docs: publish Tend Compose continuity evidence
Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
@@ -0,0 +1,348 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/netip"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const (
|
||||
SchemaVersion = 2
|
||||
SharedLockFile = "/run/lock/tend-deploy.lock"
|
||||
)
|
||||
|
||||
var (
|
||||
namePattern = regexp.MustCompile(`^[a-z][a-z0-9-]{1,62}$`)
|
||||
binaryPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)
|
||||
packagePattern = regexp.MustCompile(`^\./[A-Za-z0-9_./-]+$`)
|
||||
symbolPattern = regexp.MustCompile(`^[A-Za-z0-9._/-]+$`)
|
||||
unitPattern = regexp.MustCompile(`^[A-Za-z0-9_.@-]+\.service$`)
|
||||
)
|
||||
|
||||
type Config struct {
|
||||
SchemaVersion int `json:"schema_version"`
|
||||
Service Service `json:"service"`
|
||||
Build Build `json:"build"`
|
||||
Deployment Deployment `json:"deployment"`
|
||||
}
|
||||
|
||||
type Service struct {
|
||||
Name string `json:"name"`
|
||||
AllowedHost string `json:"allowed_host"`
|
||||
EnvironmentFile string `json:"environment_file"`
|
||||
}
|
||||
|
||||
type Build struct {
|
||||
Package string `json:"package"`
|
||||
Binary string `json:"binary"`
|
||||
Branch string `json:"branch"`
|
||||
VersionSymbol string `json:"version_symbol,omitempty"`
|
||||
CommitSymbol string `json:"commit_symbol,omitempty"`
|
||||
DateSymbol string `json:"date_symbol,omitempty"`
|
||||
}
|
||||
|
||||
type Deployment struct {
|
||||
Strategy string `json:"strategy"`
|
||||
Root string `json:"root"`
|
||||
LockFile string `json:"lock_file"`
|
||||
StateFile string `json:"state_file"`
|
||||
EventLog string `json:"event_log"`
|
||||
HealthPath string `json:"health_path"`
|
||||
ReadinessPath string `json:"readiness_path"`
|
||||
CandidateTimeoutSecs int `json:"candidate_timeout_seconds"`
|
||||
ActivationWindowSecs int `json:"activation_window_seconds"`
|
||||
Smoke []Smoke `json:"smoke"`
|
||||
PublicSmoke []PublicSmoke `json:"public_smoke"`
|
||||
BlueGreen *BlueGreen `json:"blue_green,omitempty"`
|
||||
Singleton *Singleton `json:"singleton,omitempty"`
|
||||
}
|
||||
|
||||
type Smoke struct {
|
||||
Path string `json:"path"`
|
||||
Contains string `json:"contains"`
|
||||
}
|
||||
|
||||
type PublicSmoke struct {
|
||||
URL string `json:"url"`
|
||||
Contains string `json:"contains"`
|
||||
}
|
||||
|
||||
type BlueGreen struct {
|
||||
CaddyConfig string `json:"caddy_config"`
|
||||
CaddyHandler string `json:"caddy_handler"`
|
||||
CaddyHandlerTemplate string `json:"caddy_handler_template"`
|
||||
BootstrapActive string `json:"bootstrap_active"`
|
||||
Blue Slot `json:"blue"`
|
||||
Green Slot `json:"green"`
|
||||
}
|
||||
|
||||
type Slot struct {
|
||||
Unit string `json:"unit"`
|
||||
Address string `json:"address"`
|
||||
Link string `json:"link"`
|
||||
}
|
||||
|
||||
type Singleton struct {
|
||||
Unit string `json:"unit"`
|
||||
Address string `json:"address"`
|
||||
CandidateAddress string `json:"candidate_address"`
|
||||
ListenEnv string `json:"listen_env"`
|
||||
CurrentLink string `json:"current_link"`
|
||||
PreviousLink string `json:"previous_link"`
|
||||
CaddyConfig string `json:"caddy_config"`
|
||||
CaddyHandler string `json:"caddy_handler"`
|
||||
CaddyHandlerTemplate string `json:"caddy_handler_template"`
|
||||
}
|
||||
|
||||
func Load(path string) (Config, error) {
|
||||
if !filepath.IsAbs(path) {
|
||||
return Config{}, errors.New("configuration path must be absolute")
|
||||
}
|
||||
info, err := os.Lstat(path)
|
||||
if err != nil {
|
||||
return Config{}, fmt.Errorf("inspect configuration: %w", err)
|
||||
}
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Size() > 1<<20 {
|
||||
return Config{}, errors.New("configuration must be a bounded regular file, not a symlink")
|
||||
}
|
||||
b, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return Config{}, fmt.Errorf("read configuration: %w", err)
|
||||
}
|
||||
dec := json.NewDecoder(bytes.NewReader(b))
|
||||
dec.DisallowUnknownFields()
|
||||
var cfg Config
|
||||
if err := dec.Decode(&cfg); err != nil {
|
||||
return Config{}, fmt.Errorf("decode configuration: %w", err)
|
||||
}
|
||||
if err := requireEOF(dec); err != nil {
|
||||
return Config{}, err
|
||||
}
|
||||
if err := cfg.Validate(); err != nil {
|
||||
return Config{}, err
|
||||
}
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func requireEOF(dec *json.Decoder) error {
|
||||
var extra any
|
||||
if err := dec.Decode(&extra); !errors.Is(err, io.EOF) {
|
||||
if err == nil {
|
||||
return errors.New("configuration contains multiple JSON values")
|
||||
}
|
||||
return fmt.Errorf("decode trailing configuration: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (c Config) Validate() error {
|
||||
if c.SchemaVersion != SchemaVersion {
|
||||
return fmt.Errorf("schema_version must be %d", SchemaVersion)
|
||||
}
|
||||
if !namePattern.MatchString(c.Service.Name) {
|
||||
return errors.New("service.name is invalid")
|
||||
}
|
||||
if c.Service.AllowedHost == "" || strings.ContainsAny(c.Service.AllowedHost, "/\\\x00\r\n\t ") {
|
||||
return errors.New("service.allowed_host is invalid")
|
||||
}
|
||||
if err := safeAbsolute("service.environment_file", c.Service.EnvironmentFile); err != nil {
|
||||
return err
|
||||
}
|
||||
if !within("/etc/tend/environment", c.Service.EnvironmentFile) {
|
||||
return errors.New("service.environment_file must be below /etc/tend/environment")
|
||||
}
|
||||
if !packagePattern.MatchString(c.Build.Package) || strings.Contains(c.Build.Package, "..") {
|
||||
return errors.New("build.package must be a local package without traversal")
|
||||
}
|
||||
if !binaryPattern.MatchString(c.Build.Binary) {
|
||||
return errors.New("build.binary is invalid")
|
||||
}
|
||||
if c.Build.Branch == "" || strings.ContainsAny(c.Build.Branch, "\x00\r\n\t ~^:?*[\\") {
|
||||
return errors.New("build.branch is invalid")
|
||||
}
|
||||
for label, symbol := range map[string]string{
|
||||
"build.version_symbol": c.Build.VersionSymbol,
|
||||
"build.commit_symbol": c.Build.CommitSymbol,
|
||||
"build.date_symbol": c.Build.DateSymbol,
|
||||
} {
|
||||
if symbol != "" && !symbolPattern.MatchString(symbol) {
|
||||
return fmt.Errorf("%s is invalid", label)
|
||||
}
|
||||
}
|
||||
d := c.Deployment
|
||||
if err := safeAbsolute("deployment.root", d.Root); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := safeAbsolute("deployment.lock_file", d.LockFile); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := safeAbsolute("deployment.state_file", d.StateFile); err != nil {
|
||||
return err
|
||||
}
|
||||
if filepath.Clean(d.StateFile) == filepath.Clean(d.Root) || !within(d.Root, d.StateFile) {
|
||||
return errors.New("deployment.state_file must be below deployment.root")
|
||||
}
|
||||
if err := safeAbsolute("deployment.event_log", d.EventLog); err != nil {
|
||||
return err
|
||||
}
|
||||
if filepath.Clean(d.EventLog) == filepath.Clean(d.Root) || !within(d.Root, d.EventLog) || filepath.Clean(d.EventLog) == filepath.Clean(d.StateFile) {
|
||||
return errors.New("deployment.event_log must be a distinct file below deployment.root")
|
||||
}
|
||||
if !safeHTTPPath(d.HealthPath) || !safeHTTPPath(d.ReadinessPath) {
|
||||
return errors.New("health and readiness paths must be absolute HTTP paths")
|
||||
}
|
||||
if d.CandidateTimeoutSecs < 2 || d.CandidateTimeoutSecs > 300 {
|
||||
return errors.New("candidate_timeout_seconds must be between 2 and 300")
|
||||
}
|
||||
if d.ActivationWindowSecs < 1 || d.ActivationWindowSecs > 120 {
|
||||
return errors.New("activation_window_seconds must be between 1 and 120")
|
||||
}
|
||||
if len(d.Smoke) == 0 || len(d.Smoke) > 32 {
|
||||
return errors.New("deployment.smoke must contain 1 to 32 checks")
|
||||
}
|
||||
for i, smoke := range d.Smoke {
|
||||
if !safeHTTPPath(smoke.Path) || smoke.Contains == "" || len(smoke.Contains) > 4096 || strings.ContainsRune(smoke.Contains, '\x00') {
|
||||
return fmt.Errorf("deployment.smoke[%d] is invalid", i)
|
||||
}
|
||||
}
|
||||
if len(d.PublicSmoke) == 0 || len(d.PublicSmoke) > 16 {
|
||||
return errors.New("deployment.public_smoke must contain 1 to 16 checks")
|
||||
}
|
||||
for i, smoke := range d.PublicSmoke {
|
||||
parsed, err := url.Parse(smoke.URL)
|
||||
if err != nil || parsed.Scheme != "https" || parsed.Host == "" || parsed.User != nil || parsed.Fragment != "" || parsed.RawQuery != "" || parsed.Opaque != "" || smoke.Contains == "" || len(smoke.Contains) > 4096 || strings.ContainsRune(smoke.Contains, '\x00') {
|
||||
return fmt.Errorf("deployment.public_smoke[%d] is invalid", i)
|
||||
}
|
||||
}
|
||||
switch d.Strategy {
|
||||
case "blue_green":
|
||||
if d.BlueGreen == nil || d.Singleton != nil {
|
||||
return errors.New("blue_green strategy requires only blue_green settings")
|
||||
}
|
||||
if err := validateBlueGreen(d.Root, *d.BlueGreen); err != nil {
|
||||
return err
|
||||
}
|
||||
case "singleton_candidate":
|
||||
if d.Singleton == nil || d.BlueGreen != nil {
|
||||
return errors.New("singleton_candidate strategy requires only singleton settings")
|
||||
}
|
||||
if err := validateSingleton(d.Root, *d.Singleton); err != nil {
|
||||
return err
|
||||
}
|
||||
default:
|
||||
return errors.New("deployment.strategy must be blue_green or singleton_candidate")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateBlueGreen(root string, b BlueGreen) error {
|
||||
if b.BootstrapActive != "blue" && b.BootstrapActive != "green" {
|
||||
return errors.New("blue_green.bootstrap_active must be blue or green")
|
||||
}
|
||||
for label, path := range map[string]string{"caddy_config": b.CaddyConfig, "caddy_handler": b.CaddyHandler, "caddy_handler_template": b.CaddyHandlerTemplate} {
|
||||
if err := safeAbsolute("deployment.blue_green."+label, path); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if filepath.Clean(b.CaddyHandler) == filepath.Clean(b.CaddyHandlerTemplate) {
|
||||
return errors.New("Caddy handler and template must be different files")
|
||||
}
|
||||
if err := validateSlot(root, "blue", b.Blue); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := validateSlot(root, "green", b.Green); err != nil {
|
||||
return err
|
||||
}
|
||||
if b.Blue.Address == b.Green.Address || b.Blue.Unit == b.Green.Unit || b.Blue.Link == b.Green.Link {
|
||||
return errors.New("blue and green slots must be distinct")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateSlot(root, name string, slot Slot) error {
|
||||
if !unitPattern.MatchString(slot.Unit) {
|
||||
return fmt.Errorf("%s unit is invalid", name)
|
||||
}
|
||||
if err := loopbackAddress(slot.Address); err != nil {
|
||||
return fmt.Errorf("%s address: %w", name, err)
|
||||
}
|
||||
if err := safeAbsolute(name+" link", slot.Link); err != nil {
|
||||
return err
|
||||
}
|
||||
if !within(root, slot.Link) {
|
||||
return fmt.Errorf("%s link must be below deployment.root", name)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateSingleton(root string, s Singleton) error {
|
||||
if !unitPattern.MatchString(s.Unit) {
|
||||
return errors.New("singleton unit is invalid")
|
||||
}
|
||||
if err := loopbackAddress(s.Address); err != nil {
|
||||
return fmt.Errorf("singleton address: %w", err)
|
||||
}
|
||||
if err := loopbackAddress(s.CandidateAddress); err != nil {
|
||||
return fmt.Errorf("candidate address: %w", err)
|
||||
}
|
||||
if s.Address == s.CandidateAddress {
|
||||
return errors.New("singleton addresses must be distinct")
|
||||
}
|
||||
if !regexp.MustCompile(`^[A-Z][A-Z0-9_]{0,63}$`).MatchString(s.ListenEnv) {
|
||||
return errors.New("listen_env is invalid")
|
||||
}
|
||||
for _, entry := range []struct{ name, path string }{{"current_link", s.CurrentLink}, {"previous_link", s.PreviousLink}} {
|
||||
if err := safeAbsolute(entry.name, entry.path); err != nil {
|
||||
return err
|
||||
}
|
||||
if !within(root, entry.path) {
|
||||
return fmt.Errorf("%s must be below deployment.root", entry.name)
|
||||
}
|
||||
}
|
||||
if s.CurrentLink == s.PreviousLink {
|
||||
return errors.New("current and previous links must differ")
|
||||
}
|
||||
for label, path := range map[string]string{"caddy_config": s.CaddyConfig, "caddy_handler": s.CaddyHandler, "caddy_handler_template": s.CaddyHandlerTemplate} {
|
||||
if err := safeAbsolute("deployment.singleton."+label, path); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if filepath.Clean(s.CaddyHandler) == filepath.Clean(s.CaddyHandlerTemplate) {
|
||||
return errors.New("singleton Caddy handler and template must be different files")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func safeAbsolute(label, path string) error {
|
||||
if !filepath.IsAbs(path) || filepath.Clean(path) != path || path == string(filepath.Separator) || strings.ContainsRune(path, '\x00') {
|
||||
return fmt.Errorf("%s must be a clean, non-root absolute path", label)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func within(root, child string) bool {
|
||||
rel, err := filepath.Rel(filepath.Clean(root), filepath.Clean(child))
|
||||
return err == nil && rel != "." && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
|
||||
}
|
||||
|
||||
func safeHTTPPath(path string) bool {
|
||||
return strings.HasPrefix(path, "/") && !strings.HasPrefix(path, "//") && !strings.ContainsAny(path, "\x00\r\n?#")
|
||||
}
|
||||
|
||||
func loopbackAddress(value string) error {
|
||||
addr, err := netip.ParseAddrPort(value)
|
||||
if err != nil || !addr.Addr().IsLoopback() || addr.Port() == 0 {
|
||||
return errors.New("must be a loopback IP and nonzero port")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,90 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func validConfig() Config {
|
||||
return Config{
|
||||
SchemaVersion: 2,
|
||||
Service: Service{Name: "example-site", AllowedHost: "example.test", EnvironmentFile: "/etc/tend/environment/example-site.env"},
|
||||
