@automattic/vip 4.1.3 → 4.1.4

package/internal/rechallenge/flow.go

@@ -6,6 +6,8 @@ import (
 	"io"
 	"os"
 	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // Tracker is the minimal telemetry interface the runner needs.
@@ -121,6 +123,7 @@ func (r *Runner) Run(ctx context.Context, in RunInput) (*ElevatedToken, error) {
 		return nil, NewInteractionRequiredError(scope)
 	}
 
+	debuglog.Printf(ctx, "@automattic/vip:rechallenge:client", "createSession scope=%s", scope)
 	session, err := r.Client.CreateSession(CreateSessionInput{
 		Path:               in.Extension.CreateSessionPath,
 		RequestedOperation: scope,
@@ -182,6 +185,11 @@ func (r *Runner) Run(ctx context.Context, in RunInput) (*ElevatedToken, error) {
 		}
 
 		if !ss.Status.IsTerminal() {
+			status := "unknown"
+			if ss.Status == StatusPending {
+				status = "pending"
+			}
+			debuglog.Printf(ctx, "@automattic/vip:rechallenge:flow", "still %s; polling again", status)
 			continue
 		}
 

package/internal/rechallenge/flow_test.go

@@ -11,6 +11,8 @@ import (
 	"sync/atomic"
 	"testing"
 	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 type fakeTracker struct {
@@ -77,7 +79,9 @@ func TestFlowHappyPathVerified(t *testing.T) {
 		Sleep:      func(_ context.Context, _ time.Duration) error { return nil },
 	}
 
-	tok, err := r.Run(context.Background(), RunInput{
+	var diagnostics bytes.Buffer
+	debugCtx := debuglog.WithLogger(context.Background(), "@automattic/vip:rechallenge:*", &diagnostics)
+	tok, err := r.Run(debugCtx, RunInput{
 		RequestedOperation: "doThing",
 		Interactive:        true,
 		Extension: Extension{
@@ -94,6 +98,16 @@ func TestFlowHappyPathVerified(t *testing.T) {
 	if tok.Token != "opaque" {
 		t.Errorf("token = %q", tok.Token)
 	}
+	for _, want := range []string{"createSession scope=doThing", "still pending; polling again"} {
+		if !strings.Contains(diagnostics.String(), want) {
+			t.Errorf("missing %q in diagnostics: %q", want, diagnostics.String())
+		}
+	}
+	for _, secret := range []string{"opaque", "https://example/v/c1"} {
+		if strings.Contains(diagnostics.String(), secret) {
+			t.Fatal("rechallenge diagnostic leaked credentials")
+		}
+	}
 	if atomic.LoadInt32(&openCalled) != 1 {
 		t.Errorf("OpenURL called %d times, want 1", openCalled)
 	}

package/internal/releasepromotion/buildkite.go

@@ -97,8 +97,19 @@ func (c *BuildkiteClient) DownloadArtifacts(ctx context.Context, build Build, ro
 		return fmt.Errorf("create artifact directory: %w", err)
 	}
 
+	existing, err := os.ReadDir(root)
+	if err != nil {
+		return fmt.Errorf("read artifact directory: %w", err)
+	}
+	if len(existing) != 0 {
+		return fmt.Errorf("artifact directory must be empty; refusing to mix artifacts from different builds")
+	}
+
 	for _, artifactPath := range expectedArtifactPaths {
-		artifact := manifest[artifactPath]
+		artifact, ok := manifest[artifactPath]
+		if !ok {
+			continue
+		}
 		if artifact.DownloadURL == "" {
 			return fmt.Errorf("artifact %q has no download URL", artifactPath)
 		}

