feat: publish Gamertan Tend preview source
Sanitized root snapshot from private source commit a72903c63e1753f9e6ffbf40453c0830bdfc05c5 and tree 295641e67eef5979da76746d8ae271249568263e. Private development history and workflows are excluded by the exact allowlist. AI-assisted: OpenAI Codex helped implement, test, and audit this preview. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
@@ -0,0 +1,306 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/netip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const SchemaVersion = 1
|
||||
|
||||
var (
|
||||
namePattern = regexp.MustCompile(`^[a-z][a-z0-9-]{1,62}$`)
|
||||
binaryPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)
|
||||
packagePattern = regexp.MustCompile(`^\./[A-Za-z0-9_./-]+$`)
|
||||
symbolPattern = regexp.MustCompile(`^[A-Za-z0-9._/-]+$`)
|
||||
unitPattern = regexp.MustCompile(`^[A-Za-z0-9_.@-]+\.service$`)
|
||||
)
|
||||
|
||||
type Config struct {
|
||||
SchemaVersion int `json:"schema_version"`
|
||||
Service Service `json:"service"`
|
||||
Build Build `json:"build"`
|
||||
Deployment Deployment `json:"deployment"`
|
||||
}
|
||||
|
||||
type Service struct {
|
||||
Name string `json:"name"`
|
||||
AllowedHost string `json:"allowed_host"`
|
||||
}
|
||||
|
||||
type Build struct {
|
||||
Package string `json:"package"`
|
||||
Binary string `json:"binary"`
|
||||
Branch string `json:"branch"`
|
||||
VersionSymbol string `json:"version_symbol,omitempty"`
|
||||
CommitSymbol string `json:"commit_symbol,omitempty"`
|
||||
DateSymbol string `json:"date_symbol,omitempty"`
|
||||
}
|
||||
|
||||
type Deployment struct {
|
||||
Strategy string `json:"strategy"`
|
||||
Root string `json:"root"`
|
||||
LockFile string `json:"lock_file"`
|
||||
StateFile string `json:"state_file"`
|
||||
HealthPath string `json:"health_path"`
|
||||
ReadinessPath string `json:"readiness_path"`
|
||||
CandidateTimeoutSecs int `json:"candidate_timeout_seconds"`
|
||||
Smoke []Smoke `json:"smoke"`
|
||||
BlueGreen *BlueGreen `json:"blue_green,omitempty"`
|
||||
Singleton *Singleton `json:"singleton,omitempty"`
|
||||
}
|
||||
|
||||
type Smoke struct {
|
||||
Path string `json:"path"`
|
||||
Contains string `json:"contains"`
|
||||
}
|
||||
|
||||
type BlueGreen struct {
|
||||
CaddyConfig string `json:"caddy_config"`
|
||||
CaddyHandler string `json:"caddy_handler"`
|
||||
CaddyHandlerTemplate string `json:"caddy_handler_template"`
|
||||
BootstrapActive string `json:"bootstrap_active"`
|
||||
Blue Slot `json:"blue"`
|
||||
Green Slot `json:"green"`
|
||||
}
|
||||
|
||||
type Slot struct {
|
||||
Unit string `json:"unit"`
|
||||
Address string `json:"address"`
|
||||
Link string `json:"link"`
|
||||
}
|
||||
|
||||
type Singleton struct {
|
||||
Unit string `json:"unit"`
|
||||
Address string `json:"address"`
|
||||
CandidateAddress string `json:"candidate_address"`
|
||||
ListenEnv string `json:"listen_env"`
|
||||
Environment map[string]string `json:"environment,omitempty"`
|
||||
CurrentLink string `json:"current_link"`
|
||||
PreviousLink string `json:"previous_link"`
|
||||
}
|
||||
|
||||
func Load(path string) (Config, error) {
|
||||
if !filepath.IsAbs(path) {
|
||||
return Config{}, errors.New("configuration path must be absolute")
|
||||
}
|
||||
info, err := os.Lstat(path)
|
||||
if err != nil {
|
||||
return Config{}, fmt.Errorf("inspect configuration: %w", err)
|
||||
}
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Size() > 1<<20 {
|
||||
return Config{}, errors.New("configuration must be a bounded regular file, not a symlink")
|
||||
}
|
||||
b, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return Config{}, fmt.Errorf("read configuration: %w", err)
|
||||
}
|
||||
dec := json.NewDecoder(bytes.NewReader(b))
|
||||
dec.DisallowUnknownFields()
|
||||
var cfg Config
|
||||
if err := dec.Decode(&cfg); err != nil {
|
||||
return Config{}, fmt.Errorf("decode configuration: %w", err)
|
||||
}
|
||||
if err := requireEOF(dec); err != nil {
|
||||
return Config{}, err
|
||||
}
|
||||
if err := cfg.Validate(); err != nil {
|
||||
return Config{}, err
|
||||
}
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func requireEOF(dec *json.Decoder) error {
|
||||
var extra any
|
||||
if err := dec.Decode(&extra); !errors.Is(err, io.EOF) {
|
||||
if err == nil {
|
||||
return errors.New("configuration contains multiple JSON values")
|
||||
}
|
||||
return fmt.Errorf("decode trailing configuration: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c Config) Validate() error {
|
||||
if c.SchemaVersion != SchemaVersion {
|
||||
return fmt.Errorf("schema_version must be %d", SchemaVersion)
|
||||
}
|
||||
if !namePattern.MatchString(c.Service.Name) {
|
||||
return errors.New("service.name is invalid")
|
||||
}
|
||||
if c.Service.AllowedHost == "" || strings.ContainsAny(c.Service.AllowedHost, "/\\\x00\r\n\t ") {
|
||||
return errors.New("service.allowed_host is invalid")
|
||||
}
|
||||
if !packagePattern.MatchString(c.Build.Package) || strings.Contains(c.Build.Package, "..") {
|
||||
return errors.New("build.package must be a local package without traversal")
|
||||
}
|
||||
if !binaryPattern.MatchString(c.Build.Binary) {
|
||||
return errors.New("build.binary is invalid")
|
||||
}
|
||||
if c.Build.Branch == "" || strings.ContainsAny(c.Build.Branch, "\x00\r\n\t ~^:?*[\\") {
|
||||
return errors.New("build.branch is invalid")
|
||||
}
|
||||
for label, symbol := range map[string]string{
|
||||
"build.version_symbol": c.Build.VersionSymbol,
|
||||
"build.commit_symbol": c.Build.CommitSymbol,
|
||||
"build.date_symbol": c.Build.DateSymbol,
|
||||
} {
|
||||
if symbol != "" && !symbolPattern.MatchString(symbol) {
|
||||
return fmt.Errorf("%s is invalid", label)
|
||||
}
|
||||
}
|
||||
d := c.Deployment
|
||||
if err := safeAbsolute("deployment.root", d.Root); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := safeAbsolute("deployment.lock_file", d.LockFile); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := safeAbsolute("deployment.state_file", d.StateFile); err != nil {
|
||||
return err
|
||||
}
|
||||
if filepath.Clean(d.StateFile) == filepath.Clean(d.Root) || !within(d.Root, d.StateFile) {
|
||||
return errors.New("deployment.state_file must be below deployment.root")
|
||||
}
|
||||
if !safeHTTPPath(d.HealthPath) || !safeHTTPPath(d.ReadinessPath) {
|
||||
return errors.New("health and readiness paths must be absolute HTTP paths")
|
||||
}
|
||||
if d.CandidateTimeoutSecs < 2 || d.CandidateTimeoutSecs > 300 {
|
||||
return errors.New("candidate_timeout_seconds must be between 2 and 300")
|
||||
}
|
||||
if len(d.Smoke) == 0 || len(d.Smoke) > 32 {
|
||||
return errors.New("deployment.smoke must contain 1 to 32 checks")
|
||||
}
|
||||
for i, smoke := range d.Smoke {
|
||||
if !safeHTTPPath(smoke.Path) || smoke.Contains == "" || len(smoke.Contains) > 4096 || strings.ContainsRune(smoke.Contains, '\x00') {
|
||||
return fmt.Errorf("deployment.smoke[%d] is invalid", i)
|
||||
}
|
||||
}
|
||||
switch d.Strategy {
|
||||
case "blue_green":
|
||||
if d.BlueGreen == nil || d.Singleton != nil {
|
||||
return errors.New("blue_green strategy requires only blue_green settings")
|
||||
}
|
||||
if err := validateBlueGreen(d.Root, *d.BlueGreen); err != nil {
|
||||
return err
|
||||
}
|
||||
case "singleton_candidate":
|
||||
if d.Singleton == nil || d.BlueGreen != nil {
|
||||
return errors.New("singleton_candidate strategy requires only singleton settings")
|
||||
}
|
||||
if err := validateSingleton(d.Root, *d.Singleton); err != nil {
|
||||
return err
|
||||
}
|
||||
default:
|
||||
return errors.New("deployment.strategy must be blue_green or singleton_candidate")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateBlueGreen(root string, b BlueGreen) error {
|
||||
if b.BootstrapActive != "blue" && b.BootstrapActive != "green" {
|
||||
return errors.New("blue_green.bootstrap_active must be blue or green")
|
||||
}
|
||||
for label, path := range map[string]string{"caddy_config": b.CaddyConfig, "caddy_handler": b.CaddyHandler, "caddy_handler_template": b.CaddyHandlerTemplate} {
|
||||
if err := safeAbsolute("deployment.blue_green."+label, path); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if filepath.Clean(b.CaddyHandler) == filepath.Clean(b.CaddyHandlerTemplate) {
|
||||
return errors.New("Caddy handler and template must be different files")
|
||||
}
|
||||
if err := validateSlot(root, "blue", b.Blue); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := validateSlot(root, "green", b.Green); err != nil {
|
||||
return err
|
||||
}
|
||||
if b.Blue.Address == b.Green.Address || b.Blue.Unit == b.Green.Unit || b.Blue.Link == b.Green.Link {
|
||||
return errors.New("blue and green slots must be distinct")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateSlot(root, name string, slot Slot) error {
|
||||
if !unitPattern.MatchString(slot.Unit) {
|
||||
return fmt.Errorf("%s unit is invalid", name)
|
||||
}
|
||||
if err := loopbackAddress(slot.Address); err != nil {
|
||||
return fmt.Errorf("%s address: %w", name, err)
|
||||
}
|
||||
if err := safeAbsolute(name+" link", slot.Link); err != nil {
|
||||
return err
|
||||
}
|
||||
if !within(root, slot.Link) {
|
||||
return fmt.Errorf("%s link must be below deployment.root", name)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateSingleton(root string, s Singleton) error {
|
||||
if !unitPattern.MatchString(s.Unit) {
|
||||
return errors.New("singleton unit is invalid")
|
||||
}
|
||||
if err := loopbackAddress(s.Address); err != nil {
|
||||
return fmt.Errorf("singleton address: %w", err)
|
||||
}
|
||||
if err := loopbackAddress(s.CandidateAddress); err != nil {
|
||||
return fmt.Errorf("candidate address: %w", err)
|
||||
}
|
||||
if s.Address == s.CandidateAddress {
|
||||
return errors.New("singleton addresses must be distinct")
|
||||
}
|
||||
