fix: segurança, persistência, captura e acessibilidade — correções da auditoria

.github/workflows/e2e-tests.yml

@@ -1,66 +1,49 @@
-name: End-to-End GTK Tests
-
+name: GTK and media integration
 on:
-  push:
-    branches: [ "main" ]
   pull_request:
-    branches: [ "main" ]
-
+    branches: [main]
+  push:
+    branches: [main]
+permissions:
+  contents: read
+concurrency:
+  group: gtk-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
+  integration:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    container:
+      image: manjarolinux/base:latest
+      options: --shm-size=256m
+    env:
+      PYTHONDONTWRITEBYTECODE: '1'
     steps:
-    - uses: actions/checkout@v3
-
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.11'
-
-    - name: Install System Dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y \
-          python3-pip \
-          xvfb \
-          python3-dogtail \
-          python3-gi \
-          python3-gi-cairo \
-          gir1.2-gtk-4.0 \
-          gir1.2-gstreamer-1.0 \
-          gstreamer1.0-plugins-base \
-          gstreamer1.0-plugins-good \
-          gstreamer1.0-plugins-bad \
-          v4l2loopback-utils \
-          ffmpeg \
-          xauth \
-          at-spi2-core
-
-    - name: Setup at-spi for Headless Testing
-      run: |
-        # Required to allow dogtail to run under xvfb
-        mkdir -p ~/.config/at-spi2
-        echo -e "[core]\nEnabled=true" > ~/.config/at-spi2/at-spi2-core.conf
-
-    - name: Install Python Dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install pytest aiohttp websockets opencv-python Pillow numpy qrcode pyzbar
-
-    - name: Run E2E Dogtail UI Test (XVFB)
-      run: |
-        # Inicia Xvfb com a11y (AT-SPI) dbus-run-session
-        export DISPLAY=:99
-        Xvfb $DISPLAY -screen 0 1920x1080x24 &
-        sleep 3
-
-        # Inicia o barramento DBUS e Roda os testes
-        dbus-run-session -- bash -c "python3 tests/test_ui_dogtail.py"
-
-    - name: Run Chaos Monkey Test
-      run: |
-        # O teste de chaos precisa do módulo v4l2loopback, que o kernel host do github actions geralmente não permite carregar nativamente sem config avançada.
-        # Mas validamos a importação sintática do runner de testes:
-        python3 -m py_compile tests/chaos_hotplug.py
+      - name: Install current Manjaro Python and matching GI runtime
+        run: |
+          pacman -Syu --noconfirm --needed git ca-certificates python python-pytest python-hypothesis python-cryptography python-gobject python-cairo python-numpy python-opencv python-pillow python-aiohttp python-qrcode python-atspi python-polib gtk4 libadwaita gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav gst-plugin-gtk4 ffmpeg openssl dbus xorg-server-xvfb xorg-xauth openbox at-spi2-core xdotool scrot pulseaudio adwaita-icon-theme librsvg ttf-dejavu xdg-user-dirs xdg-utils procps-ng psmisc util-linux gettext mesa
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Pure regression tests and syntax
+        run: |
+          /usr/bin/python3 -m compileall -q usr/share/biglinux/bigcam tests
+          /usr/bin/python3 -m pytest -q tests/audit
+          bash -n tests/integration/session.sh
+      - name: Actual GUI, AT-SPI, capture, recording and error handling
+        shell: bash
+        run: |
+          set -euo pipefail
+          useradd --create-home --uid 10001 --user-group bigcam-test
+          mkdir -p /tmp/bigcam-results
+          chown bigcam-test:bigcam-test /tmp/bigcam-results
+          chmod -R a+rX "$GITHUB_WORKSPACE"
+          timeout --kill-after=10s 180s runuser -u bigcam-test -- env BIGCAM_TEST_RESULTS=/tmp/bigcam-results bash tests/integration/session.sh 2>&1 | tee /tmp/bigcam-results/session.log
+      - name: Preserve evidence even when a test fails
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: graphical-manjaro-${{ github.sha }}
+          path: /tmp/bigcam-results/
+          if-no-files-found: warn
+          retention-days: 14