Build: Build{Package: "./cmd/site", Binary: "example-site", Branch: "main"},
|
||||
Deployment: Deployment{
|
||||
Strategy: "blue_green", Root: "/opt/example-site", LockFile: SharedLockFile,
|
||||
StateFile: "/opt/example-site/state.json", EventLog: "/opt/example-site/deployment-events.jsonl", HealthPath: "/healthz", ReadinessPath: "/readyz",
|
||||
CandidateTimeoutSecs: 30, ActivationWindowSecs: 10, Smoke: []Smoke{{Path: "/", Contains: "Example"}},
|
||||
PublicSmoke: []PublicSmoke{{URL: "https://example.test/", Contains: "Example"}},
|
||||
BlueGreen: &BlueGreen{
|
||||
CaddyConfig: "/etc/caddy/Caddyfile", CaddyHandler: "/etc/caddy/example.caddy",
|
||||
CaddyHandlerTemplate: "/etc/example/caddy.template",
|
||||
BootstrapActive: "blue",
|
||||
Blue: Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: "/opt/example-site/slots/blue"},
|
||||
Green: Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: "/opt/example-site/slots/green"},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateAcceptsBlueGreen(t *testing.T) {
|
||||
if err := validConfig().Validate(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateSingletonRequiresDistinctCaddyHandoffFiles(t *testing.T) {
|
||||
cfg := validConfig()
|
||||
cfg.Deployment.Strategy = "singleton_candidate"
|
||||
cfg.Deployment.BlueGreen = nil
|
||||
cfg.Deployment.Singleton = &Singleton{
|
||||
Unit: "example-site.service", Address: "127.0.0.1:8092", CandidateAddress: "127.0.0.1:18092", ListenEnv: "EXAMPLE_LISTEN",
|
||||
CurrentLink: "/opt/example-site/current", PreviousLink: "/opt/example-site/previous", CaddyConfig: "/etc/caddy/Caddyfile",
|
||||
CaddyHandler: "/etc/caddy/example-site.caddy", CaddyHandlerTemplate: "/etc/tend/caddy/example-site.template",
|
||||
}
|
||||
if err := cfg.Validate(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
cfg.Deployment.Singleton.CaddyHandlerTemplate = cfg.Deployment.Singleton.CaddyHandler
|
||||
if err := cfg.Validate(); err == nil {
|
||||
t.Fatal("expected shared handler/template path to be rejected")
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateRejectsHostileValues(t *testing.T) {
|
||||
tests := map[string]func(*Config){
|
||||
"unknown strategy": func(c *Config) { c.Deployment.Strategy = "shell" },
|
||||
"nonloopback": func(c *Config) { c.Deployment.BlueGreen.Blue.Address = "203.0.113.7:80" },
|
||||
"root path": func(c *Config) { c.Deployment.Root = "/" },
|
||||
"traversal": func(c *Config) { c.Build.Package = "./cmd/../secret" },
|
||||
"shared slot": func(c *Config) { c.Deployment.BlueGreen.Green.Link = c.Deployment.BlueGreen.Blue.Link },
|
||||
"bad smoke": func(c *Config) { c.Deployment.Smoke[0].Path = "https://attacker.test/" },
|
||||
"bad public smoke": func(c *Config) { c.Deployment.PublicSmoke[0].URL = "http://example.test/" },
|
||||
"public secret query": func(c *Config) { c.Deployment.PublicSmoke[0].URL = "https://example.test/?token=secret" },
|
||||
"environment sibling": func(c *Config) { c.Service.EnvironmentFile = "/etc/tend/environment-old/example.env" },
|
||||
}
|
||||
for name, mutate := range tests {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
cfg := validConfig()
|
||||
mutate(&cfg)
|
||||
if err := cfg.Validate(); err == nil {
|
||||
t.Fatal("expected validation failure")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnknownJSONFieldRejected(t *testing.T) {
|
||||
b, err := json.Marshal(validConfig())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var raw map[string]any
|
||||
if err := json.Unmarshal(b, &raw); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
raw["surprise"] = true
|
||||
b, _ = json.Marshal(raw)
|
||||
_ = b // Load exercises strict decoding from disk in command tests.
|
||||
}
|
||||
@@ -0,0 +1,1023 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/eventlog"
|
||||
"gamertan.com/tend/internal/state"
|
||||
)
|
||||
|
||||
type Request struct {
|
||||
Artifact string
|
||||
SHA256 string
|
||||
ApprovedSHA256 string
|
||||
Activate bool
|
||||
}
|
||||
type Report struct {
|
||||
Validated bool `json:"validated"`
|
||||
Mutation string `json:"mutation"`
|
||||
Release string `json:"release,omitempty"`
|
||||
ActiveRelease string `json:"active_release,omitempty"`
|
||||
PreviousRelease string `json:"previous_release,omitempty"`
|
||||
EventWarnings int `json:"event_warnings,omitempty"`
|
||||
LeaseCleanupPending bool `json:"lease_cleanup_pending,omitempty"`
|
||||
}
|
||||
type Status struct {
|
||||
State *state.Record `json:"state,omitempty"`
|
||||
Units map[string]bool `json:"units"`
|
||||
StateInitialized bool `json:"state_initialized"`
|
||||
}
|
||||
|
||||
type retainedCandidateError struct{ cause error }
|
||||
|
||||
func (e *retainedCandidateError) Error() string { return e.cause.Error() }
|
||||
func (e *retainedCandidateError) Unwrap() error { return e.cause }
|
||||
|
||||
type Manager struct {
|
||||
Operator Operator
|
||||
Now func() time.Time
|
||||
Prepare func(config.Config, string, string, string) (string, error)
|
||||
Inspect func(config.Config, string, string, string) error
|
||||
ReadIdentity func(string) (releaseIdentity, error)
|
||||
OperationID func() (string, error)
|
||||
AppendEvent func(string, eventlog.Event) error
|
||||
Sleep func(context.Context, time.Duration) error
|
||||
}
|
||||
|
||||
func NewManager(operator Operator) Manager {
|
||||
return Manager{Operator: operator, Now: time.Now, Prepare: prepareRelease, Inspect: inspectArtifact, ReadIdentity: readReleaseIdentity, OperationID: eventlog.OperationID, AppendEvent: eventlog.Append, Sleep: sleepContext}
|
||||
}
|
||||
|
||||
func (m Manager) Deploy(ctx context.Context, cfg config.Config, request Request) (Report, error) {
|
||||
if err := cfg.Validate(); err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
if !request.Activate {
|
||||
if err := m.Inspect(cfg, request.Artifact, request.SHA256, request.ApprovedSHA256); err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
return Report{Validated: true, Mutation: "none"}, nil
|
||||
}
|
||||
lock, err := acquireLock(cfg.Deployment.LockFile)
|
||||
if err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
defer lock.Close()
|
||||
release, err := m.Prepare(cfg, request.Artifact, request.SHA256, request.ApprovedSHA256)
|
||||
if err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
started := m.Now()
|
||||
eventWarnings := 0
|
||||
identity, identityErr := m.ReadIdentity(release)
|
||||
if identityErr != nil {
|
||||
eventWarnings++
|
||||
}
|
||||
operationID := ""
|
||||
if m.OperationID != nil {
|
||||
operationID, err = m.OperationID()
|
||||
if err != nil {
|
||||
eventWarnings++
|
||||
operationID = ""
|
||||
}
|
||||
}
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" && operationID == "" {
|
||||
return Report{}, errors.New("singleton activation requires a fresh operation identity")
|
||||
}
|
||||
emit := func(phase, slot, outcome string) {
|
||||
if m.AppendEvent == nil || identityErr != nil || operationID == "" {
|
||||
return
|
||||
}
|
||||
event := eventlog.Event{Version: eventlog.Version, OperationID: operationID, Service: cfg.Service.Name, ArtifactDigest: request.ApprovedSHA256, Commit: identity.Commit, ReleaseVersion: identity.Version, Phase: phase, Slot: slot, DurationMillis: max(0, m.Now().Sub(started).Milliseconds()), Outcome: outcome, ObservedAt: m.Now().UTC().Format(time.RFC3339Nano)}
|
||||
if eventErr := m.AppendEvent(cfg.Deployment.EventLog, event); eventErr != nil {
|
||||
eventWarnings++
|
||||
}
|
||||
}
|
||||
record, err := loadOrBootstrap(cfg, m.Now())
|
||||
if err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
leasePath := state.CandidateLeasePath(cfg.Deployment.StateFile)
|
||||
var candidateLease state.CandidateLease
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
_, exists, leaseErr := loadCandidateLease(cfg)
|
||||
if leaseErr != nil {
|
||||
return Report{}, leaseErr
|
||||
}
|
||||
if record.CandidateRelease != "" || exists {
|
||||
return Report{}, errors.New("singleton candidate lease is unresolved; run tend reconcile --json before another activation")
|
||||
}
|
||||
}
|
||||
attemptAt := m.Now().UTC().Format(time.RFC3339)
|
||||
record.DesiredRelease = release
|
||||
record.CandidateRelease = release
|
||||
record.LastAttemptRelease = release
|
||||
record.LastAttemptOutcome = "running"
|
||||
record.LastAttemptAt = attemptAt
|
||||
record.UpdatedAt = attemptAt
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
candidateUnit, unitErr := singletonCandidateUnit(cfg.Service.Name, operationID)
|
||||
if unitErr != nil {
|
||||
return Report{}, unitErr
|
||||
}
|
||||
candidateLease = state.CandidateLease{SchemaVersion: state.CandidateLeaseSchemaVersion, Service: cfg.Service.Name, OperationID: operationID, Release: release, Unit: candidateUnit, Address: cfg.Deployment.Singleton.CandidateAddress, StartedAt: attemptAt}
|
||||
}
|
||||
if err := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, record); err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
if err := state.StoreCandidateLease(leasePath, cfg.Deployment.Root, candidateLease); err != nil {
|
||||
failed := record
|
||||
clearCandidateLease(&failed)
|
||||
failed.LastAttemptOutcome = "failed"
|
||||
failed.UpdatedAt = m.Now().UTC().Format(time.RFC3339)
|
||||
if storeErr := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, failed); storeErr != nil {
|
||||
return Report{}, errors.Join(err, storeErr)
|
||||
}
|
||||
return Report{}, err
|
||||
}
|
||||
}
|
||||
emit("candidate", inactiveSlot(cfg, record), "running")
|
||||
switch cfg.Deployment.Strategy {
|
||||
case "blue_green":
|
||||
err = m.deployBlueGreen(ctx, cfg, record, release)
|
||||
case "singleton_candidate":
|
||||
err = m.deploySingleton(ctx, cfg, record, release, candidateLease.Unit)
|
||||
default:
|
||||
err = errors.New("unsupported strategy")
|
||||
}
|
||||
if err != nil {
|
||||
failed := record
|
||||
var retained *retainedCandidateError
|
||||
if !errors.As(err, &retained) {
|
||||
if cleanupErr := state.RemoveCandidateLease(leasePath); cleanupErr != nil {
|
||||
err = errors.Join(err, fmt.Errorf("candidate lease cleanup failed: %w", cleanupErr))
|
||||
} else {
|
||||
clearCandidateLease(&failed)
|
||||
}
|
||||
}
|
||||
failed.LastAttemptOutcome = "failed"
|
||||
failed.UpdatedAt = m.Now().UTC().Format(time.RFC3339)
|
||||
if storeErr := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, failed); storeErr != nil {
|
||||
err = errors.Join(err, storeErr)
|
||||
}
|
||||
emit("activation", inactiveSlot(cfg, record), "failed")
|
||||
return Report{EventWarnings: eventWarnings}, err
|
||||
}
|
||||
emit("activation", inactiveSlot(cfg, record), "succeeded")
|
||||
updated, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
return Report{}, err
|
||||
}
|
||||
report := Report{Validated: true, Mutation: "activated", Release: release, ActiveRelease: updated.ActiveRelease, PreviousRelease: updated.PreviousRelease, EventWarnings: eventWarnings}
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
if cleanupErr := state.RemoveCandidateLease(leasePath); cleanupErr != nil {
|
||||
report.LeaseCleanupPending = true
|
||||
}
|
||||
}
|
||||
return report, nil
|
||||
}
|
||||
|
||||
func singletonCandidateUnit(service, operationID string) (string, error) {
|
||||
if len(operationID) != 32 {
|
||||
return "", errors.New("candidate operation identity is invalid")
|
||||
}
|
||||
for _, character := range operationID {
|
||||
if !strings.ContainsRune("0123456789abcdef", character) {
|
||||
return "", errors.New("candidate operation identity is invalid")
|
||||
}
|
||||
}
|
||||
return service + "-tend-candidate-" + operationID[:12] + ".service", nil
|
||||
}
|
||||
|
||||
func clearCandidateLease(record *state.Record) {
|
||||
record.CandidateRelease = ""
|
||||
}
|
||||
|
||||
func loadCandidateLease(cfg config.Config) (state.CandidateLease, bool, error) {
|
||||
lease, err := state.LoadCandidateLease(state.CandidateLeasePath(cfg.Deployment.StateFile), cfg.Deployment.Root, cfg.Service.Name)
|
||||
if err == nil {
|
||||
return lease, true, nil
|
||||
}
|
||||
if os.IsNotExist(err) {
|
||||
return state.CandidateLease{}, false, nil
|
||||
}
|
||||
return state.CandidateLease{}, false, fmt.Errorf("load singleton candidate lease: %w", err)
|
||||
}
|
||||
|
||||
type releaseIdentity struct {
|
||||
Version string `json:"version"`
|
||||
Commit string `json:"commit"`
|
||||
}
|
||||
|
||||
func readReleaseIdentity(release string) (releaseIdentity, error) {
|
||||
b, err := os.ReadFile(filepath.Join(release, "RELEASE.json"))
|
||||
if err != nil {
|
||||
return releaseIdentity{}, fmt.Errorf("read installed release identity: %w", err)
|
||||
}
|
||||
if len(b) > 1<<20 {
|
||||
return releaseIdentity{}, errors.New("installed release identity is too large")
|
||||
}
|
||||
var identity releaseIdentity
|
||||
if err := json.Unmarshal(b, &identity); err != nil {
|
||||
return releaseIdentity{}, errors.New("decode installed release identity")
|
||||
}
|
||||
if identity.Version == "" || identity.Commit == "" {
|
||||
return releaseIdentity{}, errors.New("installed release identity is incomplete")
|
||||
}
|
||||
return identity, nil
|
||||
}
|
||||
|
||||
func inactiveSlot(cfg config.Config, record state.Record) string {
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
return "singleton"
|
||||
}
|
||||
if record.ActiveSlot == "blue" {
|
||||
return "green"
|
||||
}
|
||||
return "blue"
|
||||
}
|
||||
|
||||
func sleepContext(ctx context.Context, duration time.Duration) error {
|
||||
timer := time.NewTimer(duration)
|
||||
defer timer.Stop()
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return ctx.Err()
|
||||
case <-timer.C:
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
func loadOrBootstrap(cfg config.Config, now time.Time) (state.Record, error) {
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err == nil {
|
||||