package/internal/releasepromotion/buildkite_test.go

@@ -251,3 +251,34 @@ func writeJSON(t *testing.T, w http.ResponseWriter, value any) {
 		t.Fatal(err)
 	}
 }
+
+func TestDownloadArtifactsRejectsStaleOptionalInstallers(t *testing.T) {
+	server := newBuildkiteServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if !strings.HasSuffix(r.URL.Path, "/artifacts") {
+			t.Errorf("unexpected download into nonempty directory: %s", r.URL)
+			w.WriteHeader(500)
+			return
+		}
+		var artifacts []Artifact
+		for _, p := range ExpectedArtifactPaths() {
+			if strings.Contains(p, ".tar.gz") {
+				artifacts = append(artifacts, Artifact{Path: p, State: "finished", DownloadURL: "https://example.invalid/download"})
+			}
+		}
+		writeJSON(t, w, artifacts)
+	})
+	defer server.Close()
+	root := t.TempDir()
+	stale := filepath.Join(root, "vip-next-darwin-amd64.pkg")
+	if err := os.WriteFile(stale, []byte("previous build"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	err := testBuildkiteClient(server.URL).DownloadArtifacts(context.Background(), Build{Number: 28}, root)
+	if err == nil || !strings.Contains(err.Error(), "must be empty") {
+		t.Fatalf("accepted stale artifact: %v", err)
+	}
+	got, err := os.ReadFile(stale)
+	if err != nil || string(got) != "previous build" {
+		t.Fatalf("changed existing artifact: %q %v", got, err)
+	}
+}

package/internal/releasepromotion/contract.go

@@ -2,7 +2,9 @@ package releasepromotion
 
 import (
 	"fmt"
+	"os"
 	"path"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
@@ -18,6 +20,12 @@ const (
 var prereleaseVersionPattern = regexp.MustCompile(`^5\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-(alpha|beta|rc)\.(0|[1-9][0-9]*)$`)
 
 var expectedArtifactPaths = []string{
+	"dist/vip-next-darwin-amd64.pkg",
+	"dist/vip-next-darwin-amd64.pkg.sha256",
+	"dist/vip-next-darwin-arm64.pkg",
+	"dist/vip-next-darwin-arm64.pkg.sha256",
+	"dist/vip-next-windows-amd64.msi",
+	"dist/vip-next-windows-amd64.msi.sha256",
 	"dist/vip-next-darwin-amd64.tar.gz",
 	"dist/vip-next-darwin-amd64.tar.gz.sha256",
 	"dist/vip-next-darwin-arm64.tar.gz",
@@ -88,7 +96,16 @@ func ValidateArtifactManifest(artifacts []Artifact) (map[string]Artifact, error)
 	var missing []string
 	for _, artifactPath := range expectedArtifactPaths {
 		if _, ok := manifest[artifactPath]; !ok {
-			missing = append(missing, artifactPath)
+			// Portable binaries are mandatory. Installers are optional, but a
+			// package and its checksum must always be present together.
+			companion := strings.TrimSuffix(artifactPath, ".sha256")
+			if companion == artifactPath {
+				companion += ".sha256"
+			}
+			_, paired := manifest[companion]
+			if strings.Contains(artifactPath, ".tar.gz") || paired {
+				missing = append(missing, artifactPath)
+			}
 		}
 	}
 
@@ -115,3 +132,34 @@ func ValidateArtifactManifest(artifacts []Artifact) (map[string]Artifact, error)
 
 	return manifest, nil
 }
+
+// localArtifactPaths applies the same contract to downloads before upload. It
+// also rejects unknown files and non-regular entries instead of publishing them.
+func localArtifactPaths(root string) ([]string, error) {
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		return nil, err
+	}
+	var artifacts []Artifact
+	for _, entry := range entries {
+		info, err := entry.Info()
+		if err != nil {
+			return nil, err
+		}
+		if !info.Mode().IsRegular() {
+			return nil, fmt.Errorf("replacement asset %q is not a regular file", entry.Name())
+		}
+		artifacts = append(artifacts, Artifact{Path: "dist/" + entry.Name(), State: "finished"})
+	}
+	manifest, err := ValidateArtifactManifest(artifacts)
+	if err != nil {
+		return nil, err
+	}
+	paths := make([]string, 0, len(manifest))
+	for _, p := range expectedArtifactPaths {
+		if _, ok := manifest[p]; ok {
+			paths = append(paths, filepath.Base(p))
+		}
+	}
+	return paths, nil
+}

