fullsend-ai · waynesun09 · Jul 19, 2026 · Jul 16, 2026
@@ -42,6 +42,7 @@ export SCRIPT_TEST_TARGET
 
 script-test:
 	$(call run-timed,bash scripts/bundle-sh-test.sh)
+	$(call run-timed,bash scripts/gitleaks-install-test.sh)
 	$(call run-timed,bash scripts/post-failure-report-test.sh)
 	$(call run-timed,bash scripts/post-triage-test.sh)
 	$(call run-timed,bash scripts/post-prioritize-test.sh)

@@ -0,0 +1,193 @@
+#!/usr/bin/env bash
+# gitleaks-install-test.sh — Test platform detection and checksum lookup
+# from scripts/lib/gitleaks-install.lib.sh.
+#
+# Run from the repo root:
+#   bash scripts/gitleaks-install-test.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+FAILURES=0
+
+# Source the lib directly for unit testing.
+# shellcheck source=lib/gitleaks-install.lib.sh
+source "${SCRIPT_DIR}/lib/gitleaks-install.lib.sh"
+
+# ---------------------------------------------------------------------------
+# resolve_platform tests — mock uname via PATH override
+# ---------------------------------------------------------------------------
+run_platform_test() {
+  local test_name="$1"
+  local mock_os="$2"
+  local mock_arch="$3"
+  local expected="$4"
+
+  local tmpdir
+  tmpdir="$(mktemp -d)"
+  cat > "${tmpdir}/uname" <<MOCKEOF
+#!/bin/bash
+case "\$1" in
+  (-s) echo "${mock_os}" ;;
+  (-m) echo "${mock_arch}" ;;
+  (*) echo "mock-uname: unknown flag \$1" >&2; exit 1 ;;
+esac
+MOCKEOF
+  chmod +x "${tmpdir}/uname"
+
+  local actual
+  # shellcheck disable=SC2123
+  actual="$(PATH="${tmpdir}:${PATH}" resolve_platform 2>/dev/null || echo "ERROR")"
+  rm -rf "${tmpdir}"
+
+  if [ "${actual}" != "${expected}" ]; then
+    echo "FAIL: ${test_name}"
+    echo "  os=${mock_os} arch=${mock_arch}"
+    echo "  expected: '${expected}'"
+    echo "  actual:   '${actual}'"
+    FAILURES=$((FAILURES + 1))
+    return
+  fi
+
+  echo "PASS: ${test_name}"
+}
+
+run_platform_test "linux-x86_64"  "Linux"  "x86_64"  "linux_x64"
+run_platform_test "linux-amd64"   "Linux"  "amd64"   "linux_x64"
+run_platform_test "linux-aarch64" "Linux"  "aarch64" "linux_arm64"
+run_platform_test "linux-arm64"   "Linux"  "arm64"   "linux_arm64"
+run_platform_test "darwin-x86_64" "Darwin" "x86_64"  "darwin_x64"
+run_platform_test "darwin-arm64"  "Darwin" "arm64"   "darwin_arm64"
+run_platform_test "unsupported-os" "FreeBSD" "x86_64" "ERROR"
+run_platform_test "unsupported-arch" "Linux" "riscv64" "ERROR"
+
+# ---------------------------------------------------------------------------
+# gitleaks_sha256 tests — verify checksum lookup for all platforms
+# ---------------------------------------------------------------------------
+run_checksum_test() {
+  local test_name="$1"
+  local platform="$2"
+  local expect_success="$3"
+
+  local actual rc=0
+  actual="$(gitleaks_sha256 "${platform}" 2>/dev/null)" || rc=$?
