From b00fad190e0abfc62fee9b927d18069e8fc9fd07 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Serhat=20And=C4=B1=C3=A7?= Date: Tue, 8 Sep 2026 19:15:46 +0300 Subject: [PATCH 1/2] Reject Debian Bullseye in public installers Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- community-nightlies/deb.sh | 12 +++--- community/deb.sh | 12 +++--- enterprise-nightlies/deb.sh | 12 +++--- enterprise/deb.sh | 12 +++--- tests/deb-detection.sh | 77 +++++++++++++++++++++++++++++++++++++ 5 files changed, 101 insertions(+), 24 deletions(-) create mode 100644 tests/deb-detection.sh diff --git a/community-nightlies/deb.sh b/community-nightlies/deb.sh index 1773b10a..8ef33e93 100755 --- a/community-nightlies/deb.sh +++ b/community-nightlies/deb.sh @@ -147,6 +147,12 @@ detect_os () dist="${dist// /}" echo "Detected operating system as $os/$dist." + + if { [ -z "${os}" ] || [ "${os,,}" = "debian" ]; } && + { [ "${dist%%.*}" = "11" ] || [ "${dist,,}" = "bullseye" ]; }; then + echo "Debian 11 (bullseye) is no longer supported." + unknown_os + fi } detect_version_id () { @@ -178,9 +184,6 @@ detect_codename () 10) codename='buster' ;; - 11) - codename='bullseye' - ;; 12) codename='bookworm' ;; @@ -202,9 +205,6 @@ detect_codename () buster) codename="${dist}" ;; - bullseye) - codename="${dist}" - ;; bookworm) codename="${dist}" ;; diff --git a/community/deb.sh b/community/deb.sh index 1ce9eafd..397b94b5 100755 --- a/community/deb.sh +++ b/community/deb.sh @@ -147,6 +147,12 @@ detect_os () dist="${dist// /}" echo "Detected operating system as $os/$dist." + + if { [ -z "${os}" ] || [ "${os,,}" = "debian" ]; } && + { [ "${dist%%.*}" = "11" ] || [ "${dist,,}" = "bullseye" ]; }; then + echo "Debian 11 (bullseye) is no longer supported." + unknown_os + fi } detect_version_id () { @@ -178,9 +184,6 @@ detect_codename () 10) codename='buster' ;; - 11) - codename='bullseye' - ;; 12) codename='bookworm' ;; @@ -202,9 +205,6 @@ detect_codename () buster) codename="${dist}" ;; - bullseye) - codename="${dist}" - ;; bookworm) codename="${dist}" ;; diff --git a/enterprise-nightlies/deb.sh b/enterprise-nightlies/deb.sh index d6c2b0ea..fe6103ca 100755 --- a/enterprise-nightlies/deb.sh +++ b/enterprise-nightlies/deb.sh @@ -177,6 +177,12 @@ detect_os () dist="${dist// /}" echo "Detected operating system as $os/$dist." + + if { [ -z "${os}" ] || [ "${os,,}" = "debian" ]; } && + { [ "${dist%%.*}" = "11" ] || [ "${dist,,}" = "bullseye" ]; }; then + echo "Debian 11 (bullseye) is no longer supported." + unknown_os + fi } detect_version_id () { @@ -208,9 +214,6 @@ detect_codename () 10) codename='buster' ;; - 11) - codename='bullseye' - ;; 12) codename='bookworm' ;; @@ -232,9 +235,6 @@ detect_codename () buster) codename="${dist}" ;; - bullseye) - codename="${dist}" - ;; bookworm) codename="${dist}" ;; diff --git a/enterprise/deb.sh b/enterprise/deb.sh index 097005f7..18d670a5 100755 --- a/enterprise/deb.sh +++ b/enterprise/deb.sh @@ -177,6 +177,12 @@ detect_os () dist="${dist// /}" echo "Detected operating system as $os/$dist." + + if { [ -z "${os}" ] || [ "${os,,}" = "debian" ]; } && + { [ "${dist%%.*}" = "11" ] || [ "${dist,,}" = "bullseye" ]; }; then + echo "Debian 11 (bullseye) is no longer supported." + unknown_os + fi } detect_version_id () { @@ -208,9 +214,6 @@ detect_codename () 10) codename='buster' ;; - 11) - codename='bullseye' - ;; 12) codename='bookworm' ;; @@ -232,9 +235,6 @@ detect_codename () buster) codename="${dist}" ;; - bullseye) - codename="${dist}" - ;; bookworm) codename="${dist}" ;; diff --git a/tests/deb-detection.sh b/tests/deb-detection.sh new file mode 100644 index 00000000..c2188fab --- /dev/null +++ b/tests/deb-detection.sh @@ -0,0 +1,77 @@ +#!/bin/bash +# Run with: bash tests/deb-detection.sh +set -eo pipefail + +repo_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd) + +check () +{ + local expected=$1 input_os=$2 input_dist=$3 expected_codename=${4-} + local output status + if output=$( + # Only detection functions are loaded, never main or installation helpers. + eval "$detection_functions" + for tool in apt apt-get apt-key apt-cache curl wget gpg mkdir mv rm chmod sed tee; do + eval "$tool () { echo 'Unexpected $tool call' >&2; exit 99; }" + done + os=$input_os + dist=$input_dist + codename= + if [ "$os" = '' ]; then unset os; fi + detect_os + detect_codename + printf 'ACCEPTED:%s\n' "$codename" + ); then + status=0 + else + status=$? + fi + + if [ "$status" != "$expected" ] || + { [ "$expected" = 1 ] && [[ "$output" != *"Debian 11 (bullseye) is no longer supported."