if !regexp.MustCompile(`^[A-Z][A-Z0-9_]{0,63}$`).MatchString(s.ListenEnv) {
|
||||
return errors.New("listen_env is invalid")
|
||||
}
|
||||
for _, entry := range []struct{ name, path string }{{"current_link", s.CurrentLink}, {"previous_link", s.PreviousLink}} {
|
||||
if err := safeAbsolute(entry.name, entry.path); err != nil {
|
||||
return err
|
||||
}
|
||||
if !within(root, entry.path) {
|
||||
return fmt.Errorf("%s must be below deployment.root", entry.name)
|
||||
}
|
||||
}
|
||||
if s.CurrentLink == s.PreviousLink {
|
||||
return errors.New("current and previous links must differ")
|
||||
}
|
||||
for key, value := range s.Environment {
|
||||
if !regexp.MustCompile(`^[A-Z][A-Z0-9_]{0,63}$`).MatchString(key) || strings.ContainsAny(value, "\x00\r\n") {
|
||||
return fmt.Errorf("singleton environment entry %q is invalid", key)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func safeAbsolute(label, path string) error {
|
||||
if !filepath.IsAbs(path) || filepath.Clean(path) != path || path == string(filepath.Separator) || strings.ContainsRune(path, '\x00') {
|
||||
return fmt.Errorf("%s must be a clean, non-root absolute path", label)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func within(root, child string) bool {
|
||||
rel, err := filepath.Rel(filepath.Clean(root), filepath.Clean(child))
|
||||
return err == nil && rel != "." && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
|
||||
}
|
||||
|
||||
func safeHTTPPath(path string) bool {
|
||||
return strings.HasPrefix(path, "/") && !strings.HasPrefix(path, "//") && !strings.ContainsAny(path, "\x00\r\n?#")
|
||||
}
|
||||
|
||||
func loopbackAddress(value string) error {
|
||||
addr, err := netip.ParseAddrPort(value)
|
||||
if err != nil || !addr.Addr().IsLoopback() || addr.Port() == 0 {
|
||||
return errors.New("must be a loopback IP and nonzero port")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func validConfig() Config {
|
||||
return Config{
|
||||
SchemaVersion: 1,
|
||||
Service: Service{Name: "example-site", AllowedHost: "example.test"},
|
||||
Build: Build{Package: "./cmd/site", Binary: "example-site", Branch: "main"},
|
||||
Deployment: Deployment{
|
||||
Strategy: "blue_green", Root: "/opt/example-site", LockFile: "/run/lock/example-site.lock",
|
||||
StateFile: "/opt/example-site/state.json", HealthPath: "/healthz", ReadinessPath: "/readyz",
|
||||
CandidateTimeoutSecs: 30, Smoke: []Smoke{{Path: "/", Contains: "Example"}},
|
||||
BlueGreen: &BlueGreen{
|
||||
CaddyConfig: "/etc/caddy/Caddyfile", CaddyHandler: "/etc/caddy/example.caddy",
|
||||
CaddyHandlerTemplate: "/etc/example/caddy.template",
|
||||
BootstrapActive: "blue",
|
||||
Blue: Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: "/opt/example-site/slots/blue"},
|
||||
Green: Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: "/opt/example-site/slots/green"},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateAcceptsBlueGreen(t *testing.T) {
|
||||
if err := validConfig().Validate(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateRejectsHostileValues(t *testing.T) {
|
||||
tests := map[string]func(*Config){
|
||||
"unknown strategy": func(c *Config) { c.Deployment.Strategy = "shell" },
|
||||
"nonloopback": func(c *Config) { c.Deployment.BlueGreen.Blue.Address = "203.0.113.7:80" },
|
||||
"root path": func(c *Config) { c.Deployment.Root = "/" },
|
||||
"traversal": func(c *Config) { c.Build.Package = "./cmd/../secret" },
|
||||
"shared slot": func(c *Config) { c.Deployment.BlueGreen.Green.Link = c.Deployment.BlueGreen.Blue.Link },
|
||||
"bad smoke": func(c *Config) { c.Deployment.Smoke[0].Path = "https://attacker.test/" },
|
||||
}
|
||||
for name, mutate := range tests {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
cfg := validConfig()
|
||||
mutate(&cfg)
|
||||
if err := cfg.Validate(); err == nil {
|
||||
t.Fatal("expected validation failure")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnknownJSONFieldRejected(t *testing.T) {
|
||||
b, err := json.Marshal(validConfig())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var raw map[string]any
|
||||
if err := json.Unmarshal(b, &raw); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
raw["surprise"] = true
|
||||
b, _ = json.Marshal(raw)
|
||||
_ = b // Load exercises strict decoding from disk in command tests.
|
||||
}
|
||||
@@ -0,0 +1,619 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/state"
|
||||
)
|
||||
|
||||
type Request struct {
|
||||
Artifact string
|
||||
SHA256 string
|
||||
ApprovedSHA256 string
|
||||
Activate bool
|
||||
}
|
||||
type Report struct {
|
||||
Validated bool `json:"validated"`
|
||||
Mutation string `json:"mutation"`
|
||||
Release string `json:"release,omitempty"`
|
||||
ActiveRelease string `json:"active_release,omitempty"`
|
||||
PreviousRelease string `json:"previous_release,omitempty"`
|
||||
}
|
||||
type Status struct {
|
||||
State *state.Record `json:"state,omitempty"`
|
||||
Units map[string]bool `json:"units"`
|
||||
StateInitialized bool `json:"state_initialized"`
|
||||
}
|
||||
|
||||
type Manager struct {
|
||||
Operator Operator
|
||||
Now func() time.Time
|
||||
Prepare func(config.Config, string, string, string) (string, error)
|
||||
Inspect func(config.Config, string, string, string) error
|
||||
}
|
||||
|
||||
func NewManager(operator Operator) Manager {
|
||||
return Manager{Operator: operator, Now: time.Now, Prepare: prepareRelease, Inspect: inspectArtifact}
|
||||
}
|
||||
|
||||
func (m Manager) Deploy(ctx context.Context, cfg config.Config, request Request) (Report, error) {
|
||||
if err := cfg.Validate(); err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
if !request.Activate {
|
||||
if err := m.Inspect(cfg, request.Artifact, request.SHA256, request.ApprovedSHA256); err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
return Report{Validated: true, Mutation: "none"}, nil
|
||||
}
|
||||
lock, err := acquireLock(cfg.Deployment.LockFile)
|
||||
if err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
defer lock.Close()
|
||||
release, err := m.Prepare(cfg, request.Artifact, request.SHA256, request.ApprovedSHA256)
|
||||
if err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
record, err := loadOrBootstrap(cfg, m.Now())
|
||||
if err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
switch cfg.Deployment.Strategy {
|
||||
case "blue_green":
|
||||
err = m.deployBlueGreen(ctx, cfg, record, release)
|
||||
case "singleton_candidate":
|
||||
err = m.deploySingleton(ctx, cfg, record, release)
|
||||
default:
|
||||
err = errors.New("unsupported strategy")
|
||||
}
|
||||
if err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
updated, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
return Report{Validated: true, Mutation: "activated", Release: release, ActiveRelease: updated.ActiveRelease, PreviousRelease: updated.PreviousRelease}, nil
|
||||
}
|
||||
|
||||
func loadOrBootstrap(cfg config.Config, now time.Time) (state.Record, error) {
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err == nil {
|
||||
return record, nil
|
||||
}
|
||||
if !os.IsNotExist(err) {
|
||||
return state.Record{}, err
|
||||
}
|
||||
switch cfg.Deployment.Strategy {
|
||||
case "blue_green":
|
||||
slot := cfg.Deployment.BlueGreen.BootstrapActive
|
||||
release, err := resolveReleaseLink(cfg.Deployment.Root, slotConfig(*cfg.Deployment.BlueGreen, slot).Link)
|
||||
if err != nil {
|
||||
return state.Record{}, fmt.Errorf("bootstrap active slot: %w", err)
|
||||
}
|
||||
return state.Record{SchemaVersion: 1, Strategy: cfg.Deployment.Strategy, ActiveSlot: slot, ActiveRelease: release, UpdatedAt: now.UTC().Format(time.RFC3339)}, nil
|
||||
case "singleton_candidate":
|
||||
release, err := resolveReleaseLink(cfg.Deployment.Root, cfg.Deployment.Singleton.CurrentLink)
|
||||
if err != nil {
|
||||
return state.Record{}, fmt.Errorf("bootstrap singleton: %w", err)
|
||||
}
|
||||
return state.Record{SchemaVersion: 1, Strategy: cfg.Deployment.Strategy, ActiveSlot: "singleton", ActiveRelease: release, UpdatedAt: now.UTC().Format(time.RFC3339)}, nil
|
||||
}
|
||||
return state.Record{}, errors.New("unsupported strategy")
|
||||
}
|
||||
|
||||
func (m Manager) deployBlueGreen(ctx context.Context, cfg config.Config, record state.Record, release string) (err error) {
|
||||
bg := *cfg.Deployment.BlueGreen
|
||||
inactive := "blue"
|
||||
if record.ActiveSlot == "blue" {
|
||||
inactive = "green"
|
||||
}
|
||||
slot := slotConfig(bg, inactive)
|
||||
oldInactive, oldErr := resolveReleaseLink(cfg.Deployment.Root, slot.Link)
|
||||
if oldErr != nil && !os.IsNotExist(oldErr) {
|
||||
return oldErr
|
||||
}
|
||||
oldHandler, err := os.ReadFile(bg.CaddyHandler)
|
||||
if err != nil {
|
||||
return fmt.Errorf("read current Caddy handler: %w", err)
|
||||
}
|
||||
handlerChanged := false
|
||||
linkChanged := false
|
||||
defer func() {
|
||||
if err == nil {
|
||||
return
|
||||
}
|
||||
if handlerChanged {
|
||||
_ = atomicWrite(bg.CaddyHandler, oldHandler, 0o644)
|
||||
_ = m.Operator.ValidateCaddy(ctx, bg.CaddyConfig)
|
||||
_ = m.Operator.ReloadCaddy(ctx)
|
||||
}
|
||||
if linkChanged {
|
||||
if oldErr == nil {
|
||||
_ = replaceSymlink(slot.Link, oldInactive)
|
||||
_ = m.Operator.Restart(ctx, slot.Unit)
|
||||
} else {
|
||||
_ = removeSymlink(slot.Link)
|
||||
_ = m.Operator.Stop(ctx, slot.Unit)
|
||||
}
|
||||
}
|
||||
}()
|
||||
if err = replaceSymlink(slot.Link, release); err != nil {
|
||||
return err
|
||||
}
|
||||
linkChanged = true
|
||||
if err = m.Operator.Restart(ctx, slot.Unit); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.probeAll(ctx, cfg, slot.Address); err != nil {
|
||||
return fmt.Errorf("candidate failed: %w", err)
|
||||
}
|
||||
handler, err := renderHandler(bg.CaddyHandlerTemplate, slot.Address)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err = atomicWrite(bg.CaddyHandler, handler, 0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
