technova69/spip-check-cli | 20 commits
Par Gilles Vincent, le 26 août 2026 à 19h27min :
fix: legitimize formulaires/ files by squelette presence, not CVT function names
VerificationLegitimiteFormulaireCvt required a formulaires/.php to
define a function named after one of a fixed list of CVT suffixes
(charger/verifier/traiter/identifier, plus « saisies » added for the
Saisies plugin last commit). That list kept growing every time a real
plugin used a legitimate but different convention – multi-step forms
suffix verifier with a step number, and some files in formulaires/
aren’t forms at all (plugins-dist/fabrique’s
formulaires/fabriquer_plugin_actions.php is a plain action-dispatch
helper with no CVT function and no companion squelette).
Per the spip-formulaires skill, the one thing that actually legitimizes
a formulaires/.php is a squelette formulaires/.html of the
same name – SPIP calls charger/verifier/traiter/identifier individually
if and only if each exists, so no particular function is ever required.
Switched the check to that single criterion, plus the same
already-verified-against-reference exemption used by
VerificationSignatureWebshell (extracted to a shared, public method) for
plugin utility files that have no squelette but are provably unmodified.
AnalyseurPhp::definitFonctionCvt() and SUFFIXES_CVT are now unused and
removed. ContexteScan gained existeSurLeSite(), a small primitive both
this check and estUnCompagnonDeSquelette() build on.
Modifié
src/Scan/ContexteScan.php
src/Verification/AnalyseurPhp.php
src/Verification/VerificationLegitimiteFormulaireCvt.php
src/Verification/VerificationSignatureWebshell.php
tests/Verification/AnalyseurPhpTest.php
tests/Verification/VerificationLegitimiteFormulaireCvtTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 18h39min :
chore: add GPL-3.0-only license header to every PHP file
Matches the LICENSE file already added and the approach taken in the
sibling spip-check project (Gilles Vincent / spip-check · GitLab, commit
e403445). composer.json’s license field was still GPL-3.0-or-later;
aligned it to GPL-3.0-only to match LICENSE and the new headers.
Modifié
bin/spip-check-cli
composer.json
src/Application.php
src/Archive/CacheArchives.php
src/Archive/ClientHttp.php
src/Archive/ClientHttpFlux.php
src/Archive/FournisseurArchives.php
src/Archive/IndexDepotPlugins.php
src/Archive/ResolveurVersionCore.php
src/Archive/TelechargeurArchive.php
src/Command/CacheLister.php
src/Command/CacheMettreajour.php
src/Command/CacheVider.php
src/Command/QuarantaineLister.php
src/Command/QuarantaineRestaurer.php
src/Command/ScanLancer.php
src/Console/Command.php
src/Console/Style/SpipCheckStyle.php
src/Container/Container.php
src/Container/Exception/EntreeIntrouvable.php
src/Environnement/CheminsLocaux.php
src/Inventaire/InventaireSite.php
src/Inventaire/ParametresSite.php
src/Inventaire/PluginInstalle.php
src/Nettoyage/NettoyeurInteractif.php
src/Nettoyage/Quarantaine.php
src/Rapport/RapportConsole.php
src/Reference/IndexReference.php
src/Scan/Constat.php
src/Scan/ContexteScan.php
src/Scan/Scanner.php
src/Verification/AnalyseurPhp.php
src/Verification/VerificationBootstrapPlugin.php
src/Verification/VerificationEmplacementStructurel.php
src/Verification/VerificationIntegriteCore.php
src/Verification/VerificationIntegritePlugin.php
src/Verification/VerificationInterface.php
src/Verification/VerificationLegitimiteFichierLangue.php
src/Verification/VerificationLegitimiteFormulaireCvt.php
src/Verification/VerificationSignatureWebshell.php
src/Verification/VerificationSymlink.php
tests/ApplicationTest.php
tests/Archive/CacheArchivesTest.php
tests/Archive/FournisseurArchivesTest.php
tests/Archive/IndexDepotPluginsTest.php
tests/Archive/ResolveurVersionCoreTest.php
