fix(security): restore EL7 support and make the credential tests able to fail

RHEL/CentOS 7 ships curl 7.29.0, which does not know oauth2-bearer. It does
not reject the unknown configuration key either: it ignores it, exits 0, and
sends the request with no credential at all. The previous commit therefore
broke EL7 silently rather than loudly.

Each script now detects the capability positively and falls back to a raw
Authorization header when it is missing. The credential still travels on
curl's configuration input in both modes, so it never reaches the command
line. The gate moves from 7.55 to 7.33, the version that added oauth2-bearer,
which also stops blocking curl 7.33 through 7.54 for no reason, and it is
restored in the uninstall and migrate scripts where it had been dropped.
Warning text now names what is actually unverified on very old curl, which is
redirect handling, and names the control that bounds it.

Two latent defects turned up while doing this. The command -v curl guard sat
inside a command substitution, where die only exits the subshell and leaves
the variable empty; in falcon-linux-uninstall.sh that guard also called die
39 lines before die was defined, so a host without curl got "die: command not
found" instead of the message. Both are fixed.

The credential handling suite could not fail. It called rg, which is not
installed on ubuntu-latest, so "if rg ...; then fail; fi" read exit 127 as no
match and three checks quietly did nothing. Replaced with grep behind a
helper that inspects the exit status, so a missing or broken tool fails
instead of passing. The mode loop now exercises both credential mechanisms
rather than looping over a variable nothing read.

The container matrix passed its setup command through a variable that the
container shell expanded after parsing, turning && and > into literal
arguments, which is why all five legs errored. A dependency script that
detects the package manager replaces it, and Oracle Linux 7 and CentOS 7 legs
are added, since the oldest curl exercised before this was 7.81.

Also: aws_ssm_parameter no longer prints the decrypted response body on
failure, since that body can carry the client secret; the live curl test runs
on python2 and cannot hang; and the PowerShell test reports every collected
failure instead of throwing on the first one.

Author: carlosmmatos-cs

.github/scripts/install-test-deps.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+
+# Installs the packages that .github/scripts/test-curl-oauth-live.sh needs:
+# curl and a python interpreter. Only missing packages are installed, so the
+# script does nothing on images that already have both. RHEL/CentOS 7 images
+# supply curl and python2 already, so no package manager runs there.
+
+set -eu
+
+have() {
+    command -v "$1" >/dev/null 2>&1
+}
+
+have_python() {
+    have python3 || have python2 || have python
+}
+
+if have curl && have_python; then
+    echo 'curl and python are already present; no packages to install.'
+    exit 0
+fi
+
+if have apk; then
+    packages=""
+    have curl || packages="$packages curl"
+    have_python || packages="$packages python3"
+    # shellcheck disable=SC2086  # deliberate word splitting into package names
+    apk add --no-cache $packages
+elif have dnf; then
+    packages=""
+    have curl || packages="$packages curl"
+    have_python || packages="$packages python3"
+    # shellcheck disable=SC2086  # deliberate word splitting into package names
+    dnf install -y -q $packages
+elif have yum; then
+    packages=""
+    have curl || packages="$packages curl"
+    have_python || packages="$packages python"
+    # shellcheck disable=SC2086  # deliberate word splitting into package names
+    yum install -y -q $packages
+elif have apt-get; then
+    packages=""
+    have curl || packages="$packages curl"
+    have_python || packages="$packages python3"
+    apt-get update -qq
+    # shellcheck disable=SC2086  # deliberate word splitting into package names
+    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq $packages
+else
+    echo 'ERROR: no supported package manager found (apk, dnf, yum, apt-get).' >&2
+    exit 1
+fi
+
+echo 'Test dependencies are installed.'

.github/scripts/test-credential-handling.sh

@@ -11,26 +11,56 @@ fail() {
     exit 1
 }
 
+# Report an absent or broken search tool as a failure instead of a pass. grep
+# returns 0 for a match, 1 for no match, and 2 or more for an error. Only 1 is
+# an acceptable result here.
+assert_no_match() {
+    local description=$1 pattern=$2 tree=$3 include=$4
+    local output status
+
+    set +e
+    output=$(grep -rnE "$pattern" "$repo_root/$tree" --include="$include")
+    status=$?
+    set -e
+
+    if [ "$status" -eq 0 ]; then
+        echo "$output" >&2
+        fail "$description"
+    fi
+    if [ "$status" -ne 1 ]; then
+        fail "grep failed with status $status while checking: $description"
+    fi
+}
+
 curl() {
     printf '%s\n' "$@" >"$CURL_ARGS_FILE"
     cat >"$CURL_STDIN_FILE"
 }
 
-export CURL_ARGS_FILE CURL_STDIN_FILE
-
 test_curl_helper() {
     local script=$1 token_mode=$2
-    local helper
+    local helper mode expected_key
 
     helper=$(awk '/^curl_command\(\)/,/^}/' "$repo_root/$script")
     [ -n "$helper" ] || fail "curl_command not found in $script"
     eval "$helper"
 
