Production hardening: host-aware install, ownership contracts, firewall safety

tools/build/lib/package.sh

@@ -11,6 +11,11 @@ prepare_stage() {
   rm -rf "$STAGE_DIR"
   mkdir -p "$STAGE_DIR" "dist"
   copy_dir_contents "package" "$STAGE_DIR"
+  chmod 0755 "$STAGE_DIR/install.sh"
+  find "$STAGE_DIR" -type d -exec chmod 0755 {} +
+  find "$STAGE_DIR" -type f -name "*.service" -exec chmod 0644 {} +
+  find "$STAGE_DIR" -type f -name "*.tpl" -exec chmod 0644 {} +
+  find "$STAGE_DIR/config" -type f -exec chmod 0644 {} +
 
   rm -rf "$STAGE_DIR/orchestrator" "$STAGE_DIR/ui" "$STAGE_DIR/metadata"
   mkdir -p "$STAGE_DIR/orchestrator" "$STAGE_DIR/ui/hy2xs-admin" "$STAGE_DIR/metadata"
@@ -87,5 +92,5 @@ create_archive() {
   local archive="dist/hy2xs-install-${version}.tar.gz"
 
   rm -f "$archive"
-  tar -C "tools/build/output" -czf "$archive" "hy2xs-install"
+  tar --owner=0 --group=0 --numeric-owner -C "tools/build/output" -czf "$archive" "hy2xs-install"
 }

tools/build/lib/verify.sh

@@ -40,4 +40,12 @@ verify_archive() {
   env_content="$(tar -xOzf "$archive" hy2xs-install/config/hy2xs.env)"
   printf '%s\n' "$env_content" | grep -q 'replace-with-your-domain.example' && fail "packaged hy2xs.env contains placeholder domain"
   printf '%s\n' "$env_content" | grep -q 'replace-with-your-email@example.com' && fail "packaged hy2xs.env contains placeholder email"
+
+  local tmp
+  tmp="$(mktemp -d)"
+  tar -xzf "$archive" -C "$tmp"
+  [ -x "$tmp/hy2xs-install/install.sh" ] || fail "install.sh is not executable"
+  [ -x "$tmp/hy2xs-install/orchestrator/hy2xs-orchestrator" ] || fail "orchestrator is not executable"
+  [ -x "$tmp/hy2xs-install/ui/hy2xs-admin/hy2xs-admin" ] || fail "hy2xs-admin is not executable"
+  rm -rf "$tmp"
 }