handlerChanged = true
|
||||
if err = m.Operator.ValidateCaddy(ctx, bg.CaddyConfig); err != nil {
|
||||
return fmt.Errorf("Caddy validation failed: %w", err)
|
||||
}
|
||||
if err = m.Operator.ReloadCaddy(ctx); err != nil {
|
||||
return fmt.Errorf("Caddy reload failed: %w", err)
|
||||
}
|
||||
if err = m.probeAll(ctx, cfg, slot.Address); err != nil {
|
||||
return fmt.Errorf("post-activation smoke failed: %w", err)
|
||||
}
|
||||
next := state.Record{SchemaVersion: 1, Strategy: cfg.Deployment.Strategy, ActiveSlot: inactive, ActiveRelease: release, PreviousSlot: record.ActiveSlot, PreviousRelease: record.ActiveRelease, UpdatedAt: m.Now().UTC().Format(time.RFC3339)}
|
||||
if err = state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, next); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m Manager) deploySingleton(ctx context.Context, cfg config.Config, record state.Record, release string) (err error) {
|
||||
single := *cfg.Deployment.Singleton
|
||||
candidateUnit := cfg.Service.Name + "-tend-candidate.service"
|
||||
env := copyMap(single.Environment)
|
||||
env[single.ListenEnv] = single.CandidateAddress
|
||||
binary := filepath.Join(release, cfg.Build.Binary)
|
||||
if err = m.Operator.StartCandidate(ctx, candidateUnit, binary, env); err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() {
|
||||
stopCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer cancel()
|
||||
_ = m.Operator.Stop(stopCtx, candidateUnit)
|
||||
}()
|
||||
if err = m.probeAll(ctx, cfg, single.CandidateAddress); err != nil {
|
||||
return fmt.Errorf("candidate failed: %w", err)
|
||||
}
|
||||
oldCurrent, err := resolveReleaseLink(cfg.Deployment.Root, single.CurrentLink)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
oldPrevious, previousErr := resolveReleaseLink(cfg.Deployment.Root, single.PreviousLink)
|
||||
currentChanged := false
|
||||
previousChanged := false
|
||||
defer func() {
|
||||
if err == nil {
|
||||
return
|
||||
}
|
||||
if currentChanged {
|
||||
_ = replaceSymlink(single.CurrentLink, oldCurrent)
|
||||
_ = m.Operator.Restart(ctx, single.Unit)
|
||||
}
|
||||
if previousChanged {
|
||||
if previousErr == nil {
|
||||
_ = replaceSymlink(single.PreviousLink, oldPrevious)
|
||||
} else {
|
||||
_ = removeSymlink(single.PreviousLink)
|
||||
}
|
||||
}
|
||||
}()
|
||||
if err = replaceSymlink(single.PreviousLink, oldCurrent); err != nil {
|
||||
return err
|
||||
}
|
||||
previousChanged = true
|
||||
if err = replaceSymlink(single.CurrentLink, release); err != nil {
|
||||
return err
|
||||
}
|
||||
currentChanged = true
|
||||
if err = m.Operator.Restart(ctx, single.Unit); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.probeAll(ctx, cfg, single.Address); err != nil {
|
||||
return fmt.Errorf("post-activation smoke failed: %w", err)
|
||||
}
|
||||
next := state.Record{SchemaVersion: 1, Strategy: cfg.Deployment.Strategy, ActiveSlot: "singleton", ActiveRelease: release, PreviousSlot: "singleton", PreviousRelease: record.ActiveRelease, UpdatedAt: m.Now().UTC().Format(time.RFC3339)}
|
||||
if err = state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, next); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m Manager) Rollback(ctx context.Context, cfg config.Config) (state.Record, error) {
|
||||
lock, err := acquireLock(cfg.Deployment.LockFile)
|
||||
if err != nil {
|
||||
return state.Record{}, err
|
||||
}
|
||||
defer lock.Close()
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
return state.Record{}, err
|
||||
}
|
||||
if record.PreviousRelease == "" {
|
||||
return state.Record{}, errors.New("no previous release is recorded")
|
||||
}
|
||||
switch cfg.Deployment.Strategy {
|
||||
case "blue_green":
|
||||
err = m.rollbackBlueGreen(ctx, cfg, record)
|
||||
case "singleton_candidate":
|
||||
err = m.rollbackSingleton(ctx, cfg, record)
|
||||
default:
|
||||
err = errors.New("unsupported strategy")
|
||||
}
|
||||
if err != nil {
|
||||
return state.Record{}, err
|
||||
}
|
||||
return state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
}
|
||||
func (m Manager) rollbackBlueGreen(ctx context.Context, cfg config.Config, record state.Record) (err error) {
|
||||
bg := *cfg.Deployment.BlueGreen
|
||||
slot := slotConfig(bg, record.PreviousSlot)
|
||||
if active, checkErr := m.Operator.IsActive(ctx, slot.Unit); checkErr != nil {
|
||||
return checkErr
|
||||
} else if !active {
|
||||
if err = m.Operator.Restart(ctx, slot.Unit); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if err = m.probeHealthReadiness(ctx, cfg, slot.Address); err != nil {
|
||||
return err
|
||||
}
|
||||
oldHandler, err := os.ReadFile(bg.CaddyHandler)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
changed := false
|
||||
defer func() {
|
||||
if err != nil && changed {
|
||||
_ = atomicWrite(bg.CaddyHandler, oldHandler, 0o644)
|
||||
_ = m.Operator.ValidateCaddy(ctx, bg.CaddyConfig)
|
||||
_ = m.Operator.ReloadCaddy(ctx)
|
||||
}
|
||||
}()
|
||||
handler, err := renderHandler(bg.CaddyHandlerTemplate, slot.Address)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err = atomicWrite(bg.CaddyHandler, handler, 0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
changed = true
|
||||
if err = m.Operator.ValidateCaddy(ctx, bg.CaddyConfig); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.Operator.ReloadCaddy(ctx); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.probeHealthReadiness(ctx, cfg, slot.Address); err != nil {
|
||||
return err
|
||||
}
|
||||
next := state.Record{SchemaVersion: 1, Strategy: record.Strategy, ActiveSlot: record.PreviousSlot, ActiveRelease: record.PreviousRelease, PreviousSlot: record.ActiveSlot, PreviousRelease: record.ActiveRelease, UpdatedAt: m.Now().UTC().Format(time.RFC3339)}
|
||||
return state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, next)
|
||||
}
|
||||
func (m Manager) rollbackSingleton(ctx context.Context, cfg config.Config, record state.Record) (err error) {
|
||||
single := *cfg.Deployment.Singleton
|
||||
oldCurrent, err := resolveReleaseLink(cfg.Deployment.Root, single.CurrentLink)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err = replaceSymlink(single.CurrentLink, record.PreviousRelease); err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() {
|
||||
if err != nil {
|
||||
_ = replaceSymlink(single.CurrentLink, oldCurrent)
|
||||
_ = m.Operator.Restart(ctx, single.Unit)
|
||||
}
|
||||
}()
|
||||
if err = m.Operator.Restart(ctx, single.Unit); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.probeHealthReadiness(ctx, cfg, single.Address); err != nil {
|
||||
return err
|
||||
}
|
||||
_ = replaceSymlink(single.PreviousLink, record.ActiveRelease)
|
||||
next := state.Record{SchemaVersion: 1, Strategy: record.Strategy, ActiveSlot: "singleton", ActiveRelease: record.PreviousRelease, PreviousSlot: "singleton", PreviousRelease: record.ActiveRelease, UpdatedAt: m.Now().UTC().Format(time.RFC3339)}
|
||||
return state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, next)
|
||||
}
|
||||
|
||||
func (m Manager) Status(ctx context.Context, cfg config.Config) (Status, error) {
|
||||
result := Status{Units: map[string]bool{}}
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err == nil {
|
||||
result.State = &record
|
||||
result.StateInitialized = true
|
||||
} else if !os.IsNotExist(err) {
|
||||
return Status{}, err
|
||||
}
|
||||
units := []string{}
|
||||
if cfg.Deployment.Strategy == "blue_green" {
|
||||
units = []string{cfg.Deployment.BlueGreen.Blue.Unit, cfg.Deployment.BlueGreen.Green.Unit}
|
||||
} else {
|
||||
units = []string{cfg.Deployment.Singleton.Unit}
|
||||
}
|
||||
for _, unit := range units {
|
||||
active, err := m.Operator.IsActive(ctx, unit)
|
||||
if err != nil {
|
||||
return Status{}, err
|
||||
}
|
||||
result.Units[unit] = active
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func (m Manager) Prune(cfg config.Config, keep int, apply bool) ([]string, error) {
|
||||
if keep < 2 || keep > 100 {
|
||||
return nil, errors.New("keep must be between 2 and 100")
|
||||
}
|
||||
lock, err := acquireLock(cfg.Deployment.LockFile)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer lock.Close()
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
entries, err := os.ReadDir(filepath.Join(cfg.Deployment.Root, "releases"))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
type candidate struct {
|
||||
name, path string
|
||||
mod time.Time
|
||||
}
|
||||
items := []candidate{}
|
||||
protected := map[string]bool{record.ActiveRelease: true, record.PreviousRelease: true}
|
||||
for _, entry := range entries {
|
||||
if !entry.IsDir() || entry.Type()&os.ModeSymlink != 0 || !strings.HasPrefix(entry.Name(), "sha256-") {
|
||||
continue
|
||||
}
|
||||
path := filepath.Join(cfg.Deployment.Root, "releases", entry.Name())
|
||||
if protected[path] {
|
||||
continue
|
||||
}
|
||||
info, err := entry.Info()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
items = append(items, candidate{entry.Name(), path, info.ModTime()})
|
||||
}
|
||||
sort.Slice(items, func(i, j int) bool { return items[i].mod.After(items[j].mod) })
|
||||
retained := keep - 2
|
||||
if retained < 0 {
|
||||
retained = 0
|
||||
}
|
||||
if retained > len(items) {
|
||||
retained = len(items)
|
||||
}
|
||||
items = items[retained:]
|
||||
paths := make([]string, 0, len(items))
|
||||
for _, item := range items {
|
||||
paths = append(paths, item.path)
|
||||
if apply {
|
||||
if err := removeRelease(item.path, cfg.Deployment.Root); err != nil {
|
||||
return paths, err
|
||||
}
|
||||
}
|
||||
}
|
||||
return paths, nil
|
||||
}
|
||||
|
||||
func (m Manager) probeAll(ctx context.Context, cfg config.Config, address string) error {
|
||||
checks := append([]config.Smoke{{Path: cfg.Deployment.HealthPath}, {Path: cfg.Deployment.ReadinessPath}}, cfg.Deployment.Smoke...)