return record, nil
|
||||
}
|
||||
if !os.IsNotExist(err) {
|
||||
return state.Record{}, err
|
||||
}
|
||||
switch cfg.Deployment.Strategy {
|
||||
case "blue_green":
|
||||
slot := cfg.Deployment.BlueGreen.BootstrapActive
|
||||
release, err := resolveReleaseLink(cfg.Deployment.Root, slotConfig(*cfg.Deployment.BlueGreen, slot).Link)
|
||||
if err != nil {
|
||||
return state.Record{}, fmt.Errorf("bootstrap active slot: %w", err)
|
||||
}
|
||||
return state.Record{SchemaVersion: state.SchemaVersion, Strategy: cfg.Deployment.Strategy, DesiredRelease: release, ActiveSlot: slot, ActiveRelease: release, UpdatedAt: now.UTC().Format(time.RFC3339)}, nil
|
||||
case "singleton_candidate":
|
||||
release, err := resolveReleaseLink(cfg.Deployment.Root, cfg.Deployment.Singleton.CurrentLink)
|
||||
if err != nil {
|
||||
return state.Record{}, fmt.Errorf("bootstrap singleton: %w", err)
|
||||
}
|
||||
return state.Record{SchemaVersion: state.SchemaVersion, Strategy: cfg.Deployment.Strategy, DesiredRelease: release, ActiveSlot: "singleton", ActiveRelease: release, UpdatedAt: now.UTC().Format(time.RFC3339)}, nil
|
||||
}
|
||||
return state.Record{}, errors.New("unsupported strategy")
|
||||
}
|
||||
|
||||
func (m Manager) deployBlueGreen(ctx context.Context, cfg config.Config, record state.Record, release string) (err error) {
|
||||
bg := *cfg.Deployment.BlueGreen
|
||||
inactive := "blue"
|
||||
if record.ActiveSlot == "blue" {
|
||||
inactive = "green"
|
||||
}
|
||||
slot := slotConfig(bg, inactive)
|
||||
oldInactive, oldErr := resolveReleaseLink(cfg.Deployment.Root, slot.Link)
|
||||
if oldErr != nil && !os.IsNotExist(oldErr) {
|
||||
return oldErr
|
||||
}
|
||||
oldHandler, err := os.ReadFile(bg.CaddyHandler)
|
||||
if err != nil {
|
||||
return fmt.Errorf("read current Caddy handler: %w", err)
|
||||
}
|
||||
handlerChanged := false
|
||||
linkChanged := false
|
||||
defer func() {
|
||||
if err == nil {
|
||||
return
|
||||
}
|
||||
if handlerChanged {
|
||||
_ = atomicWrite(bg.CaddyHandler, oldHandler, 0o644)
|
||||
_ = m.Operator.ValidateCaddy(ctx, bg.CaddyConfig)
|
||||
_ = m.Operator.ReloadCaddy(ctx)
|
||||
}
|
||||
if linkChanged {
|
||||
if oldErr == nil {
|
||||
_ = replaceSymlink(slot.Link, oldInactive)
|
||||
_ = m.Operator.Restart(ctx, slot.Unit)
|
||||
} else {
|
||||
_ = removeSymlink(slot.Link)
|
||||
_ = m.Operator.Stop(ctx, slot.Unit)
|
||||
}
|
||||
}
|
||||
}()
|
||||
if err = replaceSymlink(slot.Link, release); err != nil {
|
||||
return err
|
||||
}
|
||||
linkChanged = true
|
||||
if err = m.Operator.Restart(ctx, slot.Unit); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.probeAll(ctx, cfg, slot.Address); err != nil {
|
||||
return fmt.Errorf("candidate failed: %w", err)
|
||||
}
|
||||
handler, err := renderHandler(bg.CaddyHandlerTemplate, slot.Address)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err = atomicWrite(bg.CaddyHandler, handler, 0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
handlerChanged = true
|
||||
if err = m.Operator.ValidateCaddy(ctx, bg.CaddyConfig); err != nil {
|
||||
return fmt.Errorf("Caddy validation failed: %w", err)
|
||||
}
|
||||
if err = m.Operator.ReloadCaddy(ctx); err != nil {
|
||||
return fmt.Errorf("Caddy reload failed: %w", err)
|
||||
}
|
||||
if err = m.probeAll(ctx, cfg, slot.Address); err != nil {
|
||||
return fmt.Errorf("post-activation smoke failed: %w", err)
|
||||
}
|
||||
if err = m.probePublic(ctx, cfg, true); err != nil {
|
||||
return fmt.Errorf("public-origin smoke failed: %w", err)
|
||||
}
|
||||
previous := slotConfig(bg, record.ActiveSlot)
|
||||
if err = m.continuityWindow(ctx, cfg, previous.Address, true); err != nil {
|
||||
return fmt.Errorf("activation continuity failed: %w", err)
|
||||
}
|
||||
next := state.Record{SchemaVersion: state.SchemaVersion, Strategy: cfg.Deployment.Strategy, DesiredRelease: release, ActiveSlot: inactive, ActiveRelease: release, PreviousSlot: record.ActiveSlot, PreviousRelease: record.ActiveRelease, LastAttemptRelease: release, LastAttemptOutcome: "succeeded", LastAttemptAt: record.LastAttemptAt, UpdatedAt: m.Now().UTC().Format(time.RFC3339)}
|
||||
if err = state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, next); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m Manager) deploySingleton(ctx context.Context, cfg config.Config, record state.Record, release, candidateUnit string) (err error) {
|
||||
if err = m.activateSingletonRelease(ctx, cfg, release, candidateUnit, true); err != nil {
|
||||
return err
|
||||
}
|
||||
next := state.Record{SchemaVersion: state.SchemaVersion, Strategy: cfg.Deployment.Strategy, DesiredRelease: release, ActiveSlot: "singleton", ActiveRelease: release, PreviousSlot: "singleton", PreviousRelease: record.ActiveRelease, LastAttemptRelease: release, LastAttemptOutcome: "succeeded", LastAttemptAt: record.LastAttemptAt, UpdatedAt: m.Now().UTC().Format(time.RFC3339)}
|
||||
if err = state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, next); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m Manager) Rollback(ctx context.Context, cfg config.Config) (state.Record, error) {
|
||||
lock, err := acquireLock(cfg.Deployment.LockFile)
|
||||
if err != nil {
|
||||
return state.Record{}, err
|
||||
}
|
||||
defer lock.Close()
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
return state.Record{}, err
|
||||
}
|
||||
if record.PreviousRelease == "" {
|
||||
return state.Record{}, errors.New("no previous release is recorded")
|
||||
}
|
||||
leasePath := state.CandidateLeasePath(cfg.Deployment.StateFile)
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
_, exists, leaseErr := loadCandidateLease(cfg)
|
||||
if leaseErr != nil {
|
||||
return state.Record{}, leaseErr
|
||||
}
|
||||
if record.CandidateRelease != "" || exists {
|
||||
return state.Record{}, errors.New("singleton candidate lease is unresolved; run tend reconcile --json before rollback")
|
||||
}
|
||||
}
|
||||
started := m.Now()
|
||||
identity, identityErr := m.ReadIdentity(record.PreviousRelease)
|
||||
digest, digestErr := releaseDigest(record.PreviousRelease)
|
||||
operationID := ""
|
||||
if m.OperationID != nil {
|
||||
operationID, err = m.OperationID()
|
||||
}
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" && (err != nil || operationID == "") {
|
||||
return state.Record{}, errors.New("singleton rollback requires a fresh operation identity")
|
||||
}
|
||||
candidateUnit := ""
|
||||
rollbackAttempt := record
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
candidateUnit, err = singletonCandidateUnit(cfg.Service.Name, operationID)
|
||||
if err != nil {
|
||||
return state.Record{}, err
|
||||
}
|
||||
attemptAt := m.Now().UTC().Format(time.RFC3339)
|
||||
rollbackAttempt.DesiredRelease = record.PreviousRelease
|
||||
rollbackAttempt.CandidateRelease = record.PreviousRelease
|
||||
rollbackAttempt.LastAttemptRelease = record.PreviousRelease
|
||||
rollbackAttempt.LastAttemptOutcome = "running"
|
||||
rollbackAttempt.LastAttemptAt = attemptAt
|
||||
rollbackAttempt.UpdatedAt = attemptAt
|
||||
if err = state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, rollbackAttempt); err != nil {
|
||||
return state.Record{}, err
|
||||
}
|
||||
lease := state.CandidateLease{SchemaVersion: state.CandidateLeaseSchemaVersion, Service: cfg.Service.Name, OperationID: operationID, Release: record.PreviousRelease, Unit: candidateUnit, Address: cfg.Deployment.Singleton.CandidateAddress, StartedAt: attemptAt}
|
||||
if err = state.StoreCandidateLease(leasePath, cfg.Deployment.Root, lease); err != nil {
|
||||
failed := rollbackAttempt
|
||||
clearCandidateLease(&failed)
|
||||
failed.LastAttemptOutcome = "failed"
|
||||
failed.UpdatedAt = m.Now().UTC().Format(time.RFC3339)
|
||||
if storeErr := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, failed); storeErr != nil {
|
||||
return state.Record{}, errors.Join(err, storeErr)
|
||||
}
|
||||
return state.Record{}, err
|
||||
}
|
||||
}
|
||||
emit := func(outcome string) {
|
||||
if m.AppendEvent == nil || identityErr != nil || digestErr != nil || operationID == "" {
|
||||
return
|
||||
}
|
||||
event := eventlog.Event{Version: eventlog.Version, OperationID: operationID, Service: cfg.Service.Name, ArtifactDigest: digest, Commit: identity.Commit, ReleaseVersion: identity.Version, Phase: "rollback", Slot: record.PreviousSlot, DurationMillis: max(0, m.Now().Sub(started).Milliseconds()), Outcome: outcome, ObservedAt: m.Now().UTC().Format(time.RFC3339Nano)}
|
||||
_ = m.AppendEvent(cfg.Deployment.EventLog, event)
|
||||
}
|
||||
emit("running")
|
||||
switch cfg.Deployment.Strategy {
|
||||
case "blue_green":
|
||||
err = m.rollbackBlueGreen(ctx, cfg, record)
|
||||
case "singleton_candidate":
|
||||
err = m.rollbackSingleton(ctx, cfg, record, candidateUnit)
|
||||
default:
|
||||
err = errors.New("unsupported strategy")
|
||||
}
|
||||
if err != nil {
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
failed := rollbackAttempt
|
||||
var retained *retainedCandidateError
|
||||
if !errors.As(err, &retained) {
|
||||
if cleanupErr := state.RemoveCandidateLease(leasePath); cleanupErr != nil {
|
||||
err = errors.Join(err, fmt.Errorf("candidate lease cleanup failed: %w", cleanupErr))
|
||||
} else {
|
||||
clearCandidateLease(&failed)
|
||||
}
|
||||
}
|
||||
failed.LastAttemptOutcome = "failed"
|
||||
failed.UpdatedAt = m.Now().UTC().Format(time.RFC3339)
|
||||
if storeErr := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, failed); storeErr != nil {
|
||||
err = errors.Join(err, storeErr)
|
||||
}
|
||||
}
|
||||
emit("failed")
|
||||
return state.Record{}, err
|
||||
}
|
||||
emit("succeeded")
|
||||
updated, loadErr := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if loadErr != nil {
|
||||
return state.Record{}, loadErr
|
||||
}
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
if cleanupErr := state.RemoveCandidateLease(leasePath); cleanupErr != nil {
|
||||
return updated, fmt.Errorf("rollback succeeded but candidate lease cleanup is pending; run tend reconcile --json: %w", cleanupErr)
|
||||
}
|
||||
}
|
||||
return updated, nil
|
||||
}
|
||||
|
||||
func releaseDigest(release string) (string, error) {
|
||||
name := filepath.Base(release)
|
||||
if !strings.HasPrefix(name, "sha256-") {
|
||||
return "", errors.New("release is not content addressed")
|
||||
}
|
||||
digest := strings.TrimPrefix(name, "sha256-")
|
||||
if len(digest) != 64 {
|
||||
return "", errors.New("release digest is invalid")
|
||||
}
|
||||
for _, character := range digest {
|
||||
if !strings.ContainsRune("0123456789abcdef", character) {
|
||||
return "", errors.New("release digest is invalid")
|
||||
}
|
||||
}
|
||||
return digest, nil
|
||||
}
|
||||
func (m Manager) rollbackBlueGreen(ctx context.Context, cfg config.Config, record state.Record) (err error) {
|
||||
bg := *cfg.Deployment.BlueGreen
|
||||
slot := slotConfig(bg, record.PreviousSlot)
|
||||
if active, checkErr := m.Operator.IsActive(ctx, slot.Unit); checkErr != nil {
|
||||
return checkErr
|
||||
} else if !active {
|
||||
if err = m.Operator.Restart(ctx, slot.Unit); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if err = m.probeHealthReadiness(ctx, cfg, slot.Address); err != nil {
|
||||
return err
|
||||
}
|
||||
oldHandler, err := os.ReadFile(bg.CaddyHandler)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
changed := false
|
||||
defer func() {
|
||||
if err != nil && changed {
|
||||
_ = atomicWrite(bg.CaddyHandler, oldHandler, 0o644)
|
||||
_ = m.Operator.ValidateCaddy(ctx, bg.CaddyConfig)
|
||||
_ = m.Operator.ReloadCaddy(ctx)
|
||||
}
|
||||
}()
|
||||
handler, err := renderHandler(bg.CaddyHandlerTemplate, slot.Address)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err = atomicWrite(bg.CaddyHandler, handler, 0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
changed = true
|
||||
if err = m.Operator.ValidateCaddy(ctx, bg.CaddyConfig); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.Operator.ReloadCaddy(ctx); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.probeHealthReadiness(ctx, cfg, slot.Address); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.probePublic(ctx, cfg, false); err != nil {
|
||||
return err
|
||||
}
|
||||
next := state.Record{SchemaVersion: state.SchemaVersion, Strategy: record.Strategy, DesiredRelease: record.PreviousRelease, ActiveSlot: record.PreviousSlot, ActiveRelease: record.PreviousRelease, PreviousSlot: record.ActiveSlot, PreviousRelease: record.ActiveRelease, LastAttemptRelease: record.PreviousRelease, LastAttemptOutcome: "rolled_back", LastAttemptAt: m.Now().UTC().Format(time.RFC3339), UpdatedAt: m.Now().UTC().Format(time.RFC3339)}
|
||||
return state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, next)
|
||||
}
|
||||
func (m Manager) rollbackSingleton(ctx context.Context, cfg config.Config, record state.Record, candidateUnit string) (err error) {
|
||||
if err = m.activateSingletonRelease(ctx, cfg, record.PreviousRelease, candidateUnit, false); err != nil {
|
||||
return err
|
||||
}
|
||||
next := state.Record{SchemaVersion: state.SchemaVersion, Strategy: record.Strategy, DesiredRelease: record.PreviousRelease, ActiveSlot: "singleton", ActiveRelease: record.PreviousRelease, PreviousSlot: "singleton", PreviousRelease: record.ActiveRelease, LastAttemptRelease: record.PreviousRelease, LastAttemptOutcome: "rolled_back", LastAttemptAt: m.Now().UTC().Format(time.RFC3339), UpdatedAt: m.Now().UTC().Format(time.RFC3339)}
|
||||
return state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, next)
|
||||
}
|
||||
|
||||
// activateSingletonRelease keeps public traffic on a proven process while the
|
||||
// installed fixed-address unit changes release. The transient candidate first
|
||||
// receives traffic, remains healthy through the handoff, and is stopped only
|
||||
// after Caddy points back to the verified installed unit.
