mirror of
https://github.com/Abdess/retroarch_system.git
synced 2026-10-11 05:53:23 -05:00
Abdessamad Derraz
185cf47bbc
Every other manifest field was treated as hostile input, but standalone_copies targets were only length-checked before being expanded and written to: a traversal component or a symlink already sitting at the destination sent the copy outside the directory the user opted into. Targets are now validated like the other paths and a symlinked destination is never followed. RETROBIOS_BASE_URL serves the manifest and the files it declares, so it now has to be HTTPS the way both bootstraps already require of the installer URL; loopback stays open for the end-to-end tests. install.ps1 left TLS at the Windows PowerShell 5.1 default, which GitHub refuses, so the download failed before any hash was checked. check_local read every file once per declared digest, single threaded. One read now feeds both, across the same pool the downloads use. RetroPie had no manifest, so the one-line installer answered 'unknown platform' for a frontend whose packs do ship.
71 lines
3.3 KiB
PowerShell
71 lines
3.3 KiB
PowerShell
# One-line bootstrap and local wrapper. The downloaded installer is accepted
|
|
# only when it matches the SHA-256 embedded in this wrapper.
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter(ValueFromRemainingArguments = $true)]
|
|
[string[]]$InstallerArguments
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
$defaultInstallUrl = "https://raw.githubusercontent.com/Abdess/retrobios/main/install.py"
|
|
$defaultInstallSha256 = "b83e7422b8516d666017964cf18fc9ef8c4f8bbdb6a594ed9da0c04158eff870"
|
|
$maximumInstallerBytes = 2MB
|
|
$installer = if ($PSScriptRoot) { Join-Path $PSScriptRoot "install.py" } else { $null }
|
|
$temporary = $null
|
|
|
|
try {
|
|
if (-not $installer -or -not (Test-Path -LiteralPath $installer -PathType Leaf)) {
|
|
$url = if ($env:RETROBIOS_INSTALL_URL) { $env:RETROBIOS_INSTALL_URL } else { $defaultInstallUrl }
|
|
$expected = if ($env:RETROBIOS_INSTALL_SHA256) { $env:RETROBIOS_INSTALL_SHA256 } else { $defaultInstallSha256 }
|
|
$uri = [Uri]$url
|
|
if ($uri.Scheme -ne "https") {
|
|
throw "RETROBIOS_INSTALL_URL must use HTTPS."
|
|
}
|
|
if ($expected -notmatch '^[0-9a-fA-F]{64}$') {
|
|
throw "Installer SHA-256 must contain exactly 64 hexadecimal characters."
|
|
}
|
|
# Windows PowerShell 5.1 still negotiates SSL 3.0 / TLS 1.0 by default
|
|
# and GitHub refuses both, so the download fails before any hash is
|
|
# checked. install.sh pins the same floor with curl --tlsv1.2.
|
|
if ($PSVersionTable.PSEdition -ne "Core") {
|
|
[Net.ServicePointManager]::SecurityProtocol = `
|
|
[Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
|
|
}
|
|
$temporary = Join-Path ([IO.Path]::GetTempPath()) ("retrobios-install-{0}.py" -f [Guid]::NewGuid())
|
|
Invoke-WebRequest -Uri $uri -OutFile $temporary -UseBasicParsing
|
|
if ((Get-Item -LiteralPath $temporary).Length -gt $maximumInstallerBytes) {
|
|
throw "Downloaded installer exceeds the size limit."
|
|
}
|
|
$actual = (Get-FileHash -LiteralPath $temporary -Algorithm SHA256).Hash.ToLowerInvariant()
|
|
if ($actual -ne $expected.ToLowerInvariant()) {
|
|
throw "install.py SHA-256 mismatch."
|
|
}
|
|
$installer = $temporary
|
|
}
|
|
|
|
$python = Get-Command py -ErrorAction SilentlyContinue
|
|
if ($python) {
|
|
& $python.Source -3 -c "import sys; raise SystemExit(sys.version_info < (3, 8))"
|
|
if ($LASTEXITCODE -ne 0) { throw "Python 3.8 or newer is required." }
|
|
& $python.Source -3 $installer @InstallerArguments
|
|
if ($LASTEXITCODE -ne 0) { throw "RetroBIOS installer failed with exit code $LASTEXITCODE." }
|
|
return
|
|
}
|
|
$python = Get-Command python3 -ErrorAction SilentlyContinue
|
|
if (-not $python) {
|
|
$python = Get-Command python -ErrorAction SilentlyContinue
|
|
}
|
|
if (-not $python) {
|
|
throw "Python 3.8 or newer is required."
|
|
}
|
|
& $python.Source -c "import sys; raise SystemExit(sys.version_info < (3, 8))"
|
|
if ($LASTEXITCODE -ne 0) { throw "Python 3.8 or newer is required." }
|
|
& $python.Source $installer @InstallerArguments
|
|
if ($LASTEXITCODE -ne 0) { throw "RetroBIOS installer failed with exit code $LASTEXITCODE." }
|
|
}
|
|
finally {
|
|
if ($temporary -and (Test-Path -LiteralPath $temporary)) {
|
|
Remove-Item -LiteralPath $temporary -Force
|
|
}
|
|
}
|