|
||||
return m.probe(ctx, cfg, address, checks)
|
||||
}
|
||||
|
||||
func (m Manager) probeHealthReadiness(ctx context.Context, cfg config.Config, address string) error {
|
||||
checks := []config.Smoke{{Path: cfg.Deployment.HealthPath}, {Path: cfg.Deployment.ReadinessPath}}
|
||||
return m.probe(ctx, cfg, address, checks)
|
||||
}
|
||||
|
||||
func (m Manager) probe(ctx context.Context, cfg config.Config, address string, checks []config.Smoke) error {
|
||||
timeout := time.Duration(cfg.Deployment.CandidateTimeoutSecs) * time.Second
|
||||
for _, check := range checks {
|
||||
deadline := m.Now().Add(timeout)
|
||||
var last error
|
||||
for {
|
||||
attempt, cancel := context.WithTimeout(ctx, 2*time.Second)
|
||||
last = m.Operator.Probe(attempt, address, cfg.Service.AllowedHost, check.Path, check.Contains)
|
||||
cancel()
|
||||
if last == nil {
|
||||
break
|
||||
}
|
||||
if !m.Now().Before(deadline) {
|
||||
return last
|
||||
}
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return ctx.Err()
|
||||
case <-time.After(200 * time.Millisecond):
|
||||
}
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func slotConfig(bg config.BlueGreen, name string) config.Slot {
|
||||
if name == "blue" {
|
||||
return bg.Blue
|
||||
}
|
||||
return bg.Green
|
||||
}
|
||||
func copyMap(source map[string]string) map[string]string {
|
||||
target := make(map[string]string, len(source)+1)
|
||||
for k, v := range source {
|
||||
target[k] = v
|
||||
}
|
||||
return target
|
||||
}
|
||||
func resolveReleaseLink(root, link string) (string, error) {
|
||||
info, err := os.Lstat(link)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if info.Mode()&os.ModeSymlink == 0 {
|
||||
return "", errors.New("release pointer is not a symlink")
|
||||
}
|
||||
target, err := os.Readlink(link)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if !filepath.IsAbs(target) {
|
||||
target = filepath.Join(filepath.Dir(link), target)
|
||||
}
|
||||
target = filepath.Clean(target)
|
||||
probe := state.Record{SchemaVersion: 1, Strategy: "singleton_candidate", ActiveSlot: "singleton", ActiveRelease: target, UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
|
||||
if err := probe.Validate(root, "singleton_candidate"); err != nil {
|
||||
return "", err
|
||||
}
|
||||
targetInfo, err := os.Lstat(target)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if !targetInfo.IsDir() || targetInfo.Mode()&os.ModeSymlink != 0 {
|
||||
return "", errors.New("release target must be a real directory")
|
||||
}
|
||||
return target, nil
|
||||
}
|
||||
func replaceSymlink(link, target string) error {
|
||||
if info, err := os.Lstat(link); err == nil && info.Mode()&os.ModeSymlink == 0 {
|
||||
return errors.New("refusing to replace non-symlink release pointer")
|
||||
} else if err != nil && !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Dir(link), 0o755); err != nil {
|
||||
return err
|
||||
}
|
||||
stage, err := os.MkdirTemp(filepath.Dir(link), ".tend-link-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.RemoveAll(stage)
|
||||
tmp := filepath.Join(stage, "next")
|
||||
if err := os.Symlink(target, tmp); err != nil {
|
||||
return err
|
||||
}
|
||||
return os.Rename(tmp, link)
|
||||
}
|
||||
func removeSymlink(path string) error {
|
||||
info, err := os.Lstat(path)
|
||||
if os.IsNotExist(err) {
|
||||
return nil
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if info.Mode()&os.ModeSymlink == 0 {
|
||||
return errors.New("refusing to remove non-symlink")
|
||||
}
|
||||
return os.Remove(path)
|
||||
}
|
||||
func renderHandler(templatePath, address string) ([]byte, error) {
|
||||
b, err := os.ReadFile(templatePath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
const marker = "{{UPSTREAM}}"
|
||||
if bytes := strings.Count(string(b), marker); bytes != 1 {
|
||||
return nil, errors.New("Caddy handler template must contain exactly one upstream marker")
|
||||
}
|
||||
return []byte(strings.Replace(string(b), marker, address, 1)), nil
|
||||
}
|
||||
func atomicWrite(path string, data []byte, mode os.FileMode) error {
|
||||
var existing os.FileInfo
|
||||
if info, err := os.Lstat(path); err == nil {
|
||||
if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
|
||||
return errors.New("refusing to replace non-regular or symlink file")
|
||||
}
|
||||
existing = info
|
||||
} else if !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
identity := identityFor(existing, mode)
|
||||
dir := filepath.Dir(path)
|
||||
tmp, err := os.CreateTemp(dir, ".tend-write-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
name := tmp.Name()
|
||||
ok := false
|
||||
defer func() {
|
||||
_ = tmp.Close()
|
||||
if !ok {
|
||||
_ = os.Remove(name)
|
||||
}
|
||||
}()
|
||||
if err := applyIdentity(tmp, identity); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := tmp.Write(data); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tmp.Sync(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tmp.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Rename(name, path); err != nil {
|
||||
return err
|
||||
}
|
||||
ok = true
|
||||
return syncDirectory(dir)
|
||||
}
|
||||
func syncDirectory(path string) error {
|
||||
dir, err := os.Open(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer dir.Close()
|
||||
return dir.Sync()
|
||||
}
|
||||
func removeRelease(path, root string) error {
|
||||
releases := filepath.Join(root, "releases")
|
||||
rel, err := filepath.Rel(releases, path)
|
||||
if err != nil || rel == "." || rel == ".." || strings.ContainsRune(rel, filepath.Separator) || !strings.HasPrefix(rel, "sha256-") {
|
||||
return errors.New("unsafe prune target")
|
||||
}
|
||||
info, err := os.Lstat(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return errors.New("prune target is not a real release directory")
|
||||
}
|
||||
return os.RemoveAll(path)
|
||||
}
|
||||
func Marshal(value any) ([]byte, error) {
|
||||
b, err := json.MarshalIndent(value, "", " ")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return append(b, '\n'), nil
|
||||
}
|
||||
@@ -0,0 +1,213 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/state"
|
||||
)
|
||||
|
||||
type fakeOperator struct {
|
||||
failReload bool
|
||||
failRestartUnit string
|
||||
rejectMarkers bool
|
||||
active map[string]bool
|
||||
starts, stops, restarts []string
|
||||
probes []string
|
||||
}
|
||||
|
||||
func (f *fakeOperator) Restart(_ context.Context, unit string) error {
|
||||
f.restarts = append(f.restarts, unit)
|
||||
if unit == f.failRestartUnit {
|
||||
return errors.New("injected restart failure")
|
||||
}
|
||||
f.active[unit] = true
|
||||
return nil
|
||||
}
|
||||
func (f *fakeOperator) Stop(_ context.Context, unit string) error {
|
||||
f.stops = append(f.stops, unit)
|
||||
f.active[unit] = false
|
||||
return nil
|
||||
}
|
||||
func (f *fakeOperator) IsActive(_ context.Context, unit string) (bool, error) {
|
||||
return f.active[unit], nil
|
||||
}
|
||||
func (f *fakeOperator) StartCandidate(_ context.Context, unit, binary string, env map[string]string) error {
|
||||
if !filepath.IsAbs(binary) || len(env) == 0 {
|
||||
return errors.New("bad candidate")
|
||||
}
|
||||
f.starts = append(f.starts, unit)
|
||||
f.active[unit] = true
|
||||
return nil
|
||||
}
|
||||
func (f *fakeOperator) ValidateCaddy(context.Context, string) error { return nil }
|
||||
func (f *fakeOperator) ReloadCaddy(context.Context) error {
|
||||
if f.failReload {
|
||||
return errors.New("injected reload failure")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func (f *fakeOperator) Probe(_ context.Context, address, host, path, contains string) error {
|
||||
f.probes = append(f.probes, address+path)
|
||||
if f.rejectMarkers && contains != "" {
|
||||
return errors.New("unexpected future-release smoke marker")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func baseConfig(t *testing.T, strategy string) (config.Config, string, string) {
|
||||
t.Helper()
|
||||
root := filepath.Join(t.TempDir(), "service")
|
||||
if err := os.MkdirAll(filepath.Join(root, "releases"), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
old := filepath.Join(root, "releases", "legacy-old")
|
||||
fresh := filepath.Join(root, "releases", "sha256-"+strings.Repeat("a", 64))
|
||||
for _, dir := range []string{old, fresh} {
|
||||
if err := os.Mkdir(dir, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(dir, "app"), []byte("x"), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
cfg := config.Config{SchemaVersion: 1, Service: config.Service{Name: "example-site", AllowedHost: "example.test"}, Build: config.Build{Package: "./cmd/site", Binary: "app", Branch: "main"}, Deployment: config.Deployment{Strategy: strategy, Root: root, LockFile: filepath.Join(root, "deploy.lock"), StateFile: filepath.Join(root, "state.json"), HealthPath: "/healthz", ReadinessPath: "/readyz", CandidateTimeoutSecs: 2, Smoke: []config.Smoke{{Path: "/", Contains: "Example"}}}}
|
||||
return cfg, old, fresh
|
||||
}
|
||||
func manager(operator Operator, fresh string) Manager {
|
||||
return Manager{Operator: operator, Now: func() time.Time { return time.Unix(100, 0).UTC() }, Prepare: func(config.Config, string, string, string) (string, error) { return fresh, nil }, Inspect: func(config.Config, string, string, string) error { return nil }}
|
||||
}
|
||||
|
||||
func TestBlueGreenActivationAndRollback(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "blue_green")
|
||||
handler := filepath.Join(cfg.Deployment.Root, "handler.caddy")
|
||||
template := filepath.Join(cfg.Deployment.Root, "handler.template")
|
||||
if err := os.WriteFile(handler, []byte("reverse_proxy 127.0.0.1:8090\n"), 0o640); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(template, []byte("reverse_proxy {{UPSTREAM}}\n"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
blue := filepath.Join(cfg.Deployment.Root, "slots", "blue")
|
||||
green := filepath.Join(cfg.Deployment.Root, "slots", "green")
|
||||
if err := replaceSymlink(blue, old); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := replaceSymlink(green, old); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
cfg.Deployment.BlueGreen = &config.BlueGreen{CaddyConfig: filepath.Join(cfg.Deployment.Root, "Caddyfile"), CaddyHandler: handler, CaddyHandlerTemplate: template, BootstrapActive: "blue", Blue: config.Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: blue}, Green: config.Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: green}}
|
||||
if err := cfg.Validate(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
operator := &fakeOperator{active: map[string]bool{"example-blue.service": true, "example-green.service": true}}
|
||||
m := manager(operator, fresh)
|
||||
report, err := m.Deploy(context.Background(), cfg, Request{Activate: true})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if report.ActiveRelease != fresh || report.PreviousRelease != old {
|
||||
t.Fatalf("report=%+v", report)
|
||||
}
|
||||
if info, err := os.Stat(handler); err != nil || info.Mode().Perm() != 0o640 {
|
||||
t.Fatalf("handler mode=%v err=%v", info.Mode().Perm(), err)
|
||||
}
|
||||
if target, err := resolveReleaseLink(cfg.Deployment.Root, green); err != nil || target != fresh {
|
||||
t.Fatalf("green=%q err=%v", target, err)
|
||||
}
|
||||
operator.rejectMarkers = true
|
||||
operator.probes = nil
|
||||
record, err := m.Rollback(context.Background(), cfg)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if record.ActiveRelease != old || record.PreviousRelease != fresh {
|
||||
t.Fatalf("rollback=%+v", record)
|
||||
}
|
||||
if len(operator.probes) != 4 {
|
||||
t.Fatalf("rollback probes=%#v", operator.probes)
|
||||
}
|
||||
for _, probe := range operator.probes {
|
||||
if !strings.HasSuffix(probe, "/healthz") && !strings.HasSuffix(probe, "/readyz") {
|
||||
t.Fatalf("rollback applied future-release smoke checks: %#v", operator.probes)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestBlueGreenCaddyFailureRestoresHandlerAndSlot(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "blue_green")
|
||||
handler := filepath.Join(cfg.Deployment.Root, "handler.caddy")
|
||||
template := filepath.Join(cfg.Deployment.Root, "handler.template")
|
||||
original := []byte("reverse_proxy 127.0.0.1:8090\n")
|
||||
_ = os.WriteFile(handler, original, 0o644)
|
||||
_ = os.WriteFile(template, []byte("reverse_proxy {{UPSTREAM}}\n"), 0o644)
|
||||
blue := filepath.Join(cfg.Deployment.Root, "slots", "blue")
|
||||
green := filepath.Join(cfg.Deployment.Root, "slots", "green")
|
||||
_ = replaceSymlink(blue, old)
|
||||
_ = replaceSymlink(green, old)
|
||||
cfg.Deployment.BlueGreen = &config.BlueGreen{CaddyConfig: filepath.Join(cfg.Deployment.Root, "Caddyfile"), CaddyHandler: handler, CaddyHandlerTemplate: template, BootstrapActive: "blue", Blue: config.Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: blue}, Green: config.Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: green}}