|
||||
func (m Manager) activateSingletonRelease(ctx context.Context, cfg config.Config, release, candidateUnit string, checkMarkers bool) (err error) {
|
||||
single := *cfg.Deployment.Singleton
|
||||
env := map[string]string{single.ListenEnv: single.CandidateAddress}
|
||||
binary := filepath.Join(release, cfg.Build.Binary)
|
||||
if err = m.Operator.StartCandidate(ctx, candidateUnit, binary, cfg.Service.EnvironmentFile, env); err != nil {
|
||||
return err
|
||||
}
|
||||
stopCandidate := true
|
||||
defer func() {
|
||||
if !stopCandidate {
|
||||
return
|
||||
}
|
||||
stopCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer cancel()
|
||||
_ = m.Operator.Stop(stopCtx, candidateUnit)
|
||||
}()
|
||||
probeLocal := m.probeHealthReadiness
|
||||
if checkMarkers {
|
||||
probeLocal = m.probeAll
|
||||
}
|
||||
if err = probeLocal(ctx, cfg, single.CandidateAddress); err != nil {
|
||||
return fmt.Errorf("candidate failed: %w", err)
|
||||
}
|
||||
|
||||
oldHandler, err := os.ReadFile(single.CaddyHandler)
|
||||
if err != nil {
|
||||
return fmt.Errorf("read current Caddy handler: %w", err)
|
||||
}
|
||||
oldCurrent, err := resolveReleaseLink(cfg.Deployment.Root, single.CurrentLink)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
oldPrevious, previousErr := resolveReleaseLink(cfg.Deployment.Root, single.PreviousLink)
|
||||
handlerChanged := false
|
||||
currentChanged := false
|
||||
previousChanged := false
|
||||
defer func() {
|
||||
if err == nil {
|
||||
return
|
||||
}
|
||||
recoveryErr := error(nil)
|
||||
if currentChanged {
|
||||
if restoreErr := replaceSymlink(single.CurrentLink, oldCurrent); restoreErr != nil {
|
||||
recoveryErr = errors.Join(recoveryErr, restoreErr)
|
||||
} else if restoreErr = m.Operator.Restart(ctx, single.Unit); restoreErr != nil {
|
||||
recoveryErr = errors.Join(recoveryErr, restoreErr)
|
||||
} else if restoreErr = m.probeHealthReadiness(ctx, cfg, single.Address); restoreErr != nil {
|
||||
recoveryErr = errors.Join(recoveryErr, restoreErr)
|
||||
}
|
||||
}
|
||||
if previousChanged {
|
||||
var restoreErr error
|
||||
if previousErr == nil {
|
||||
restoreErr = replaceSymlink(single.PreviousLink, oldPrevious)
|
||||
} else {
|
||||
restoreErr = removeSymlink(single.PreviousLink)
|
||||
}
|
||||
recoveryErr = errors.Join(recoveryErr, restoreErr)
|
||||
}
|
||||
if handlerChanged && recoveryErr == nil {
|
||||
if restoreErr := atomicWrite(single.CaddyHandler, oldHandler, 0o644); restoreErr != nil {
|
||||
recoveryErr = errors.Join(recoveryErr, restoreErr)
|
||||
} else if restoreErr = m.Operator.ValidateCaddy(ctx, single.CaddyConfig); restoreErr != nil {
|
||||
recoveryErr = errors.Join(recoveryErr, restoreErr)
|
||||
} else if restoreErr = m.Operator.ReloadCaddy(ctx); restoreErr != nil {
|
||||
recoveryErr = errors.Join(recoveryErr, restoreErr)
|
||||
}
|
||||
}
|
||||
if recoveryErr != nil && handlerChanged {
|
||||
stopCandidate = false
|
||||
err = &retainedCandidateError{cause: errors.Join(err, fmt.Errorf("singleton recovery incomplete; candidate remains routed for operator recovery: %w", recoveryErr))}
|
||||
}
|
||||
}()
|
||||
|
||||
candidateHandler, err := renderHandler(single.CaddyHandlerTemplate, single.CandidateAddress)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err = atomicWrite(single.CaddyHandler, candidateHandler, 0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
handlerChanged = true
|
||||
if err = m.Operator.ValidateCaddy(ctx, single.CaddyConfig); err != nil {
|
||||
return fmt.Errorf("candidate Caddy validation failed: %w", err)
|
||||
}
|
||||
if err = m.Operator.ReloadCaddy(ctx); err != nil {
|
||||
return fmt.Errorf("candidate Caddy reload failed: %w", err)
|
||||
}
|
||||
if err = m.probePublic(ctx, cfg, checkMarkers); err != nil {
|
||||
return fmt.Errorf("candidate public-origin smoke failed: %w", err)
|
||||
}
|
||||
|
||||
if err = replaceSymlink(single.PreviousLink, oldCurrent); err != nil {
|
||||
return err
|
||||
}
|
||||
previousChanged = true
|
||||
if err = replaceSymlink(single.CurrentLink, release); err != nil {
|
||||
return err
|
||||
}
|
||||
currentChanged = true
|
||||
if err = m.Operator.Restart(ctx, single.Unit); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = probeLocal(ctx, cfg, single.Address); err != nil {
|
||||
return fmt.Errorf("post-activation smoke failed: %w", err)
|
||||
}
|
||||
installedHandler, err := renderHandler(single.CaddyHandlerTemplate, single.Address)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err = atomicWrite(single.CaddyHandler, installedHandler, 0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = m.Operator.ValidateCaddy(ctx, single.CaddyConfig); err != nil {
|
||||
return fmt.Errorf("installed Caddy validation failed: %w", err)
|
||||
}
|
||||
if err = m.Operator.ReloadCaddy(ctx); err != nil {
|
||||
return fmt.Errorf("installed Caddy reload failed: %w", err)
|
||||
}
|
||||
if err = m.probePublic(ctx, cfg, checkMarkers); err != nil {
|
||||
return fmt.Errorf("public-origin smoke failed: %w", err)
|
||||
}
|
||||
if err = m.continuityWindow(ctx, cfg, single.CandidateAddress, checkMarkers); err != nil {
|
||||
return fmt.Errorf("activation continuity failed: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m Manager) Status(ctx context.Context, cfg config.Config) (Status, error) {
|
||||
result := Status{Units: map[string]bool{}}
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err == nil {
|
||||
result.State = &record
|
||||
result.StateInitialized = true
|
||||
} else if !os.IsNotExist(err) {
|
||||
return Status{}, err
|
||||
}
|
||||
units := []string{}
|
||||
if cfg.Deployment.Strategy == "blue_green" {
|
||||
units = []string{cfg.Deployment.BlueGreen.Blue.Unit, cfg.Deployment.BlueGreen.Green.Unit}
|
||||
} else {
|
||||
units = []string{cfg.Deployment.Singleton.Unit}
|
||||
lease, exists, leaseErr := loadCandidateLease(cfg)
|
||||
if leaseErr != nil {
|
||||
return Status{}, leaseErr
|
||||
}
|
||||
if exists {
|
||||
units = append(units, lease.Unit)
|
||||
} else if result.StateInitialized && record.CandidateRelease != "" {
|
||||
return Status{}, errors.New("candidate release has no operation-scoped lease; run tend reconcile --json")
|
||||
}
|
||||
}
|
||||
for _, unit := range units {
|
||||
active, err := m.Operator.IsActive(ctx, unit)
|
||||
if err != nil {
|
||||
return Status{}, err
|
||||
}
|
||||
result.Units[unit] = active
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func (m Manager) Prune(cfg config.Config, keep int, apply bool) ([]string, error) {
|
||||
if keep < 2 || keep > 100 {
|
||||
return nil, errors.New("keep must be between 2 and 100")
|
||||
}
|
||||
lock, err := acquireLock(cfg.Deployment.LockFile)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer lock.Close()
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
entries, err := os.ReadDir(filepath.Join(cfg.Deployment.Root, "releases"))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
type candidate struct {
|
||||
name, path string
|
||||
mod time.Time
|
||||
}
|
||||
items := []candidate{}
|
||||
protected := map[string]bool{record.ActiveRelease: true, record.PreviousRelease: true}
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
lease, exists, leaseErr := loadCandidateLease(cfg)
|
||||
if leaseErr != nil {
|
||||
return nil, leaseErr
|
||||
}
|
||||
if exists {
|
||||
protected[lease.Release] = true
|
||||
} else if record.CandidateRelease != "" {
|
||||
protected[record.CandidateRelease] = true
|
||||
}
|
||||
}
|
||||
for _, entry := range entries {
|
||||
if !entry.IsDir() || entry.Type()&os.ModeSymlink != 0 || !strings.HasPrefix(entry.Name(), "sha256-") {
|
||||
continue
|
||||
}
|
||||
path := filepath.Join(cfg.Deployment.Root, "releases", entry.Name())
|
||||
if protected[path] {
|
||||
continue
|
||||
}
|
||||
info, err := entry.Info()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
items = append(items, candidate{entry.Name(), path, info.ModTime()})
|
||||
}
|
||||
sort.Slice(items, func(i, j int) bool { return items[i].mod.After(items[j].mod) })
|
||||
retained := keep - 2
|
||||
if retained < 0 {
|
||||
retained = 0
|
||||
}
|
||||
if retained > len(items) {
|
||||
retained = len(items)
|
||||
}
|
||||
items = items[retained:]
|
||||
paths := make([]string, 0, len(items))
|
||||
for _, item := range items {
|
||||
paths = append(paths, item.path)
|
||||
if apply {
|
||||
if err := removeRelease(item.path, cfg.Deployment.Root); err != nil {
|
||||
return paths, err
|
||||
}
|
||||
}
|
||||
}
|
||||
return paths, nil
|
||||
}
|
||||
|
||||
func (m Manager) probeAll(ctx context.Context, cfg config.Config, address string) error {
|
||||
checks := append([]config.Smoke{{Path: cfg.Deployment.HealthPath}, {Path: cfg.Deployment.ReadinessPath}}, cfg.Deployment.Smoke...)
