Replace Pelican with Zola

scripts/get_release_info.py → .github/scripts/get_release_info.py

@@ -9,20 +9,36 @@
  - `BLOG_POST_SLUG_TITLE` :
  - `BLOG_POST_AUTHOR` :
 """
-import requests
+
+from dataclasses import dataclass
+from typing import Optional
+import httpx
 import bs4
 import time
 import os
 
 ROOT: str = "https://blahcat.github.io"
-URL: str = f"{ROOT}/feeds/all.atom.xml"
+ATOM_FEED_URL: str = f"{ROOT}/feeds/all.atom.xml"
+
+
+@dataclass
+class SocialMedia:
+    twitter: Optional[str]
+    mastodon: Optional[str]
+    discord: Optional[str]
+    github: Optional[str]
+
 
-time.sleep(10)
+AUTHORS = {
+    "hugsy": SocialMedia("@_hugsy_", "@[email protected]", "@crazy.hugsy", "hugsy")
+}
 
-h = requests.get(URL)
+time.sleep(2)
+
+h = httpx.get(ATOM_FEED_URL)
 assert h.status_code == 200
 
-soup = bs4.BeautifulSoup(h.text, "lxml")
+soup = bs4.BeautifulSoup(h.text, "xml")
 node = soup.find("entry")
 assert node is not None
 
@@ -34,33 +50,29 @@ def get(x: str):
 
 
 def strip_html(html: str):
-    s = bs4.BeautifulSoup(html, features="html.parser")
+    s = bs4.BeautifulSoup(html, features="xml")
     return s.get_text()
 
 
+def env(x: str):
+    os.system(f"echo {x} >> $GITHUB_ENV")
+
+
 title = get("title").text
 authors = [x.text for x in get("author").find_all("name")]
 published = get("published").text
-url = ROOT + get("link")["href"]
-slug = get("link")["href"][18:-5]
+url = str(get("link")["href"])
+slug = str(get("link")["href"].rsplit("/")[-1])
 summary = strip_html(get("summary").text)[:-3] + " [...]"
 
-author_twitters = []
-for author in authors:
-    if author == "hugsy":
-        author_twitters.append("@_hugsy_")
-# TODO automate this
-
+author_twitters = [
+    AUTHORS[n].twitter for n in authors if n in AUTHORS and AUTHORS[n].twitter
+]
 twitter_body = (
     f"""New blog post: '{title}' by {' and '.join(author_twitters)} - {url}"""
 )
 twitter_body = twitter_body[:280]
 
-
-def env(x: str):
-    os.system(f"echo {x} >> $GITHUB_ENV")
-
-
 env(f"""BLOG_POST_TITLE="{title}" """)
 env(f"""BLOG_POST_PUBLISHED_DATE="{published}" """)
 env(f"""BLOG_POST_URL={url}""")

.github/scripts/requirements.txt

@@ -0,0 +1,2 @@
+httpx[cli]
+bs4

.github/spellcheck.yml

@@ -8,6 +8,20 @@ matrix:
     - .github/wordlist.txt
     encoding: utf-8
   pipeline:
+  - pyspelling.filters.context:
+      context_visible_first: true
+      escapes: \\[\\`~]
+      delimiters:
+      # Ignore anything in {{ }}
+      - open: '(?s)(?P<open> *\{{2})'
+        close: '^(?P=open)$'
+      - open: '(?P<open>\}{2})'
+        close: '(?P=open)'
+      # Ignore frontmatter (+++ / +++)
+      - open: '(?s)^(?P<open> *\+{3})$'
+        close: '^(?P=open)$'
+      - open: '(?P<open>\+{3})$'
+        close: '(?P=open)'
   - pyspelling.filters.markdown:
       markdown_extensions:
       - pymdownx.superfences

.github/workflows/build.yml

@@ -20,10 +20,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          submodules: true
           token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: '3.11'
           architecture: 'x64'
           cache: 'pip'
       - name: Build and publish the site
@@ -32,8 +33,6 @@ jobs:
           source ~/.bashrc
           git config --global user.name "hugsy"
           git config --global user.email "[email protected]"
-          git clone https://github.com/hugsy/attila.git /tmp/themes/attila
-          pelican-themes --install /tmp/themes/attila
-          pelican content -o output -s pelicanconf.py
+          zola build -o output
           ghp-import output --no-jekyll --branch=gh-pages --message="Generated new content"
           git push --force origin gh-pages

.github/workflows/check.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: checkout
         uses: actions/[email protected]
+        with:
+          submodules: true
 
