feat(installer): build worker source over SSH

internal/sshinstall/plan.go

@@ -3,6 +3,7 @@ package sshinstall
 import (
 	"fmt"
 	"net/url"
+	"regexp"
 	"strings"
 )
 
@@ -15,9 +16,25 @@ const DefaultGoVersion = "1.26.0"
 // source credential and is the plan's default clone URL.
 const DefaultRepo = "https://rocketgit.ru/rsmon/worker.git"
 
-// DefaultBranch is the branch the source installer checks out and
-// builds.
-const DefaultBranch = "main"
+var (
+	// goVersionPattern bounds Go toolchain version strings that are
+	// interpolated into remote shell commands and download URLs.
+	goVersionPattern = regexp.MustCompile(`^[0-9][0-9A-Za-z._-]*$`)
+	// goArchPattern bounds Go download archive suffixes (e.g. "amd64")
+	// that are interpolated into remote shell commands and URLs.
+	goArchPattern = regexp.MustCompile(`^[0-9A-Za-z][0-9A-Za-z_-]*$`)
+)
+
+// ValidGoVersion reports whether a Go toolchain version uses only safe
+// characters (digits, letters, dots, dashes, underscores) and starts
+// with a digit. Versions are embedded in remote shell commands and
+// download URLs, so the charset is the injection boundary.
+func ValidGoVersion(v string) bool { return goVersionPattern.MatchString(v) }
+
+// ValidGoArch reports whether a Go download archive suffix uses only
+// safe characters. Suffixes are embedded in remote shell commands and
+// download URLs, so the charset is the injection boundary.
+func ValidGoArch(a string) bool { return goArchPattern.MatchString(a) }
 
 // Toolchain is a pinned, checksum-verified Go toolchain download for a
 // remote Linux architecture. The SHA-256 is baked for the default
@@ -117,7 +134,7 @@ func ToolchainFor(goarch, version string) (Toolchain, error) {
 // back to the pinned defaults.
 type SourceOptions struct {
 	Repo          string // clone URL; default DefaultRepo
-	Branch        string // default DefaultBranch
+	Branch        string // branch to build; empty means "the remote default branch"
 	GoVersion     string // default DefaultGoVersion
 	GoArch        string // go archive suffix; when empty, derived from UnameM
 	UnameM        string // remote `uname -m` output; required unless GoArch set
@@ -147,6 +164,9 @@ func PlanSource(d Detection, opts SourceOptions) (SourcePlan, error) {
 		return SourcePlan{}, fmt.Errorf("unsupported distro %q: no package manager", d.ID)
 	}
 	goarch := strings.TrimSpace(opts.GoArch)
+	if goarch != "" && !ValidGoArch(goarch) {
+		return SourcePlan{}, fmt.Errorf("invalid Go architecture %q: only letters, digits, dashes, and underscores are allowed", goarch)
+	}
 	if goarch == "" {
 		var err error
 		goarch, err = GoArch(opts.UnameM)
@@ -154,6 +174,9 @@ func PlanSource(d Detection, opts SourceOptions) (SourcePlan, error) {
 			return SourcePlan{}, err
 		}
 	}
+	if version := strings.TrimSpace(opts.GoVersion); version != "" && !ValidGoVersion(version) {
+		return SourcePlan{}, fmt.Errorf("invalid Go version %q: only digits, letters, dots, dashes, and underscores are allowed", version)
+	}
 	toolchain, err := ToolchainFor(goarch, opts.GoVersion)
 	if err != nil {
 		return SourcePlan{}, err
@@ -166,9 +189,10 @@ func PlanSource(d Detection, opts SourceOptions) (SourcePlan, error) {
 		return SourcePlan{}, err
 	}
 	branch := strings.TrimSpace(opts.Branch)
-	if branch == "" {
-		branch = DefaultBranch
-	}
+	// An empty branch means "build the remote's default branch" (the
+	// public repo currently publishes master). The executor resolves and
+	// records the remote default; a non-empty branch is pinned and must
+	// exist on the remote.
 	buildDir := strings.TrimSpace(opts.BuildDir)
 	if buildDir == "" {
 		buildDir = "/opt/rsmon-worker-src"
@@ -206,9 +230,19 @@ func packagePrereqs(pkg PackageManager) []string {
 	}
 }
 
-// validateRepoURL rejects repository references that could smuggle a
-// command or a non-remote scheme into the clone step. Only http(s) and
-// the git protocol are accepted; the default repository is https.
+// ValidateRepoURL rejects repository references that could smuggle a
+// command or a non-remote scheme into the clone step. Only https is
+// accepted (the default repository is https), and userinfo such as
+// `user:pass@host` is rejected so credentials can never reach the remote
+// clone command or the clone's config. An empty value is accepted here
+// (it falls back to the default repository when planning).
+func ValidateRepoURL(repo string) error {
+	if repo == "" {
+		return nil
+	}
+	return validateRepoURL(repo)
+}
+
 func validateRepoURL(repo string) error {
 	if strings.ContainsAny(repo, "\r\n\t ") {
 		return fmt.Errorf("repository URL %q contains whitespace", repo)
@@ -217,12 +251,13 @@ func validateRepoURL(repo string) error {
 	if err != nil || u.Host == "" {
 		return fmt.Errorf("repository URL %q is not an absolute clone URL", repo)
 	}
-	switch u.Scheme {
-	case "https", "http", "git":
-		return nil
-	default:
-		return fmt.Errorf("repository URL %q uses unsupported scheme %q", repo, u.Scheme)
+	if u.User != nil {
+		return fmt.Errorf("repository URL %q must not contain userinfo", repo)
 	}
+	if u.Scheme != "https" {
+		return fmt.Errorf("repository URL %q must use the https scheme", repo)
+	}
+	return nil
 }
 
 // StepKind identifies one ordered remote step the executor will run.
@@ -248,11 +283,15 @@ type Step struct {
 // Steps returns the ordered source-install plan as stable, reviewable
 // steps. It is the contract the executor work package implements.
 func (p SourcePlan) Steps() []Step {
+	checkoutDetail := "check out branch " + p.Branch + " and record the resolved commit"
+	if p.Branch == "" {
+		checkoutDetail = "check out the remote default branch and record the resolved commit"
+	}
 	return []Step{
 		{Kind: StepInstallPackages, Detail: "install minimal build prerequisites", Packages: p.Packages},
 		{Kind: StepInstallToolchain, Detail: "install pinned Go " + p.Toolchain.Version + " (" + p.Toolchain.Arch + ") and verify SHA-256"},
 		{Kind: StepCloneSource, Detail: "clone " + p.Repo + " into " + p.BuildDir},
-		{Kind: StepCheckoutBranch, Detail: "check out branch " + p.Branch + " and record the resolved commit"},
+		{Kind: StepCheckoutBranch, Detail: checkoutDetail},
 		{Kind: StepBuildWorker, Detail: "build the worker binary with CGO_ENABLED=0 and trimpath"},
 		{Kind: StepInstallService, Detail: "atomically install the binary, env, data dir, and " + string(p.InitSystem) + " service definition"},
 	}