|
||||
operator := &fakeOperator{active: map[string]bool{}, failReload: true}
|
||||
m := manager(operator, fresh)
|
||||
if _, err := m.Deploy(context.Background(), cfg, Request{Activate: true}); err == nil {
|
||||
t.Fatal("expected failure")
|
||||
}
|
||||
body, _ := os.ReadFile(handler)
|
||||
if string(body) != string(original) {
|
||||
t.Fatalf("handler not restored: %q", body)
|
||||
}
|
||||
target, err := resolveReleaseLink(cfg.Deployment.Root, green)
|
||||
if err != nil || target != old {
|
||||
t.Fatalf("green=%q err=%v", target, err)
|
||||
}
|
||||
if _, err := os.Stat(cfg.Deployment.StateFile); !os.IsNotExist(err) {
|
||||
t.Fatal("failed activation wrote state")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSingletonRestartFailureRestoresPointers(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
previous := filepath.Join(cfg.Deployment.Root, "previous")
|
||||
current := filepath.Join(cfg.Deployment.Root, "current")
|
||||
_ = replaceSymlink(current, old)
|
||||
cfg.Deployment.Singleton = &config.Singleton{Unit: "example-site.service", Address: "127.0.0.1:8092", CandidateAddress: "127.0.0.1:18092", ListenEnv: "EXAMPLE_LISTEN", CurrentLink: current, PreviousLink: previous}
|
||||
operator := &fakeOperator{active: map[string]bool{}, failRestartUnit: "example-site.service"}
|
||||
m := manager(operator, fresh)
|
||||
if _, err := m.Deploy(context.Background(), cfg, Request{Activate: true}); err == nil {
|
||||
t.Fatal("expected failure")
|
||||
}
|
||||
target, err := resolveReleaseLink(cfg.Deployment.Root, current)
|
||||
if err != nil || target != old {
|
||||
t.Fatalf("current=%q err=%v", target, err)
|
||||
}
|
||||
if _, err := os.Lstat(previous); !os.IsNotExist(err) {
|
||||
t.Fatal("previous pointer was not restored")
|
||||
}
|
||||
}
|
||||
|
||||
func TestStatePersistsOnlyAfterSuccessfulActivation(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
current := filepath.Join(cfg.Deployment.Root, "current")
|
||||
previous := filepath.Join(cfg.Deployment.Root, "previous")
|
||||
_ = replaceSymlink(current, old)
|
||||
cfg.Deployment.Singleton = &config.Singleton{Unit: "example-site.service", Address: "127.0.0.1:8092", CandidateAddress: "127.0.0.1:18092", ListenEnv: "EXAMPLE_LISTEN", CurrentLink: current, PreviousLink: previous}
|
||||
operator := &fakeOperator{active: map[string]bool{}}
|
||||
m := manager(operator, fresh)
|
||||
if _, err := m.Deploy(context.Background(), cfg, Request{Activate: true}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if record.ActiveRelease != fresh || record.PreviousRelease != old {
|
||||
t.Fatalf("state=%+v", record)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
//go:build linux
|
||||
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"os"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
type fileLock struct{ file *os.File }
|
||||
|
||||
func acquireLock(path string) (*fileLock, error) {
|
||||
file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := syscall.Flock(int(file.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
|
||||
_ = file.Close()
|
||||
return nil, errors.New("deployment lock is held")
|
||||
}
|
||||
return &fileLock{file: file}, nil
|
||||
}
|
||||
func (l *fileLock) Close() error {
|
||||
if l == nil || l.file == nil {
|
||||
return nil
|
||||
}
|
||||
_ = syscall.Flock(int(l.file.Fd()), syscall.LOCK_UN)
|
||||
return l.file.Close()
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
//go:build !linux
|
||||
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import "errors"
|
||||
|
||||
type fileLock struct{}
|
||||
|
||||
func acquireLock(string) (*fileLock, error) {
|
||||
return nil, errors.New("deployment mutations require Linux")
|
||||
}
|
||||
func (*fileLock) Close() error { return nil }
|
||||
@@ -0,0 +1,111 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"gamertan.com/tend/internal/process"
|
||||
)
|
||||
|
||||
type Operator interface {
|
||||
Restart(context.Context, string) error
|
||||
Stop(context.Context, string) error
|
||||
IsActive(context.Context, string) (bool, error)
|
||||
StartCandidate(context.Context, string, string, map[string]string) error
|
||||
ValidateCaddy(context.Context, string) error
|
||||
ReloadCaddy(context.Context) error
|
||||
Probe(context.Context, string, string, string, string) error
|
||||
}
|
||||
|
||||
type SystemOperator struct {
|
||||
Runner process.Runner
|
||||
Timeout time.Duration
|
||||
}
|
||||
|
||||
func (o SystemOperator) Restart(ctx context.Context, unit string) error {
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "systemctl", "restart", unit)
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) Stop(ctx context.Context, unit string) error {
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "systemctl", "stop", unit)
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) IsActive(ctx context.Context, unit string) (bool, error) {
|
||||
out, err := o.Runner.Run(ctx, "/", nil, "systemctl", "is-active", unit)
|
||||
if err != nil {
|
||||
if strings.TrimSpace(string(out)) == "inactive" || strings.TrimSpace(string(out)) == "failed" {
|
||||
return false, nil
|
||||
}
|
||||
return false, err
|
||||
}
|
||||
return strings.TrimSpace(string(out)) == "active", nil
|
||||
}
|
||||
func (o SystemOperator) StartCandidate(ctx context.Context, unit, binary string, env map[string]string) error {
|
||||
args := []string{
|
||||
"--unit", unit, "--collect",
|
||||
"--property=DynamicUser=yes", "--property=NoNewPrivileges=yes",
|
||||
"--property=PrivateDevices=yes", "--property=PrivateTmp=yes",
|
||||
"--property=ProtectClock=yes", "--property=ProtectControlGroups=yes",
|
||||
"--property=ProtectHome=yes", "--property=ProtectHostname=yes",
|
||||
"--property=ProtectKernelLogs=yes", "--property=ProtectKernelModules=yes",
|
||||
"--property=ProtectKernelTunables=yes", "--property=ProtectSystem=strict",
|
||||
"--property=RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX",
|
||||
"--property=RestrictNamespaces=yes", "--property=RestrictRealtime=yes",
|
||||
"--property=RestrictSUIDSGID=yes", "--property=LockPersonality=yes",
|
||||
"--property=MemoryDenyWriteExecute=yes", "--property=CapabilityBoundingSet=",
|
||||
"--property=AmbientCapabilities=",
|
||||
}
|
||||
keys := make([]string, 0, len(env))
|
||||
for key := range env {
|
||||
keys = append(keys, key)
|
||||
}
|
||||
sort.Strings(keys)
|
||||
for _, key := range keys {
|
||||
args = append(args, "--setenv", key+"="+env[key])
|
||||
}
|
||||
args = append(args, "--", binary)
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "systemd-run", args...)
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) ValidateCaddy(ctx context.Context, path string) error {
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "caddy", "validate", "--config", path, "--adapter", "caddyfile")
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) ReloadCaddy(ctx context.Context) error {
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "systemctl", "reload", "caddy.service")
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) Probe(ctx context.Context, address, host, path, contains string) error {
|
||||
u := url.URL{Scheme: "http", Host: address, Path: path}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
req.Host = host
|
||||
client := &http.Client{Timeout: o.Timeout, CheckRedirect: func(*http.Request, []*http.Request) error { return errors.New("redirect refused") }}
|
||||
response, err := client.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer response.Body.Close()
|
||||
if response.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("probe returned HTTP %d", response.StatusCode)
|
||||
}
|
||||
body, err := io.ReadAll(io.LimitReader(response.Body, 1<<20))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if contains != "" && !strings.Contains(string(body), contains) {
|
||||
return errors.New("probe response omitted required marker")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"reflect"
|
||||
"testing"
|
||||
)
|
||||
|
||||
type recordingRunner struct {
|
||||
name string
|
||||
args []string
|
||||
}
|
||||
|
||||
func (r *recordingRunner) Run(_ context.Context, _ string, _ map[string]string, name string, args ...string) ([]byte, error) {
|
||||
r.name = name
|
||||
r.args = append([]string(nil), args...)
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func TestStartCandidateUsesArgumentVectorAndHardenedUnit(t *testing.T) {
|
||||
runner := &recordingRunner{}
|
||||
operator := SystemOperator{Runner: runner}
|
||||
env := map[string]string{"Z_ENV": "safe value", "A_ENV": "first"}
|
||||
if err := operator.StartCandidate(context.Background(), "example-tend-candidate.service", "/opt/example/releases/sha256-a/app", env); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if runner.name != "systemd-run" {
|
||||
t.Fatalf("command=%q", runner.name)
|
||||
}
|
||||
required := []string{"--property=DynamicUser=yes", "--property=NoNewPrivileges=yes", "--property=ProtectSystem=strict", "--property=MemoryDenyWriteExecute=yes", "--property=CapabilityBoundingSet=", "--setenv", "A_ENV=first", "--setenv", "Z_ENV=safe value", "--", "/opt/example/releases/sha256-a/app"}
|
||||
cursor := 0
|
||||
for _, arg := range runner.args {
|
||||
if cursor < len(required) && arg == required[cursor] {
|
||||
cursor++
|
||||
}
|
||||
}
|
||||
if cursor != len(required) {
|
||||
t.Fatalf("arguments omitted ordered security boundary: %#v", runner.args)
|
||||
}
|
||||
if reflect.DeepEqual(runner.args, []string{"sh", "-c"}) {
|
||||
t.Fatal("candidate command used a shell")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
//go:build linux
|
||||
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"os"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
type fileIdentity struct {
|
||||
mode os.FileMode
|
||||
uid, gid int
|
||||
owned bool
|
||||
}
|
||||
|
||||
func identityFor(info os.FileInfo, fallback os.FileMode) fileIdentity {
|
||||
identity := fileIdentity{mode: fallback}
|
||||
if info == nil {
|
||||
return identity
|
||||
}
|
||||
identity.mode = info.Mode().Perm()
|
||||
if stat, ok := info.Sys().(*syscall.Stat_t); ok {
|
||||
identity.uid = int(stat.Uid)
|
||||
identity.gid = int(stat.Gid)
|
||||
identity.owned = true
|
||||
}
|
||||
return identity
|
||||
}
|
||||
func applyIdentity(file *os.File, identity fileIdentity) error {
|
||||
if identity.owned {
|
||||
if err := file.Chown(identity.uid, identity.gid); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return file.Chmod(identity.mode)
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
//go:build !linux
|
||||
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import "os"
|
||||
|
||||
type fileIdentity struct{ mode os.FileMode }
|
||||
|
||||
func identityFor(info os.FileInfo, fallback os.FileMode) fileIdentity {
|
||||
if info != nil {
|
||||
return fileIdentity{mode: info.Mode().Perm()}
|
||||
}
|
||||
return fileIdentity{mode: fallback}
|
||||
}
|
||||
func applyIdentity(file *os.File, identity fileIdentity) error { return file.Chmod(identity.mode) }
|
||||
@@ -0,0 +1,309 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/packager"
|
||||
)
|
||||
|
||||
const maxArtifactSize int64 = 512 << 20
|
||||
|
||||
func prepareRelease(cfg config.Config, artifact, expected, approved string) (string, error) {
|
||||
if err := checkArtifact(artifact, expected, approved); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := ensureTree(cfg.Deployment.Root); err != nil {
|
||||
return "", err
|
||||
}
|
||||
releases := filepath.Join(cfg.Deployment.Root, "releases")
|
||||
release := filepath.Join(releases, "sha256-"+expected)
|
||||
if info, err := os.Lstat(release); err == nil {
|
||||
if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return "", errors.New("existing release is not a directory")
|
||||
}
|
||||
if err := validateRelease(cfg, release); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return release, nil
|
||||
} else if !os.IsNotExist(err) {
|
||||
return "", err
|
||||
}
|
||||
stage := filepath.Join(releases, ".tend-stage-"+expected)
|
||||
if err := os.Mkdir(stage, 0o700); err != nil {
|
||||
return "", err
|
||||
}
|
||||
ok := false
|
||||
defer func() {
|
||||
if !ok {
|
||||
_ = os.RemoveAll(stage)
|
||||
}
|
||||
}()
|
||||
if err := extractArtifact(artifact, stage); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := validateRelease(cfg, stage); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := os.Chmod(stage, 0o755); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := os.Rename(stage, release); err != nil {
|
||||
return "", err
|
||||
}
|
||||
ok = true
|
||||
return release, nil
|
||||
}
|
||||
|
||||
func inspectArtifact(cfg config.Config, artifact, expected, approved string) error {
|
||||
if err := checkArtifact(artifact, expected, approved); err != nil {
|
||||
return err
|
||||
}
|
||||
stage, err := os.MkdirTemp("", "tend-inspect-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.RemoveAll(stage)