package/internal/releasepromotion/contract_test.go

@@ -16,6 +16,8 @@ func TestValidateRequest(t *testing.T) {
 		{"5.0.0-beta.1", "refs/heads/trunk", true},
 		{"5.12.3-alpha.10", "refs/heads/trunk", true},
 		{"5.1.0-rc.2", "refs/heads/trunk", true},
+		{"5.0.0-beta.200", "refs/heads/trunk", true},
+		{"5.0.65-alpha.1", "refs/heads/trunk", true},
 		{"5.0.0", "refs/heads/trunk", false},
 		{"v5.0.0-beta.1", "refs/heads/trunk", false},
 		{"4.9.0-beta.1", "refs/heads/trunk", false},
@@ -34,6 +36,42 @@ func TestValidateRequest(t *testing.T) {
 	}
 }
 
+func TestManifestAllowsMissingInstallerPairs(t *testing.T) {
+	var artifacts []Artifact
+	for _, p := range ExpectedArtifactPaths() {
+		if strings.Contains(p, ".tar.gz") {
+			artifacts = append(artifacts, Artifact{Path: p, State: "finished"})
+		}
+	}
+	if _, err := ValidateArtifactManifest(artifacts); err != nil {
+		t.Fatal(err)
+	}
+	artifacts = append(artifacts, Artifact{Path: "dist/vip-next-windows-amd64.msi", State: "finished"}, Artifact{Path: "dist/vip-next-windows-amd64.msi.sha256", State: "finished"})
+	if _, err := ValidateArtifactManifest(artifacts); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestManifestRejectsPartialInstallerPairs(t *testing.T) {
+	for _, missing := range []string{
+		"dist/vip-next-darwin-amd64.pkg", "dist/vip-next-darwin-amd64.pkg.sha256",
+		"dist/vip-next-darwin-arm64.pkg", "dist/vip-next-darwin-arm64.pkg.sha256",
+		"dist/vip-next-windows-amd64.msi", "dist/vip-next-windows-amd64.msi.sha256",
+	} {
+		t.Run(missing, func(t *testing.T) {
+			var artifacts []Artifact
+			for _, p := range ExpectedArtifactPaths() {
+				if p != missing {
+					artifacts = append(artifacts, Artifact{Path: p, State: "finished"})
+				}
+			}
+			if _, err := ValidateArtifactManifest(artifacts); err == nil || !strings.Contains(err.Error(), missing) {
+				t.Fatalf("missing installer artifact accepted: %v", err)
+			}
+		})
+	}
+}
+
 func TestValidateArtifactManifest(t *testing.T) {
 	t.Parallel()
 	expected := ExpectedArtifactPaths()

package/internal/releasepromotion/github.go

@@ -172,14 +172,9 @@ func (c *GitHubClient) ReplaceAssets(ctx context.Context, release Release, root
 			return fmt.Errorf("unexpected existing asset %q on draft release", asset.Name)
 		}
 	}
-	for name := range expectedNames {
-		info, err := os.Stat(filepath.Join(root, name))
-		if err != nil {
-			return fmt.Errorf("read replacement asset %q: %w", name, err)
-		}
-		if !info.Mode().IsRegular() {
-			return fmt.Errorf("replacement asset %q is not a regular file", name)
-		}
+	paths, err := localArtifactPaths(root)
+	if err != nil {
+		return fmt.Errorf("read replacement assets: %w", err)
 	}
 
 	for _, asset := range release.Assets {
@@ -193,8 +188,7 @@ func (c *GitHubClient) ReplaceAssets(ctx context.Context, release Release, root
 	if uploadBase == "" {
 		uploadBase = fmt.Sprintf("%s/repos/%s/releases/%d/assets", c.uploadsURL(), GitHubRepository, release.ID)
 	}
-	for _, artifactPath := range expectedArtifactPaths {
-		name := filepath.Base(artifactPath)
+	for _, name := range paths {
 		if err := c.uploadAsset(ctx, uploadBase, name, filepath.Join(root, name)); err != nil {
 			return err
 		}

