testing: add bats and pester suites with CI job - #141
Open
brainbloodbarrier wants to merge 17 commits into
Open
Conversation
Includes baseline architecture, 6-group review plan, prioritized findings, and arm64 macOS deployment requirements. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
…x flake for hash source; workflow reads hashes from files
…ncher, atomic update, and hash verification
… launcher, jpackage fixes, and hash verification
…acing, and add hash verification
…es and hash verification notes
The previous update.sh inherited install.sh verbatim, including sudo apt update && sudo apt install git wget openjdk-21-jre -y. Every update re-ran apt with sudo on already-provisioned machines. This rewrite keeps update.sh narrow: * require an existing git checkout in $HOME/Burpsuite-Professional * git pull --ff-only * revalidate VERSION/BURP_SHA256/LOADER_SHA256 * redownload and rehash the Burp JAR * rehash the bundled loader.jar * atomically replace /bin/burpsuitepro No package installs, no loader download, no Burp launch.
Launcher.jpg (capital L) and launcher.jpg (lowercase) tracked the same image. core.ignorecase=true on macOS hid the duplicate locally, but the repo on Linux/Nix shows both. The lowercase launcher.jpg is the one referenced by install_macos.sh and README.md; the capital-L variant is dead weight.
lib.sh (bash) exposes: - read_value, read_version - hash_sha256, verify_sha256, download_with_hash - require_command, verify_loader lib.ps1 (powershell) exposes: - Read-NormalizedValue, Read-BurpVersion - Get-Sha256, Test-Sha256, Invoke-DownloadWithHash - Test-LoaderHash Both normalize whitespace, lowercase hashes, and fail closed on mismatch.
All four installers now use the shared helpers: - install.sh, update.sh, install_macos.sh source lib.sh - install.ps1 dot-sources lib.ps1 This removes ~30 lines of duplicated VERSION/BURP_SHA256/LOADER_SHA256 read + hash verification logic from each script. The shared helpers normalize whitespace, lowercase hashes, and fail closed on mismatch.
bootstrap.sh downloads the canonical install.sh and lib.sh into a temp dir and execs install.sh. Supports BURP_REPO_URL override and a ref argument. Useful for curl|bash installs without cloning the full repo.
- tests/bats/lib.bats: coverage for lib.sh helpers - tests/bats/help.bats: coverage for help.sh entry points - tests/bats/update.bats: coverage for update.sh error path - tests/pester/lib.Tests.ps1: coverage for lib.ps1 helpers - .github/workflows/burp-pro.yml: new 'test' job running bats, Pester, and a Nix build smoke test on pull requests.
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Refactors the installers/packaging to centralize version + hash handling, adds shared helper libraries, and introduces CI-backed automated tests to prevent unsafe/incorrect downloads and regressions.
Changes:
- Added shared Bash (
lib.sh) and PowerShell (lib.ps1) helpers for reading pinned version/hash values, downloading artifacts, and verifying SHA-256. - Updated Linux/macOS/Windows installer/updater scripts to use
VERSION, verifyBURP_SHA256/LOADER_SHA256, and generate launchers more safely. - Added Bats + Pester tests and extended GitHub Actions workflow to run linting/tests and build the Nix package.
Reviewed changes
Copilot reviewed 21 out of 22 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
update.sh |
Reworks updater to pull repo, download pinned JAR, verify hashes, and update launcher atomically. |
install.sh |
Uses lib.sh for pinned version/hash download/verification and safer launcher generation. |
install_macos.sh |
Adds prerequisite checks, pinned download + hash verification, and improved launcher/app bundle creation. |
install.ps1 |
Introduces lib.ps1 helpers and switches to pinned JAR download + verification. |
lib.sh |
New shared Bash functions for normalization, download, and SHA-256 verification. |
lib.ps1 |
New shared PowerShell functions for normalization, download, and SHA-256 verification. |
tests/bats/lib.bats |
Adds Bats coverage for lib.sh helpers (normalization, hash, download). |
tests/bats/update.bats |
Adds a basic failure-mode test for update.sh. |
tests/bats/help.bats |
Adds smoke tests for help.sh exit codes/output. |
tests/pester/lib.Tests.ps1 |
Adds Pester tests for the PowerShell helper library. |