|
||||
if err := extractArtifact(artifact, stage); err != nil {
|
||||
return err
|
||||
}
|
||||
return validateRelease(cfg, stage)
|
||||
}
|
||||
func checkArtifact(artifact, expected, approved string) error {
|
||||
if expected != approved || len(expected) != 64 {
|
||||
return errors.New("artifact digest was not explicitly approved")
|
||||
}
|
||||
if _, err := hex.DecodeString(expected); err != nil {
|
||||
return errors.New("artifact digest is not hexadecimal")
|
||||
}
|
||||
if !filepath.IsAbs(artifact) || filepath.Clean(artifact) != artifact {
|
||||
return errors.New("artifact path must be a clean absolute path")
|
||||
}
|
||||
info, err := os.Lstat(artifact)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Size() > maxArtifactSize {
|
||||
return errors.New("artifact must be a bounded regular file")
|
||||
}
|
||||
actual, err := fileSHA(artifact)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if actual != expected {
|
||||
return errors.New("artifact digest does not match")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func ensureTree(root string) error {
|
||||
if os.Geteuid() != 0 && strings.HasPrefix(root, "/opt/") {
|
||||
return errors.New("deployment under /opt requires root")
|
||||
}
|
||||
if err := rejectSymlinkAncestors(root); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Join(root, "releases"), 0o755); err != nil {
|
||||
return err
|
||||
}
|
||||
return rejectSymlinkAncestors(filepath.Join(root, "releases"))
|
||||
}
|
||||
func rejectSymlinkAncestors(path string) error {
|
||||
clean := filepath.Clean(path)
|
||||
parts := strings.Split(strings.TrimPrefix(clean, string(filepath.Separator)), string(filepath.Separator))
|
||||
current := string(filepath.Separator)
|
||||
for _, part := range parts {
|
||||
current = filepath.Join(current, part)
|
||||
info, err := os.Lstat(current)
|
||||
if os.IsNotExist(err) {
|
||||
continue
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if info.Mode()&os.ModeSymlink != 0 {
|
||||
return fmt.Errorf("symlink ancestor refused: %s", current)
|
||||
}
|
||||
if !info.IsDir() {
|
||||
return fmt.Errorf("non-directory ancestor refused: %s", current)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func extractArtifact(artifact, stage string) error {
|
||||
file, err := os.Open(artifact)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer file.Close()
|
||||
gz, err := gzip.NewReader(file)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer gz.Close()
|
||||
tr := tar.NewReader(io.LimitReader(gz, maxArtifactSize))
|
||||
files := 0
|
||||
var total int64
|
||||
for {
|
||||
header, err := tr.Next()
|
||||
if errors.Is(err, io.EOF) {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
clean := filepath.Clean(filepath.FromSlash(header.Name))
|
||||
parts := strings.Split(clean, string(filepath.Separator))
|
||||
if len(parts) == 1 && header.Typeflag == tar.TypeDir {
|
||||
continue
|
||||
}
|
||||
if len(parts) != 2 || parts[0] != "bundle" || parts[1] == "" || parts[1] == "." || parts[1] == ".." {
|
||||
return fmt.Errorf("unsafe archive path %q", header.Name)
|
||||
}
|
||||
if header.Typeflag != tar.TypeReg || header.Size < 0 {
|
||||
return errors.New("archive may contain only regular files")
|
||||
}
|
||||
files++
|
||||
total += header.Size
|
||||
if files > 16 || total > maxArtifactSize {
|
||||
return errors.New("artifact exceeds extraction bounds")
|
||||
}
|
||||
target := filepath.Join(stage, parts[1])
|
||||
mode := os.FileMode(0o644)
|
||||
if !strings.HasSuffix(parts[1], ".json") && parts[1] != "SHA256SUMS" {
|
||||
mode = 0o755
|
||||
}
|
||||
out, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := io.CopyN(out, tr, header.Size); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
if err := out.Sync(); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
if err := out.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if files < 5 {
|
||||
return errors.New("artifact is incomplete")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateRelease(cfg config.Config, release string) error {
|
||||
manifestPath := filepath.Join(release, "RELEASE.json")
|
||||
b, err := os.ReadFile(manifestPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
dec := json.NewDecoder(strings.NewReader(string(b)))
|
||||
dec.DisallowUnknownFields()
|
||||
var manifest packager.Manifest
|
||||
if err := dec.Decode(&manifest); err != nil {
|
||||
return err
|
||||
}
|
||||
var trailing any
|
||||
if err := dec.Decode(&trailing); !errors.Is(err, io.EOF) {
|
||||
return errors.New("release manifest contains trailing data")
|
||||
}
|
||||
if manifest.SchemaVersion != 1 || manifest.Service != cfg.Service.Name || manifest.Binary != cfg.Build.Binary || manifest.GOOS != "linux" || manifest.GOARCH != "amd64" || manifest.CGOEnabled {
|
||||
return errors.New("release manifest does not match configuration")
|
||||
}
|
||||
if matched, _ := regexp.MatchString(`^[0-9a-f]{40}$`, manifest.Commit); !matched {
|
||||
return errors.New("release manifest commit is invalid")
|
||||
}
|
||||
binary := filepath.Join(release, cfg.Build.Binary)
|
||||
sum, err := fileSHA(binary)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if sum != manifest.BinarySHA256 {
|
||||
return errors.New("release binary digest does not match manifest")
|
||||
}
|
||||
if err := verifySums(release); err != nil {
|
||||
return err
|
||||
}
|
||||
entries, err := os.ReadDir(release)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
allowed := map[string]bool{cfg.Build.Binary: true, "BUILDINFO.json": true, "RELEASE.json": true, "SBOM.spdx.json": true, "SHA256SUMS": true}
|
||||
if len(entries) != len(allowed) {
|
||||
return errors.New("release contains unexpected files")
|
||||
}
|
||||
for _, entry := range entries {
|
||||
if !allowed[entry.Name()] || !entry.Type().IsRegular() {
|
||||
return fmt.Errorf("unexpected release entry %s", entry.Name())
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func verifySums(release string) error {
|
||||
b, err := os.ReadFile(filepath.Join(release, "SHA256SUMS"))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
lines := strings.Split(strings.TrimSpace(string(b)), "\n")
|
||||
if len(lines) != 4 {
|
||||
return errors.New("SHA256SUMS must cover four release files")
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
for _, line := range lines {
|
||||
fields := strings.Fields(line)
|
||||
if len(fields) != 2 || len(fields[0]) != 64 {
|
||||
return errors.New("malformed SHA256SUMS")
|
||||
}
|
||||
name := fields[1]
|
||||
if filepath.Base(name) != name || seen[name] {
|
||||
return errors.New("unsafe or duplicate checksum entry")
|
||||
}
|
||||
seen[name] = true
|
||||
actual, err := fileSHA(filepath.Join(release, name))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if actual != fields[0] {
|
||||
return fmt.Errorf("checksum mismatch for %s", name)
|
||||
}
|
||||
}
|
||||
required := []string{"BUILDINFO.json", "RELEASE.json", "SBOM.spdx.json"}
|
||||
sort.Strings(required)
|
||||
for _, name := range required {
|
||||
if !seen[name] {
|
||||
return fmt.Errorf("checksum omitted %s", name)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func fileSHA(path string) (string, error) {
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer f.Close()
|
||||
h := sha256.New()
|
||||
if _, err := io.Copy(h, f); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return hex.EncodeToString(h.Sum(nil)), nil
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func writeHostileArchive(t *testing.T, name string, typeflag byte) {
|
||||
t.Helper()
|
||||
path := filepath.Join(t.TempDir(), "bad.tar.gz")
|
||||
file, err := os.Create(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
gz := gzip.NewWriter(file)
|
||||
tw := tar.NewWriter(gz)
|
||||
body := []byte("x")
|
||||
if err := tw.WriteHeader(&tar.Header{Name: name, Typeflag: typeflag, Mode: 0o644, Size: int64(len(body))}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if typeflag == tar.TypeReg {
|
||||
_, _ = tw.Write(body)
|
||||
}
|
||||
_ = tw.Close()
|
||||
_ = gz.Close()
|
||||
_ = file.Close()
|
||||
stage := filepath.Join(t.TempDir(), "stage")
|
||||
_ = os.Mkdir(stage, 0o700)
|
||||
if err := extractArtifact(path, stage); err == nil {
|
||||
t.Fatalf("accepted hostile entry %q type %d", name, typeflag)
|
||||
}
|
||||
}
|
||||
func TestExtractionRejectsTraversalAndLinks(t *testing.T) {
|
||||
writeHostileArchive(t, "bundle/../../escape", tar.TypeReg)
|
||||
writeHostileArchive(t, "bundle/link", tar.TypeSymlink)
|
||||
}
|
||||
@@ -0,0 +1,399 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package packager
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"debug/buildinfo"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/process"
|
||||
"gamertan.com/tend/internal/provenance"
|
||||
)
|
||||
|
||||
var versionPattern = regexp.MustCompile(`^v[0-9]+\.[0-9]+\.[0-9]+-preview\.[1-9][0-9]*$`)
|
||||
|
||||
type Result struct {
|
||||
Artifact string `json:"artifact"`
|
||||
SHA256 string `json:"sha256"`
|
||||
Commit string `json:"commit"`
|
||||
Version string `json:"version"`
|
||||
}
|
||||
type Manifest struct {
|
||||
SchemaVersion int `json:"schema_version"`
|
||||
Service string `json:"service"`
|
||||
Version string `json:"version"`
|
||||
Commit string `json:"commit"`
|
||||
SourceEpoch int64 `json:"source_date_epoch"`
|
||||
GOOS string `json:"goos"`
|
||||
GOARCH string `json:"goarch"`
|
||||
CGOEnabled bool `json:"cgo_enabled"`
|
||||
Binary string `json:"binary"`
|
||||
BinarySHA256 string `json:"binary_sha256"`
|
||||
GoVersion string `json:"go_version"`
|
||||
ModulePath string `json:"module_path"`
|
||||
ModuleVersion string `json:"module_version"`
|
||||
}
|
||||
type buildRecord struct {
|
||||
GoVersion string `json:"go_version"`
|
||||
Path string `json:"path"`
|
||||
Main moduleRecord `json:"main"`
|
||||
Deps []moduleRecord `json:"dependencies"`
|
||||
Settings []settingRecord `json:"settings"`
|
||||
}
|
||||
type moduleRecord struct {
|
||||
Path string `json:"path"`
|
||||
Version string `json:"version"`
|
||||
Sum string `json:"sum,omitempty"`
|
||||
}
|
||||
type settingRecord struct {
|
||||
Key string `json:"key"`
|
||||
Value string `json:"value"`
|
||||
}
|
||||
type spdxDocument struct {
|
||||
SPDXVersion string `json:"spdxVersion"`
|
||||
DataLicense string `json:"dataLicense"`
|
||||
SPDXID string `json:"SPDXID"`
|
||||
Name string `json:"name"`
|
||||
DocumentNamespace string `json:"documentNamespace"`
|
||||
CreationInfo spdxCreation `json:"creationInfo"`
|
||||
Packages []spdxPackage `json:"packages"`
|
||||
Relationships []spdxRelationship `json:"relationships"`
|
||||
}
|
||||
type spdxCreation struct {
|
||||
Created string `json:"created"`
|
||||
Creators []string `json:"creators"`
|
||||
}
|
||||
type spdxPackage struct {
|
||||
Name string `json:"name"`
|
||||
SPDXID string `json:"SPDXID"`
|
||||
VersionInfo string `json:"versionInfo"`
|
||||
DownloadLocation string `json:"downloadLocation"`
|
||||
FilesAnalyzed bool `json:"filesAnalyzed"`
|
||||
LicenseConcluded string `json:"licenseConcluded"`
|
||||
LicenseDeclared string `json:"licenseDeclared"`
|
||||
}
|
||||
type spdxRelationship struct {
|
||||
SPDXElementID string `json:"spdxElementId"`
|
||||
RelationshipType string `json:"relationshipType"`
|
||||
RelatedSPDXElement string `json:"relatedSpdxElement"`
|
||||
}
|
||||
|
||||
func Package(ctx context.Context, runner process.Runner, cfg config.Config, sourceDir, outDir, version string) (Result, error) {
|
||||
if !versionPattern.MatchString(version) {
|
||||
return Result{}, errors.New("version must use vX.Y.Z-preview.N")
|
||||
}
|
||||
if !filepath.IsAbs(sourceDir) || !filepath.IsAbs(outDir) {
|
||||
return Result{}, errors.New("source and output directories must be absolute")
|
||||
}
|
||||
source, err := provenance.Inspect(ctx, runner, sourceDir, cfg.Build.Branch)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := verifyModules(ctx, runner, sourceDir); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
work, err := os.MkdirTemp("", "tend-package-")
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
defer os.RemoveAll(work)
|
||||
first := filepath.Join(work, "first", cfg.Build.Binary)
|
||||
second := filepath.Join(work, "second", cfg.Build.Binary)
|
||||
if err := build(ctx, runner, cfg, source, sourceDir, version, first); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := build(ctx, runner, cfg, source, sourceDir, version, second); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
firstSHA, err := fileSHA(first)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
secondSHA, err := fileSHA(second)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if firstSHA != secondSHA {
|
||||
return Result{}, errors.New("two clean builds were not byte-identical")
|
||||
}
|
||||
record, err := readBuildRecord(first)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if record.Main.Path == "" {