package/internal/releasepromotion/optional_installers_test.go

@@ -0,0 +1,87 @@
+package releasepromotion
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+)
+
+func TestDownloadVerifyAndReplaceWithOptionalInstallers(t *testing.T) {
+	for _, windowsInstaller := range []bool{false, true} {
+		name := "binaries-only"
+		if windowsInstaller {
+			name = "binaries-and-windows-installer"
+		}
+		t.Run(name, func(t *testing.T) {
+			fixtures := t.TempDir()
+			writeCompleteArtifactSet(t, fixtures)
+			var expected, uploaded []string
+			var artifacts []Artifact
+			var serverURL string
+			deleted := false
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				switch {
+				case strings.HasSuffix(r.URL.Path, "/artifacts"):
+					writeJSON(t, w, artifacts)
+				case strings.HasPrefix(r.URL.Path, "/download/"):
+					data, err := os.ReadFile(filepath.Join(fixtures, filepath.Base(r.URL.Path)))
+					if err != nil {
+						t.Error(err)
+						w.WriteHeader(404)
+						return
+					}
+					_, _ = w.Write(data)
+				case r.Method == http.MethodDelete:
+					deleted = true
+					w.WriteHeader(http.StatusNoContent)
+				case r.Method == http.MethodPost && r.URL.Path == "/uploads":
+					name := r.URL.Query().Get("name")
+					data, _ := io.ReadAll(r.Body)
+					original, err := os.ReadFile(filepath.Join(fixtures, name))
+					if err != nil || string(data) != string(original) {
+						t.Errorf("uploaded wrong bytes for %s: %v", name, err)
+					}
+					uploaded = append(uploaded, name)
+					w.WriteHeader(http.StatusCreated)
+				default:
+					t.Errorf("unexpected request %s %s", r.Method, r.URL)
+					w.WriteHeader(500)
+				}
+			}))
+			defer server.Close()
+			serverURL = server.URL
+			for _, p := range ExpectedArtifactPaths() {
+				if !strings.Contains(p, ".tar.gz") && !(windowsInstaller && strings.Contains(p, ".msi")) {
+					continue
+				}
+				expected = append(expected, filepath.Base(p))
+				artifacts = append(artifacts, Artifact{Path: p, State: "finished", DownloadURL: serverURL + "/download/" + filepath.Base(p)})
+			}
+			downloads := t.TempDir()
+			if err := testBuildkiteClient(server.URL).DownloadArtifacts(context.Background(), Build{Number: 28}, downloads); err != nil {
+				t.Fatal(err)
+			}
+			if err := VerifyDownloads(downloads); err != nil {
+				t.Fatal(err)
+			}
+			// A retry also removes an old optional installer from the draft when the
+			// current exact build did not produce it.
+			release := Release{ID: 1, Draft: true, UploadURL: server.URL + "/uploads{?name,label}", Assets: []ReleaseAsset{{ID: 9, Name: "vip-next-darwin-amd64.pkg"}}}
+			if err := testGitHubClient(server.URL).ReplaceAssets(context.Background(), release, downloads); err != nil {
+				t.Fatal(err)
+			}
+			sort.Strings(expected)
+			sort.Strings(uploaded)
+			if !deleted || !reflect.DeepEqual(expected, uploaded) {
+				t.Fatalf("deleted=%t uploaded=%v want=%v", deleted, uploaded, expected)
+			}
+		})
+	}
+}

package/internal/releasepromotion/verify.go

@@ -3,6 +3,7 @@ package releasepromotion
 import (
 	"archive/tar"
 	"bufio"
+	"bytes"
 	"compress/gzip"
 	"crypto/sha256"
 	"crypto/subtle"
@@ -20,8 +21,12 @@ var unixEntries = map[string]struct{}{"vip-next": {}, "go-search-replace": {}}
 var windowsEntries = map[string]struct{}{"vip-next.exe": {}, "go-search-replace.exe": {}}
 
