[Bugfix] Support EulerOS in dependencies installer#2460
[Bugfix] Support EulerOS in dependencies installer#2460stmatengss merged 2 commits intokvcache-ai:mainkvcache-ai/Mooncake:mainfrom he-yufeng:fix/euleros-dependencieshe-yufeng/Mooncake:fix/euleros-dependenciesCopy head branch name to clipboard
Conversation
There was a problem hiding this comment.
Code Review
This pull request adds support for EulerOS in the dependencies installation script and introduces an overridable environment variable, OS_RELEASE_FILE, for the OS release file path. However, sourcing this overridable file directly introduces a critical security vulnerability that could allow privilege escalation or code injection. It is recommended to safely parse the required variables using grep and cut instead of sourcing the file.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| if [ -f "$OS_RELEASE_FILE" ]; then | ||
| . "$OS_RELEASE_FILE" |
There was a problem hiding this comment.
Sourcing an overridable environment variable (OS_RELEASE_FILE) using the . command introduces a critical security vulnerability (Privilege Escalation / Code Injection). If this script is run with sudo privileges (e.g., in environments where users have restricted sudo access to run specific scripts), an attacker can escalate privileges to root by setting OS_RELEASE_FILE to a malicious file they control.
Instead of sourcing the file, parse the required variables (ID and VERSION_ID) safely using grep and cut to avoid executing arbitrary code.
| if [ -f "$OS_RELEASE_FILE" ]; then | |
| . "$OS_RELEASE_FILE" | |
| if [ -f "$OS_RELEASE_FILE" ]; then | |
| OS=$(grep -E '^ID=' "$OS_RELEASE_FILE" | cut -d= -f2- | tr -d '"' | tr -d "'") | |
| OS=$(echo "$OS" | tr '[:upper:]' '[:lower:]') | |
| OS_VERSION=$(grep -E '^VERSION_ID=' "$OS_RELEASE_FILE" | cut -d= -f2- | tr -d '"' | tr -d "'") |
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
Hi. Can you explain the difference between OpenEuler and EulerOS? |
|
Good question. They are related but not the same distribution identity.
I also pushed Validation: |
|
Small correction: the pushed follow-up commit is \25b6f699\ ( ix: parse os-release without sourcing it). The rest of the explanation and validation above applies to that commit. |
Thanks for clarifying. Others LGTM |
Summary
dependencies.shreads/etc/os-releaseand lowercasesID, but the RHEL-like branch only acceptscentos,rhel,rocky,almalinux, andopeneuler. On EulerOS hosts where/etc/os-releasereportsID=euleros, the installer reaches the unsupported-OS path even though the package flow is the same yum-based family.This adds
eulerosto the RHEL-like branches and keeps the unsupported-OS message aligned with the accepted list. I also made the os-release path overridable so the detection logic can be smoke-tested without changing the host/etc/os-release.Fixes #2385.
Validation
To verify:
"C:\Program Files\Git\bin\bash.exe" -lc 'cd /c/dev/GITHUB-clean/Mooncake-2385; bash -n dependencies.sh; tmp=$(mktemp); printf "ID=euleros\nVERSION_ID=2.0\n" > "$tmp"; test_script=$(mktemp); { echo "GREEN=; RED=; NC="; echo "print_error(){ echo ERROR: \"\$1\"; exit 1; }"; echo "OS_RELEASE_FILE=\"$tmp\""; awk "/^detect_os\(\)/,/^}/" dependencies.sh; echo "detect_os >/dev/null"; echo "test \"\$OS\" = euleros"; echo "test \"\$OS_VERSION\" = 2.0"; } > "$test_script"; bash "$test_script"; rm -f "$tmp" "$test_script"; echo ok'git diff --check