.github/workflows/translate-and-build-package.yml

@@ -1,83 +1,66 @@
-name: Translate and Build Package
-
+name: Catalog validation and verified build dispatch
 on:
+  pull_request:
+    branches: [main]
+    paths: ['locale/**', 'usr/share/biglinux/bigcam/**', '.github/workflows/translate-and-build-package.yml']
+  workflow_run:
+    workflows: ['GTK and media integration']
+    types: [completed]
+    branches: [main]
   workflow_dispatch:
     inputs:
-      debug_enabled:
+      dispatch_build:
         type: boolean
-        description: 'With TMATE'
-        required: false
+        description: Dispatch the reviewed main revision to BigLinux package builders
+        required: true
         default: false
-
-  push:
-    branches: [ "*" ]
-
+permissions:
+  contents: read
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  catalogs:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
-      - name: If Template exit
-        shell: bash
-        run: |
-          cancel () {
-            echo "Pacote de template, não precisa traduzir e compilar"
-            echo "SAINDO...."
-            curl -s -H "Authorization: token ${{ github.token }}" \
-            -X POST "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
-            sleep infinity
-          }
-          if [ -n "$(grep biglinux-package-template pkgbuild/PKGBUILD)" ];then
-            cancel
-          fi
-
-      - name: Install Translator Dependencies
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+      - run: sudo apt-get update && sudo apt-get install -y --no-install-recommends gettext
+      - name: Validate catalogs without translation-service secrets or repository writes
         shell: bash
         run: |
-          sudo apt-get update
-          sudo apt-get install \
-          git \
-          gettext \
-          npm
-          # Install attranslator
-          sudo npm install --location=global attranslate
-
-      ## Tmate ##
-      - name: Setup TMATE Session
-        uses: mxschmitt/action-tmate@v3
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
-
-      - name: Translate Package
-        shell: bash #-O extglob {0}
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/catalogs"
+          for po in locale/*.po; do
+            msgfmt --check --check-format -o "$RUNNER_TEMP/catalogs/$(basename "${po%.po}").mo" "$po"
+          done
+  dispatch:
+    needs: catalogs
+    if: >-
+      github.repository == 'biglinux/bigcam' &&
+      ((github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.head_repository.full_name == github.repository) ||
+       (github.event_name == 'workflow_dispatch' && inputs.dispatch_build && github.ref == 'refs/heads/main'))
+    runs-on: ubuntu-24.04
+    timeout-minutes: 3
+    steps:
+      - name: Dispatch tested main; never execute repository code with this credential
         env:
-          AZURE_KEY: ${{ secrets.AZURE_KEY }}
-          OPENAI_KEY: ${{ secrets.OPENAI_KEY }}
-        run: |
-          cd ..
-          git clone https://github.com/biglinux/big-auto-translator.git
-          mv big-auto-translator/gettext_po_generator_github.sh .
-          sudo cp -f big-auto-translator/openai-translate.js /usr/local/lib/node_modules/attranslate/dist/services/openai-translate.js
-          gitfolder=$(echo ${{ github.repository }} | rev | cut -d "/" -f1 | rev)
-          # export OriginalLang=pt-BR
-          bash gettext_po_generator_github.sh $gitfolder
-
-      - name: Update github
-        run: |
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
-          git add --all
-          if [ -n "$(git commit -m "translate $(date +%y-%m-%d_%H:%M)" -a | grep "nothing to commit")" ];then exit 0; fi
-
-      - name: Push changes
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          branch: ${{ github.ref }}
-
-      - name: Send Hooks BigLinux Build Package
+          WEBHOOK_TOKEN: ${{ secrets.WEBHOOK_TOKEN }}
+          REVISION: ${{ github.event.workflow_run.head_sha || github.sha }}
         shell: bash
         run: |
-          if [ -z "$(grep biglinux-package-template pkgbuild/PKGBUILD)" ];then
-            curl -X POST -H "Accept: application/json" -H "Authorization: token ${{ secrets.WEBHOOK_TOKEN }}" --data '{"event_type": "${{ github.repository }}", "client_payload": { "branch": "${{ github.ref_name }}", "url": "https://github.com/${{ github.repository }}"}}' https://api.github.com/repos/BigLinux-Package-Build/build-package/dispatches
-            curl -X POST -H "Accept: application/json" -H "Authorization: token ${{ secrets.WEBHOOK_TOKEN }}" --data '{"event_type": "${{ github.repository }}", "client_payload": { "branch": "${{ github.ref_name }}", "url": "https://github.com/${{ github.repository }}"}}' https://api.github.com/repos/BigLinux-Package-Build/build-package-ARM/dispatches
+          set -euo pipefail
+          test -n "$WEBHOOK_TOKEN"
+          current=$(git ls-remote https://github.com/biglinux/bigcam.git refs/heads/main | cut -f1)
+          if [ "$current" != "$REVISION" ]; then
+            echo 'main advanced; its own successful integration run will dispatch the build.'
+            exit 0
           fi
+          body='{"event_type":"biglinux/bigcam","client_payload":{"branch":"main","url":"https://github.com/biglinux/bigcam"}}'
+          for repository in build-package build-package-ARM; do
+            curl --fail-with-body --silent --show-error --max-time 30 -X POST \
+              -H 'Accept: application/vnd.github+json' -H "Authorization: Bearer $WEBHOOK_TOKEN" \
+              -H 'X-GitHub-Api-Version: 2022-11-28' --data "$body" \
+              "https://api.github.com/repos/BigLinux-Package-Build/$repository/dispatches"
+          done

default.nix

@@ -15,6 +15,10 @@
   libcamera,
   zbar,
   polkit,
+  kmod,
+  linuxPackages,
+  openssl,
+  pulseaudio,
 }:
 
 let
@@ -26,10 +30,11 @@ let
       opencv4
       qrcode
       aiohttp
+      pillow
     ]
   );
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "bigcam";
   version = "4.5.0";
 