 func VerifyDownloads(root string) error {
-	for _, artifactPath := range expectedArtifactPaths {
-		if !strings.HasSuffix(artifactPath, ".tar.gz") {
+	paths, err := localArtifactPaths(root)
+	if err != nil {
+		return err
+	}
+	for _, artifactPath := range paths {
+		if strings.HasSuffix(artifactPath, ".sha256") {
 			continue
 		}
 		archivePath := filepath.Join(root, filepath.Base(artifactPath))
@@ -29,6 +34,12 @@ func VerifyDownloads(root string) error {
 		if err := verifyChecksum(archivePath, checksumPath); err != nil {
 			return fmt.Errorf("verify %s: %w", filepath.Base(archivePath), err)
 		}
+		if !strings.HasSuffix(artifactPath, ".tar.gz") {
+			if err := verifyInstallerContainer(archivePath); err != nil {
+				return fmt.Errorf("verify %s: %w", filepath.Base(archivePath), err)
+			}
+			continue
+		}
 		expected := unixEntries
 		if strings.Contains(filepath.Base(archivePath), "-windows-") {
 			expected = windowsEntries
@@ -40,6 +51,33 @@ func VerifyDownloads(root string) error {
 	return nil
 }
 
+// Platform builders verify the actual payload and platform signature before
+// upload. This portable gate checks the container type as well as its checksum;
+// it is deliberately not a replacement for native PKG/MSI validation.
+func verifyInstallerContainer(name string) error {
+	f, err := os.Open(name)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	magic, minSize := []byte("xar!"), int64(28)
+	if strings.HasSuffix(name, ".msi") {
+		magic, minSize = []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, 512
+	}
+	info, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	header := make([]byte, len(magic))
+	if _, err := io.ReadFull(f, header); err != nil {
+		return fmt.Errorf("truncated installer: %w", err)
+	}
+	if info.Size() < minSize || !bytes.Equal(header, magic) {
+		return fmt.Errorf("invalid installer container")
+	}
+	return nil
+}
+
 func verifyChecksum(archivePath, checksumPath string) error {
 	checksumFile, err := os.Open(checksumPath)
 	if err != nil {
@@ -140,3 +178,62 @@ func verifyArchive(archivePath string, expected map[string]struct{}) error {
 	}
 	return nil
 }
+
+// ExtractBinaryArchive verifies the checksum and strict two-file archive
+// contract before writing signed payload bytes for a downstream installer job.
+// The destination must be new; no existing installation can be overwritten.
+func ExtractBinaryArchive(platform, archivePath, destination string) error {
+	expected := unixEntries
+	switch platform {
+	case "darwin":
+	case "windows":
+		expected = windowsEntries
+	default:
+		return fmt.Errorf("unsupported installer platform %q", platform)
+	}
+	if err := verifyChecksum(archivePath, archivePath+".sha256"); err != nil {
+		return err
+	}
+	if err := verifyArchive(archivePath, expected); err != nil {
+		return err
+	}
+	if err := os.Mkdir(destination, 0700); err != nil {
+		return err
+	}
+	file, err := os.Open(archivePath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	gz, err := gzip.NewReader(file)
+	if err != nil {
+		return err
+	}
+	defer gz.Close()
+	reader := tar.NewReader(gz)
+	for {
+		header, err := reader.Next()
+		if err == io.EOF {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		// Recheck names/types on the extraction pass as well.
+		if _, ok := expected[header.Name]; !ok || (header.Typeflag != tar.TypeReg && header.Typeflag != tar.TypeRegA) {
+			return fmt.Errorf("invalid payload entry %q", header.Name)
+		}
+		out, err := os.OpenFile(filepath.Join(destination, header.Name), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0755)
+		if err != nil {
+			return err
+		}
+		_, copyErr := io.Copy(out, reader)
+		closeErr := out.Close()
+		if copyErr != nil {
+			return copyErr
+		}
+		if closeErr != nil {
+			return closeErr
+		}
+	}
+}