tests/Archive/TelechargeurArchiveTest.php
tests/Command/CacheCommandesTest.php
tests/Command/QuarantaineCommandesTest.php
tests/Command/ScanLancerTest.php
tests/Double/ClientHttpFactice.php
tests/Environnement/CheminsLocauxTest.php
tests/Fixtures/ArbreTemporaire.php
tests/Fixtures/ConstructeurZip.php
tests/Inventaire/InventaireSiteTest.php
tests/Inventaire/ParametresSiteTest.php
tests/Inventaire/PluginInstalleTest.php
tests/Nettoyage/NettoyeurInteractifTest.php
tests/Nettoyage/QuarantaineTest.php
tests/Rapport/RapportConsoleTest.php
tests/Reference/IndexReferenceTest.php
tests/Scan/ConstatTest.php
tests/Scan/ContexteScanTest.php
tests/Scan/ScannerTest.php
tests/Verification/AnalyseurPhpTest.php
tests/Verification/VerificationBootstrapPluginTest.php
tests/Verification/VerificationEmplacementStructurelTest.php
tests/Verification/VerificationIntegriteCoreTest.php
tests/Verification/VerificationIntegritePluginTest.php
tests/Verification/VerificationLegitimiteFichierLangueTest.php
tests/Verification/VerificationLegitimiteFormulaireCvtTest.php
tests/Verification/VerificationSignatureWebshellTest.php
tests/Verification/VerificationSymlinkTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 18h35min :
feat: recognize the Saisies CVT hook and add a lang/ legitimacy check
VerificationLegitimiteFormulaireCvt only knew the 4 canonical CVT
suffixes (charger/verifier/traiter/identifier), so a config form built
on the (near-ubiquitous) Saisies plugin’s convention – a lone
formulaires__saisies_dist() declaring fields, with
charger/verifier/traiter handled by the plugin’s generic engine – was
flagged as an orphan script. Added « saisies » as a recognized suffix.
Added VerificationLegitimiteFichierLangue: a lang/ file should never be
more than a translation array (see the spip-lang skill), which makes it
the one content check still meaningful for a plugin with no reference
archive to diff against (a « plugin perso ») or for a site’s own
squelettes/lang/ overrides – nothing else in the pipeline looks at
those files at all. Recognizes both forms SPIP actually reads
(ecrire/inc/traduire.php::lire_fichier_langue): return […] and the
historical $GLOBALS[$GLOBALS[‹ idx_lang ›]] = […] assignment, the
latter still used by the majority of real-world third-party plugins.
Ajouté
LICENSE
src/Verification/VerificationLegitimiteFichierLangue.php
tests/Verification/VerificationLegitimiteFichierLangueTest.php
Modifié
src/Application.php
src/Verification/AnalyseurPhp.php
tests/Verification/AnalyseurPhpTest.php
tests/Verification/VerificationLegitimiteFormulaireCvtTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 18h17min :
fix: stop re-flagging unmodified reference files and squelette companions
Two more --approfondi false positives, both from legitimate SPIP
constructs the deep checks didn’t know about:
-
VerificationSignatureWebshell scanned every script’s content for
exec()-family calls regardless of whether the file was already proven
byte-identical to its official reference (core or plugin). Core files
like ecrire/action/tester.php and filtres_images_lib_mini.php call
exec() legitimately; once a file’s integrity is established by hash
comparison, replaying the content heuristic against it only produces
noise. A file that no longer matches its reference (real tampering)
is unaffected and still gets flagged. -
VerificationLegitimiteFormulaireCvt required every formulaires/*.php
file to define a CVT function named after its own filename, but a
file like formulaires/editer_site_fonctions.php is a squelette
companion (loaded because squelettes/formulaires/editer_site.html
exists next to it, same mechanism as sommaire_fonctions.php) — its
form’s actual CVT functions live in the sibling editer_site.php.
