diff --git a/.env.example b/.env.example index a4d5c5a..6b1f76e 100644 --- a/.env.example +++ b/.env.example @@ -4,6 +4,9 @@ POSTGRES_USER=artex POSTGRES_PASSWORD=change-me-please POSTGRES_DB=artex +# 私有 GitHub Release 更新（仅后端读取；令牌需 Hinln/ARTEX 的 Contents: read） +ARTEX_UPDATE_GITHUB_TOKEN= + # LLM（二选一或都填；也可留空到 UI 里配） ANTHROPIC_API_KEY= OPENAI_API_KEY= diff --git a/README.md b/README.md index 3bddb9c..7f2dc83 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ AI 自主渗透测试系统（Go 后端 + Next.js 前端） ### 方式一：一键安装脚本（推荐） ```bash -git clone https://github.com/Autumn-27/ARTEX.git +git clone https://github.com/Hinln/ARTEX.git cd ARTEX ./install.sh ``` @@ -84,7 +84,7 @@ cd ARTEX ### 方式二：Docker Compose（手动） ```bash -git clone https://github.com/Autumn-27/ARTEX.git +git clone https://github.com/Hinln/ARTEX.git cd ARTEX cp .env.example .env # 填 POSTGRES_PASSWORD、可选 ANTHROPIC_API_KEY docker compose up -d # 拉取 autumn27/artex 镜像 + postgres @@ -100,7 +100,7 @@ docker compose up -d # 拉取 autumn27/artex 镜像 + postgres ### 方式三：下载预编译二进制（Releases） -到 [Releases](https://github.com/Autumn-27/ARTEX/releases) 下载对应平台的 zip，解压后得到 `artex` + `start.sh`（Windows 为 `start.bat`）+ `skills/` + `config.example.json`： +到 [Releases](https://github.com/Hinln/ARTEX/releases) 下载对应平台的 zip，解压后得到 `artex` + `start.sh`（Windows 为 `start.bat`）+ `skills/` + `config.example.json`： ```bash cp config.example.json config.json # 填好 database 连接 @@ -144,6 +144,21 @@ ARTEX_TARGETS=linux/amd64,windows/amd64 ./build.sh --release > 升级只换程序、不动数据：Postgres 数据卷 `pgdata`、`./data`（jwt.key / SQLite 等）、`./skills` 都会保留。**数据库迁移无需手动执行**——`artex` 每次启动会幂等重跑 `schema.sql`（含 `ADD COLUMN` / `CREATE INDEX IF NOT EXISTS`），即“重启即迁移”。升级前仍建议先备份 `./data` 与数据库。 +### 本仓库的私有 Release 更新源 + +页面一键更新固定从 [Hinln/ARTEX Releases](https://github.com/Hinln/ARTEX/releases) 检查和下载版本。克隆或通过 Git 更新源码也使用 `Hinln/ARTEX`；原项目的 Go module 路径保持不变。 + +这是私有仓库。请为运行 ARTEX 的后端进程设置 `ARTEX_UPDATE_GITHUB_TOKEN`，令牌只需本仓库的 **Contents: read** 权限。令牌由后端用于查询 Release 和下载附件，不发送给浏览器，也不要提交到 Git。 + +```bash +# 先在当前 shell 或服务环境中安全设置 ARTEX_UPDATE_GITHUB_TOKEN +./start.sh +``` + +本地直接启动时，`start.sh` 不会自动读取 `.env`；必须将变量导出到进程环境。Docker Compose 部署则可在未纳入 Git 的 `.env` 中填写该变量，并重建 artex 容器；镜像需要包含本分支的更新代码，旧版镜像不会因此切换升级源。 + +需要先在本仓库发布非 draft、非 prerelease 的正式 Release，并附上 `artex-<版本>--.zip` 和 `SHA256SUMS`，页面才能提供可安装更新。仓库里只有源码时还不能在线升级。现有 Release 工作流会在推送 `v*` tag 时为当前仓库生成这些附件。 + ### 方式一：页面一键更新（推荐） 在 **系统配置** 页（侧边栏「系统配置」→ `/system/settings`）的**版本与更新**卡片里，可以直接检查并安装新版本，无需登录服务器。 @@ -182,7 +197,7 @@ docker image prune -f # 清理旧镜像（可选） ### 方式四：预编译二进制（Releases） -到 [Releases](https://github.com/Autumn-27/ARTEX/releases) 下载新版本 zip，停掉旧进程后覆盖 `artex` 与 `skills/`（保留你的 `config.json` 与 `data/`），重启即可： +到 [Releases](https://github.com/Hinln/ARTEX/releases) 下载新版本 zip，停掉旧进程后覆盖 `artex` 与 `skills/`（保留你的 `config.json` 与 `data/`），重启即可： ```bash cp -r <解压目录>/skills ./ && cp <解压目录>/artex ./ diff --git a/docker-compose.yml b/docker-compose.yml index ca788e4..807e53e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -21,6 +21,7 @@ services: condition: service_healthy environment: ARTEX_PG_DSN: postgres://${POSTGRES_USER:-artex}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-artex}?sslmode=disable + ARTEX_UPDATE_GITHUB_TOKEN: ${ARTEX_UPDATE_GITHUB_TOKEN:-} ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-} OPENAI_API_KEY: ${OPENAI_API_KEY:-} ARTEX_LLM_PROVIDER: ${ARTEX_LLM_PROVIDER:-} diff --git a/selfupdate/github.go b/selfupdate/github.go index e3ea60e..6372daa 100644 --- a/selfupdate/github.go +++ b/selfupdate/github.go @@ -6,13 +6,17 @@ import ( "fmt" "net/http" "net/url" + "os" "strings" "time" ) // Repo 是发布源。