|
||||
return m.probe(ctx, cfg, address, checks)
|
||||
}
|
||||
|
||||
func (m Manager) probeHealthReadiness(ctx context.Context, cfg config.Config, address string) error {
|
||||
checks := []config.Smoke{{Path: cfg.Deployment.HealthPath}, {Path: cfg.Deployment.ReadinessPath}}
|
||||
return m.probe(ctx, cfg, address, checks)
|
||||
}
|
||||
|
||||
func (m Manager) probePublic(ctx context.Context, cfg config.Config, checkMarkers bool) error {
|
||||
timeout := time.Duration(cfg.Deployment.CandidateTimeoutSecs) * time.Second
|
||||
for _, check := range cfg.Deployment.PublicSmoke {
|
||||
attempt, cancel := context.WithTimeout(ctx, timeout)
|
||||
contains := check.Contains
|
||||
if !checkMarkers {
|
||||
contains = ""
|
||||
}
|
||||
err := m.Operator.ProbeURL(attempt, check.URL, contains)
|
||||
cancel()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m Manager) continuityWindow(ctx context.Context, cfg config.Config, previousAddress string, checkMarkers bool) error {
|
||||
steps := cfg.Deployment.ActivationWindowSecs * 4
|
||||
if steps < 1 {
|
||||
steps = 1
|
||||
}
|
||||
for step := 0; step < steps; step++ {
|
||||
if err := m.probePublic(ctx, cfg, checkMarkers); err != nil {
|
||||
return err
|
||||
}
|
||||
if previousAddress != "" {
|
||||
if err := m.probeHealthReadiness(ctx, cfg, previousAddress); err != nil {
|
||||
return fmt.Errorf("previous slot lost continuity: %w", err)
|
||||
}
|
||||
}
|
||||
if step+1 < steps {
|
||||
sleep := m.Sleep
|
||||
if sleep == nil {
|
||||
sleep = sleepContext
|
||||
}
|
||||
if err := sleep(ctx, 250*time.Millisecond); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m Manager) probe(ctx context.Context, cfg config.Config, address string, checks []config.Smoke) error {
|
||||
timeout := time.Duration(cfg.Deployment.CandidateTimeoutSecs) * time.Second
|
||||
for _, check := range checks {
|
||||
deadline := m.Now().Add(timeout)
|
||||
var last error
|
||||
for {
|
||||
attempt, cancel := context.WithTimeout(ctx, 2*time.Second)
|
||||
last = m.Operator.Probe(attempt, address, cfg.Service.AllowedHost, check.Path, check.Contains)
|
||||
cancel()
|
||||
if last == nil {
|
||||
break
|
||||
}
|
||||
if !m.Now().Before(deadline) {
|
||||
return last
|
||||
}
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return ctx.Err()
|
||||
case <-time.After(200 * time.Millisecond):
|
||||
}
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func slotConfig(bg config.BlueGreen, name string) config.Slot {
|
||||
if name == "blue" {
|
||||
return bg.Blue
|
||||
}
|
||||
return bg.Green
|
||||
}
|
||||
func resolveReleaseLink(root, link string) (string, error) {
|
||||
info, err := os.Lstat(link)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if info.Mode()&os.ModeSymlink == 0 {
|
||||
return "", errors.New("release pointer is not a symlink")
|
||||
}
|
||||
target, err := os.Readlink(link)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if !filepath.IsAbs(target) {
|
||||
target = filepath.Join(filepath.Dir(link), target)
|
||||
}
|
||||
target = filepath.Clean(target)
|
||||
probe := state.Record{SchemaVersion: state.SchemaVersion, Strategy: "singleton_candidate", ActiveSlot: "singleton", ActiveRelease: target, UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
|
||||
if err := probe.Validate(root, "singleton_candidate"); err != nil {
|
||||
return "", err
|
||||
}
|
||||
targetInfo, err := os.Lstat(target)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if !targetInfo.IsDir() || targetInfo.Mode()&os.ModeSymlink != 0 {
|
||||
return "", errors.New("release target must be a real directory")
|
||||
}
|
||||
return target, nil
|
||||
}
|
||||
func replaceSymlink(link, target string) error {
|
||||
if info, err := os.Lstat(link); err == nil && info.Mode()&os.ModeSymlink == 0 {
|
||||
return errors.New("refusing to replace non-symlink release pointer")
|
||||
} else if err != nil && !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Dir(link), 0o755); err != nil {
|
||||
return err
|
||||
}
|
||||
stage, err := os.MkdirTemp(filepath.Dir(link), ".tend-link-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.RemoveAll(stage)
|
||||
tmp := filepath.Join(stage, "next")
|
||||
if err := os.Symlink(target, tmp); err != nil {
|
||||
return err
|
||||
}
|
||||
return os.Rename(tmp, link)
|
||||
}
|
||||
func removeSymlink(path string) error {
|
||||
info, err := os.Lstat(path)
|
||||
if os.IsNotExist(err) {
|
||||
return nil
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if info.Mode()&os.ModeSymlink == 0 {
|
||||
return errors.New("refusing to remove non-symlink")
|
||||
}
|
||||
return os.Remove(path)
|
||||
}
|
||||
func renderHandler(templatePath, address string) ([]byte, error) {
|
||||
b, err := os.ReadFile(templatePath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
const marker = "{{UPSTREAM}}"
|
||||
if bytes := strings.Count(string(b), marker); bytes != 1 {
|
||||
return nil, errors.New("Caddy handler template must contain exactly one upstream marker")
|
||||
}
|
||||
return []byte(strings.Replace(string(b), marker, address, 1)), nil
|
||||
}
|
||||
func atomicWrite(path string, data []byte, mode os.FileMode) error {
|
||||
var existing os.FileInfo
|
||||
if info, err := os.Lstat(path); err == nil {
|
||||
if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
|
||||
return errors.New("refusing to replace non-regular or symlink file")
|
||||
}
|
||||
existing = info
|
||||
} else if !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
identity := identityFor(existing, mode)
|
||||
dir := filepath.Dir(path)
|
||||
tmp, err := os.CreateTemp(dir, ".tend-write-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
name := tmp.Name()
|
||||
ok := false
|
||||
defer func() {
|
||||
_ = tmp.Close()
|
||||
if !ok {
|
||||
_ = os.Remove(name)
|
||||
}
|
||||
}()
|
||||
if err := applyIdentity(tmp, identity); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := tmp.Write(data); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tmp.Sync(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tmp.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Rename(name, path); err != nil {
|
||||
return err
|
||||
}
|
||||
ok = true
|
||||
return syncDirectory(dir)
|
||||
}
|
||||
func syncDirectory(path string) error {
|
||||
dir, err := os.Open(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer dir.Close()
|
||||
return dir.Sync()
|
||||
}
|
||||
func removeRelease(path, root string) error {
|
||||
releases := filepath.Join(root, "releases")
|
||||
rel, err := filepath.Rel(releases, path)
|
||||
if err != nil || rel == "." || rel == ".." || strings.ContainsRune(rel, filepath.Separator) || !strings.HasPrefix(rel, "sha256-") {
|
||||
return errors.New("unsafe prune target")
|
||||
}
|
||||
info, err := os.Lstat(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return errors.New("prune target is not a real release directory")
|
||||
}
|
||||
return os.RemoveAll(path)
|
||||
}
|
||||
func Marshal(value any) ([]byte, error) {
|
||||
b, err := json.MarshalIndent(value, "", " ")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return append(b, '\n'), nil
|
||||
}
|
||||
@@ -0,0 +1,591 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/eventlog"
|
||||
"gamertan.com/tend/internal/state"
|
||||
)
|
||||
|
||||
const testCandidateUnit = "example-site-tend-candidate-dddddddddddd.service"
|
||||
|
||||
func storeTestCandidateLease(t *testing.T, cfg config.Config, release, startedAt string) {
|
||||
t.Helper()
|
||||
lease := state.CandidateLease{SchemaVersion: state.CandidateLeaseSchemaVersion, Service: cfg.Service.Name, OperationID: strings.Repeat("d", 32), Release: release, Unit: testCandidateUnit, Address: cfg.Deployment.Singleton.CandidateAddress, StartedAt: startedAt}
|
||||
if err := state.StoreCandidateLease(state.CandidateLeasePath(cfg.Deployment.StateFile), cfg.Deployment.Root, lease); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
type fakeOperator struct {
|
||||
failReload bool
|
||||
failReloadAt int
|
||||
reloads int
|
||||
failRestartUnit string
|
||||
failRestartOnce bool
|
||||
rejectMarkers bool
|
||||
active map[string]bool
|
||||
starts, stops, restarts []string
|
||||
probes []string
|
||||
publicProbes []string
|
||||
failPublic bool
|
||||
failPublicAfter int
|
||||
candidateEnvironment map[string]string
|
||||
candidateFile string
|
||||
}
|
||||
|
||||
func (f *fakeOperator) Restart(_ context.Context, unit string) error {
|
||||
f.restarts = append(f.restarts, unit)
|
||||
if unit == f.failRestartUnit {
|
||||
if f.failRestartOnce {
|
||||
f.failRestartUnit = ""
|
||||
}
|
||||
return errors.New("injected restart failure")
|
||||
}
|
||||
f.active[unit] = true
|
||||
return nil
|
||||
}
|
||||
func (f *fakeOperator) Stop(_ context.Context, unit string) error {
|
||||
f.stops = append(f.stops, unit)
|
||||
f.active[unit] = false
|
||||
return nil
|
||||
}
|
||||
func (f *fakeOperator) IsActive(_ context.Context, unit string) (bool, error) {
|
||||
return f.active[unit], nil
|
||||
}
|
||||
func (f *fakeOperator) StartCandidate(_ context.Context, unit, binary, environmentFile string, env map[string]string) error {
|
||||
if !filepath.IsAbs(binary) || !filepath.IsAbs(environmentFile) || len(env) == 0 {
|
||||
return errors.New("bad candidate")
|
||||
}
|
||||
f.starts = append(f.starts, unit)
|
||||
f.candidateFile = environmentFile
|
||||
f.candidateEnvironment = make(map[string]string, len(env))
|
||||
for key, value := range env {
|
||||
f.candidateEnvironment[key] = value
|
||||
}
|
||||
f.active[unit] = true
|
||||
return nil
|
||||
}
|
||||
func (f *fakeOperator) ProbeURL(_ context.Context, value, contains string) error {
|
||||
f.publicProbes = append(f.publicProbes, value)
|
||||
if f.failPublic || (f.failPublicAfter > 0 && len(f.publicProbes) >= f.failPublicAfter) {
|
||||
return errors.New("injected public smoke failure")
|
||||
}
|
||||
if f.rejectMarkers && contains != "" {
|
||||
return errors.New("unexpected future-release smoke marker")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func TestPublicSmokeFailureRestoresBlueGreenHandlerAndSlot(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "blue_green")
|
||||
handler := filepath.Join(cfg.Deployment.Root, "handler.caddy")
|
||||
template := filepath.Join(cfg.Deployment.Root, "handler.template")
|
||||
original := []byte("reverse_proxy 127.0.0.1:8090\n")
|
||||
_ = os.WriteFile(handler, original, 0o644)
|
||||
_ = os.WriteFile(template, []byte("reverse_proxy {{UPSTREAM}}\n"), 0o644)
|
||||
blue := filepath.Join(cfg.Deployment.Root, "slots", "blue")
|
||||
green := filepath.Join(cfg.Deployment.Root, "slots", "green")
|
||||
_ = replaceSymlink(blue, old)
|
||||
_ = replaceSymlink(green, old)
|
||||
cfg.Deployment.BlueGreen = &config.BlueGreen{CaddyConfig: filepath.Join(cfg.Deployment.Root, "Caddyfile"), CaddyHandler: handler, CaddyHandlerTemplate: template, BootstrapActive: "blue", Blue: config.Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: blue}, Green: config.Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: green}}
|
||||
operator := &fakeOperator{active: map[string]bool{}, failPublic: true}
|
||||
if _, err := manager(operator, fresh).Deploy(context.Background(), cfg, Request{Activate: true}); err == nil {
|
||||
t.Fatal("expected public smoke failure")
|
||||
}
|
||||
body, _ := os.ReadFile(handler)
|
||||
if string(body) != string(original) {
|
||||
t.Fatalf("handler not restored: %q", body)
|
||||
}
|
||||
target, err := resolveReleaseLink(cfg.Deployment.Root, green)
|
||||
if err != nil || target != old {
|
||||
t.Fatalf("green=%q err=%v", target, err)
|
||||
}
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if record.ActiveRelease != old || record.LastAttemptOutcome != "failed" || record.CandidateRelease != "" || record.LastAttemptRelease != fresh {
|
||||
t.Fatalf("failed attempt state=%+v", record)
|
||||
}
|
||||
}
|
||||
|
||||
func TestContinuityFailureRestoresBlueGreenRoute(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "blue_green")
|
||||
handler := filepath.Join(cfg.Deployment.Root, "handler.caddy")
|
||||
template := filepath.Join(cfg.Deployment.Root, "handler.template")
|
||||
original := []byte("reverse_proxy 127.0.0.1:8090\n")
|
||||
_ = os.WriteFile(handler, original, 0o644)
|
||||
_ = os.WriteFile(template, []byte("reverse_proxy {{UPSTREAM}}\n"), 0o644)
|
||||
blue := filepath.Join(cfg.Deployment.Root, "slots", "blue")
|
||||
green := filepath.Join(cfg.Deployment.Root, "slots", "green")
|
||||
_ = replaceSymlink(blue, old)
|
||||
_ = replaceSymlink(green, old)
|
||||
cfg.Deployment.BlueGreen = &config.BlueGreen{CaddyConfig: filepath.Join(cfg.Deployment.Root, "Caddyfile"), CaddyHandler: handler, CaddyHandlerTemplate: template, BootstrapActive: "blue", Blue: config.Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: blue}, Green: config.Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: green}}
|
||||
operator := &fakeOperator{active: map[string]bool{}, failPublicAfter: 3}
|
||||
if _, err := manager(operator, fresh).Deploy(context.Background(), cfg, Request{Activate: true, ApprovedSHA256: strings.Repeat("a", 64)}); err == nil || !strings.Contains(err.Error(), "continuity") {
|
||||
t.Fatalf("expected continuity failure, got %v", err)
|
||||
}
|
||||
body, _ := os.ReadFile(handler)
|
||||
if string(body) != string(original) {
|
||||
t.Fatalf("handler not restored: %q", body)
|
||||
}
|
||||
target, err := resolveReleaseLink(cfg.Deployment.Root, green)
|
||||
if err != nil || target != old {
|
||||
t.Fatalf("green=%q err=%v", target, err)
|
||||
}
|
||||
}
|
||||
func (f *fakeOperator) ValidateCaddy(context.Context, string) error { return nil }
|
||||
func (f *fakeOperator) ReloadCaddy(context.Context) error {
|
||||
f.reloads++
|
||||
if f.failReload || (f.failReloadAt > 0 && f.reloads == f.failReloadAt) {
|
||||
return errors.New("injected reload failure")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func (f *fakeOperator) Probe(_ context.Context, address, host, path, contains string) error {
|
||||
f.probes = append(f.probes, address+path)
|
||||
if f.rejectMarkers && contains != "" {
|
||||
