45 lines
1.8 KiB
Bash
45 lines
1.8 KiB
Bash
 
|
#!/bin/sh
|
||
|
|
# What this repository adds to BentoPDF's finished build, run in the
|
||
|
|
# Dockerfile's builder stage after `npm run build`:
|
||
|
|
#
|
||
|
|
# finish.sh <app-dir>
|
||
|
|
#
|
||
|
|
# 1. a <script src="/bau-pm/handoff.js"> in every HTML page, the PDF.js
|
||
|
|
# viewers' pages included (the sign tool saves from inside one of them);
|
||
|
|
# 2. the precompressed copies of those pages regenerated, because nginx's
|
||
|
|
# gzip_static would otherwise serve the old page without the tag;
|
||
|
|
# 3. every host taken out of the generated Content-Security-Policy, so the
|
||
|
|
# pages may load from their own origin and from nowhere else.
|
||
|
|
#
|
||
|
|
# Each step checks its own result and fails the build when it did not happen.
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
app=$1
|
||
|
|
dist=$app/dist
|
||
|
|
tag='<script src="/bau-pm/handoff.js"></script>'
|
||
|
|
|
||
|
|
pages=$(find "$dist" -name '*.html' | wc -l)
|
||
|
|
[ "$pages" -gt 100 ] || { echo "finish: only $pages pages in $dist" >&2; exit 1; }
|
||
|
|
|
||
|
|
find "$dist" -name '*.html' | while read -r page; do
|
||
|
|
grep -q '</head>' "$page" || { echo "finish: $page has no </head>" >&2; exit 1; }
|
||
|
|
sed -i "s#</head>#$tag</head>#" "$page"
|
||
|
|
rm -f "$page.gz" "$page.br"
|
||
|
|
gzip -9 -k -n "$page"
|
||
|
|
done
|
||
|
|
# find -exec rather than grep --include, which busybox's grep does not know.
|
||
|
|
tagged=$(find "$dist" -name '*.html' -exec grep -lF "$tag" {} + | wc -l)
|
||
|
|
[ "$tagged" -eq "$pages" ] || { echo "finish: $tagged of $pages pages carry the tag" >&2; exit 1; }
|
||
|
|
stale=$(find "$dist" -name '*.html.br' | wc -l)
|
||
|
|
[ "$stale" -eq 0 ] || { echo "finish: $stale brotli copies left" >&2; exit 1; }
|
||
|
|
|
||
|
|
for conf in security-headers.conf security-headers-docs.conf; do
|
||
|
|
sed -E -i 's# https?:(//[^ ;"]*)?##g' "$app/$conf"
|
||
|
|
if grep -Eq 'https?:' "$app/$conf"; then
|
||
|
|
echo "finish: $conf still names a host:" >&2
|
||
|
|
grep -Eo 'https?:[^ ;"]*' "$app/$conf" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
echo "finish: $tagged pages tagged, CSP without hosts"
|