写死而不是做成配置项：更新源可配等于给任何能改配置的人一条 // 远程代码执行通道，对一个渗透测试平台来说这个口子开不得。 -const Repo = "Autumn-27/artex" +const Repo = "Hinln/ARTEX" + +// GitHubTokenEnv 只由后端进程读取，不通过前端或配置 API 传递令牌。 +const GitHubTokenEnv = "ARTEX_UPDATE_GITHUB_TOKEN" // latestURL 是 GitHub 的"最新正式版"接口。它会自动跳过 prerelease 和 draft。 const latestURL = "https://api.github.com/repos/" + Repo + "/releases/latest" @@ -42,9 +46,33 @@ type Release struct { // Asset 是 Release 上挂的一个文件。 type Asset struct { - Name string `json:"name"` - URL string `json:"browser_download_url"` - Size int64 `json:"size"` + Name string `json:"name"` + URL string `json:"browser_download_url"` + APIURL string `json:"url"` + Size int64 `json:"size"` +} + +// 私有仓库的附件需通过 Release Asset API 携带认证下载。 +func (a Asset) downloadURL() string { + if a.APIURL != "" { + return a.APIURL + } + return a.URL +} + +// setUpdateAuth 仅向固定发布仓库的 HTTPS API 发送令牌。附件重定向到 +// GitHub 对象存储时使用签名 URL，不得把 Authorization 一并转发。 +func setUpdateAuth(req *http.Request) { + req.Header.Del("Authorization") + u := req.URL + if u.Scheme != "https" || !strings.EqualFold(u.Hostname(), "api.github.com") || + (u.Port() != "" && u.Port() != "443") || u.User != nil || + !strings.HasPrefix(strings.ToLower(u.EscapedPath()), strings.ToLower("/repos/"+Repo+"/releases/")) { + return + } + if token := strings.TrimSpace(os.Getenv(GitHubTokenEnv)); token != "" { + req.Header.Set("Authorization", "Bearer "+token) + } } // NewClient 构造一个只认 GitHub 域名的 HTTP 客户端。proxy 为空则直连。 @@ -68,7 +96,11 @@ func NewClient(proxy string) *http.Client { if len(via) >= 10 { return fmt.Errorf("重定向次数过多") } - return checkURL(req.URL) + if err := checkURL(req.URL); err != nil { + return err + } + setUpdateAuth(req) + return nil }, } } @@ -95,6 +127,7 @@ func FetchLatest(ctx context.Context, c *http.Client) (*Release, error) { } req.Header.Set("Accept", "application/vnd.github+json") req.Header.Set("User-Agent", "artex-selfupdate") + setUpdateAuth(req) resp, err := c.Do(req) if err != nil { @@ -103,11 +136,14 @@ func FetchLatest(ctx context.Context, c *http.Client) (*Release, error) { defer resp.Body.Close() switch { - case resp.StatusCode == http.StatusForbidden, resp.StatusCode == http.StatusTooManyRequests: - // 未认证的 GitHub API 是每 IP 每小时 60 次，共用出口 IP 时很容易撞上。 - return nil, fmt.Errorf("GitHub 接口限流（每小时 60 次），请稍后再试") + case resp.StatusCode == http.StatusUnauthorized: + return nil, fmt.Errorf("GitHub 认证失败，请检查后端环境变量 %s", GitHubTokenEnv) + case resp.StatusCode == http.StatusForbidden: + return nil, fmt.Errorf("GitHub 拒绝访问：请检查令牌的仓库 Contents 读取权限或 API 限额") + case resp.StatusCode == http.StatusTooManyRequests: + return nil, fmt.Errorf("GitHub 接口限流，请稍后再试") case resp.StatusCode == http.StatusNotFound: - return nil, fmt.Errorf("仓库 %s 尚未发布任何正式版本", Repo) + return nil, fmt.Errorf("仓库 %s 不可访问或尚未发布正式版本；私有仓库请在后端设置 %s（需 Contents 读取权限）", Repo, GitHubTokenEnv) case resp.StatusCode != http.StatusOK: return nil, fmt.Errorf("GitHub 返回 %d", resp.StatusCode) } diff --git a/selfupdate/github_test.go b/selfupdate/github_test.go new file mode 100644 index 0000000..91420c8 --- /dev/null +++ b/selfupdate/github_test.go @@ -0,0 +1,151 @@ +package selfupdate + +import ( + "crypto/sha256" + "encoding/hex" + "fmt" + "io" + "net/http" + "path/filepath" + "strings" + "testing" +) + +type updateTransportFunc