|
||||
return Result{}, errors.New("built binary has no main module provenance")
|
||||
}
|
||||
if err := verifyBuildSettings(record, source.Commit); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
manifest := Manifest{SchemaVersion: 1, Service: cfg.Service.Name, Version: version, Commit: source.Commit, SourceEpoch: source.Epoch, GOOS: "linux", GOARCH: "amd64", CGOEnabled: false, Binary: cfg.Build.Binary, BinarySHA256: firstSHA, GoVersion: record.GoVersion, ModulePath: record.Main.Path, ModuleVersion: record.Main.Version}
|
||||
bundle := filepath.Join(work, "bundle")
|
||||
if err := os.Mkdir(bundle, 0o700); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := copyFile(first, filepath.Join(bundle, cfg.Build.Binary), 0o755); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := writeJSON(filepath.Join(bundle, "RELEASE.json"), manifest, 0o644); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := writeJSON(filepath.Join(bundle, "BUILDINFO.json"), record, 0o644); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := writeJSON(filepath.Join(bundle, "SBOM.spdx.json"), makeSPDX(cfg, version, source, record), 0o644); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := writeSums(bundle, []string{cfg.Build.Binary, "BUILDINFO.json", "RELEASE.json", "SBOM.spdx.json"}); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := os.MkdirAll(outDir, 0o755); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
artifactName := fmt.Sprintf("%s-%s-linux-amd64.tar.gz", cfg.Service.Name, strings.TrimPrefix(version, "v"))
|
||||
artifact := filepath.Join(outDir, artifactName)
|
||||
if err := writeArchive(artifact, bundle, source.Epoch); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
artifactSHA, err := fileSHA(artifact)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := os.WriteFile(artifact+".sha256", []byte(artifactSHA+" "+artifactName+"\n"), 0o644); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
return Result{Artifact: artifact, SHA256: artifactSHA, Commit: source.Commit, Version: version}, nil
|
||||
}
|
||||
|
||||
func verifyModules(ctx context.Context, runner process.Runner, dir string) error {
|
||||
out, err := runner.Run(ctx, dir, map[string]string{"GOWORK": "off", "GOFLAGS": "-mod=readonly"}, "go", "list", "-m", "-json", "all")
|
||||
if err != nil {
|
||||
return fmt.Errorf("list modules: %w", err)
|
||||
}
|
||||
dec := json.NewDecoder(strings.NewReader(string(out)))
|
||||
count := 0
|
||||
for {
|
||||
var module struct {
|
||||
Path, Version string
|
||||
Main bool
|
||||
Replace *json.RawMessage
|
||||
}
|
||||
if err := dec.Decode(&module); errors.Is(err, io.EOF) {
|
||||
break
|
||||
} else if err != nil {
|
||||
return fmt.Errorf("decode module graph: %w", err)
|
||||
}
|
||||
count++
|
||||
if module.Replace != nil {
|
||||
return fmt.Errorf("module %s uses a replacement", module.Path)
|
||||
}
|
||||
if !module.Main && module.Version == "" {
|
||||
return fmt.Errorf("module %s is not pinned", module.Path)
|
||||
}
|
||||
}
|
||||
if count == 0 {
|
||||
return errors.New("module graph is empty")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func build(ctx context.Context, runner process.Runner, cfg config.Config, source provenance.Source, dir, version, output string) error {
|
||||
if err := os.MkdirAll(filepath.Dir(output), 0o700); err != nil {
|
||||
return err
|
||||
}
|
||||
ldflags := []string{"-s", "-w"}
|
||||
date := time.Unix(source.Epoch, 0).UTC().Format(time.RFC3339)
|
||||
pairs := [][2]string{{cfg.Build.VersionSymbol, version}, {cfg.Build.CommitSymbol, source.Commit}, {cfg.Build.DateSymbol, date}}
|
||||
for _, pair := range pairs {
|
||||
if pair[0] != "" {
|
||||
ldflags = append(ldflags, "-X", pair[0]+"="+pair[1])
|
||||
}
|
||||
}
|
||||
args := []string{"build", "-mod=readonly", "-trimpath", "-buildvcs=true", "-ldflags", strings.Join(ldflags, " "), "-o", output, cfg.Build.Package}
|
||||
env := map[string]string{"GOWORK": "off", "GOFLAGS": "-mod=readonly", "GOOS": "linux", "GOARCH": "amd64", "CGO_ENABLED": "0", "SOURCE_DATE_EPOCH": fmt.Sprint(source.Epoch)}
|
||||
if _, err := runner.Run(ctx, dir, env, "go", args...); err != nil {
|
||||
return fmt.Errorf("build candidate: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func readBuildRecord(path string) (buildRecord, error) {
|
||||
info, err := buildinfo.ReadFile(path)
|
||||
if err != nil {
|
||||
return buildRecord{}, fmt.Errorf("read Go build info: %w", err)
|
||||
}
|
||||
record := buildRecord{GoVersion: info.GoVersion, Path: info.Path, Main: moduleRecord{Path: info.Main.Path, Version: info.Main.Version, Sum: info.Main.Sum}}
|
||||
for _, dep := range info.Deps {
|
||||
if dep.Replace != nil {
|
||||
return buildRecord{}, fmt.Errorf("built binary contains replacement for %s", dep.Path)
|
||||
}
|
||||
record.Deps = append(record.Deps, moduleRecord{Path: dep.Path, Version: dep.Version, Sum: dep.Sum})
|
||||
}
|
||||
for _, setting := range info.Settings {
|
||||
record.Settings = append(record.Settings, settingRecord{Key: setting.Key, Value: setting.Value})
|
||||
}
|
||||
sort.Slice(record.Deps, func(i, j int) bool { return record.Deps[i].Path < record.Deps[j].Path })
|
||||
sort.Slice(record.Settings, func(i, j int) bool { return record.Settings[i].Key < record.Settings[j].Key })
|
||||
return record, nil
|
||||
}
|
||||
|
||||
func verifyBuildSettings(record buildRecord, commit string) error {
|
||||
settings := map[string]string{}
|
||||
for _, setting := range record.Settings {
|
||||
settings[setting.Key] = setting.Value
|
||||
}
|
||||
for key, expected := range map[string]string{"vcs.revision": commit, "vcs.modified": "false", "GOOS": "linux", "GOARCH": "amd64", "CGO_ENABLED": "0"} {
|
||||
if settings[key] != expected {
|
||||
return fmt.Errorf("build setting %s is %q, expected %q", key, settings[key], expected)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func makeSPDX(cfg config.Config, version string, source provenance.Source, record buildRecord) spdxDocument {
|
||||
created := time.Unix(source.Epoch, 0).UTC().Format("2006-01-02T15:04:05Z")
|
||||
modules := append([]moduleRecord{record.Main}, record.Deps...)
|
||||
doc := spdxDocument{SPDXVersion: "SPDX-2.3", DataLicense: "CC0-1.0", SPDXID: "SPDXRef-DOCUMENT", Name: cfg.Service.Name + "-" + version, DocumentNamespace: "https://gamertan.com/tend/sbom/" + source.Commit + "/" + cfg.Service.Name, CreationInfo: spdxCreation{Created: created, Creators: []string{"Tool: gamertan.com/tend"}}}
|
||||
for i, module := range modules {
|
||||
id := fmt.Sprintf("SPDXRef-Package-%d", i+1)
|
||||
versionInfo := module.Version
|
||||
if versionInfo == "" {
|
||||
versionInfo = source.Commit
|
||||
}
|
||||
doc.Packages = append(doc.Packages, spdxPackage{Name: module.Path, SPDXID: id, VersionInfo: versionInfo, DownloadLocation: "NOASSERTION", FilesAnalyzed: false, LicenseConcluded: "NOASSERTION", LicenseDeclared: "NOASSERTION"})
|
||||
doc.Relationships = append(doc.Relationships, spdxRelationship{SPDXElementID: "SPDXRef-DOCUMENT", RelationshipType: "DESCRIBES", RelatedSPDXElement: id})
|
||||
}
|
||||
return doc
|
||||
}
|
||||
func writeJSON(path string, value any, mode os.FileMode) error {
|
||||
b, err := json.MarshalIndent(value, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
b = append(b, '\n')
|
||||
return os.WriteFile(path, b, mode)
|
||||
}
|
||||
func writeSums(dir string, names []string) error {
|
||||
sort.Strings(names)
|
||||
var b strings.Builder
|
||||
for _, name := range names {
|
||||
sum, err := fileSHA(filepath.Join(dir, name))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Fprintf(&b, "%s %s\n", sum, name)
|
||||
}
|
||||
return os.WriteFile(filepath.Join(dir, "SHA256SUMS"), []byte(b.String()), 0o644)
|
||||
}
|
||||
func writeArchive(path, bundle string, epoch int64) error {
|
||||
tmp := path + ".tmp"
|
||||
_ = os.Remove(tmp)
|
||||
file, err := os.OpenFile(tmp, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o644)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
ok := false
|
||||
defer func() {
|
||||
_ = file.Close()
|
||||
if !ok {
|
||||
_ = os.Remove(tmp)
|
||||
}
|
||||
}()
|
||||
gz := gzip.NewWriter(file)
|
||||
gz.Header.ModTime = time.Unix(0, 0)
|
||||
gz.Header.OS = 255
|
||||
tw := tar.NewWriter(gz)
|
||||
entries, err := os.ReadDir(bundle)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
names := make([]string, 0, len(entries))
|
||||
for _, entry := range entries {
|
||||
if entry.Type().IsRegular() {
|
||||
names = append(names, entry.Name())
|
||||
}
|
||||
}
|
||||
sort.Strings(names)
|
||||
root := filepath.Base(bundle)
|
||||
if err := tw.WriteHeader(&tar.Header{Name: root + "/", Typeflag: tar.TypeDir, Mode: 0o755, ModTime: time.Unix(epoch, 0), Uid: 0, Gid: 0}); err != nil {
|
||||
return err
|
||||
}
|
||||
for _, name := range names {
|
||||
data, err := os.ReadFile(filepath.Join(bundle, name))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
mode := int64(0o644)
|
||||
if name != "BUILDINFO.json" && !strings.HasSuffix(name, ".json") && name != "SHA256SUMS" {
|
||||
mode = 0o755
|
||||
}
|
||||
if err := tw.WriteHeader(&tar.Header{Name: root + "/" + name, Typeflag: tar.TypeReg, Mode: mode, Size: int64(len(data)), ModTime: time.Unix(epoch, 0), Uid: 0, Gid: 0}); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := tw.Write(data); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if err := tw.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := gz.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := file.Sync(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := file.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Rename(tmp, path); err != nil {
|
||||
return err
|
||||
}
|
||||
ok = true
|
||||
return nil
|
||||
}
|
||||
func copyFile(source, target string, mode os.FileMode) error {
|
||||
in, err := os.Open(source)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer in.Close()
|
||||
out, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := io.Copy(out, in); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
if err := out.Sync(); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
return out.Close()
|
||||
}
|
||||
func fileSHA(path string) (string, error) {
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer f.Close()
|
||||
h := sha256.New()
|
||||
if _, err := io.Copy(h, f); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return hex.EncodeToString(h.Sum(nil)), nil
|
||||
}
|
||||
@@ -0,0 +1,77 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package packager
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"errors"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestVersionPattern(t *testing.T) {
|
||||
for _, v := range []string{"v0.1.0-preview.1", "v12.3.4-preview.99"} {
|
||||
if !versionPattern.MatchString(v) {
|
||||
t.Errorf("rejected %q", v)
|
||||
}
|
||||
}
|
||||
for _, v := range []string{"v0.1.0", "0.1.0-preview.1", "v0.1.0-preview.0", "v0.1.0-preview.01", "v0.1.0-preview.1+dirty"} {
|
||||
if versionPattern.MatchString(v) {
|
||||
t.Errorf("accepted %q", v)
|
||||
}
|
||||
}
|
||||
}
|
||||
func TestArchiveHasOnlyRegularBundleEntries(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
bundle := filepath.Join(dir, "bundle")
|
||||
if err := os.Mkdir(bundle, 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(bundle, "app"), []byte("binary"), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(bundle, "RELEASE.json"), []byte("{}\n"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
archive := filepath.Join(dir, "out.tar.gz")
|
||||
if err := writeArchive(archive, bundle, 1); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
f, err := os.Open(archive)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer f.Close()
|
||||
gz, err := gzip.NewReader(f)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer gz.Close()
|
||||
tr := tar.NewReader(gz)
|
||||
seen := 0
|
||||
for {
|
||||
h, err := tr.Next()
|
||||
if errors.Is(err, io.EOF) {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if h.Name == "bundle/" {
|
||||
continue
|
||||
}
|
||||
if h.Typeflag != tar.TypeReg {
|
||||
t.Fatalf("unexpected type %d", h.Typeflag)
|
||||
}
|
||||
if filepath.IsAbs(h.Name) || filepath.Clean(h.Name) != h.Name {
|
||||
t.Fatalf("unsafe path %q", h.Name)
|
||||
}
|
||||
seen++
|
||||
}
|
||||
if seen != 2 {
|
||||
t.Fatalf("saw %d files", seen)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package process
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"sort"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const maxOutput = 4 << 20
|
||||
|
||||
type Runner interface {
|
||||
Run(ctx context.Context, dir string, env map[string]string, name string, args ...string) ([]byte, error)
|
||||
}
|
||||
|
||||
type ExecRunner struct{}
|
||||
|
||||
func (ExecRunner) Run(ctx context.Context, dir string, env map[string]string, name string, args ...string) ([]byte, error) {
|
||||
cmd := exec.CommandContext(ctx, name, args...)