Extracted the squelette-companion check (previously private to
VerificationBootstrapPlugin) onto ContexteScan so both verifications
share it.
Modifié
src/Scan/ContexteScan.php
src/Verification/VerificationBootstrapPlugin.php
src/Verification/VerificationLegitimiteFormulaireCvt.php
src/Verification/VerificationSignatureWebshell.php
tests/Verification/VerificationLegitimiteFormulaireCvtTest.php
tests/Verification/VerificationSignatureWebshellTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 18h03min :
fix: clarify the wording for a file missing from a plugin or the core
« Fichier absent de l’installation du plugin X » read as if the file
shouldn’t be there, when a missing-file finding actually means the
opposite: the reference archive has it and it can be restored from
there. Reworded to say so explicitly for both the core and plugin
checks.
Modifié
src/Verification/VerificationIntegriteCore.php
src/Verification/VerificationIntegritePlugin.php
tests/Fixtures/ArbreTemporaire.php
tests/Verification/VerificationIntegriteCoreTest.php
tests/Verification/VerificationIntegritePluginTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 17h51min :
fix: stop flagging SPIP’s own plugin-loading caches as orphan bootstraps
tmp/cache/charger_plugins_fonctions.php and charger_plugins_options.php
are generated by SPIP itself (ecrire/inc/plugin.php::plugins_precompile_xxxtions)
to aggregate every active plugin’s own _fonctions.php/_options.php, and
are regenerated on each activation. Their name happens to match the
plugin-bootstrap naming convention without being one, so they fell
through to the « orphan bootstrap » warning on every site.
Modifié
src/Verification/VerificationBootstrapPlugin.php
tests/Verification/VerificationBootstrapPluginTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 17h41min :
fix: stop flagging plugins-dist and core files as orphan bootstraps
plugins-dist/ isn’t discovered by InventaireSite::plugins() (only
plugins/ and declared extras are), so a distributed plugin’s own
_fonctions.php had no matching entry in
VerificationBootstrapPlugin’s prefix map and fell through to « orphan
bootstrap ». Same issue for core files that happen to share the naming
convention, like ecrire/req/sqlite_fonctions.php.
Both directories are already fully covered by VerificationIntegriteCore
(any addition or alteration there is caught by diffing against the
official archive), so the bootstrap heuristic now skips anything under
a core-owned directory instead of duplicating — and getting wrong —
that check.
Modifié
src/Verification/VerificationBootstrapPlugin.php
tests/Verification/VerificationBootstrapPluginTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 15h07min :
feat: show progress bars during reference downloads and verifications
A scan gave no feedback between the header table and the final report,
which could take several seconds on a site with many plugins or on a
first run (cold cache, one download per archive). Added a progress bar
for the reference-preparation phase and one for the verification phase,
each labelled with what’s currently being processed.
Scanner::analyser() gained an optional callback invoked before each
verification, so the console layer can drive progress without the
scanner depending on it.
Modifié
src/Command/ScanLancer.php
src/Scan/Scanner.php
==============================
Par Gilles Vincent, le 26 août 2026 à 15h04min :
fix: stop flagging composer-managed vendor/ files as core tampering
Real sites run composer install locally, so vendor/ almost never matches
the official archive byte-for-byte — treating it like ecrire/prive as a
strictly-owned core directory drowned reports in false CRITIQUE findings.
Files the core archive genuinely ships under vendor/ are still diffed for
tampering; only the « any extra file is critical » rule no longer applies
to it.
Same principle for VerificationBootstrapPlugin: a plugin’s vendor/ or lib/
subtree is third-party code SPIP never autoloads, so bootstrap-shaped file
names found there are no longer treated as suspicious.
Also fixes a related false-positive multiplier found while investigating:
ContexteScan keyed plugin references by prefix alone, so two installs of
the same plugin at different versions (SVP keeps the old directory after
an update) collided — the second overwrote the first, and both ended up
diffed against whichever version’s archive was registered last. The key
now includes the version.
