improve gh permissions

Author: terion-labs

install.sh

@@ -59,7 +59,9 @@ ensure_bootstrap_deps() {
   apt-get -o DPkg::Lock::Timeout=900 install -y ca-certificates curl
   install -d -m 0755 /etc/apt/keyrings
   curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
-  chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+  chown root:root /etc/apt/keyrings/githubcli-archive-keyring.gpg
+  chmod 0644 /etc/apt/keyrings/githubcli-archive-keyring.gpg
+  install -o root -g root -m 0644 /dev/null /etc/apt/sources.list.d/github-cli.list
   printf 'deb [arch=%s signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main\n' "$(dpkg --print-architecture)" > /etc/apt/sources.list.d/github-cli.list
   apt-get -o DPkg::Lock::Timeout=900 update -y
   apt-get -o DPkg::Lock::Timeout=900 install -y gh unzip python3

scripts/ctl/update.ts

@@ -218,9 +218,12 @@ async function ensureUpdateDependencies(): Promise<void> {
   await runText(["apt-get", "-o", "DPkg::Lock::Timeout=900", "install", "-y", "ca-certificates", "curl"], PREFIX);
   await runText(["install", "-d", "-m", "0755", "/etc/apt/keyrings"], PREFIX);
   await runText(["curl", "-fsSL", `${GITHUB_CLI_APT_REPO}/githubcli-archive-keyring.gpg`, "-o", GITHUB_CLI_APT_KEYRING], PREFIX);
+  await runText(["chown", "root:root", GITHUB_CLI_APT_KEYRING], PREFIX);
   chmodSync(GITHUB_CLI_APT_KEYRING, 0o644);
   const arch = (await runText(["dpkg", "--print-architecture"], PREFIX)).trim();
   writeFileSync(GITHUB_CLI_APT_SOURCE, `deb [arch=${arch} signed-by=${GITHUB_CLI_APT_KEYRING}] ${GITHUB_CLI_APT_REPO} stable main\n`);
+  await runText(["chown", "root:root", GITHUB_CLI_APT_SOURCE], PREFIX);
+  chmodSync(GITHUB_CLI_APT_SOURCE, 0o644);
   await runText(["apt-get", "-o", "DPkg::Lock::Timeout=900", "update", "-y"], PREFIX);
   await runText(["apt-get", "-o", "DPkg::Lock::Timeout=900", "install", "-y", "git", "gh", "ansible", "python3", "jq", "unzip"], PREFIX);
   await runText(["gh", "attestation", "verify", "--help"], PREFIX);

tests/install-bootstrap.test.ts

@@ -48,6 +48,9 @@ describe("install.sh bootstrap", () => {
     expect(source).toContain("DPkg::Lock::Timeout=900");
     expect(source).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y ca-certificates curl");
     expect(source).toContain("https://cli.github.com/packages/githubcli-archive-keyring.gpg");
+    expect(source).toContain("chown root:root /etc/apt/keyrings/githubcli-archive-keyring.gpg");
+    expect(source).toContain("chmod 0644 /etc/apt/keyrings/githubcli-archive-keyring.gpg");
+    expect(source).toContain("install -o root -g root -m 0644 /dev/null /etc/apt/sources.list.d/github-cli.list");
     expect(source).toContain("/etc/apt/sources.list.d/github-cli.list");
     expect(source).toContain("https://cli.github.com/packages stable main");
     expect(source).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y gh unzip python3");

tests/terrarium-update.test.ts

@@ -20,6 +20,10 @@ describe("terrarium update command", () => {
     expect(update).toContain("https://cli.github.com/packages");
     expect(update).toContain("githubcli-archive-keyring.gpg");
     expect(update).toContain('"dpkg", "--print-architecture"');
+    expect(update).toContain('"chown", "root:root", GITHUB_CLI_APT_KEYRING');
+    expect(update).toContain("chmodSync(GITHUB_CLI_APT_KEYRING, 0o644)");
+    expect(update).toContain('"chown", "root:root", GITHUB_CLI_APT_SOURCE');
+    expect(update).toContain("chmodSync(GITHUB_CLI_APT_SOURCE, 0o644)");
     expect(update).toContain('"git", "gh", "ansible", "python3", "jq", "unzip"');
     expect(update).toContain('"gh", "attestation", "verify", "--help"');
     expect(update).toContain("SHA256SUMS");