* ]]; } || + { [ "$expected" = 0 ] && [[ "$output" != *"ACCEPTED:$expected_codename" ]]; }; then + printf 'FAIL %s os=%q dist=%q: status=%s\n%s\n' "$script" "$input_os" "$input_dist" "$status" "$output" >&2 + exit 1 + fi +} + +for channel in community community-nightlies enterprise enterprise-nightlies; do + script="$repo_dir/$channel/deb.sh" + # Accept Windows checkout line endings without modifying the source files. + script_text=$(tr -d '\r' < "$script") + bash -n <<< "$script_text" + detection_functions=$(awk ' + /^(unknown_os|detect_os|detect_codename) \(\)/ { copying=1 } + copying { print } + copying && /^}/ { copying=0 } + ' <<< "$script_text") + first_command=$(awk ' + /^main \(\)/ { in_main=1; next } + in_main && /^[[:space:]]*(#|$|\{)/ { next } + in_main { print; exit } + ' <<< "$script_text") + if [ "$first_command" != ' detect_os' ]; then + echo "FAIL $script: detection must precede installer side effects." >&2 + exit 1 + fi + + # Nonempty explicit dist values skip host discovery, including with os unset. + for input_os in debian Debian ' De bian ' '' ' ' ''; do + for input_dist in 11 11.11 bullseye BULLSEYE ' Bull seye '; do + check 1 "$input_os" "$input_dist" + done + done + for pair in 12:bookworm 13:trixie 14:forky; do + check 0 debian "${pair%%:*}" "${pair#*:}" + check 0 debian "${pair#*:}" "${pair#*:}" + done + check 0 ubuntu jammy jammy + check 0 Ubuntu noble noble + check 0 ubuntu 11 11 + check 0 raspbian 11 11 + check 0 raspbian bullseye bullseye + check 0 custom bullseye bullseye + check 0 '' bookworm bookworm + check 0 '' 12 12 + echo "PASS $channel/deb.sh" +done From de33327f93bbbbd65043fcb938369a0071710b98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Serhat=20And=C4=B1=C3=A7?= Date: Tue, 8 Sep 2026 19:46:14 +0300 Subject: [PATCH 2/2] Keep installer validation outside the public installer source Remove the standalone detection harness; retain only the installer retirement changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- tests/deb-detection.sh | 77 ------------------------------------------ 1 file changed, 77 deletions(-) delete mode 100644 tests/deb-detection.sh diff --git a/tests/deb-detection.sh b/tests/deb-detection.sh deleted file mode 100644 index c2188fab..00000000 --- a/tests/deb-detection.sh +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/bash -# Run with: bash tests/deb-detection.sh -set -eo pipefail - -repo_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd) - -check () -{ - local expected=$1 input_os=$2 input_dist=$3 expected_codename=${4-} - local output status - if output=$( - # Only detection functions are loaded, never main or installation helpers. - eval "$detection_functions" - for tool in apt apt-get apt-key apt-cache curl wget gpg mkdir mv rm chmod sed tee; do - eval "$tool () { echo 'Unexpected $tool call' >&2; exit 99; }" - done - os=$input_os - dist=$input_dist - codename= - if [ "$os" = '' ]; then unset os; fi - detect_os - detect_codename - printf 'ACCEPTED:%s\n' "$codename" - ); then - status=0 - else - status=$? - fi - - if [ "$status" != "$expected" ] || - { [ "$expected" = 1 ] && [[ "$output" != *"Debian 11 (bullseye) is no longer supported."* ]]; } || - { [ "$expected" = 0 ] && [[ "$output" != *"ACCEPTED:$expected_codename" ]]; }; then - printf 'FAIL %s os=%q dist=%q: status=%s\n%s\n' "$script" "$input_os" "$input_dist" "$status" "$output" >&2 - exit 1 - fi -} - -for channel in community community-nightlies enterprise enterprise-nightlies; do - script="$repo_dir/$channel/deb.sh" - # Accept Windows checkout line endings without modifying the source files. - script_text=$(tr -d '\r' < "$script") - bash -n <<< "$script_text" - detection_functions=$(awk ' - /^(unknown_os|detect_os|detect_codename) \(\)/ { copying=1 } - copying { print } - copying && /^}/ { copying=0 } - ' <<< "$script_text") - first_command=$(awk ' - /^main \(\)/ { in_main=1; next } - in_main && /^[[:space:]]*(#|$|\{)/ { next } - in_main { print; exit } - ' <<< "$script_text") - if [ "$first_command" != ' detect_os' ]; then - echo "FAIL $script: detection must precede installer side effects." >&2 - exit 1 - fi - - # Nonempty explicit dist values skip host discovery, including with os unset. - for input_os in debian Debian ' De bian ' '' ' ' ''; do - for input_dist in 11 11.11 bullseye BULLSEYE ' Bull seye '; do - check 1 "$input_os" "$input_dist" - done - done - for pair in 12:bookworm 13:trixie 14:forky; do - check 0 debian "${pair%%:*}" "${pair#*:}" - check 0 debian "${pair#*:}" "${pair#*:}" - done - check 0 ubuntu jammy jammy - check 0 Ubuntu noble noble - check 0 ubuntu 11 11 - check 0 raspbian 11 11 - check 0 raspbian bullseye bullseye - check 0 custom bullseye bullseye - check 0 '' bookworm bookworm - check 0 '' 12 12 - echo "PASS $channel/deb.sh" -done