Skip to content

Commit 1c1c333

Browse files
committed
Validate TLS staging ownership by UID
1 parent d6c0903 commit 1c1c333

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

.github/workflows/mainnet-origin-tls-install.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ jobs:
100100
active=/etc/nginx/sites-enabled/lithoscan.ai.conf
101101
upload_dir="$deploy_dir/tls-staging"
102102
current_user="$(id -un)"
103+
current_uid="$(id -u)"
103104
104105
actual_helper_sha="$(sha256sum "$helper" | cut -d' ' -f1)"
105106
echo "helper_sha256=$actual_helper_sha"
@@ -123,7 +124,7 @@ jobs:
123124
stat --format='tls_staging=%F owner=%U:%G mode=%a path=%n' "$upload_dir"
124125
test -d "$upload_dir" && test ! -L "$upload_dir" || { echo "TLS staging path is not a real directory" >&2; exit 1; }
125126
test "$(readlink -f "$upload_dir")" = "$upload_dir" || { echo "TLS staging path contains a symlink" >&2; exit 1; }
126-
test "$(stat -c %U "$upload_dir")" = "$current_user" || { echo "TLS staging directory owner differs from deploy user" >&2; exit 1; }
127+
test "$(stat -c %u "$upload_dir")" = "$current_uid" || { echo "TLS staging directory owner differs from deploy user" >&2; exit 1; }
127128
test "$(stat -c %a "$upload_dir")" = 700 || { echo "TLS staging directory must use mode 0700" >&2; exit 1; }
128129
else
129130
install -d -m 0700 "$upload_dir"

0 commit comments

Comments
 (0)