.github/workflows/burp-pro.yml |
Adds PR CI runs for bats/pester + Nix build; reads pinned version/hash for verification. |
default.nix |
Switches Nix package to read VERSION/BURP_SHA256, updates fetch URL, and adjusts metadata/runScript. |
flake.nix |
Simplifies flake outputs and updates description. |
bootstrap.sh |
Adds one-liner bootstrap that downloads scripts into a temp dir and executes install.sh. |
README.md |
Replaces long-form instructions with a structured, cross-platform overview and security notes. |
VERSION / BURP_SHA256 / LOADER_SHA256 |
Adds pinned version and expected hashes for integrity checks. |
AGENTS.md |
Documents project structure, test commands, and conventions. |
PLAN.md |
Adds planning notes and execution checklist (non-runtime documentation). |
help.sh |
Enables strict mode and hardens argument parsing. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+41
to
+79
| function Test-Sha256 { | ||
| [CmdletBinding()] | ||
| param( | ||
| [Parameter(Mandatory)] | ||
| [string]$Path, | ||
|
|
||
| [Parameter(Mandatory)] | ||
| [string]$Expected | ||
| ) | ||
|
|
||
| $actual = Get-Sha256 -Path $Path | ||
| if ($actual -ne $Expected.ToLower()) { | ||
| throw "SHA-256 mismatch for ${Path}. Expected $Expected, got $actual." | ||
| } | ||
| Write-Host "SHA-256 verified for $Path" | ||
| } | ||
|
|
||
| function Invoke-DownloadWithHash { | ||
| [CmdletBinding()] | ||
| param( | ||
| [Parameter(Mandatory)] | ||
| [string]$Url, | ||
|
|
||
| [Parameter(Mandatory)] | ||
| [string]$OutFile, | ||
|
|
||
| [Parameter(Mandatory)] | ||
| [string]$ExpectedSha256 | ||
| ) | ||
|
|
||
| Write-Host "Downloading $OutFile..." | ||
| try { | ||
| Invoke-WebRequest -Uri $Url -OutFile $OutFile -UseBasicParsing -ErrorAction Stop | ||
| } catch { | ||
| throw "Failed to download ${Url}: $_" | ||
| } | ||
|
|
||
| Test-Sha256 -Path $OutFile -ExpectedSha256 $ExpectedSha256 | ||
| } |
| unzip, | ||
| }: let | ||
| version = "2025.1.1"; | ||
| version = lib.removeSuffix "\n" (lib.fileContents ./VERSION); |
Comment on lines
+14
to
22
| burpHash = lib.removeSuffix "\n" (lib.fileContents ./BURP_SHA256); | ||
|
|
||
| burpSrc = fetchurl { | ||
| name = "burpsuite.jar"; | ||
| urls = [ | ||
| "https://portswigger.net/burp/releases/download?product=${productName}&version=${version}&type=Jar" | ||
| "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=${productName}&version=${version}&type=Jar" | ||
| "https://github.com/xiv3r/Burpsuite-Professional/releases/download/burpsuite-pro/burpsuite_pro_v${version}.jar" | ||
| ]; | ||
| hash = burpHash; | ||
| sha256 = burpHash; | ||
| }; |
Comment on lines
+25
to
+31
| @test "read_version reads VERSION and sets bp_version" { | ||
| printf '2026\n' > VERSION | ||
| source ./lib.sh | ||
| run read_version | ||
| [ "$status" -eq 0 ] | ||
| [ "$bp_version" = '2026' ] | ||
| } |
| # Usage: | ||
| # curl -fsSL https://github.com/xiv3r/Burpsuite-Professional/raw/main/bootstrap.sh | bash -s -- [ref] | ||
| # | ||
| REPO_URL="${BURP_REPO_URL:-https://github.com/xiv3r/Burpsuite-Professional}" |
Comment on lines
+3
to
+4
| # Downloads install.sh and lib.sh from a GitHub ref into a temp dir, | ||
| # verifies lib.sh against LOADER_SHA256 (if available), then execs install.sh. |
Comment on lines
+47
to
+51
| # Best-effort hash check of the downloaded lib.sh against the same ref. | ||
| # If LOADER_SHA256 is not reachable without auth, we still proceed (defense in depth). | ||
| if command -v sha256sum >/dev/null 2>&1; then | ||
| echo "SHA-256 of downloaded lib.sh: $(sha256sum "${TMP_DIR}/lib.sh" | cut -d' ' -f1)" | ||
| fi |
Comment on lines
+63
to
+66
| @test "download_with_hash fetches a file and verifies hash" { | ||
| python3 -m http.server 8765 >/dev/null 2>&1 & | ||
| SERVER_PID=$! | ||
| sleep 1 |
Comment on lines
+78
to
+81
| @test "download_with_hash fails and removes file on hash mismatch" { | ||
| python3 -m http.server 8766 >/dev/null 2>&1 & | ||
| SERVER_PID=$! | ||
| sleep 1 |
Comment on lines
+22
to
+26
| Push-Location (New-Item -ItemType Directory -Path (Join-Path $env:TEMP ([Guid]::NewGuid().ToString()))) | ||
| '2026' | Set-Content -Path 'VERSION' -NoNewline | ||
| Read-BurpVersion | ||
| $BurpVersion | Should -Be '2026' | ||
| Pop-Location |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.