- commit
- 209456b72ebf505e371aacc21ed4135104f5465c
- parent
- 8d2730e29da4b324a47a942a3ead9ea3b9f40d46
- author
- Dami <dami.etoile@gmail.com>
| M | docs/ | 62 | ++++++++++++++++++++++++++---- |
| M | scripts/ | 6 | +++ |
@@ -25,7 +25,10 @@ early_uinput_rule="$current/assets/72-sigil-uinput.rules"
2525 final_uinput_rule="$current/assets/99-sigil-uinput.rules"2626 test -x "$current/sigil"2727 for rule in "$remote_input_rule" "$early_uinput_rule" "$final_uinput_rule"; do28- test -f "$rule" && test ! -L "$rule"28+ if test ! -f "$rule" || test -L "$rule"; then29+ echo "unsafe or missing package rule: $rule" >&230+ exit 131+ fi2932 done3033 3134 getent group sigil-uinput >/dev/null || sudo groupadd --system sigil-uinput@@ -76,10 +79,13 @@ sigil="$HOME/.local/libexec/sigil-spark/current/sigil"
7679 identity="$HOME/.local/share/sigil-spark/identity/host.key"7780 install -d -m 0700 "$(dirname "$identity")" \7881 "$HOME/.config/sigil-spark" "$HOME/.local/state/sigil-spark"79-if ! test -e "$identity"; then82+if test ! -e "$identity" && test ! -L "$identity"; then8083 "$sigil" identity init --output "$identity"8184 fi82-test -f "$identity" && test ! -L "$identity"85+if test ! -f "$identity" || test -L "$identity"; then86+ echo "unsafe host identity: $identity" >&287+ exit 188+fi8389 chmod 0600 "$identity"8490 "$sigil" identity show --identity "$identity"8591 ```@@ -98,6 +104,33 @@ inventory is intentionally ambiguous.
98104 ```bash99105 set -euo pipefail100106 107+gst_inspect_path="$(command -v gst-inspect-1.0)"108+timeout_path="$(command -v timeout)"109+inspect_max_bytes=1048576110+inspection_dir="$(mktemp -d "${TMPDIR:-/tmp}/sigil-activation-inspect.XXXXXX")"111+chmod 0700 "$inspection_dir"112+trap 'rm -rf -- "$inspection_dir"' EXIT INT TERM HUP113+114+bounded_gst_inspect() {115+ local output_path116+ local output_size117+ output_path="$(mktemp "$inspection_dir/gst-inspect.XXXXXX")"118+ if ! "$timeout_path" --signal=TERM --kill-after=2s 5s \119+ "$gst_inspect_path" "$@" 2>/dev/null \120+ | head -c "$((inspect_max_bytes + 1))" >"$output_path"121+ then122+ rm -f -- "$output_path"123+ return 1124+ fi125+ output_size="$(wc -c <"$output_path" | tr -d '[:space:]')"126+ if test "$output_size" -gt "$inspect_max_bytes"; then127+ rm -f -- "$output_path"128+ return 1129+ fi130+ cat "$output_path"131+ rm -f -- "$output_path"132+}133+101134 mapfile -t amd_nodes < <(102135 for sysfs_node in /sys/class/drm/renderD*; do103136 test -e "$sysfs_node/device/driver" || continue@@ -116,14 +149,15 @@ else
116149 fi117150 printf '%s\n' "${amd_nodes[@]}" | grep -Fx "$render_node"118151 152+registry="$(bounded_gst_inspect)"119153 mapfile -t va_factories < <(120- gst-inspect-1.0 | awk '$2 ~ /^va(renderD[0-9]+)?h264(lp)?enc:$/ {154+ awk '$2 ~ /^va(renderD[0-9]+)?h264(lp)?enc:$/ {121155 sub(/:$/, "", $2); print $2122- }' | sort -u156+ }' <<<"$registry" | sort -u123157 )124158 matching_factories=()125159 for factory in "${va_factories[@]}"; do126- inspection="$(gst-inspect-1.0 "$factory")" || continue160+ inspection="$(bounded_gst_inspect "$factory")" || continue127161 grep -Fq "Default: \"$render_node\"" <<<"$inspection" || continue128162 grep -Eq '\([0-9]+\): cbr([[:space:]]|$)' <<<"$inspection" || continue129163 matching_factories+=("$factory")@@ -139,6 +173,9 @@ printf '%s\n' "${matching_factories[@]}" | grep -Fx "$va_encoder"
139173 140174 printf 'export SIGIL_RENDER_NODE=%q\n' "$render_node"141175 printf 'export SIGIL_VA_ENCODER=%q\n' "$va_encoder"176+177+rm -rf -- "$inspection_dir"178+trap - EXIT INT TERM HUP142179 ```143180 144181 Keep the two printed export commands for the next step. If automatic selection@@ -195,11 +232,17 @@ gst_inspect_path="$(command -v gst-inspect-1.0)"
195232 test -n "$uinput_gid"196233 197234 umask 077198-if test -e "$config" || test -L "$config"; then235+set +e236+set -o noclobber237+exec 3>"$config"238+create_status=$?239+set +o noclobber240+set -e241+if test "$create_status" -ne 0; then199242 echo "refusing to replace existing host configuration: $config" >&2200243 exit 1201244 fi202-cat >"$config" <<EOF245+cat >&3 <<EOF203246 identity_path = "$HOME/.local/share/sigil-spark/identity/host.key"204247 state_path = "$HOME/.local/state/sigil-spark/runtime"205248 source = "gamescope-pipewire"@@ -232,7 +275,8 @@ node_name = "sigil_spark"
232275 media_class = "Audio/Sink"233276 bitrate_bps = 96000234277 EOF235-chmod 0600 "$config"278+exec 3>&-279+test "$(stat -Lc '%a:%U' "$config")" = "600:$(id -un)"236280 237281 "$sigil" config check --config "$config"238282 "$sigil" capture probe \@@ -44,6 +44,12 @@ fi
4444 4545 grep -Fq 'refusing to replace existing host configuration' "$guide" \4646 || fail 'the activation guide can overwrite an existing host configuration'47+grep -Fq 'set -o noclobber' "$guide" \48+ || fail 'the activation guide does not create host.toml exclusively'49+grep -Fq -- '--kill-after=2s 5s' "$guide" \50+ || fail 'the activation guide does not time-bound GStreamer inspection'51+grep -Fq 'inspect_max_bytes=1048576' "$guide" \52+ || fail 'the activation guide does not size-bound GStreamer inspection'4753 grep -Fq 'current/assets/72-sigil-uinput.rules' "$guide" \4854 || fail 'the activation guide does not use its packaged early uinput rule'4955 grep -Fq 'current/assets/99-sigil-uinput.rules' "$guide" \