10/4

src/pkg.c

@@ -15,17 +15,6 @@
 #include "common.h"
 #include "pkg.h"
 
-/* directory definitions */
-const dir_t gl_root = { "/glacier", 0750 };
-
-const dir_t gl_usr = { "/glacier/usr", 0700 };
-const dir_t gl_usr_index = { "/glacier/usr/index", 0700 };
-const dir_t gl_usr_store = { "/glacier/usr/store", 0700 };
-
-const dir_t gl_sys = { "/glacier/sys", 0700 };
-const dir_t gl_sys_index = { "/glacier/sys/index", 0700 };
-const dir_t gl_sys_store = { "/glacier/sys/store", 0700 };
-
 /* null dependencies/conflicts for error throwing */
 dep_t null_dep = { "null", {-1, -1, -1, NULL} };
 conf_t null_conf = { "null", {-1, -1, -1, NULL} };
@@ -133,24 +122,64 @@ gl_pkg_t
 	return new_pkg;
 }
 
+/*
+ * gl_valid_pkg_ident
+ * DESCRIPTION: checks that a package name or repo name is safe to use as a
+ * 		single path component: non-empty, only [A-Za-z0-9._-], and not
+ * 		"." or "..". Both come straight out of an untrusted manifest (or
+ * 		off a command line) and get spliced into store paths, so
+ * 		anything else could escape ctx->store_path.
+ * PARAMETERS:
+ * 	~ const char *s (the identifier to check; NULL is invalid)
+ * RETURNS:
+ * 	~ true if safe, false otherwise
+ */
+bool
+gl_valid_pkg_ident(const char *s)
+{
+	if (!s || s[0] == '\0') { return false; }
+	if (strcmp(s, ".") == 0 || strcmp(s, "..") == 0) { return false; }
+
+	for (const char *p = s; *p; p++) {
+		char c = *p;
+		if (!((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||
+		      (c >= '0' && c <= '9') || c == '.' || c == '_' || c == '-')) {
+			return false;
+		}
+	}
+
+	return true;
+}
+
 int
 gl_gpm2gpkg(const char *filename, gl_pkg_t *pkg)
 {
 	config_t cfg;
 	config_setting_t *deps, *confs;
 	const char *tmp_str;
+	const char *name = NULL, *repo = NULL;
 
 	config_init(&cfg);
 
 	if (!config_read_file(&cfg, filename)) {
+		config_destroy(&cfg);
 		return ENOENT;
 	}
 
-	if (config_lookup_string(&cfg, "PKG_NAME", &tmp_str)) { pkg->pkg_name = strdup(tmp_str); }
+	/* Validate before anything is strdup'd, so a rejected manifest leaves
+	 * pkg untouched and the caller has nothing to free. */
+	config_lookup_string(&cfg, "PKG_NAME", &name);
+	config_lookup_string(&cfg, "PKG_REPO", &repo);
+	if (!gl_valid_pkg_ident(name) || !gl_valid_pkg_ident(repo)) {
+		config_destroy(&cfg);
+		return EINVAL;
+	}
+
+	pkg->pkg_name = strdup(name);
+	pkg->pkg_repo = strdup(repo);
 	if (config_lookup_string(&cfg, "PKG_DESC", &tmp_str)) { pkg->pkg_desc = strdup(tmp_str); }
 	if (config_lookup_string(&cfg, "PKG_MAINT", &tmp_str)) { pkg->pkg_maint = strdup(tmp_str); }
 	if (config_lookup_string(&cfg, "PKG_COPYRIGHT", &tmp_str)) { pkg->pkg_copyright = strdup(tmp_str); }
-	if (config_lookup_string(&cfg, "PKG_REPO", &tmp_str)) { pkg->pkg_repo = strdup(tmp_str); }
 	if (config_lookup_string(&cfg, "PKG_VER", &tmp_str)) { pkg->pkg_ver = gl_parse_semver(tmp_str); }
 
 	deps = config_lookup(&cfg, "PKG_DEPS");
@@ -281,34 +310,6 @@ gl_free_pkg(gl_pkg_t *pkg)
 	}
 }
 
-int
-gl_prepare_pkgdir(gl_pkg_t *pkg, bool is_syspkg)
-{
-
-	dir_t pkg_root = { pkg -> pkg_name, 0750 };
-	dir_t pkg_store_final;
-	dir_t pkg_index_final;
-	
-	if (!is_syspkg) {
-		dir_t pkg_store_initial = gl_return_dir(&gl_usr_store, &pkg_root, 0750);
-		pkg_store_final = gl_return_dir_and_ver(&pkg_store_initial, pkg, 0750);
-		dir_t pkg_index_initial = gl_return_dir(&gl_usr_index, &pkg_root, 0750);
-		pkg_index_final = gl_return_dir_and_ver(&pkg_index_initial, pkg, 0750);
-	}
-	else if (is_syspkg) {
-		dir_t pkg_store_initial = gl_return_dir(&gl_sys_store, &pkg_root, 0750);
-		pkg_store_final = gl_return_dir_and_ver(&pkg_store_initial, pkg, 0750);
-		dir_t pkg_index_initial = gl_return_dir(&gl_sys_index, &pkg_root, 0750);
-		pkg_index_final = gl_return_dir_and_ver(&pkg_index_initial, pkg, 0750);
-	}
-
-	printf("%s\n%s\n", pkg_index_final.path, pkg_store_final.path);
-	gl_free_dir(&pkg_index_final);
-	gl_free_dir(&pkg_store_final);
-
-	return 0;
-}
-
 void
 gl_show_pkg_props(const gl_pkg_t *pkg)
 {
@@ -346,3 +347,39 @@ gl_show_pkg_props(const gl_pkg_t *pkg)
 	}
 }
 
+/*
+ * Read integer `key` from a libconfig file (glacier.conf). Distinguishes
+ * the failures a caller has to report differently:
+ *   GL_CONF_OK           *out set
+ *   GL_CONF_ERR_READ     file missing, unreadable, or not valid libconfig
+ *   GL_CONF_ERR_MISSING  file fine, key absent
+ *   GL_CONF_ERR_TYPE     key present but not an integer
+ * There are deliberately no defaults here: a setting the caller needs and
+ * the file doesn't have is an error, not a silent fallback (CLAUDE.md bug
+ * 10 is what a plausible default hides).
+ */
+gl_conf_status_t
+gl_conf_get_int(const char *path, const char *key, int *out)
+{
+	config_t cfg;
+	config_init(&cfg);
+
+	if (!config_read_file(&cfg, path)) {
+		config_destroy(&cfg);
+		return GL_CONF_ERR_READ;
+	}
+
+	config_setting_t *setting = config_lookup(&cfg, key);
+	if (!setting) {
+		config_destroy(&cfg);
+		return GL_CONF_ERR_MISSING;
+	}
+	if (config_setting_type(setting) != CONFIG_TYPE_INT) {
+		config_destroy(&cfg);
+		return GL_CONF_ERR_TYPE;
+	}
+
+	*out = config_setting_get_int(setting);
+	config_destroy(&cfg);
+	return GL_CONF_OK;
+}