_pat_[A-Za-z0-9_]{60,}|gh[pousr]_[A-Za-z0-9]{36}' "$STAGE_DIR/opt/jasp-desktop/bin" >/dev/null 2>&1; then
echo "error: something shaped like a GitHub token is in the JASP binaries" >&2
exit 1
fi
staged_r="$STAGE_DIR$PREFIX/R/lib/R/lib"
for lib in libR.so libRblas.so libRlapack.so; do
[[ -f "$staged_r/$lib" ]] || { echo "error: staged tree lacks $lib" >&2; exit 1; }