func(*http.Request) (*http.Response, error) + +func (f updateTransportFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) } + +func updateResponse(req *http.Request, status int, body string) *http.Response { + return &http.Response{StatusCode: status, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(body)), Request: req} +} + +func TestPrivateReleaseMetadataChecksumsAndDownload(t *testing.T) { + t.Setenv(GitHubTokenEnv, "test-private-release-token") + payload := "release archive bytes" + sum := sha256.Sum256([]byte(payload)) + wantSum := hex.EncodeToString(sum[:]) + client := NewClient("") + seen := map[string]bool{} + client.Transport = updateTransportFunc(func(req *http.Request) (*http.Response, error) { + seen[req.URL.String()] = true + if req.URL.Host == "api.github.com" { + if req.Header.Get("Authorization") != "Bearer test-private-release-token" { + t.Fatal("private Release API request missing authentication") + } + } else if req.Header.Get("Authorization") != "" { + t.Fatal("token leaked to release object storage") + } + switch req.URL.String() { + case latestURL: + if req.Header.Get("Accept") != "application/vnd.github+json" { + t.Fatal("metadata request must ask for JSON") + } + return updateResponse(req, 200, fmt.Sprintf(`{"tag_name":"v0.3.16","assets":[ + {"name":"SHA256SUMS","url":"https://api.github.com/repos/%s/releases/assets/1","browser_download_url":"https://github.com/unusable-sums"}, + {"name":"artex-0.3.16-darwin-arm64.zip","url":"https://api.github.com/repos/%s/releases/assets/2","browser_download_url":"https://github.com/unusable-zip","size":%d} + ]}`, Repo, Repo, len(payload))), nil + case "https://api.github.com/repos/" + Repo + "/releases/assets/1": + if req.Header.Get("Accept") != "application/octet-stream" { + t.Fatal("checksum request must ask for binary data") + } + return updateResponse(req, 200, wantSum+" artex-0.3.16-darwin-arm64.zip\n"), nil + case "https://api.github.com/repos/" + Repo + "/releases/assets/2": + if req.Header.Get("Accept") != "application/octet-stream" { + t.Fatal("archive request must ask for binary data") + } + resp := updateResponse(req, 302, "") + resp.Header.Set("Location", "https://release-assets.githubusercontent.com/signed-archive") + return resp, nil + case "https://release-assets.githubusercontent.com/signed-archive": + return updateResponse(req, 200, payload), nil + default: + t.Fatalf("unexpected update URL: %s", req.URL) + return nil, nil + } + }) + rel, err := FetchLatest(t.Context(), client) + if err != nil { + t.Fatal(err) + } + sums, err := fetchSums(t.Context(), client, rel) + if err != nil { + t.Fatal(err) + } + asset, ok := rel.FindAsset("artex-0.3.16-darwin-arm64.zip") + if !ok { + t.Fatal("archive missing") + } + dst := filepath.Join(t.TempDir(), "release.zip") + got, err := download(t.Context(), client, asset, dst, func(Phase, int, string) {}) + if err != nil { + t.Fatal(err) + } + if got != sums[asset.Name] || got != wantSum || readAll(t, dst) != payload { + t.Fatal("downloaded archive/checksum mismatch") + } + if len(seen) != 4 { + t.Fatalf("expected metadata, sums, archive API and CDN requests, got %d", len(seen)) + } +} + +func TestUpdateTokenNeverLeavesReleaseAPI(t *testing.T) { + t.Setenv(GitHubTokenEnv, "test-token") + for _, raw := range []string{ + "https://github.com/" + Repo + "/releases/download/v1/file.zip", + "https://api.github.com/repos/other/repo/releases/assets/1", + "https://api.github.com/repos/" + Repo + "-other/releases/assets/1", + "https://api.github.com:8443/repos/" + Repo + "/releases/assets/1", + "https://api.github.com/repos/" + Repo + "/releases%2Fassets/1", + "https://objects.githubusercontent.com/archive", + "http://api.github.com/repos/" + Repo + "/releases/assets/1", + } { + t.Run(raw, func(t *testing.T) { + req, err := http.NewRequest(http.MethodGet, raw, nil) + if err != nil { + t.Fatal(err) + } + req.Header.Set("Authorization", "Bearer inherited-token") + setUpdateAuth(req) + if req.Header.Get("Authorization") != "" { + t.Fatal("unsafe destination retained token") + } + }) + } + // A same-host redirect must not inherit authorization for a different repo. + req, _ := http.NewRequest(http.MethodGet, "https://api.github.com/repos/other/repo/releases/assets/1", nil) + req.Header.Set("Authorization", "Bearer test-token") + if err := NewClient("").CheckRedirect(req, nil); err != nil { + t.Fatal(err) + } + if req.Header.Get("Authorization") != "" { + t.Fatal("same-host redirect leaked token to another repo") + } +} + +func TestPublicReleaseDownloadWithoutToken(t *testing.T) { + t.Setenv(GitHubTokenEnv, "") + asset := Asset{Name: "archive", URL: "https://github.com/" + Repo + "/releases/download/v1/archive.zip"} + client := NewClient("") + client.Transport = updateTransportFunc(func(req *http.Request) (*http.Response, error) { + if req.URL.String() != asset.URL || req.Header.Get("Authorization") != "" { + t.Fatal("invalid public asset request") + } + return updateResponse(req, 200, "archive"), nil + }) + if _, err := download(t.Context(), client, asset, filepath.Join(t.TempDir(), "archive"), func(Phase, int, string) {}); err != nil { + t.Fatal(err) + } +} + +func TestReleaseAuthenticationErrors(t *testing.T) { + t.Setenv(GitHubTokenEnv, "") + for status, message := range map[int]string{401: GitHubTokenEnv, 403: "Contents", 404: Repo, 429: "限流"} { + t.Run(fmt.Sprint(status), func(t *testing.T) { + client := &http.Client{Transport: updateTransportFunc(func(req *http.Request) (*http.Response, error) { return updateResponse(req, status, "{}"), nil })} + _, err := FetchLatest(t.Context(), client) + if err == nil || !strings.Contains(err.Error(), message) { + t.Fatalf("unexpected error: %v", err) + } + }) + } +} diff --git a/selfupdate/stage.go b/selfupdate/stage.go index fe41aaf..89d99b4 100644 --- a/selfupdate/stage.go +++ b/selfupdate/stage.go @@ -133,7 +133,7 @@ func fetchSums(ctx context.Context, c *http.Client, rel *Release) (map[string]st if !ok { return nil, fmt.Errorf("该 Release 没有 %s，无法校验完整性，拒绝升级", sumsAsset) } - body, err := get(ctx, c, asset.URL) + body, err := get(ctx, c, asset.downloadURL()) if err != nil { return nil, fmt.Errorf("下载 %s: %w", sumsAsset, err) } @@ -189,7 +189,7 @@ func isHexSHA256(s string) bool { // download 把资产写入 dst，同时计算 SHA256 并按 Content-Length 汇报进度。 func download(ctx context.Context, c *http.Client, a Asset, dst string, prog Progress) (string, error) { - body, err := get(ctx, c, a.URL) + body, err := get(ctx, c, a.downloadURL()) if err != nil { return "", fmt.Errorf("下载 %s: %w", a.Name, err) } @@ -225,6 +225,8 @@ func get(ctx context.Context, c *http.Client, rawURL string) (io.ReadCloser, err return nil, err } req.Header.Set("User-Agent", "artex-selfupdate") + req.Header.Set("Accept", "application/octet-stream") + setUpdateAuth(req) resp, err := c.Do(req) if err != nil { return nil, err