-    for old_curl in 0 1; do
+    # Mode 1 uses the oauth2-bearer configuration key. Mode 0 is the fallback
+    # for curl older than 7.33.0 and uses a raw Authorization header. Both must
+    # keep the credential on stdin.
+    for mode in 1 0; do
+        # shellcheck disable=SC2034  # read by the curl_command body under eval
+        curl_has_oauth2_bearer=$mode
+        if [ "$mode" -eq 1 ]; then
+            expected_key='oauth2-bearer = "REGRESSION_SECRET_TOKEN"'
+        else
+            expected_key='header = "Authorization: Bearer REGRESSION_SECRET_TOKEN"'
+        fi
+
         CURL_ARGS_FILE="$work_dir/args"
         CURL_STDIN_FILE="$work_dir/stdin"
+        # shellcheck disable=SC2034  # read by the curl_command body under eval
         proxy=""
-        export proxy
         cs_falcon_oauth_token="REGRESSION_SECRET_TOKEN"
 
         if [ "$token_mode" = "argument" ]; then
@@ -40,16 +70,18 @@ test_curl_helper() {
         fi
 
         if grep -qF "$cs_falcon_oauth_token" "$CURL_ARGS_FILE"; then
-            fail "$script exposed the bearer token in curl arguments (old_curl=$old_curl)"
+            fail "$script exposed the bearer token in curl arguments (mode=$mode)"
         fi
         grep -qF 'https://api.example.invalid/resource' "$CURL_ARGS_FILE" ||
-            fail "$script did not pass the expected URL (old_curl=$old_curl)"
+            fail "$script did not pass the expected URL (mode=$mode)"
         grep -qF "$cs_falcon_oauth_token" "$CURL_STDIN_FILE" ||
-            fail "$script did not provide the bearer token through stdin (old_curl=$old_curl)"
+            fail "$script did not provide the bearer token through stdin (mode=$mode)"
+        grep -qF "$expected_key" "$CURL_STDIN_FILE" ||
+            fail "$script did not use the expected credential mechanism (mode=$mode)"
         grep -qF -- '--proto' "$CURL_ARGS_FILE" ||
-            fail "$script did not restrict the request protocol (old_curl=$old_curl)"
+            fail "$script did not restrict the request protocol (mode=$mode)"
         grep -qF -- '--proto-redir' "$CURL_ARGS_FILE" ||
-            fail "$script did not restrict the redirect protocol (old_curl=$old_curl)"
+            fail "$script did not restrict the redirect protocol (mode=$mode)"
     done
 }
 
@@ -85,37 +117,51 @@ test_hash_verification() {
 
     helper=$(awk '/^verify_sha256\(\)/,/^}/' "$repo_root/$script")
     [ -n "$helper" ] || fail "verify_sha256 not found in $script"
-    eval "$helper"
-    die() { exit 1; }
-
-    test_file="$work_dir/installer"
-    printf '%s' 'verified installer content' >"$test_file"
-    expected_sha=$(openssl dgst -sha256 "$test_file" | awk '{ print $NF }')
-    verify_sha256 "$test_file" "$expected_sha" ||
-        fail "$script rejected a valid installer hash"
-
-    if (verify_sha256 "$test_file" '0000000000000000000000000000000000000000000000000000000000000000'); then
-        fail "$script accepted an invalid installer hash"
-    fi
-    [ ! -e "$test_file" ] || fail "$script retained an installer with an invalid hash"
+    (
+        eval "$helper"
+        # verify_sha256 calls die on a mismatch; keep the stub inside the subshell.
+        # shellcheck disable=SC2329  # invoked indirectly by verify_sha256
+        die() { exit 1; }
+
+        test_file="$work_dir/installer"
+        printf '%s' 'verified installer content' >"$test_file"
+        expected_sha=$(openssl dgst -sha256 "$test_file" | awk '{ print $NF }')
+        verify_sha256 "$test_file" "$expected_sha" ||
+            fail "$script rejected a valid installer hash"
+
+        if (verify_sha256 "$test_file" '0000000000000000000000000000000000000000000000000000000000000000'); then
+            fail "$script accepted an invalid installer hash"
+        fi
+        [ ! -e "$test_file" ] || fail "$script retained an installer with an invalid hash"
+    )
 }
 
 test_hash_verification bash/install/falcon-linux-install.sh
 test_hash_verification bash/migrate/falcon-linux-migrate.sh
 
-if rg -n 'Invalid Access Token:.*\$cs_falcon_oauth_token|Failed to retrieve maintenance token\. Response:' \
-    "$repo_root/bash" --glob '*.sh'; then
-    fail 'a Bash error path exposes a credential or raw maintenance-token response'
-fi
-
-if rg -n 'curl .*X-aws-ec2-metadata-token:.*\$token' \
-    "$repo_root/bash" --glob '*.sh'; then
-    fail 'an EC2 metadata token is exposed in curl arguments'
-fi
-
-if rg -n '(Invoke-FalconAuth|GetToken) - \$content:|Retrieved maintenance token:|Starting .*parameters.*\$(Install|Uninstall)Params' \
-    "$repo_root/powershell" --glob '*.ps1'; then
-    fail 'a PowerShell log statement exposes an authentication or installer token'
-fi
+# The arguments below are grep patterns, not shell expansions.
+# shellcheck disable=SC2016
+assert_no_match \
+    'a Bash error path exposes a credential or raw maintenance-token response' \
+    'Invalid Access Token:.*\$cs_falcon_oauth_token|Failed to retrieve maintenance token\. Response:' \
+    bash '*.sh'
+
+# shellcheck disable=SC2016
+assert_no_match \
+    'an EC2 metadata token is exposed in curl arguments' \
+    'curl .*X-aws-ec2-metadata-token:.*\$token' \
+    bash '*.sh'
+
+# shellcheck disable=SC2016
+assert_no_match \
+    'an AWS SSM Parameter Store error path prints the decrypted response body' \
+    'AWS SSM Parameter Store[^"]*\$response' \
+    bash '*.sh'
+
+# shellcheck disable=SC2016
+assert_no_match \
+    'a PowerShell log statement exposes an authentication or installer token' \
+    '(Invoke-FalconAuth|GetToken) - \$content:|Retrieved maintenance token:|Starting .*parameters.*\$(Install|Uninstall)Params' \
+    powershell '*.ps1'
 
 echo 'PASS: credential handling regression checks'