switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Changeset 0.38.0 (#233)

Browse Source 
Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>
This commit is contained in:
gobha
2026-03-25 09:20:06 +00:00
committed by xcaliber
parent be67feaa8e
commit 10acadc9d0
13 changed files with 556 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
server/handlers/packages.go
View File

@@ -241,31 +241,25 @@ func (h *PackageHandler) InstallPackage(c *gin.Context) {
return
}
// v0.37.15: Read script.star from archive if present.
// Keeps the manifest clean — authors write a file, installer injects
// it as _starlark_script for the sandbox runner.
if _, hasInline := manifest["_starlark_script"]; !hasInline {
// v0.38.0: Entry point validation for starlark-tier packages.
// Scripts are loaded from disk at runtime — no _starlark_script injection.
if manifestTier, _ := manifest["tier"].(string); manifestTier == "starlark" {
entryPoint := "script.star"
if ep, ok := manifest["entry_point"].(string); ok && ep != "" {
entryPoint = ep
}
found := false
for _, f := range zr.File {
name := f.Name
base := filepath.Base(name)
if base == "script.star" && !f.FileInfo().IsDir() {
rc, err := f.Open()
if err != nil {
break
}
data, err := io.ReadAll(rc)
rc.Close()
if err != nil {
break
}
script := string(data)
if strings.TrimSpace(script) != "" {
manifest["_starlark_script"] = script
log.Printf("[packages] Injected script.star (%d bytes) into manifest", len(data))
}
base := filepath.Base(f.Name)
if base == entryPoint && !f.FileInfo().IsDir() {
found = true
break
}
}
if !found {
c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("starlark package missing entry point %q", entryPoint)})
return
}
}
// Validate required fields
@@ -487,17 +481,25 @@ func (h *PackageHandler) InstallPackage(c *gin.Context) {
}
// extractableRelPath returns the relative path for a zip entry if it
// belongs to an extractable static directory (js/, css/, assets/).
// belongs to an extractable directory (js/, css/, assets/, star/) or
// is a bare .star file at the archive root.
// Returns "" if the file should be skipped.
func extractableRelPath(name string) string {
staticPrefixes := []string{"js/", "css/", "assets/"}
staticPrefixes := []string{"js/", "css/", "assets/", "star/"}
// Direct match (flat archive without package-id/ wrapper)
for _, p := range staticPrefixes {
if strings.HasPrefix(name, p) {
return name
}
}
// Bare .star file at root (e.g. "script.star")
if strings.HasSuffix(name, ".star") && !strings.Contains(name, "/") {
return name
}
// Nested inside package-id/ directory
idx := strings.Index(name, "/")
if idx <= 0 {
return ""
@@ -510,6 +512,11 @@ func extractableRelPath(name string) string {
}
}
// Bare .star file inside package-id/ (e.g. "gitea-client/script.star")
if strings.HasSuffix(rest, ".star") && !strings.Contains(rest, "/") {
return rest
}
return ""
}