       - name: Restore lychee cache
         uses: actions/[email protected]
@@ -33,9 +35,19 @@ jobs:
         env:
           GITHUB_TOKEN: ${{secrets.LYCHEE_TOKEN}}
         with:
-          args: --exclude='^http://rawpixels.net/.*$' --exclude='^http://rawpixels.net/.*$' --exclude='^https://twitter.com/.*$' --exclude='^https://ctftime.org/.*$' --cache --max-cache-age 1w --exclude-all-private --threads 10 --timeout 30 --retry-wait-time 60 --user-agent 'Mozilla/5.0 (Windows NT x.y; rv:10.0) Gecko/20100101 Firefox/10.0' --no-progress 'content/**/*.md'
+          args: --exclude='^file://.*$' --exclude='^http://rawpixels.net/.*$' --exclude='^http://rawpixels.net/.*$' --exclude='^https://twitter.com/.*$' --exclude='^https://ctftime.org/.*$' --cache --max-cache-age 1w --exclude-all-private --threads 10 --timeout 30 --retry-wait-time 60 --user-agent 'Mozilla/5.0 (Windows NT x.y; rv:10.0) Gecko/20100101 Firefox/10.0' --no-progress 'content/**/*.md'
           fail: true
 
+      - name: Check anchors (setup)
+        uses: taiki-e/install-action@v2
+        with:
+          tool: [email protected]
+
+      - name: Check anchors (setup)
+        run: |
+          zola check
+
+
   spellcheck:
     name: Spell Checker
     runs-on: ubuntu-latest
@@ -46,7 +58,7 @@ jobs:
         uses: actions/[email protected]
 
       - name: Spellcheck
-        uses: rojopolis/spellcheck-github-actions@0.36.0
+        uses: rojopolis/spellcheck-github-actions@0.38.0
         with:
           task_name: Markdown
           config_path: .github/spellcheck.yml
@@ -55,5 +67,5 @@ jobs:
       - if: '!cancelled()'
         run: |
           if [ -f spellcheck-output.txt ]; then
-              python scripts/ci_spellcheck_format.py spellcheck-output.txt >> ${GITHUB_STEP_SUMMARY}
+              python .github/scripts/ci_spellcheck_format.py spellcheck-output.txt >> ${GITHUB_STEP_SUMMARY}
           fi

.github/workflows/notify.yml

@@ -23,13 +23,13 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
         with:
-          python-version: '3.10'
+          python-version: '3.11'
           architecture: 'x64'
           cache: 'pip'
       - shell: bash
         run: |
-          python -m pip install -r scripts/requirements.txt
-          python scripts/get_release_info.py
+          python -m pip install -r .github/scripts/requirements.txt
+          python .github/scripts/get_release_info.py
       - uses: nearform-actions/[email protected]
         with:
           twitter-app-key: ${{ secrets.TWITTER_CONSUMER_API_KEY }}

.github/workflows/release.yml

@@ -22,13 +22,13 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
         with:
-          python-version: '3.10'
+          python-version: '3.11'
           architecture: 'x64'
           cache: 'pip'
       - shell: bash
         run: |
           python -m pip install -r scripts/requirements.txt
-          python scripts/get_release_info.py
+          python .github/scripts/get_release_info.py
       - uses: ncipollo/release-action@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -45,13 +45,13 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
         with:
-          python-version: '3.10'
+          python-version: '3.11'
           architecture: 'x64'
           cache: 'pip'
       - shell: bash
         run: |
           python -m pip install -r scripts/requirements.txt
-          python scripts/get_release_info.py
+          python .github/scripts/get_release_info.py
       - name: Create the new GitHub Discussion
         uses: abirismyname/[email protected]
         env:

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "themes/zola-clean-blog"]
+	path = themes/zola-clean-blog
+	url = https://github.com/dave-tucker/zola-clean-blog

.vscode/settings.json

@@ -0,0 +1,5 @@
+{
+    "files.associations": {
+        "themes/*/templates/*.html": "jinja-html"
+    },
+}

config.toml

@@ -0,0 +1,56 @@
+# https://www.getzola.org/documentation/getting-started/configuration/
+base_url = "https://blahcat.github.io"
+title = "BlahCats Blog"
+description = "Tales of a binary encoded life..."
+theme = "zola-clean-blog"
+generate_feeds = true
+feed_filenames = ["atom.xml", "rss.xml"]
+author = "hugsy"
+compile_sass = true
+build_search_index = true
+minify_html = true
+
+taxonomies = [
+    { name = "categories", rss = true, paginate_by = 10 },
+    { name = "tags", rss = true, paginate_by = 10 },
+    { name = "authors" },
+]
+
+[markdown]
+highlight_code = true
+highlight_theme = "base16-ocean-dark" # https://www.getzola.org/documentation/getting-started/configuration/#syntax-highlighting
+render_emoji = true
+bottom_footnotes = true
+smart_punctuation = true
+external_links_target_blank = true
+external_links_no_follow = true
+external_links_no_referrer = true
+
+[slugify]
+paths = "on"
+taxonomies = "on"
+anchors = "on"
+paths_keep_dates = true
+
+[link_checker]
+internal_level = "error"
+external_level = "warn"
+
+[extra]
+clean_default_bg_cover = "/img/blog-cover.png"
+
+clean_blog_menu = [
+    { url = "$BASE_URL", name = "Home" },
+    { url = "$BASE_URL/series", name = "Series" },
+    { url = "$BASE_URL/notes", name = "Notes" },
+    { url = "$BASE_URL/about", name = "About" },
+    { url = "$BASE_URL/qemu", name = "Qemu VMs" },
+]
+
+clean_blog_social = [
+    { icon = "fas fa-rss", url = "$BASE_URL/atom.xml" },
+    { icon = "fab fa-twitter", url = "https://twitter.com/ctf_blahcat" },
+    { icon = "fab fa-github", url = "https://github.com/blahcat" },
+    { icon = "fab fa-youtube", url = "https://www.youtube.com/channel/UCDrgY65mRZWVoMiB5-VMqfg" },
+    { icon = "fab fa-discord", url = "https://discord.gg/hSbqxxBgRX" },
+]