Modifié
src/Command/ScanLancer.php
src/Scan/ContexteScan.php
src/Verification/VerificationBootstrapPlugin.php
src/Verification/VerificationIntegriteCore.php
src/Verification/VerificationIntegritePlugin.php
tests/Scan/ContexteScanTest.php
tests/Verification/VerificationBootstrapPluginTest.php
tests/Verification/VerificationIntegriteCoreTest.php
tests/Verification/VerificationIntegritePluginTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 14h48min :
chore: drop the Co-Authored-By trailer from the plan’s example commits
Modifié
docs/superpowers/plans/2026-08-26-spip-check-cli.md
Détails : https://git.spip.net/technova69/spip-check-cli/-/commit/ec8b9d3221c993204761f1dcb5e63cee6ae85d82
==============================
Par Gilles Vincent, le 26 août 2026 à 14h46min :
feat: add the scan:lancer command tying the pipeline together
Ajouté
src/Command/ScanLancer.php
tests/Command/ScanLancerTest.php
Modifié
src/Application.php
==============================
Par Gilles Vincent, le 26 août 2026 à 14h45min :
feat: add the type-aware interactive cleanup loop
Ajouté
src/Nettoyage/NettoyeurInteractif.php
tests/Nettoyage/NettoyeurInteractifTest.php
Modifié
src/Console/Style/SpipCheckStyle.php
src/Reference/IndexReference.php
==============================
Par Gilles Vincent, le 26 août 2026 à 14h41min :
feat: add reversible quarantine and its commands
Ajouté
src/Command/QuarantaineLister.php
src/Command/QuarantaineRestaurer.php
src/Nettoyage/Quarantaine.php
tests/Command/QuarantaineCommandesTest.php
tests/Nettoyage/QuarantaineTest.php
Modifié
src/Application.php
==============================
Par Gilles Vincent, le 26 août 2026 à 14h39min :
feat: render the scan report in the terminal
Ajouté
src/Rapport/RapportConsole.php
tests/Rapport/RapportConsoleTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 13h58min :
feat: add token-based content verifications
Ajouté
src/Verification/AnalyseurPhp.php
src/Verification/VerificationLegitimiteFormulaireCvt.php
src/Verification/VerificationSignatureWebshell.php
tests/Verification/AnalyseurPhpTest.php
tests/Verification/VerificationLegitimiteFormulaireCvtTest.php
tests/Verification/VerificationSignatureWebshellTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 13h56min :
feat: add the structural verifications
Ajouté
src/Verification/VerificationBootstrapPlugin.php
src/Verification/VerificationEmplacementStructurel.php
src/Verification/VerificationSymlink.php
tests/Verification/VerificationBootstrapPluginTest.php
tests/Verification/VerificationEmplacementStructurelTest.php
tests/Verification/VerificationSymlinkTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 13h54min :
feat: diff core and plugin files against official archives
Ajouté
src/Verification/VerificationIntegriteCore.php
src/Verification/VerificationIntegritePlugin.php
tests/Verification/VerificationIntegriteCoreTest.php
tests/Verification/VerificationIntegritePluginTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 13h52min :
feat: add the scan context, findings and orchestrator
Ajouté
src/Scan/Constat.php
src/Scan/ContexteScan.php
src/Scan/Scanner.php
src/Verification/VerificationInterface.php
tests/Scan/ConstatTest.php
tests/Scan/ContexteScanTest.php
tests/Scan/ScannerTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 13h50min :
feat: inventory a site without executing any of its PHP
Ajouté
src/Inventaire/InventaireSite.php
tests/Inventaire/InventaireSiteTest.php
==============================
Par Gilles Vincent, le 26 août 2026 à 13h47min :
feat: model installed plugins and per-site remembered settings
Ajouté
src/Inventaire/ParametresSite.php
src/Inventaire/PluginInstalle.php
tests/Inventaire/ParametresSiteTest.php
tests/Inventaire/PluginInstalleTest.php