return errors.New("unexpected future-release smoke marker")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func baseConfig(t *testing.T, strategy string) (config.Config, string, string) {
|
||||
t.Helper()
|
||||
root := filepath.Join(t.TempDir(), "service")
|
||||
if err := os.MkdirAll(filepath.Join(root, "releases"), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
old := filepath.Join(root, "releases", "sha256-"+strings.Repeat("c", 64))
|
||||
fresh := filepath.Join(root, "releases", "sha256-"+strings.Repeat("a", 64))
|
||||
for _, dir := range []string{old, fresh} {
|
||||
if err := os.Mkdir(dir, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(dir, "app"), []byte("x"), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
cfg := config.Config{SchemaVersion: 2, Service: config.Service{Name: "example-site", AllowedHost: "example.test", EnvironmentFile: "/etc/tend/environment/example-site.env"}, Build: config.Build{Package: "./cmd/site", Binary: "app", Branch: "main"}, Deployment: config.Deployment{Strategy: strategy, Root: root, LockFile: filepath.Join(root, "deploy.lock"), StateFile: filepath.Join(root, "state.json"), EventLog: filepath.Join(root, "deployment-events.jsonl"), HealthPath: "/healthz", ReadinessPath: "/readyz", CandidateTimeoutSecs: 2, ActivationWindowSecs: 1, Smoke: []config.Smoke{{Path: "/", Contains: "Example"}}, PublicSmoke: []config.PublicSmoke{{URL: "https://example.test/", Contains: "Example"}}}}
|
||||
return cfg, old, fresh
|
||||
}
|
||||
func manager(operator Operator, fresh string) Manager {
|
||||
return Manager{Operator: operator, Now: func() time.Time { return time.Unix(100, 0).UTC() }, Prepare: func(config.Config, string, string, string) (string, error) { return fresh, nil }, Inspect: func(config.Config, string, string, string) error { return nil }, ReadIdentity: func(string) (releaseIdentity, error) {
|
||||
return releaseIdentity{Version: "v0.2.0-preview.1", Commit: strings.Repeat("b", 40)}, nil
|
||||
}, OperationID: func() (string, error) { return strings.Repeat("d", 32), nil }, Sleep: func(context.Context, time.Duration) error { return nil }}
|
||||
}
|
||||
|
||||
func singletonSettings(t *testing.T, cfg config.Config, currentRelease string) (*config.Singleton, string) {
|
||||
t.Helper()
|
||||
handler := filepath.Join(cfg.Deployment.Root, "handler.caddy")
|
||||
template := filepath.Join(cfg.Deployment.Root, "handler.template")
|
||||
if err := os.WriteFile(handler, []byte("reverse_proxy 127.0.0.1:8092\n"), 0o640); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(template, []byte("reverse_proxy {{UPSTREAM}}\n"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
current := filepath.Join(cfg.Deployment.Root, "current")
|
||||
if err := replaceSymlink(current, currentRelease); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return &config.Singleton{
|
||||
Unit: "example-site.service", Address: "127.0.0.1:8092", CandidateAddress: "127.0.0.1:18092", ListenEnv: "EXAMPLE_LISTEN",
|
||||
CurrentLink: current, PreviousLink: filepath.Join(cfg.Deployment.Root, "previous"), CaddyConfig: filepath.Join(cfg.Deployment.Root, "Caddyfile"),
|
||||
CaddyHandler: handler, CaddyHandlerTemplate: template,
|
||||
}, handler
|
||||
}
|
||||
|
||||
func TestBlueGreenActivationAndRollback(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "blue_green")
|
||||
handler := filepath.Join(cfg.Deployment.Root, "handler.caddy")
|
||||
template := filepath.Join(cfg.Deployment.Root, "handler.template")
|
||||
if err := os.WriteFile(handler, []byte("reverse_proxy 127.0.0.1:8090\n"), 0o640); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(template, []byte("reverse_proxy {{UPSTREAM}}\n"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
blue := filepath.Join(cfg.Deployment.Root, "slots", "blue")
|
||||
green := filepath.Join(cfg.Deployment.Root, "slots", "green")
|
||||
if err := replaceSymlink(blue, old); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := replaceSymlink(green, old); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
cfg.Deployment.BlueGreen = &config.BlueGreen{CaddyConfig: filepath.Join(cfg.Deployment.Root, "Caddyfile"), CaddyHandler: handler, CaddyHandlerTemplate: template, BootstrapActive: "blue", Blue: config.Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: blue}, Green: config.Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: green}}
|
||||
if err := cfg.Validate(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
operator := &fakeOperator{active: map[string]bool{"example-blue.service": true, "example-green.service": true}}
|
||||
m := manager(operator, fresh)
|
||||
var events []eventlog.Event
|
||||
m.AppendEvent = func(_ string, event eventlog.Event) error {
|
||||
events = append(events, event)
|
||||
return nil
|
||||
}
|
||||
report, err := m.Deploy(context.Background(), cfg, Request{Activate: true, ApprovedSHA256: strings.Repeat("a", 64)})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if report.ActiveRelease != fresh || report.PreviousRelease != old {
|
||||
t.Fatalf("report=%+v", report)
|
||||
}
|
||||
deployed, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if deployed.DesiredRelease != fresh || deployed.CandidateRelease != "" || deployed.LastAttemptRelease != fresh || deployed.LastAttemptOutcome != "succeeded" {
|
||||
t.Fatalf("deployment identity state=%+v", deployed)
|
||||
}
|
||||
if len(events) != 2 || events[0].Phase != "candidate" || events[0].Outcome != "running" || events[1].Phase != "activation" || events[1].Outcome != "succeeded" || events[0].OperationID != events[1].OperationID {
|
||||
t.Fatalf("events=%+v", events)
|
||||
}
|
||||
if info, err := os.Stat(handler); err != nil || info.Mode().Perm() != 0o640 {
|
||||
t.Fatalf("handler mode=%v err=%v", info.Mode().Perm(), err)
|
||||
}
|
||||
if target, err := resolveReleaseLink(cfg.Deployment.Root, green); err != nil || target != fresh {
|
||||
t.Fatalf("green=%q err=%v", target, err)
|
||||
}
|
||||
operator.rejectMarkers = true
|
||||
operator.probes = nil
|
||||
record, err := m.Rollback(context.Background(), cfg)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if record.ActiveRelease != old || record.PreviousRelease != fresh {
|
||||
t.Fatalf("rollback=%+v", record)
|
||||
}
|
||||
if len(events) != 4 || events[2].Phase != "rollback" || events[2].Outcome != "running" || events[3].Phase != "rollback" || events[3].Outcome != "succeeded" || events[2].OperationID != events[3].OperationID || events[2].ArtifactDigest != strings.Repeat("c", 64) {
|
||||
t.Fatalf("rollback events=%+v", events)
|
||||
}
|
||||
if len(operator.probes) != 4 {
|
||||
t.Fatalf("rollback probes=%#v", operator.probes)
|
||||
}
|
||||
for _, probe := range operator.probes {
|
||||
if !strings.HasSuffix(probe, "/healthz") && !strings.HasSuffix(probe, "/readyz") {
|
||||
t.Fatalf("rollback applied future-release smoke checks: %#v", operator.probes)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeploymentEvidenceCanNeverBlockActivationOrRollback(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
cfg.Deployment.Singleton, _ = singletonSettings(t, cfg, old)
|
||||
m := manager(&fakeOperator{active: map[string]bool{}}, fresh)
|
||||
appendCalls := 0
|
||||
m.AppendEvent = func(string, eventlog.Event) error {
|
||||
appendCalls++
|
||||
return errors.New("injected event failure")
|
||||
}
|
||||
report, err := m.Deploy(context.Background(), cfg, Request{Activate: true, ApprovedSHA256: strings.Repeat("a", 64)})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if report.EventWarnings != 2 || report.ActiveRelease != fresh {
|
||||
t.Fatalf("report=%+v", report)
|
||||
}
|
||||
if _, err := m.Rollback(context.Background(), cfg); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil || record.ActiveRelease != old || appendCalls != 4 {
|
||||
t.Fatalf("record=%+v appends=%d err=%v", record, appendCalls, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeploymentEvidenceIdentityIsBestEffort(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
cfg.Deployment.Singleton, _ = singletonSettings(t, cfg, old)
|
||||
m := manager(&fakeOperator{active: map[string]bool{}}, fresh)
|
||||
m.ReadIdentity = func(string) (releaseIdentity, error) {
|
||||
return releaseIdentity{}, errors.New("injected identity failure")
|
||||
}
|
||||
report, err := m.Deploy(context.Background(), cfg, Request{Activate: true, ApprovedSHA256: strings.Repeat("a", 64)})
|
||||
if err != nil || report.EventWarnings != 1 || report.ActiveRelease != fresh {
|
||||
t.Fatalf("report=%+v err=%v", report, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSingletonOperationIdentityIsRequiredBeforeCandidateStart(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
cfg.Deployment.Singleton, _ = singletonSettings(t, cfg, old)
|
||||
operator := &fakeOperator{active: map[string]bool{}}
|
||||
m := manager(operator, fresh)
|
||||
m.OperationID = func() (string, error) { return "", errors.New("injected entropy failure") }
|
||||
if _, err := m.Deploy(context.Background(), cfg, Request{Activate: true, ApprovedSHA256: strings.Repeat("a", 64)}); err == nil || !strings.Contains(err.Error(), "operation identity") {
|
||||
t.Fatalf("expected operation identity refusal, got %v", err)
|
||||
}
|
||||
if len(operator.starts) != 0 {
|
||||
t.Fatalf("candidate started without an operation identity: %#v", operator.starts)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSingletonUnresolvedLeaseBlocksReplacementBeforeCandidateStart(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
cfg.Deployment.Singleton, _ = singletonSettings(t, cfg, old)
|
||||
at := time.Unix(100, 0).UTC().Format(time.RFC3339)
|
||||
record := state.Record{SchemaVersion: state.SchemaVersion, Strategy: cfg.Deployment.Strategy, DesiredRelease: fresh, CandidateRelease: fresh, ActiveSlot: "singleton", ActiveRelease: old, LastAttemptRelease: fresh, LastAttemptOutcome: "failed", LastAttemptAt: at, UpdatedAt: at}
|
||||
if err := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, record); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
storeTestCandidateLease(t, cfg, fresh, at)
|
||||
operator := &fakeOperator{active: map[string]bool{testCandidateUnit: true}}
|
||||
if _, err := manager(operator, fresh).Deploy(context.Background(), cfg, Request{Activate: true, ApprovedSHA256: strings.Repeat("a", 64)}); err == nil || !strings.Contains(err.Error(), "run tend reconcile") {
|
||||
t.Fatalf("expected unresolved lease refusal, got %v", err)
|
||||
}
|
||||
if len(operator.starts) != 0 || !operator.active[testCandidateUnit] {
|
||||
t.Fatalf("existing candidate was disturbed: starts=%#v active=%#v", operator.starts, operator.active)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBlueGreenCaddyFailureRestoresHandlerAndSlot(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "blue_green")
|
||||
handler := filepath.Join(cfg.Deployment.Root, "handler.caddy")
|
||||
template := filepath.Join(cfg.Deployment.Root, "handler.template")
|
||||
original := []byte("reverse_proxy 127.0.0.1:8090\n")
|
||||
_ = os.WriteFile(handler, original, 0o644)
|
||||
_ = os.WriteFile(template, []byte("reverse_proxy {{UPSTREAM}}\n"), 0o644)
|
||||
blue := filepath.Join(cfg.Deployment.Root, "slots", "blue")
|
||||
green := filepath.Join(cfg.Deployment.Root, "slots", "green")
|
||||
_ = replaceSymlink(blue, old)
|
||||
_ = replaceSymlink(green, old)
|
||||
cfg.Deployment.BlueGreen = &config.BlueGreen{CaddyConfig: filepath.Join(cfg.Deployment.Root, "Caddyfile"), CaddyHandler: handler, CaddyHandlerTemplate: template, BootstrapActive: "blue", Blue: config.Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: blue}, Green: config.Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: green}}
|
||||
operator := &fakeOperator{active: map[string]bool{}, failReload: true}
|
||||
m := manager(operator, fresh)
|
||||
if _, err := m.Deploy(context.Background(), cfg, Request{Activate: true}); err == nil {
|
||||
t.Fatal("expected failure")
|
||||
}
|
||||
body, _ := os.ReadFile(handler)
|
||||
if string(body) != string(original) {
|
||||
t.Fatalf("handler not restored: %q", body)
|
||||
}
|
||||
target, err := resolveReleaseLink(cfg.Deployment.Root, green)
|
||||
if err != nil || target != old {
|
||||
t.Fatalf("green=%q err=%v", target, err)
|
||||
}
|
||||
failed, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if failed.ActiveRelease != old || failed.LastAttemptOutcome != "failed" || failed.CandidateRelease != "" {
|
||||
t.Fatalf("failed state=%+v", failed)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSingletonRestartFailureRestoresPointers(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
settings, handler := singletonSettings(t, cfg, old)
|
||||
cfg.Deployment.Singleton = settings
|
||||
operator := &fakeOperator{active: map[string]bool{}, failRestartUnit: "example-site.service", failRestartOnce: true}
|
||||
m := manager(operator, fresh)
|
||||
if _, err := m.Deploy(context.Background(), cfg, Request{Activate: true}); err == nil {
|
||||
t.Fatal("expected failure")
|
||||
}
|
||||
target, err := resolveReleaseLink(cfg.Deployment.Root, cfg.Deployment.Singleton.CurrentLink)
|
||||
if err != nil || target != old {
|
||||
t.Fatalf("current=%q err=%v", target, err)
|
||||
}
|
||||
if _, err := os.Lstat(cfg.Deployment.Singleton.PreviousLink); !os.IsNotExist(err) {
|
||||
t.Fatal("previous pointer was not restored")
|
||||
}
|
||||
body, err := os.ReadFile(handler)
|
||||
if err != nil || string(body) != "reverse_proxy 127.0.0.1:8092\n" {
|
||||
t.Fatalf("handler=%q err=%v", body, err)
|
||||
}
|
||||
if info, err := os.Stat(handler); err != nil || info.Mode().Perm() != 0o640 {
|
||||
t.Fatalf("handler mode=%v err=%v", info.Mode().Perm(), err)
|
||||
}
|
||||
if operator.active[testCandidateUnit] {
|
||||
t.Fatal("candidate was not stopped after successful restoration")
|
||||
}
|
||||
}
|
||||
|
||||
func TestStateRecordsSuccessfulActivation(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
settings, handler := singletonSettings(t, cfg, old)
|
||||
cfg.Deployment.Singleton = settings
|
||||
operator := &fakeOperator{active: map[string]bool{}}
|
||||
m := manager(operator, fresh)
|
||||