content/2013-06-20-I_feel_lucky.md

@@ -1,10 +1,13 @@
-title: I feel lucky - or why I wrote a FreeBSD 1-day in one day
-author: hugsy
-category: research
-tags: freebsd, 1day, lpe
-date: 2013-06-20 00:00 +0000
-modified: 2013-06-20 00:00 +0000
++++
+title = "I feel lucky - or why I wrote a FreeBSD 1-day in one day"
+authors = ["hugsy"]
+date = 2013-06-20T00:00:00Z
+updated = 2013-06-20T00:00:00Z
 
+[taxonomies]
+categories = ["research"]
+tags = ["freebsd", "1day", "lpe"]
++++
 
 Sometimes life gives you eggs for free, you just need to spend some time making an omelet. That's exactly what happened to me on a recent engagement for a client: a typical PHP webapp full of holes left me with a nice stable shell access.
 
@@ -40,7 +43,9 @@ Index: sys/vm/vm_map.c
 
 It kindda gave a good pointer of where to start: the usual rule for setuid dictates that a write access should immediately imply losing the elevated privilege. But this is where the bug was: by `mmap` a setuid binary (which any user can do), I can then choose to `ptrace` the process, and use `PT_WRITE` command to overwrite the `mmap`-ed memory, effectively overwriting the setuid binary!
 
-<div markdown="span" class="alert-info"><i class="fa fa-info-circle">&nbsp;Note:</i> I was in a rush, so my exploit is partially destructive as I overwrite directly the setuid binary. If you choose to use it, please make a copy to be able to restore it.</div>
+{% note() %}
+I was in a rush, so my exploit is partially destructive as I overwrite directly the setuid binary. If you choose to use it, please make a copy to be able to restore it.
+{% end %}
 
 My exploit was in 4 parts:
 
@@ -86,7 +91,7 @@ My exploit was in 4 parts:
 
 Done! Simply execute the target binary to get a root shell.
 
-```shell
+```bash
  $ id
  uid=1001(user) gid=1001(user) groups=1001(user)
  $ gcc -Wall ./mmap.c && ./a.out

content/2013-12-23-read_write_process_memory_on_linux.md

@@ -1,13 +1,17 @@
-title: Using new syscalls for read/write arbitrary memory on Linux.
-author: hugsy
-tags: linux, kernel, seccomp
-date: 2013-12-23 00:00 +0000
-modified: 2013-12-23 00:00 +0000
-category: research
++++
+title = "Using new syscalls for read/write arbitrary memory on Linux."
+authors = ["hugsy"]
+date = 2013-12-23T00:00:00Z
+updated = 2013-12-23T00:00:00Z
+
+[taxonomies]
+tags = ["linux", "kernel", "seccomp"]
+categories = ["research"]
++++
 
 Even though well known methods exist to bypass ptrace deactivation on a process when spawning (fake `ptrace()` preloading, breakpoint on `ptrace()`, etc... ), it is trickier when process is already protected.
 
-Thankfully Linux 3.2+ was generous enough to provide read/write capabilities to another process with 2 new system calls: `sys_process_vm_readv` and `sys_process_vm_writev`. (see [the source code](https://github.com/torvalds/linux/blob/master/arch/x86/entry/syscalls/syscall_64.tbl#L319)). For our Windows friend, those new syscalls are similar to `ReadProcessMemory()` and `WriteProcessMemory()`.
+Thankfully Linux 3.2+ was generous enough to provide read/write capabilities to another process with 2 new system calls: `sys_process_vm_readv` and `sys_process_vm_writev`. (see [the source code](https://github.com/torvalds/linux/blob/975f3b6da18020f1c8a7667ccb08fa542928ec03/arch/x86/entry/syscalls/syscall_64.tbl#L321)). For our Windows friend, those new syscalls are similar to `ReadProcessMemory()` and `WriteProcessMemory()`.
 
 The manual says:
 > These system calls transfer data between the address space of the calling process  ("the  local  process") and the process identified by pid ("the remote process").  The data moves directly  between  the address spaces of the two processes, without passing through kernel space.