+
+  if [ "${expect_success}" = "yes" ]; then
+    if [ "${rc}" -ne 0 ] || [ -z "${actual}" ]; then
+      echo "FAIL: ${test_name}"
+      echo "  platform: '${platform}' — expected checksum, got rc=${rc}"
+      FAILURES=$((FAILURES + 1))
+      return
+    fi
+    if [ "${#actual}" -ne 64 ]; then
+      echo "FAIL: ${test_name}"
+      echo "  platform: '${platform}' — checksum length ${#actual}, expected 64"
+      FAILURES=$((FAILURES + 1))
+      return
+    fi
+  else
+    if [ "${rc}" -eq 0 ]; then
+      echo "FAIL: ${test_name}"
+      echo "  platform: '${platform}' — expected failure, got: '${actual}'"
+      FAILURES=$((FAILURES + 1))
+      return
+    fi
+  fi
+
+  echo "PASS: ${test_name}"
+}
+
+run_checksum_test "checksum-linux-x64"    "linux_x64"    "yes"
+run_checksum_test "checksum-linux-arm64"  "linux_arm64"  "yes"
+run_checksum_test "checksum-darwin-x64"   "darwin_x64"   "yes"
+run_checksum_test "checksum-darwin-arm64" "darwin_arm64" "yes"
+run_checksum_test "checksum-unknown"      "freebsd_x64"  "no"
+
+# ---------------------------------------------------------------------------
+# verify_checksum tests — verify the checksum function works
+# ---------------------------------------------------------------------------
+run_verify_test() {
+  local test_name="$1"
+  local content="$2"
+  local checksum="$3"
+  local expect_pass="$4"
+
+  local tmpfile
+  tmpfile="$(mktemp)"
+  printf '%s' "${content}" > "${tmpfile}"
+
+  local rc=0
+  verify_checksum "${tmpfile}" "${checksum}" >/dev/null 2>&1 || rc=$?
+  rm -f "${tmpfile}"
+
+  if [ "${expect_pass}" = "yes" ] && [ "${rc}" -ne 0 ]; then
+    echo "FAIL: ${test_name} — expected pass, got rc=${rc}"
+    FAILURES=$((FAILURES + 1))
+    return
+  fi
+  if [ "${expect_pass}" = "no" ] && [ "${rc}" -eq 0 ]; then
+    echo "FAIL: ${test_name} — expected fail, got pass"
+    FAILURES=$((FAILURES + 1))
+    return
+  fi
+
+  echo "PASS: ${test_name}"
+}
+
+KNOWN_CONTENT="gitleaks-test-content"
+KNOWN_HASH="$(printf '%s' "${KNOWN_CONTENT}" | sha256sum | cut -d' ' -f1)"
+
+run_verify_test "verify-valid-checksum" "${KNOWN_CONTENT}" "${KNOWN_HASH}" "yes"
+run_verify_test "verify-invalid-checksum" "${KNOWN_CONTENT}" "0000000000000000000000000000000000000000000000000000000000000000" "no"
+
+# ---------------------------------------------------------------------------
+# Version drift guard — GITLEAKS_VERSION must be consistent
+# ---------------------------------------------------------------------------
+for script in post-code post-fix; do
+  src_file="${SCRIPT_DIR}/${script}.src.sh"
+  [ -f "${src_file}" ] || continue
+  src_ver="$(grep -o 'GITLEAKS_VERSION="[^"]*"' "${src_file}" || true)"
+  if [ -n "${src_ver}" ]; then
+    echo "FAIL: version-not-in-src-${script}"
+    echo "  ${src_file} still defines GITLEAKS_VERSION — should come from gitleaks-install.lib.sh only"
+    FAILURES=$((FAILURES + 1))
+  else
+    echo "PASS: version-not-in-src-${script}"
+  fi
+done
+
+lib_ver="$(grep -o 'GITLEAKS_VERSION="[^"]*"' "${SCRIPT_DIR}/lib/gitleaks-install.lib.sh")"
+if [ -z "${lib_ver}" ]; then
+  echo "FAIL: version-in-lib"
+  echo "  gitleaks-install.lib.sh missing GITLEAKS_VERSION"
+  FAILURES=$((FAILURES + 1))
+else
+  echo "PASS: version-in-lib (${lib_ver})"
+fi
+
+# ---------------------------------------------------------------------------
+# Function drift guard — both bundled scripts must contain the shared functions
+# ---------------------------------------------------------------------------
+for script in post-code post-fix; do
+  bundled="${SCRIPT_DIR}/${script}.sh"
+  [ -f "${bundled}" ] || continue
+  for func in resolve_platform gitleaks_sha256 verify_checksum install_gitleaks; do
+    if ! grep -q "${func}" "${bundled}"; then
+      echo "FAIL: bundled-has-${func}-${script}"
+      echo "  ${bundled} missing ${func}"
+      FAILURES=$((FAILURES + 1))
+    else
+      echo "PASS: bundled-has-${func}-${script}"
+    fi
+  done
+done
+
+# --- Summary ---
+
+echo ""
+if [ ${FAILURES} -gt 0 ]; then
+  echo "${FAILURES} test(s) failed"
+  exit 1
+fi
+echo "All tests passed"
@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# gitleaks-install.lib.sh — Platform-aware gitleaks download and verification.
