version: "11.0"
description: "Script tree, path, and manifest requirements."
directives:
  - id: E-1110.5
    dos:
      - Find scripts in the scripts folder beside the config file.
      - Scan script folders recursively.
      - Include regular files and ignore symbolic links.
      - Use forward slashes in script names.
      - Accept letters, digits, period, underscore, slash, at sign, and hyphen in script paths.
      - Allow the at sign in safe systemd template paths.
      - Reject absolute paths, empty segments, dot segments, and parent segments.
      - Read the local bundle manifest from config.boot.manifest.tsv beside the config.
      - Accept the header type and path, with an optional preexisting column.
      - Require each record to name one file and one safe path.
      - Require each manifest path to match a file in the local script tree.
      - Reject duplicate paths and malformed records.
      - Read a missing local bundle manifest as an empty manifest.
      - Keep router deployment state in config.boot.deployment.tsv.
      - Do not read router deployment state as a local bundle manifest.
    donts:
      - Do not include symbolic links in the script tree.
      - Do not reject a safe script path because it contains an at sign.
      - Do not accept paths that can go outside the script root.
  - id: E-1110.6
    dos:
      - Reject carriage-return bytes in text scripts.
      - Allow carriage-return bytes in .exe files.
      - Use .exe files as binary files.
      - Require a shebang for executable text scripts.
      - Mark files executable by mode, shebang, .sh, .script, or post-commit script path.
      - Mark files under commit/post-hooks.d as executable.
      - Mark vyos-preconfig-bootup.script and vyos-postconfig-bootup.script as executable.
      - Allow /bin/sh, /bin/bash, /bin/vbash, and /usr/bin/env as script interpreters.
      - Preserve each script path in the manifest.
    donts:
      - Do not require a shebang for a non-executable text file without an executable name.
      - Do not follow a symbolic link outside the bundle.
  - id: E-1110.7
    dos:
      - Use an .exe file as a binary script during release.
      - Check binary type and CPU type on the router.
      - Accept ELF binaries for x86-64, AArch64, and ARMv7 CPUs.
      - Compare the remote binary hash with the local hash when --verify-binaries is set.
    donts:
      - Do not accept a binary with a different file type or CPU type.