package/internal/releasepromotion/verify_test.go

@@ -34,6 +34,47 @@ func TestVerifyDownloads(t *testing.T) {
 	}
 }
 
+func TestVerifyDownloadsWithoutInstallers(t *testing.T) {
+	root := t.TempDir()
+	writeCompleteArtifactSet(t, root)
+	for _, p := range ExpectedArtifactPaths() {
+		if !strings.Contains(p, ".tar.gz") {
+			if err := os.Remove(filepath.Join(root, filepath.Base(p))); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	if err := VerifyDownloads(root); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestVerifyInstallerDownloads(t *testing.T) {
+	for _, name := range []string{"vip-next-darwin-amd64.pkg", "vip-next-darwin-arm64.pkg", "vip-next-windows-amd64.msi"} {
+		for _, mutation := range []string{"checksum", "format", "truncated"} {
+			t.Run(name+"/"+mutation, func(t *testing.T) {
+				root := t.TempDir()
+				writeCompleteArtifactSet(t, root)
+				file := filepath.Join(root, name)
+				if err := os.WriteFile(file, []byte("invalid installer"), 0600); err != nil {
+					t.Fatal(err)
+				}
+				if mutation == "truncated" {
+					if err := os.WriteFile(file, []byte("xar!"), 0600); err != nil {
+						t.Fatal(err)
+					}
+				}
+				if mutation != "checksum" {
+					writeChecksum(t, root, name, false, false)
+				}
+				if err := VerifyDownloads(root); err == nil || !strings.Contains(err.Error(), name) {
+					t.Fatalf("invalid installer accepted: %v", err)
+				}
+			})
+		}
+	}
+}
+
 func TestVerifyDownloadsRejectsInvalidArtifacts(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
@@ -103,6 +144,20 @@ func writeCompleteArtifactSet(t *testing.T, root string) {
 			continue
 		}
 		archiveName := filepath.Base(artifactPath)
+		if strings.HasSuffix(archiveName, ".pkg") || strings.HasSuffix(archiveName, ".msi") {
+			// Container checks only; platform-native tests validate real payloads.
+			data := make([]byte, 512)
+			if strings.HasSuffix(archiveName, ".pkg") {
+				copy(data, "xar!")
+			} else {
+				copy(data, []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1})
+			}
+			if err := os.WriteFile(filepath.Join(root, archiveName), data, 0600); err != nil {
+				t.Fatal(err)
+			}
+			writeChecksum(t, root, archiveName, false, false)
+			continue
+		}
 		entries := []archiveEntry{{name: "vip-next", typeflag: tar.TypeReg}, {name: "go-search-replace", typeflag: tar.TypeReg}}
 		if strings.Contains(archiveName, "windows") {
 			entries = []archiveEntry{{name: "vip-next.exe", typeflag: tar.TypeReg}, {name: "go-search-replace.exe", typeflag: tar.TypeReg}}
@@ -195,3 +250,47 @@ func writeChecksum(t *testing.T, root, archiveName string, includeDist, uppercas
 		t.Fatal(err)
 	}
 }
+
+func TestExtractBinaryArchive(t *testing.T) {
+	for _, platform := range []string{"darwin", "windows"} {
+		t.Run(platform, func(t *testing.T) {
+			root := t.TempDir()
+			writeCompleteArtifactSet(t, root)
+			archive := filepath.Join(root, "vip-next-"+platform+"-amd64.tar.gz")
+			destination := filepath.Join(root, "payload")
+			if err := ExtractBinaryArchive(platform, archive, destination); err != nil {
+				t.Fatal(err)
+			}
+			expected := unixEntries
+			if platform == "windows" {
+				expected = windowsEntries
+			}
+			for name := range expected {
+				got, err := os.ReadFile(filepath.Join(destination, name))
+				if err != nil || string(got) != "x" {
+					t.Fatalf("payload %s = %q, %v", name, got, err)
+				}
+			}
+			if err := ExtractBinaryArchive(platform, archive, destination); err == nil {
+				t.Fatal("overwrote existing destination")
+			}
+		})
+	}
+}
+
+func TestExtractBinaryArchiveRejectsInvalidPayloadBeforeWriting(t *testing.T) {
+	for _, mutation := range []fixtureMutation{corruptChecksum, addReadmeEntry, addNestedVIPNext, replaceVIPNextWithSymlink} {
+		t.Run(fmt.Sprint(mutation), func(t *testing.T) {
+			root := t.TempDir()
+			writeCompleteArtifactSet(t, root)
+			applyFixtureMutation(t, root, mutation)
+			destination := filepath.Join(root, "payload")
+			if err := ExtractBinaryArchive("darwin", filepath.Join(root, "vip-next-darwin-amd64.tar.gz"), destination); err == nil {
+				t.Fatal("invalid archive accepted")
+			}
+			if _, err := os.Stat(destination); !os.IsNotExist(err) {
+				t.Fatalf("destination created before validation: %v", err)
+			}
+		})
+	}
+}