@@ -84,12 +89,25 @@ stdenv.mkDerivation {
       cp -r usr/share/locale/* $out/share/locale/
     fi
 
-    # System config (polkit, modprobe, sudoers)
+    # Module configuration
     if [ -d etc ]; then
       mkdir -p $out/etc
       cp -r etc/* $out/etc/
     fi
 
+    install -Dm755 usr/lib/bigcam/virtual-camera-helper $out/lib/bigcam/virtual-camera-helper
+    install -Dm644 usr/share/polkit-1/actions/br.com.biglinux.bigcam.policy \
+      $out/share/polkit-1/actions/br.com.biglinux.bigcam.policy
+    substituteInPlace $out/share/biglinux/bigcam/core/virtual_camera.py \
+      $out/share/polkit-1/actions/br.com.biglinux.bigcam.policy \
+      --replace-fail /usr/lib/bigcam/virtual-camera-helper $out/lib/bigcam/virtual-camera-helper
+    substituteInPlace $out/lib/bigcam/virtual-camera-helper \
+      --replace-fail '#!/usr/bin/python3 -I' '#!${python3}/bin/python3 -I' \
+      --replace-fail 'SAFE_PATH = "/usr/sbin:/usr/bin:/sbin:/bin"' \
+        'SAFE_PATH = "${lib.makeBinPath [ kmod linuxPackages.v4l2loopback.bin ]}"'
+    substituteInPlace $out/share/biglinux/bigcam/core/phone_tls.py \
+      --replace-fail '"PATH": "/usr/bin:/bin"' '"PATH": "${lib.makeBinPath [ openssl ]}"'
+
     # Launcher script
     mkdir -p $out/bin
     cat > $out/bin/bigcam <<'LAUNCHER'
@@ -110,7 +128,7 @@ stdenv.mkDerivation {
   postFixup = ''
     wrapProgram $out/bin/bigcam \
       "''${gappsWrapperArgs[@]}" \
-      --prefix PATH : "${lib.makeBinPath [ pythonEnv ffmpeg v4l-utils gphoto2 ]}" \
+      --prefix PATH : "${lib.makeBinPath [ pythonEnv ffmpeg v4l-utils gphoto2 pipewire polkit openssl pulseaudio linuxPackages.v4l2loopback.bin ]}" \
       --prefix PYTHONPATH : "$out/share/biglinux/bigcam" \
       --prefix PYTHONPATH : "${pythonEnv}/${pythonEnv.sitePackages}" \
       --prefix GI_TYPELIB_PATH : "${lib.makeSearchPath "lib/girepository-1.0" buildInputs}" \

etc/modprobe.d/v4l2loopback.conf

@@ -1,13 +1,2 @@
-# v4l2loopback configuration for BigCam
-# Fallback config when v4l2loopback-ctl is unavailable.
-# When v4l2loopback-ctl IS available, BigCam loads with devices=0
-# and creates devices dynamically via v4l2loopback-ctl add.
-#
-# Parameters:
-#   devices=5             - Create 5 virtual video devices (one per camera)
-#   exclusive_caps=1,...  - Allow browsers/WebRTC apps to see ALL cameras
-#   max_buffers=8         - Larger buffer to absorb USB timing jitter
-#   video_nr=20-24        - Use /dev/video20-24 (avoids physical camera collisions)
-#   card_label            - Friendly name shown in apps
-#
-options v4l2loopback devices=5 exclusive_caps=1,1,1,1,1 max_buffers=8 video_nr=20,21,22,23,24 card_label="BigCam Virtual 1,BigCam Virtual 2,BigCam Virtual 3,BigCam Virtual 4,BigCam Virtual 5"
+# BigCam creates its own loopbacks dynamically after Polkit authorization.
+# No global options: do not override configurations belonging to other applications.

etc/sudoers.d/bigcam

@@ -1,11 +1,2 @@
-# Allow wheel group to load/unload v4l2loopback without password (BigCam)
-# modprobe may live in /usr/bin or /usr/sbin depending on distro
-%wheel ALL=(root) NOPASSWD: /usr/bin/modprobe v4l2loopback *
-%wheel ALL=(root) NOPASSWD: /usr/bin/modprobe -r v4l2loopback
-%wheel ALL=(root) NOPASSWD: /usr/sbin/modprobe v4l2loopback *
-%wheel ALL=(root) NOPASSWD: /usr/sbin/modprobe -r v4l2loopback
-# Allow dynamic v4l2loopback device management (add/delete)
-%wheel ALL=(root) NOPASSWD: /usr/sbin/v4l2loopback-ctl add *
-%wheel ALL=(root) NOPASSWD: /usr/sbin/v4l2loopback-ctl delete *
-%wheel ALL=(root) NOPASSWD: /usr/bin/v4l2loopback-ctl add *
-%wheel ALL=(root) NOPASSWD: /usr/bin/v4l2loopback-ctl delete *
+# BigCam no longer grants passwordless access to generic system utilities.
+# Virtual cameras are managed by the Polkit-authorized fixed-operation helper.