if _, err := m.Deploy(context.Background(), cfg, Request{Activate: true}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if record.ActiveRelease != fresh || record.PreviousRelease != old || record.CandidateRelease != "" {
|
||||
t.Fatalf("state=%+v", record)
|
||||
}
|
||||
if _, err := os.Lstat(state.CandidateLeasePath(cfg.Deployment.StateFile)); !os.IsNotExist(err) {
|
||||
t.Fatalf("candidate lease was not removed: %v", err)
|
||||
}
|
||||
if len(operator.starts) != 1 || operator.starts[0] != testCandidateUnit {
|
||||
t.Fatalf("candidate starts=%#v", operator.starts)
|
||||
}
|
||||
if operator.candidateFile != cfg.Service.EnvironmentFile || len(operator.candidateEnvironment) != 1 || operator.candidateEnvironment["EXAMPLE_LISTEN"] != "127.0.0.1:18092" {
|
||||
t.Fatalf("candidate file=%q environment=%#v", operator.candidateFile, operator.candidateEnvironment)
|
||||
}
|
||||
body, err := os.ReadFile(handler)
|
||||
if err != nil || string(body) != "reverse_proxy 127.0.0.1:8092\n" {
|
||||
t.Fatalf("handler=%q err=%v", body, err)
|
||||
}
|
||||
if operator.reloads != 2 || operator.active[testCandidateUnit] {
|
||||
t.Fatalf("reloads=%d active=%#v", operator.reloads, operator.active)
|
||||
}
|
||||
reconciliation, err := m.Reconcile(context.Background(), cfg)
|
||||
if err != nil || reconciliation.Mutation != "none" || reconciliation.Disposition != "settled" || reconciliation.Observed.CandidateLease || !reconciliation.Consistent {
|
||||
t.Fatalf("reconciliation=%+v err=%v", reconciliation, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSingletonContinuityFailureRestoresHandlerPointersAndService(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
settings, handler := singletonSettings(t, cfg, old)
|
||||
cfg.Deployment.Singleton = settings
|
||||
operator := &fakeOperator{active: map[string]bool{"example-site.service": true}, failPublicAfter: 4}
|
||||
m := manager(operator, fresh)
|
||||
if _, err := m.Deploy(context.Background(), cfg, Request{Activate: true}); err == nil || !strings.Contains(err.Error(), "continuity") {
|
||||
t.Fatalf("expected continuity failure, got %v", err)
|
||||
}
|
||||
current, err := resolveReleaseLink(cfg.Deployment.Root, cfg.Deployment.Singleton.CurrentLink)
|
||||
if err != nil || current != old {
|
||||
t.Fatalf("current=%q err=%v", current, err)
|
||||
}
|
||||
body, err := os.ReadFile(handler)
|
||||
if err != nil || string(body) != "reverse_proxy 127.0.0.1:8092\n" {
|
||||
t.Fatalf("handler=%q err=%v", body, err)
|
||||
}
|
||||
if operator.active[testCandidateUnit] {
|
||||
t.Fatal("candidate was not stopped after continuity restoration")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSingletonCaddyReloadFailuresRestorePriorRoute(t *testing.T) {
|
||||
for _, reload := range []int{1, 2} {
|
||||
t.Run(fmt.Sprintf("reload-%d", reload), func(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
settings, handler := singletonSettings(t, cfg, old)
|
||||
cfg.Deployment.Singleton = settings
|
||||
operator := &fakeOperator{active: map[string]bool{"example-site.service": true}, failReloadAt: reload}
|
||||
if _, err := manager(operator, fresh).Deploy(context.Background(), cfg, Request{Activate: true}); err == nil || !strings.Contains(err.Error(), "Caddy reload failed") {
|
||||
t.Fatalf("expected Caddy reload failure, got %v", err)
|
||||
}
|
||||
current, err := resolveReleaseLink(cfg.Deployment.Root, settings.CurrentLink)
|
||||
if err != nil || current != old {
|
||||
t.Fatalf("current=%q err=%v", current, err)
|
||||
}
|
||||
body, err := os.ReadFile(handler)
|
||||
if err != nil || string(body) != "reverse_proxy 127.0.0.1:8092\n" {
|
||||
t.Fatalf("handler=%q err=%v", body, err)
|
||||
}
|
||||
if operator.active[testCandidateUnit] {
|
||||
t.Fatal("candidate was not stopped after route restoration")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSingletonIncompleteRecoveryKeepsProvenCandidateRunning(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
settings, _ := singletonSettings(t, cfg, old)
|
||||
cfg.Deployment.Singleton = settings
|
||||
operator := &fakeOperator{active: map[string]bool{"example-site.service": true}, failReload: true}
|
||||
_, err := manager(operator, fresh).Deploy(context.Background(), cfg, Request{Activate: true})
|
||||
if err == nil || !strings.Contains(err.Error(), "candidate remains routed for operator recovery") {
|
||||
t.Fatalf("expected explicit incomplete recovery, got %v", err)
|
||||
}
|
||||
if !operator.active[testCandidateUnit] {
|
||||
t.Fatal("proven candidate was stopped despite incomplete route restoration")
|
||||
}
|
||||
record, loadErr := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
lease, leaseErr := state.LoadCandidateLease(state.CandidateLeasePath(cfg.Deployment.StateFile), cfg.Deployment.Root, cfg.Service.Name)
|
||||
if loadErr != nil || leaseErr != nil || record.CandidateRelease != fresh || lease.OperationID != strings.Repeat("d", 32) || lease.Unit != testCandidateUnit {
|
||||
t.Fatalf("retained state=%+v err=%v", record, loadErr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestReconcileReportsRetainedCandidateWithoutMutation(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
settings, handler := singletonSettings(t, cfg, old)
|
||||
cfg.Deployment.Singleton = settings
|
||||
at := time.Unix(100, 0).UTC().Format(time.RFC3339)
|
||||
record := state.Record{SchemaVersion: state.SchemaVersion, Strategy: cfg.Deployment.Strategy, DesiredRelease: fresh, CandidateRelease: fresh, ActiveSlot: "singleton", ActiveRelease: old, LastAttemptRelease: fresh, LastAttemptOutcome: "failed", LastAttemptAt: at, UpdatedAt: at}
|
||||
if err := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, record); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
storeTestCandidateLease(t, cfg, fresh, at)
|
||||
candidateHandler, err := renderHandler(settings.CaddyHandlerTemplate, settings.CandidateAddress)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(handler, candidateHandler, 0o640); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
operator := &fakeOperator{active: map[string]bool{settings.Unit: true, testCandidateUnit: true}}
|
||||
reconciliation, err := manager(operator, fresh).Reconcile(context.Background(), cfg)
|
||||
if err != nil || reconciliation.Mutation != "none" || !reconciliation.Observed.CandidateLease || reconciliation.Observed.CandidateUnitActive == nil || !*reconciliation.Observed.CandidateUnitActive || reconciliation.Observed.HandlerFileTarget != "candidate" || reconciliation.Disposition != "retained_candidate_handler_file" {
|
||||
t.Fatalf("reconciliation=%+v err=%v", reconciliation, err)
|
||||
}
|
||||
if len(operator.stops) != 0 || len(operator.restarts) != 0 || operator.reloads != 0 {
|
||||
t.Fatalf("reconcile mutated services: stops=%#v restarts=%#v reloads=%d", operator.stops, operator.restarts, operator.reloads)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSingletonRollbackRetainsOperationLeaseWhenRecoveryIsIncomplete(t *testing.T) {
|
||||
cfg, old, fresh := baseConfig(t, "singleton_candidate")
|
||||
cfg.Deployment.Singleton, _ = singletonSettings(t, cfg, old)
|
||||
operator := &fakeOperator{active: map[string]bool{cfg.Deployment.Singleton.Unit: true}}
|
||||
m := manager(operator, fresh)
|
||||
if _, err := m.Deploy(context.Background(), cfg, Request{Activate: true, ApprovedSHA256: strings.Repeat("a", 64)}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
operator.failReload = true
|
||||
if _, err := m.Rollback(context.Background(), cfg); err == nil || !strings.Contains(err.Error(), "candidate remains routed for operator recovery") {
|
||||
t.Fatalf("expected retained rollback candidate, got %v", err)
|
||||
}
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
lease, leaseErr := state.LoadCandidateLease(state.CandidateLeasePath(cfg.Deployment.StateFile), cfg.Deployment.Root, cfg.Service.Name)
|
||||
if record.ActiveRelease != fresh || record.CandidateRelease != old || leaseErr != nil || lease.OperationID != strings.Repeat("d", 32) || lease.Unit != testCandidateUnit || record.LastAttemptOutcome != "failed" {
|
||||
t.Fatalf("rollback state=%+v", record)
|
||||
}
|
||||
if !operator.active[testCandidateUnit] {
|
||||
t.Fatal("rollback candidate was stopped despite incomplete recovery")
|
||||
}
|
||||
}
|
||||
|
||||
func TestPruneProtectsOperationScopedCandidateRelease(t *testing.T) {
|
||||
cfg, active, candidate := baseConfig(t, "singleton_candidate")
|
||||
cfg.Deployment.Singleton, _ = singletonSettings(t, cfg, active)
|
||||
at := time.Unix(100, 0).UTC().Format(time.RFC3339)
|
||||
record := state.Record{SchemaVersion: state.SchemaVersion, Strategy: cfg.Deployment.Strategy, DesiredRelease: candidate, CandidateRelease: candidate, ActiveSlot: "singleton", ActiveRelease: active, LastAttemptRelease: candidate, LastAttemptOutcome: "failed", LastAttemptAt: at, UpdatedAt: at}
|
||||
if err := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, record); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
storeTestCandidateLease(t, cfg, candidate, at)
|
||||
removed, err := manager(&fakeOperator{active: map[string]bool{}}, candidate).Prune(cfg, 2, true)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(removed) != 0 {
|
||||
t.Fatalf("candidate release was selected for pruning: %#v", removed)
|
||||
}
|
||||
if info, err := os.Stat(candidate); err != nil || !info.IsDir() {
|
||||
t.Fatalf("candidate release was not preserved: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
//go:build linux
|
||||
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"os"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
type fileLock struct{ file *os.File }
|
||||
|
||||
func acquireLock(path string) (*fileLock, error) {
|
||||
file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := syscall.Flock(int(file.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
|
||||
_ = file.Close()
|
||||
return nil, errors.New("deployment lock is held")
|
||||
}
|
||||
return &fileLock{file: file}, nil
|
||||
}
|
||||
func (l *fileLock) Close() error {
|
||||
if l == nil || l.file == nil {
|
||||
return nil
|
||||
}
|
||||
_ = syscall.Flock(int(l.file.Fd()), syscall.LOCK_UN)
|
||||
return l.file.Close()
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
//go:build linux
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestHostWideLockSerializesIndependentServices(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "tend-deploy.lock")
|
||||
first, err := acquireLock(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer first.Close()
|
||||
if second, err := acquireLock(path); err == nil {
|
||||
_ = second.Close()
|
||||
t.Fatal("second service acquired the shared activation lock")
|
||||
}
|
||||
if err = first.Close(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
third, err := acquireLock(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_ = third.Close()
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
//go:build !linux
|
||||
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import "errors"
|
||||
|
||||
type fileLock struct{}
|
||||
|
||||
func acquireLock(string) (*fileLock, error) {
|
||||
return nil, errors.New("deployment mutations require Linux")
|
||||
}
|
||||
func (*fileLock) Close() error { return nil }
|
||||
@@ -0,0 +1,125 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"gamertan.com/tend/internal/process"
|
||||
)
|
||||
|
||||
type Operator interface {
|
||||
Restart(context.Context, string) error
|
||||
Stop(context.Context, string) error
|
||||
IsActive(context.Context, string) (bool, error)
|
||||
StartCandidate(context.Context, string, string, string, map[string]string) error
|
||||
ValidateCaddy(context.Context, string) error
|
||||
ReloadCaddy(context.Context) error
|
||||
Probe(context.Context, string, string, string, string) error
|
||||
ProbeURL(context.Context, string, string) error
|
||||
}
|
||||
|
||||
type SystemOperator struct {
|
||||
Runner process.Runner
|
||||
Timeout time.Duration
|
||||
}
|
||||
|
||||
func (o SystemOperator) Restart(ctx context.Context, unit string) error {
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "systemctl", "restart", unit)
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) Stop(ctx context.Context, unit string) error {
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "systemctl", "stop", unit)
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) IsActive(ctx context.Context, unit string) (bool, error) {
|
||||
out, err := o.Runner.Run(ctx, "/", nil, "systemctl", "is-active", unit)
|
||||
if err != nil {
|
||||
if strings.TrimSpace(string(out)) == "inactive" || strings.TrimSpace(string(out)) == "failed" {
|
||||
return false, nil
|
||||
}
|
||||
return false, err
|
||||
}
|
||||
return strings.TrimSpace(string(out)) == "active", nil
|
||||
}
|
||||
func (o SystemOperator) StartCandidate(ctx context.Context, unit, binary, environmentFile string, env map[string]string) error {
|
||||
args := []string{
|
||||
"--unit", unit, "--collect",
|
||||
"--property=DynamicUser=yes", "--property=NoNewPrivileges=yes",
|
||||
"--property=PrivateDevices=yes", "--property=PrivateTmp=yes",
|
||||
"--property=ProtectClock=yes", "--property=ProtectControlGroups=yes",
|
||||
"--property=ProtectHome=yes", "--property=ProtectHostname=yes",
|
||||
"--property=ProtectKernelLogs=yes", "--property=ProtectKernelModules=yes",
|
||||
"--property=ProtectKernelTunables=yes", "--property=ProtectSystem=strict",
|
||||
"--property=RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX",
|
||||
"--property=RestrictNamespaces=yes", "--property=RestrictRealtime=yes",
|
||||
"--property=RestrictSUIDSGID=yes", "--property=LockPersonality=yes",
|
||||
"--property=MemoryDenyWriteExecute=yes", "--property=CapabilityBoundingSet=",
|
||||
"--property=AmbientCapabilities=",
|
||||
"--property=EnvironmentFile=" + environmentFile,
|
||||
}
|
||||
keys := make([]string, 0, len(env))
|
||||
for key := range env {
|
||||
keys = append(keys, key)
|
||||
}
|
||||
sort.Strings(keys)
|
||||
for _, key := range keys {
|
||||
args = append(args, "--setenv", key+"="+env[key])
|
||||
}
|
||||
args = append(args, "--", binary)
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "systemd-run", args...)