+#
+# Source from post-code.src.sh / post-fix.src.sh:
+#   source "${SCRIPT_DIR_POST}/lib/gitleaks-install.lib.sh"
+#
+# Provides:
+#   resolve_platform   — detect OS/arch and print a platform key (e.g. linux_x64)
+#   gitleaks_sha256    — print the SHA-256 checksum for a given platform key
+#   verify_checksum    — verify a file against an expected SHA-256 hash
+#   install_gitleaks   — download, verify, and install the gitleaks binary
+#
+# Uses case statements (not declare -A / mapfile) so the script runs on
+# bash 3.2 (macOS system bash).
+
+# shellcheck shell=bash
+
+[[ -n "${GITLEAKS_INSTALL_SH_LOADED:-}" ]] && return 0
+GITLEAKS_INSTALL_SH_LOADED=1
+
+GITLEAKS_VERSION="8.30.1"
+
+gitleaks_sha256() {
+  case "$1" in
+    linux_x64)    echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb" ;;
+    linux_arm64)  echo "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080" ;;
+    darwin_x64)   echo "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709" ;;
+    darwin_arm64) echo "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5" ;;
+    *) return 1 ;;
+  esac
+}
+
+resolve_platform() {
+  local os arch
+  os="$(uname -s)"
+  arch="$(uname -m)"
+
+  case "${os}" in
+    Linux)  os="linux" ;;
+    Darwin) os="darwin" ;;
+    *)
+      echo "::error::Unsupported OS for gitleaks: ${os}" >&2
+      return 1
+      ;;
+  esac
+
+  case "${arch}" in
+    x86_64|amd64) arch="x64" ;;
+    aarch64|arm64) arch="arm64" ;;
+    *)
+      echo "::error::Unsupported architecture for gitleaks: ${arch}" >&2
+      return 1
+      ;;
+  esac
+
+  echo "${os}_${arch}"
+}
+
+verify_checksum() {
+  local file="$1"
+  local expected="$2"
+
+  if command -v sha256sum >/dev/null 2>&1; then
+    echo "${expected}  ${file}" | sha256sum -c -
+  elif command -v shasum >/dev/null 2>&1; then
+    echo "${expected}  ${file}" | shasum -a 256 -c -
+  else
+    echo "::error::Neither sha256sum nor shasum found — cannot verify gitleaks checksum" >&2
+    return 1
+  fi
+}
+
+install_gitleaks() {
+  if command -v gitleaks >/dev/null 2>&1; then
+    return 0
+  fi
+
+  echo "Installing gitleaks v${GITLEAKS_VERSION}..."
+  local platform checksum tarball
+  platform="$(resolve_platform)"
+  checksum="$(gitleaks_sha256 "${platform}" || true)"
+  if [ -z "${checksum}" ]; then
+    echo "::error::No gitleaks checksum for platform: ${platform}" >&2
+    return 1
+  fi
+  mkdir -p "${HOME}/.local/bin"
+  tarball="$(mktemp)"
+  if ! curl -fsSL \
+       "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${platform}.tar.gz" \
+       -o "${tarball}" \
+     || ! verify_checksum "${tarball}" "${checksum}" \
+     || ! tar xzf "${tarball}" -C "${HOME}/.local/bin" gitleaks; then
+    rm -f "${tarball}"
+    echo "::error::Failed to download and verify gitleaks v${GITLEAKS_VERSION} (${platform})" >&2
+    return 1
+  fi
+  rm -f "${tarball}"
+  export PATH="${HOME}/.local/bin:${PATH}"
+}
@@ -25,6 +25,14 @@ else
   echo "PASS: bundled-script-has-failure-reporting"
 fi
 
+if ! grep -q 'install_gitleaks' "${POST_SCRIPT}"; then
+  echo "FAIL: bundled-script-has-gitleaks-install"
+  echo "  ${POST_SCRIPT} missing install_gitleaks"
+  FAILURES=$((FAILURES + 1))
+else
+  echo "PASS: bundled-script-has-gitleaks-install"
+fi
+
 # ---------------------------------------------------------------------------
 # Test helper — reimplements the title-rewriting logic from post-code.sh
 # so we can test it without a git repo or network access.