14e547ce56
Separate system configuration from Dotfiles_ArchAP. Add package manifests, system inventories, reusable templates, safer backup/deployment scripts, on-demand service management, TLP and zram configuration, and updated maintenance documentation.
121 lines
2.8 KiB
Bash
Executable file
121 lines
2.8 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
|
|
set -Eeuo pipefail
|
|
|
|
readonly REPO_DIR="$(
|
|
cd "$(dirname "${BASH_SOURCE[0]}")/.."
|
|
pwd
|
|
)"
|
|
|
|
status=0
|
|
|
|
fail() {
|
|
printf '[!] %s\n' "$*" >&2
|
|
status=1
|
|
}
|
|
|
|
echo '[*] Validation syntaxique Bash'
|
|
|
|
while IFS= read -r -d '' file; do
|
|
bash -n "$file" || status=1
|
|
done < <(
|
|
find \
|
|
"$REPO_DIR/scripts" \
|
|
"$REPO_DIR/rootfs/usr/local/sbin" \
|
|
-type f \
|
|
-print0 2>/dev/null
|
|
)
|
|
|
|
echo '[*] Validation des listes de paquets'
|
|
|
|
for file in \
|
|
"$REPO_DIR/pkglist/pacman.txt" \
|
|
"$REPO_DIR/pkglist/aur.txt" \
|
|
"$REPO_DIR/pkglist/orphans.txt"
|
|
do
|
|
[[ -f "$file" ]] || {
|
|
fail "Liste absente : $file"
|
|
continue
|
|
}
|
|
|
|
LC_ALL=C sort -cu "$file" ||
|
|
fail "Liste non triée ou contenant des doublons : $file"
|
|
done
|
|
|
|
if [[ -f "$REPO_DIR/pkglist/pacman.txt" &&
|
|
-f "$REPO_DIR/pkglist/aur.txt" ]]; then
|
|
if LC_ALL=C comm -12 \
|
|
"$REPO_DIR/pkglist/pacman.txt" \
|
|
"$REPO_DIR/pkglist/aur.txt" |
|
|
grep -q .
|
|
then
|
|
fail 'Des paquets apparaissent dans les listes Pacman et AUR.'
|
|
fi
|
|
fi
|
|
|
|
echo '[*] Recherche de fichiers sensibles'
|
|
|
|
while IFS= read -r file; do
|
|
fail "Fichier potentiellement sensible : $file"
|
|
done < <(
|
|
find "$REPO_DIR" \
|
|
-type f \
|
|
\( \
|
|
-name '*.key' \
|
|
-o -name '*.pem' \
|
|
-o -name '*.p12' \
|
|
-o -name '.netrc' \
|
|
-o -name '*.sqlite' \
|
|
-o -name '*.sqlite3' \
|
|
-o -name '*.db' \
|
|
\) \
|
|
-not -path "$REPO_DIR/.git/*"
|
|
)
|
|
|
|
echo '[*] Vérification de la séparation des dépôts'
|
|
|
|
for forbidden in \
|
|
"$REPO_DIR/userfs" \
|
|
"$REPO_DIR/inventory/packages" \
|
|
"$REPO_DIR/rootfs/etc/sudoers.d"
|
|
do
|
|
[[ ! -e "$forbidden" ]] ||
|
|
fail "Répertoire interdit dans arch-system : $forbidden"
|
|
done
|
|
|
|
echo '[*] Vérification des templates'
|
|
|
|
grep -q '@ROOT_UUID@' \
|
|
"$REPO_DIR/templates/fstab.btrfs" ||
|
|
fail 'Placeholder @ROOT_UUID@ absent de fstab.btrfs.'
|
|
|
|
grep -q '@EFI_UUID@' \
|
|
"$REPO_DIR/templates/fstab.btrfs" ||
|
|
fail 'Placeholder @EFI_UUID@ absent de fstab.btrfs.'
|
|
|
|
grep -q '@ROOT_UUID@' \
|
|
"$REPO_DIR/templates/limine.conf" ||
|
|
fail 'Placeholder @ROOT_UUID@ absent de limine.conf.'
|
|
|
|
grep -q '@USER@' \
|
|
"$REPO_DIR/templates/sudoers.d/batlimit" ||
|
|
fail 'Placeholder @USER@ absent du sudoers batlimit.'
|
|
|
|
grep -q '@USER@' \
|
|
"$REPO_DIR/templates/sudoers.d/vmware-stack" ||
|
|
fail 'Placeholder @USER@ absent du sudoers VMware.'
|
|
|
|
if git -C "$REPO_DIR" \
|
|
rev-parse --is-inside-work-tree >/dev/null 2>&1
|
|
then
|
|
echo '[*] Contrôle du diff Git'
|
|
git -C "$REPO_DIR" diff --check || status=1
|
|
fi
|
|
|
|
if (( status == 0 )); then
|
|
echo '[+] Dépôt valide.'
|
|
else
|
|
echo '[!] Le dépôt contient encore des erreurs.' >&2
|
|
fi
|
|
|
|
exit "$status"
|