Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases 1 Activity

source: advance the checked projection

Browse source 
Source-Sha: 194a59adfd6c901635da7a9c18253bb2210e2426
Policy-Sha: b9b0be0ee74e55f561a803b8aef6be3c2134f5a83b46816a069a372f2eb04f4d
Tree-Digest: 4697f2e281c1c6ecafff17cf6eeb391a0a1ac0fa6e5fc429f5b473f4579c252c
This commit is contained in:
Source publisher 2026-09-21 14:39:08 +00:00
commit ffdccba10f
42 changed files with 2516 additions and 554 deletions
Download patch file Download diff file Expand all files Collapse all files

38
installer/windows/build-desktop.ps1
View file

@ -34,6 +34,14 @@ try {
& go build -trimpath -ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$Version" -o (Join-Path $output 'redflag-agent.exe') ./cmd/agent/
if ($LASTEXITCODE -ne 0) { throw 'Agent build failed.' }
} finally { Pop-Location }
Push-Location (Join-Path $root 'helper')
$previousVersion = $env:REDFLAG_RELEASE_VERSION
try {
$env:REDFLAG_RELEASE_VERSION = $Version
& cargo build --release --locked
if ($LASTEXITCODE -ne 0) { throw 'Helper build failed.' }
Copy-Item 'target/release/redflag-helper.exe' $output
} finally { $env:REDFLAG_RELEASE_VERSION = $previousVersion; Pop-Location }
$desktop = Join-Path $output 'redflag-desktop.exe'
& windeployqt --release --qmldir (Join-Path $root 'desktop/qml') --dir $output $desktop
if ($LASTEXITCODE -ne 0) { throw 'Qt runtime deployment failed.' }
@ -42,6 +50,7 @@ foreach ($relative in @('Qt6Core.dll', 'Qt6Gui.dll', 'Qt6Qml.dll', 'Qt6Quick.dll
}
Copy-Item (Join-Path $root 'LICENSE') (Join-Path $output 'LICENSE.txt')
Copy-Item (Join-Path $root 'THIRD_PARTY_LICENSES.md') $output
Copy-Item (Join-Path $root 'installer/windows/provision-helper.ps1') $output
# Remove the build toolchain from DLL lookup for the version check. A clean
# Windows VM must additionally launch QML and exercise the Agent pipe.
$buildPath = $env:PATH
@ -51,6 +60,33 @@ try {
if ($LASTEXITCODE -ne 0 -or $reportedVersion -ne "RedFlag v$expectedVersion") {
throw 'Staged Desktop failed its version check without the Qt build PATH.'
}
$helper = Join-Path $output 'redflag-helper.exe'
$helperVersion = & $helper --version
if ($LASTEXITCODE -ne 0 -or $helperVersion -ne "RedFlag helper v$expectedVersion") {
throw 'Staged Helper failed its version check.'
}
& $helper execute-envelope
if ($LASTEXITCODE -ne 18) {
throw 'Windows Helper did not fail closed for unavailable execution.'
}
# The fixed task entry point takes no runtime arguments, and its exchange
# root is not negotiable. Both checks are read-only: this worker carries no
# RedFlag installation, so run-request can only fail to open the fixed root.
# Neither touches service identity, ACLs, or the task scheduler.
& $helper run-request extra-argument
if ($LASTEXITCODE -ne 10) {
throw 'Windows Helper accepted arguments on its fixed task entry point.'
}
& $helper run-request
if ($LASTEXITCODE -ne 26) {
throw 'Windows Helper did not refuse an unprovisioned exchange root.'
}
$helperRail = & (Join-Path $output 'provision-helper.ps1') -Describe | ConvertFrom-Json
if ($helperRail.principal -ne 'SYSTEM' -or
$helperRail.runnable_by -ne 'NT SERVICE\RedFlagAgent' -or
$helperRail.arguments -ne 'run-request') {
throw 'Staged Helper task description does not preserve the fixed authority boundary.'
}
} finally { $env:PATH = $buildPath }
$files = @(Get-ChildItem $output -Recurse -File | Sort-Object FullName | ForEach-Object {
[ordered]@{
@ -59,6 +95,6 @@ $files = @(Get-ChildItem $output -Recurse -File | Sort-Object FullName | ForEach
size = $_.Length
}
})
[ordered]@{ desktop_version = $reportedVersion; files = $files } |
[ordered]@{ desktop_version = $reportedVersion; helper_version = $helperVersion; files = $files } |
ConvertTo-Json -Depth 4 | Set-Content (Join-Path $output 'payload.json') -Encoding UTF8
Write-Output "Desktop payload staged at $output; this is not yet an installer or an installation test."

15
installer/windows/test_build_inputs.py
View file

@ -10,6 +10,21 @@ spec.loader.exec_module(license_module)
class BuildInputs(unittest.TestCase):
def test_helper_task_is_fixed_and_separates_agent_input(self):
script = pathlib.Path(__file__).with_name("provision-helper.ps1").read_text()
self.assertIn("$serviceAccount = 'NT SERVICE\\RedFlagAgent'", script)
self.assertIn("$requestPath = Join-Path $helperState 'requests'", script)
self.assertIn("-Execute $helperPath -Argument 'run-request'", script)
self.assertIn("$agentService.StartName -ne $serviceAccount", script)
self.assertIn("[switch]$MigrateAgentService", script)
self.assertIn("Refusing to replace operator-owned Agent service identity", script)
self.assertIn("'sidtype', 'RedFlagAgent', 'unrestricted'", script)
self.assertIn("'config', 'RedFlagAgent', 'obj=', $serviceAccount", script)
self.assertIn("'config', 'RedFlagAgent', 'obj=', 'LocalSystem'", script)
self.assertIn("Set-RedFlagDirectoryAcl -Path $requestPath -AgentAccess Modify", script)
self.assertIn("Set-RedFlagDirectoryAcl -Path $resultPath -AgentAccess Read", script)
self.assertNotIn("$(Arg", script)
def test_revision_upgrades_are_distinct_and_ordered(self):
releases = ["0.2.9.5", "0.2.9.6", "0.2.10", "0.3.0", "1.0.0"]
versions = [tuple(map(int, product_version(v).split("."))) for v in releases]