|
||||
cmd.Dir = dir
|
||||
cmd.Env = mergeEnv(os.Environ(), env)
|
||||
var output limitedBuffer
|
||||
cmd.Stdout = &output
|
||||
cmd.Stderr = &output
|
||||
err := cmd.Run()
|
||||
if err != nil {
|
||||
return output.Bytes(), fmt.Errorf("%s failed: %w: %s", name, err, strings.TrimSpace(output.String()))
|
||||
}
|
||||
return output.Bytes(), nil
|
||||
}
|
||||
|
||||
type limitedBuffer struct{ bytes.Buffer }
|
||||
|
||||
func (b *limitedBuffer) Write(p []byte) (int, error) {
|
||||
written := len(p)
|
||||
remaining := maxOutput - b.Len()
|
||||
if remaining > 0 {
|
||||
if len(p) > remaining {
|
||||
p = p[:remaining]
|
||||
}
|
||||
_, _ = b.Buffer.Write(p)
|
||||
}
|
||||
return written, nil
|
||||
}
|
||||
|
||||
func mergeEnv(base []string, extra map[string]string) []string {
|
||||
values := make(map[string]string, len(base)+len(extra))
|
||||
for _, pair := range base {
|
||||
key, value, ok := strings.Cut(pair, "=")
|
||||
if ok {
|
||||
values[key] = value
|
||||
}
|
||||
}
|
||||
for key, value := range extra {
|
||||
values[key] = value
|
||||
}
|
||||
keys := make([]string, 0, len(values))
|
||||
for key := range values {
|
||||
keys = append(keys, key)
|
||||
}
|
||||
sort.Strings(keys)
|
||||
out := make([]string, 0, len(keys))
|
||||
for _, key := range keys {
|
||||
out = append(out, key+"="+values[key])
|
||||
}
|
||||
return out
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package provenance
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"gamertan.com/tend/internal/process"
|
||||
)
|
||||
|
||||
type Source struct {
|
||||
Commit string
|
||||
Epoch int64
|
||||
}
|
||||
|
||||
func Inspect(ctx context.Context, runner process.Runner, dir, branch string) (Source, error) {
|
||||
status, err := runner.Run(ctx, dir, nil, "git", "status", "--porcelain=v1", "--untracked-files=all")
|
||||
if err != nil {
|
||||
return Source{}, err
|
||||
}
|
||||
if len(status) != 0 {
|
||||
return Source{}, errors.New("source checkout is not clean")
|
||||
}
|
||||
commitOut, err := runner.Run(ctx, dir, nil, "git", "rev-parse", "HEAD")
|
||||
if err != nil {
|
||||
return Source{}, err
|
||||
}
|
||||
commit := strings.TrimSpace(string(commitOut))
|
||||
if len(commit) != 40 {
|
||||
return Source{}, errors.New("source commit is not a full SHA-1 object id")
|
||||
}
|
||||
remoteOut, err := runner.Run(ctx, dir, nil, "git", "ls-remote", "--exit-code", "origin", "refs/heads/"+branch)
|
||||
if err != nil {
|
||||
return Source{}, fmt.Errorf("verify pushed commit: %w", err)
|
||||
}
|
||||
fields := strings.Fields(string(remoteOut))
|
||||
if len(fields) != 2 || fields[0] != commit || fields[1] != "refs/heads/"+branch {
|
||||
return Source{}, errors.New("HEAD is not the exact pushed branch commit")
|
||||
}
|
||||
epochOut, err := runner.Run(ctx, dir, nil, "git", "show", "-s", "--format=%ct", commit)
|
||||
if err != nil {
|
||||
return Source{}, err
|
||||
}
|
||||
epoch, err := strconv.ParseInt(strings.TrimSpace(string(epochOut)), 10, 64)
|
||||
if err != nil || epoch <= 0 {
|
||||
return Source{}, errors.New("commit timestamp is invalid")
|
||||
}
|
||||
return Source{Commit: commit, Epoch: epoch}, nil
|
||||
}
|
||||
@@ -0,0 +1,147 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package state
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
const SchemaVersion = 1
|
||||
|
||||
type Record struct {
|
||||
SchemaVersion int `json:"schema_version"`
|
||||
Strategy string `json:"strategy"`
|
||||
ActiveSlot string `json:"active_slot"`
|
||||
ActiveRelease string `json:"active_release"`
|
||||
PreviousSlot string `json:"previous_slot,omitempty"`
|
||||
PreviousRelease string `json:"previous_release,omitempty"`
|
||||
UpdatedAt string `json:"updated_at"`
|
||||
}
|
||||
|
||||
func Load(path, root, strategy string) (Record, error) {
|
||||
b, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return Record{}, err
|
||||
}
|
||||
dec := json.NewDecoder(bytes.NewReader(b))
|
||||
dec.DisallowUnknownFields()
|
||||
var record Record
|
||||
if err := dec.Decode(&record); err != nil {
|
||||
return Record{}, fmt.Errorf("decode state: %w", err)
|
||||
}
|
||||
var extra any
|
||||
if err := dec.Decode(&extra); !errors.Is(err, io.EOF) {
|
||||
return Record{}, errors.New("state contains trailing data")
|
||||
}
|
||||
if err := record.Validate(root, strategy); err != nil {
|
||||
return Record{}, err
|
||||
}
|
||||
return record, nil
|
||||
}
|
||||
|
||||
func (r Record) Validate(root, strategy string) error {
|
||||
if r.SchemaVersion != SchemaVersion {
|
||||
return errors.New("state schema version is unsupported")
|
||||
}
|
||||
if r.Strategy != strategy {
|
||||
return errors.New("state strategy does not match configuration")
|
||||
}
|
||||
if strategy == "blue_green" && (r.ActiveSlot != "blue" && r.ActiveSlot != "green") {
|
||||
return errors.New("active slot is invalid")
|
||||
}
|
||||
if strategy == "singleton_candidate" && r.ActiveSlot != "singleton" {
|
||||
return errors.New("singleton state slot is invalid")
|
||||
}
|
||||
if err := releaseBelow(root, r.ActiveRelease); err != nil {
|
||||
return fmt.Errorf("active release: %w", err)
|
||||
}
|
||||
if r.PreviousRelease != "" {
|
||||
if err := releaseBelow(root, r.PreviousRelease); err != nil {
|
||||
return fmt.Errorf("previous release: %w", err)
|
||||
}
|
||||
}
|
||||
if strategy == "blue_green" && r.PreviousRelease != "" && r.PreviousSlot == r.ActiveSlot {
|
||||
return errors.New("previous slot must differ from active slot")
|
||||
}
|
||||
if _, err := time.Parse(time.RFC3339, r.UpdatedAt); err != nil {
|
||||
return errors.New("state timestamp is invalid")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func Store(path, root string, record Record) error {
|
||||
if err := record.Validate(root, record.Strategy); err != nil {
|
||||
return err
|
||||
}
|
||||
if info, err := os.Lstat(path); err == nil && info.Mode()&os.ModeSymlink != 0 {
|
||||
return errors.New("state file must not be a symlink")
|
||||
} else if err != nil && !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
b, err := json.MarshalIndent(record, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
b = append(b, '\n')
|
||||
dir := filepath.Dir(path)
|
||||
if err := os.MkdirAll(dir, 0o755); err != nil {
|
||||
return err
|
||||
}
|
||||
tmp, err := os.CreateTemp(dir, ".tend-state-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
name := tmp.Name()
|
||||
ok := false
|
||||
defer func() {
|
||||
_ = tmp.Close()
|
||||
if !ok {
|
||||
_ = os.Remove(name)
|
||||
}
|
||||
}()
|
||||
if err := tmp.Chmod(0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := tmp.Write(b); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tmp.Sync(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tmp.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Rename(name, path); err != nil {
|
||||
return err
|
||||
}
|
||||
ok = true
|
||||
return syncDir(dir)
|
||||
}
|
||||
|
||||
func releaseBelow(root, path string) error {
|
||||
if !filepath.IsAbs(path) || filepath.Clean(path) != path {
|
||||
return errors.New("must be a clean absolute path")
|
||||
}
|
||||
releases := filepath.Join(root, "releases")
|
||||
rel, err := filepath.Rel(releases, path)
|
||||
if err != nil || rel == "." || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || strings.ContainsRune(rel, filepath.Separator) {
|
||||
return errors.New("must be one direct child of the release directory")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func syncDir(path string) error {
|
||||
dir, err := os.Open(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer dir.Close()
|
||||
return dir.Sync()
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package state
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestStoreLoadRoundTripAndRejectSymlink(t *testing.T) {
|
||||
root := filepath.Join(t.TempDir(), "service")
|
||||
release := filepath.Join(root, "releases", "sha256-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
|
||||
if err := os.MkdirAll(release, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
path := filepath.Join(root, "state.json")
|
||||
record := Record{SchemaVersion: 1, Strategy: "singleton_candidate", ActiveSlot: "singleton", ActiveRelease: release, UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
|
||||
if err := Store(path, root, record); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
loaded, err := Load(path, root, "singleton_candidate")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if loaded.ActiveRelease != release {
|
||||
t.Fatalf("release=%q", loaded.ActiveRelease)
|
||||
}
|
||||
if err := os.Remove(path); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.Symlink(filepath.Join(root, "elsewhere"), path); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := Store(path, root, record); err == nil {
|
||||
t.Fatal("expected symlink refusal")
|
||||
}
|
||||
}
|
||||
func TestRecordRejectsReleaseOutsideRoot(t *testing.T) {
|
||||
record := Record{SchemaVersion: 1, Strategy: "singleton_candidate", ActiveSlot: "singleton", ActiveRelease: "/tmp/other/release", UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
|
||||
if err := record.Validate("/opt/example", "singleton_candidate"); err == nil {
|
||||
t.Fatal("expected path refusal")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package version
|
||||
|
||||
var (
|
||||
Version = "v0.1.0-dev"
|
||||
Commit = "unknown"
|
||||
Date = "unknown"
|
||||
)
|
||||
Reference in New Issue
Block a user