package/internal/searchreplace/debug_test.go

@@ -0,0 +1,71 @@
+package searchreplace
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestRunContextReportsRoutesWithoutSensitiveValues(t *testing.T) {
+	for _, mode := range []string{"in-place", "temporary-file", "file"} {
+		t.Run(mode, func(t *testing.T) {
+			t.Setenv("VIP_SEARCH_REPLACE_BIN", fakeBinary(t))
+			input := write(t, "private-input.sql", "-- metadata.header 1\n-- private_table 123\n")
+			opts := Options{InPlace: mode == "in-place"}
+			if mode == "file" {
+				opts.Output = filepath.Join(t.TempDir(), "private-output.sql")
+			}
+			var diagnostics bytes.Buffer
+			ctx := debuglog.WithLogger(context.Background(), "@automattic/vip:lib:search-and-replace", &diagnostics)
+			result, err := RunContext(ctx, input, []string{"private-search,private-replacement"}, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if mode == "temporary-file" {
+				t.Cleanup(func() { _ = os.RemoveAll(filepath.Dir(result.OutputFileName)) })
+			}
+			got, err := os.ReadFile(result.OutputFileName)
+			if err != nil || !strings.Contains(string(got), "-- PRIVATE_TABLE -1") {
+				t.Fatalf("mydumper output=%q err=%v", got, err)
+			}
+			log := diagnostics.String()
+			for _, want := range []string{"input=file", "output=" + mode, "stage=started", "mydumper=true", "stage=completed"} {
+				if !strings.Contains(log, want) {
+					t.Errorf("missing %q in %q", want, log)
+				}
+			}
+			for _, secret := range []string{input, result.OutputFileName, "private-", "PRIVATE_TABLE", "metadata.header"} {
+				if strings.Contains(log, secret) {
+					t.Errorf("diagnostics expose %q: %q", secret, log)
+				}
+			}
+		})
+	}
+}
+
+func TestRunContextDoesNotReportCompletionWhenCompanionFails(t *testing.T) {
+	t.Setenv("VIP_SEARCH_REPLACE_BIN", failingBinary(t))
+	input := write(t, "private-input.sql", "private_sql\n")
+	var diagnostics bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "*", &diagnostics)
+	_, err := RunContext(ctx, input, []string{"private-search,private-replacement"}, Options{InPlace: true})
+	if err == nil {
+		t.Fatal("expected companion failure")
+	}
+	log := diagnostics.String()
+	if !strings.Contains(log, "stage=started") || strings.Contains(log, "stage=completed") {
+		t.Fatalf("inaccurate stage diagnostics: %q", log)
+	}
+	if strings.Contains(log, "private") {
+		t.Fatalf("sensitive diagnostic: %q", log)
+	}
+	got, err := os.ReadFile(input)
+	if err != nil || string(got) != "private_sql\n" {
+		t.Fatalf("input changed: %q err=%v", got, err)
+	}
+}