Skip to content

Use explicit TLS for Hostinger FTPS #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alanw707 merged 1 commit into from
Oct 12, 2026
Merged

Use explicit TLS for Hostinger FTPS #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/pr-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@ jobs:
- name: Check deployment scripts and asset syntax
run: |
bash -n scripts/deploy-file.sh
bash -n scripts/deploy-theme.sh
node --check deploy/production/3w-newsletter-popup/assets/newsletter-popup.js
bash tests/scripts/deploy-file.test.sh

Expand Down
9 changes: 6 additions & 3 deletions scripts/deploy-file.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,8 +148,9 @@ if [[ "$TARGET" == "production" ]]; then
fi

case "$DEPLOY_SCHEME" in
ftp|ftps) DEFAULT_PORT=21 ;;
sftp) DEFAULT_PORT=22 ;;
ftp) DEFAULT_PORT=21; LFTP_SCHEME=ftp ;;
ftps) DEFAULT_PORT=21; LFTP_SCHEME=ftp ;;
sftp) DEFAULT_PORT=22; LFTP_SCHEME=sftp ;;
*)
echo "Unsupported THREEW_DEPLOY_SCHEME '$DEPLOY_SCHEME'. Use ftp, ftps, or sftp." >&2
exit 1
Expand All @@ -170,7 +171,9 @@ if [[ -z "$FTP_PASS" && ! ( "$DEPLOY_SCHEME" == "sftp" && -n "$SSH_KEY_PATH" ) ]
echo
fi

LFTP_URI="${DEPLOY_SCHEME}://${FTP_HOST}:${FTP_PORT}"
# lftp's ftps:// URI means implicit TLS. Hostinger uses explicit TLS (AUTH TLS)
# on port 21, represented by an ftp:// URI plus ftp:ssl-force below.
LFTP_URI="${LFTP_SCHEME}://${FTP_HOST}:${FTP_PORT}"
FTP_SETUP_CMDS="set cmd:fail-exit yes
set ssl:verify-certificate $SSL_VERIFY
set xfer:clobber yes"
Expand Down
7 changes: 6 additions & 1 deletion scripts/deploy-theme.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,12 +116,15 @@ REMOTE_THEME_DIR=${CUSTOM_REMOTE_DIR:-$REMOTE_THEME_DIR}
case "$DEPLOY_SCHEME" in
ftp)
DEFAULT_PORT=21
LFTP_SCHEME=ftp
;;
ftps)
DEFAULT_PORT=21
LFTP_SCHEME=ftp
;;
sftp)
DEFAULT_PORT=22
LFTP_SCHEME=sftp
;;
*)
echo "Unsupported THREEW_DEPLOY_SCHEME '$DEPLOY_SCHEME'. Use ftp, ftps, or sftp." >&2
Expand All @@ -134,7 +137,9 @@ if [[ "$TARGET" == "production" ]]; then
FTP_PORT=${THREEW_PROD_FTP_PORT:-$FTP_PORT}
fi

LFTP_URI="${DEPLOY_SCHEME}://${FTP_HOST}:${FTP_PORT}"
# lftp's ftps:// URI means implicit TLS. Hostinger uses explicit TLS (AUTH TLS)
# on port 21, represented by an ftp:// URI plus ftp:ssl-force below.
LFTP_URI="${LFTP_SCHEME}://${FTP_HOST}:${FTP_PORT}"

FTP_SETUP_CMDS="set ssl:verify-certificate $SSL_VERIFY"

Expand Down
34 changes: 34 additions & 0 deletions tests/scripts/deploy-file.test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,14 @@ mkdir -p "$TMP/bin"
cat > "$TMP/bin/lftp" <<'FAKE_LFTP'
#!/usr/bin/env bash
set -euo pipefail
if [[ -n "${FAKE_LFTP_ARGS_LOG:-}" ]]; then
printf '%s\n' "$*" >> "$FAKE_LFTP_ARGS_LOG"
fi
did_put=false
while IFS= read -r line; do
if [[ -n "${FAKE_LFTP_STDIN_LOG:-}" ]]; then
printf '%s\n' "$line" >> "$FAKE_LFTP_STDIN_LOG"
fi
if [[ "$line" =~ ^get\ \"([^\"]+)\"\ -o\ \"([^\"]+)\"$ ]]; then
destination=${BASH_REMATCH[2]}
if [[ "$did_put" == true && -n "${FAKE_CORRUPT_READBACK_ONCE:-}" && -f "${FAKE_CORRUPT_STATE}" ]]; then
Expand Down Expand Up @@ -78,6 +84,34 @@ env "${COMMON_ENV[@]}" "$SCRIPT" \
--expected-remote-sha256 "$LOCAL_HASH"
[[ $(sha256sum "$TMP/remote.js" | awk '{print $1}') == "$LOCAL_HASH" ]]

# Explicit FTPS uses an ftp:// URI plus AUTH TLS rather than implicit ftps://.
: > "$TMP/lftp-args.log"
: > "$TMP/lftp-stdin.log"
env "${COMMON_ENV[@]}" \
THREEW_DEPLOY_SCHEME=ftps \
"FAKE_LFTP_ARGS_LOG=$TMP/lftp-args.log" \
"FAKE_LFTP_STDIN_LOG=$TMP/lftp-stdin.log" \
"$SCRIPT" \
--target staging \
--local-file "$TMP/local.js" \
--remote-file newsletter-popup.js \
--backup-file "$TMP/backup.js" \
--verified-file "$TMP/verified.js" \
--expected-remote-sha256 "$ORIGINAL_HASH" \
--expected-remote-sha256 "$LOCAL_HASH"
grep -Fq 'ftp://fake.invalid:21' "$TMP/lftp-args.log"
if grep -Fq 'ftps://fake.invalid:21' "$TMP/lftp-args.log"; then
echo 'Expected explicit FTPS to avoid the implicit-TLS URI scheme' >&2
exit 1
fi
grep -Fxq 'set ftp:ssl-force true' "$TMP/lftp-stdin.log"
grep -Fxq 'set ftp:ssl-protect-data true' "$TMP/lftp-stdin.log"
grep -Fxq 'set ftp:ssl-auth TLS' "$TMP/lftp-stdin.log"

# The theme mirror must use the same explicit-FTPS URI mapping.
grep -Fq 'LFTP_SCHEME=ftp' "$REPO_ROOT/scripts/deploy-theme.sh"
grep -Fq 'LFTP_URI="${LFTP_SCHEME}://' "$REPO_ROOT/scripts/deploy-theme.sh"

# Unknown remote bytes must fail before upload.
printf 'unreviewed remote edit' > "$TMP/remote.js"
if run_deploy >/dev/null 2>&1; then
Expand Down
Loading