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) ValidateCaddy(ctx context.Context, path string) error {
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "caddy", "validate", "--config", path, "--adapter", "caddyfile")
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) ReloadCaddy(ctx context.Context) error {
|
||||
_, err := o.Runner.Run(ctx, "/", nil, "systemctl", "reload", "caddy.service")
|
||||
return err
|
||||
}
|
||||
func (o SystemOperator) Probe(ctx context.Context, address, host, path, contains string) error {
|
||||
u := url.URL{Scheme: "http", Host: address, Path: path}
|
||||
return o.probeRequest(ctx, u.String(), host, contains)
|
||||
}
|
||||
func (o SystemOperator) ProbeURL(ctx context.Context, value, contains string) error {
|
||||
u, err := url.Parse(value)
|
||||
if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.Fragment != "" {
|
||||
return errors.New("public probe URL is invalid")
|
||||
}
|
||||
return o.probeRequest(ctx, u.String(), "", contains)
|
||||
}
|
||||
func (o SystemOperator) probeRequest(ctx context.Context, value, host, contains string) error {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, value, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if host != "" {
|
||||
req.Host = host
|
||||
}
|
||||
client := &http.Client{Timeout: o.Timeout, CheckRedirect: func(*http.Request, []*http.Request) error { return errors.New("redirect refused") }}
|
||||
response, err := client.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer response.Body.Close()
|
||||
if response.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("probe returned HTTP %d", response.StatusCode)
|
||||
}
|
||||
body, err := io.ReadAll(io.LimitReader(response.Body, 1<<20))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if contains != "" && !strings.Contains(string(body), contains) {
|
||||
return errors.New("probe response omitted required marker")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"reflect"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
type recordingRunner struct {
|
||||
name string
|
||||
args []string
|
||||
}
|
||||
|
||||
func (r *recordingRunner) Run(_ context.Context, _ string, _ map[string]string, name string, args ...string) ([]byte, error) {
|
||||
r.name = name
|
||||
r.args = append([]string(nil), args...)
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func TestStartCandidateUsesArgumentVectorAndHardenedUnit(t *testing.T) {
|
||||
runner := &recordingRunner{}
|
||||
operator := SystemOperator{Runner: runner}
|
||||
env := map[string]string{"Z_ENV": "safe value", "A_ENV": "first"}
|
||||
if err := operator.StartCandidate(context.Background(), "example-tend-candidate.service", "/opt/example/releases/sha256-a/app", "/etc/tend/environment/example.env", env); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if runner.name != "systemd-run" {
|
||||
t.Fatalf("command=%q", runner.name)
|
||||
}
|
||||
required := []string{"--property=DynamicUser=yes", "--property=NoNewPrivileges=yes", "--property=ProtectSystem=strict", "--property=MemoryDenyWriteExecute=yes", "--property=CapabilityBoundingSet=", "--property=EnvironmentFile=/etc/tend/environment/example.env", "--setenv", "A_ENV=first", "--setenv", "Z_ENV=safe value", "--", "/opt/example/releases/sha256-a/app"}
|
||||
cursor := 0
|
||||
for _, arg := range runner.args {
|
||||
if cursor < len(required) && arg == required[cursor] {
|
||||
cursor++
|
||||
}
|
||||
}
|
||||
if cursor != len(required) {
|
||||
t.Fatalf("arguments omitted ordered security boundary: %#v", runner.args)
|
||||
}
|
||||
if reflect.DeepEqual(runner.args, []string{"sh", "-c"}) {
|
||||
t.Fatal("candidate command used a shell")
|
||||
}
|
||||
if strings.Contains(strings.Join(runner.args, "\n"), "SUPER_SECRET") {
|
||||
t.Fatal("candidate arguments exposed a secret value")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
//go:build linux
|
||||
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"os"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
type fileIdentity struct {
|
||||
mode os.FileMode
|
||||
uid, gid int
|
||||
owned bool
|
||||
}
|
||||
|
||||
func identityFor(info os.FileInfo, fallback os.FileMode) fileIdentity {
|
||||
identity := fileIdentity{mode: fallback}
|
||||
if info == nil {
|
||||
return identity
|
||||
}
|
||||
identity.mode = info.Mode().Perm()
|
||||
if stat, ok := info.Sys().(*syscall.Stat_t); ok {
|
||||
identity.uid = int(stat.Uid)
|
||||
identity.gid = int(stat.Gid)
|
||||
identity.owned = true
|
||||
}
|
||||
return identity
|
||||
}
|
||||
func applyIdentity(file *os.File, identity fileIdentity) error {
|
||||
if identity.owned {
|
||||
if err := file.Chown(identity.uid, identity.gid); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return file.Chmod(identity.mode)
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
//go:build !linux
|
||||
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import "os"
|
||||
|
||||
type fileIdentity struct{ mode os.FileMode }
|
||||
|
||||
func identityFor(info os.FileInfo, fallback os.FileMode) fileIdentity {
|
||||
if info != nil {
|
||||
return fileIdentity{mode: info.Mode().Perm()}
|
||||
}
|
||||
return fileIdentity{mode: fallback}
|
||||
}
|
||||
func applyIdentity(file *os.File, identity fileIdentity) error { return file.Chmod(identity.mode) }
|
||||
@@ -0,0 +1,270 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/state"
|
||||
)
|
||||
|
||||
type Finding struct {
|
||||
Code string `json:"code"`
|
||||
Severity string `json:"severity"`
|
||||
Message string `json:"message"`
|
||||
}
|
||||
|
||||
type ObservedReleaseIdentity struct {
|
||||
Version string `json:"version"`
|
||||
Commit string `json:"commit"`
|
||||
}
|
||||
|
||||
type ObservedState struct {
|
||||
ActiveRelease string `json:"active_release,omitempty"`
|
||||
PreviousRelease string `json:"previous_release,omitempty"`
|
||||
ActiveIdentity *ObservedReleaseIdentity `json:"active_identity,omitempty"`
|
||||
Units map[string]bool `json:"units"`
|
||||
CandidateLease bool `json:"candidate_lease"`
|
||||
CandidateUnit string `json:"candidate_unit,omitempty"`
|
||||
CandidateUnitActive *bool `json:"candidate_unit_active,omitempty"`
|
||||
LegacyCandidateUnit string `json:"legacy_candidate_unit,omitempty"`
|
||||
LegacyCandidateActive *bool `json:"legacy_candidate_unit_active,omitempty"`
|
||||
RouteHandlerMatches bool `json:"route_handler_matches"`
|
||||
HandlerFileTarget string `json:"handler_file_target,omitempty"`
|
||||
}
|
||||
|
||||
type Reconciliation struct {
|
||||
Service string `json:"service"`
|
||||
Strategy string `json:"strategy"`
|
||||
Mutation string `json:"mutation"`
|
||||
Consistent bool `json:"consistent"`
|
||||
StateInitialized bool `json:"state_initialized"`
|
||||
State *state.Record `json:"state,omitempty"`
|
||||
Observed ObservedState `json:"observed"`
|
||||
Disposition string `json:"disposition"`
|
||||
Findings []Finding `json:"findings"`
|
||||
}
|
||||
|
||||
// Reconcile observes configured units, release pointers, installed release
|
||||
// identity, and the imported Caddy handler. It never acquires the deployment
|
||||
// lock or mutates service state; proposed repairs remain an operator decision.
|
||||
func (m Manager) Reconcile(ctx context.Context, cfg config.Config) (Reconciliation, error) {
|
||||
if err := cfg.Validate(); err != nil {
|
||||
return Reconciliation{}, err
|
||||
}
|
||||
if m.Operator == nil || m.ReadIdentity == nil {
|
||||
return Reconciliation{}, errors.New("reconciliation dependencies are unavailable")
|
||||
}
|
||||
report := Reconciliation{
|
||||
Service: cfg.Service.Name, Strategy: cfg.Deployment.Strategy, Mutation: "none",
|
||||
Observed: ObservedState{Units: map[string]bool{}}, Findings: []Finding{},
|
||||
}
|
||||
add := func(code, severity, message string) {
|
||||
report.Findings = append(report.Findings, Finding{Code: code, Severity: severity, Message: message})
|
||||
}
|
||||
record, err := state.Load(cfg.Deployment.StateFile, cfg.Deployment.Root, cfg.Deployment.Strategy)
|
||||
if err == nil {
|
||||
report.State = &record
|
||||
report.StateInitialized = true
|
||||
} else if os.IsNotExist(err) {
|
||||
add("state_uninitialized", "warning", "Tend has no validated state record for this service.")
|
||||
} else {
|
||||
add("state_invalid", "error", "The Tend state record could not be validated.")
|
||||
}
|
||||
|
||||
activeSlot := ""
|
||||
activeUnit := ""
|
||||
activeAddress := ""
|
||||
handler := ""
|
||||
template := ""
|
||||
var candidateLease *state.CandidateLease
|
||||
switch cfg.Deployment.Strategy {
|
||||
case "singleton_candidate":
|
||||
single := *cfg.Deployment.Singleton
|
||||
activeSlot = "singleton"
|
||||
activeUnit = single.Unit
|
||||
activeAddress = single.Address
|
||||
handler, template = single.CaddyHandler, single.CaddyHandlerTemplate
|
||||
report.Observed.ActiveRelease = observeReleaseLink(cfg, single.CurrentLink, true, add)
|
||||
report.Observed.PreviousRelease = observeReleaseLink(cfg, single.PreviousLink, false, add)
|
||||
legacyCandidateUnit := cfg.Service.Name + "-tend-candidate.service"
|
||||
candidateUnit := legacyCandidateUnit
|
||||
lease, leaseErr := state.LoadCandidateLease(state.CandidateLeasePath(cfg.Deployment.StateFile), cfg.Deployment.Root, cfg.Service.Name)
|
||||
if leaseErr == nil {
|
||||
candidateLease = &lease
|
||||
report.Observed.CandidateLease = true
|
||||
candidateUnit = lease.Unit
|
||||
} else if !os.IsNotExist(leaseErr) {
|
||||
report.Observed.CandidateLease = true
|
||||
candidateUnit = ""
|
||||
add("candidate_lease_invalid", "error", "The operation-scoped candidate lease could not be validated.")
|
||||
} else if report.State != nil && report.State.CandidateRelease != "" {
|
||||
report.Observed.CandidateLease = true
|
||||
candidateUnit = ""
|
||||
add("legacy_candidate_lease", "error", "The state records a candidate release without an operation-scoped lease and requires manual review.")
|
||||
}
|
||||
if candidateUnit != "" {
|
||||
report.Observed.CandidateUnit = candidateUnit
|
||||
candidateActive, candidateErr := m.Operator.IsActive(ctx, candidateUnit)
|
||||
if candidateErr != nil {
|
||||
add("candidate_unit_unobservable", "error", "The transient candidate unit state could not be observed.")
|
||||
} else {
|
||||
report.Observed.CandidateUnitActive = &candidateActive
|
||||
report.Observed.Units[candidateUnit] = candidateActive
|
||||
}
|
||||
}
|
||||
if candidateUnit != legacyCandidateUnit {
|
||||
report.Observed.LegacyCandidateUnit = legacyCandidateUnit
|
||||
legacyActive, legacyErr := m.Operator.IsActive(ctx, legacyCandidateUnit)
|
||||
if legacyErr != nil {
|
||||
add("legacy_candidate_unit_unobservable", "error", "The legacy fixed candidate unit state could not be observed.")
|
||||
} else {
|
||||
report.Observed.LegacyCandidateActive = &legacyActive
|
||||
report.Observed.Units[legacyCandidateUnit] = legacyActive
|
||||
if legacyActive {
|
||||
add("legacy_candidate_unit_active", "error", "A legacy fixed-name candidate remains active beside an operation-scoped lease.")
|
||||
}
|
||||
}
|
||||
}
|
||||
case "blue_green":
|
||||
blueGreen := *cfg.Deployment.BlueGreen
|
||||
handler, template = blueGreen.CaddyHandler, blueGreen.CaddyHandlerTemplate
|
||||
activeSlot = blueGreen.BootstrapActive
|
||||
if report.State != nil {
|
||||
activeSlot = report.State.ActiveSlot
|
||||
}
|
||||
active := slotConfig(blueGreen, activeSlot)
|
||||
previousName := "blue"
|
||||
if activeSlot == "blue" {
|
||||
previousName = "green"
|
||||
}
|
||||
previous := slotConfig(blueGreen, previousName)
|
||||
activeUnit, activeAddress = active.Unit, active.Address
|
||||
report.Observed.ActiveRelease = observeReleaseLink(cfg, active.Link, true, add)
|
||||
report.Observed.PreviousRelease = observeReleaseLink(cfg, previous.Link, false, add)
|
||||
for _, slot := range []config.Slot{blueGreen.Blue, blueGreen.Green} {
|
||||
observeUnit(ctx, m.Operator, slot.Unit, report.Observed.Units, add)
|
||||
}
|
||||
}
|
||||
if _, exists := report.Observed.Units[activeUnit]; !exists {
|
||||
observeUnit(ctx, m.Operator, activeUnit, report.Observed.Units, add)
|
||||
}
|
||||
if active, observed := report.Observed.Units[activeUnit]; activeUnit != "" && observed && !active {
|
||||
add("active_unit_inactive", "error", "The configured active service unit is not active.")
|
||||
}
|
||||
|
||||
if report.Observed.ActiveRelease != "" {
|
||||
identity, identityErr := m.ReadIdentity(report.Observed.ActiveRelease)
|
||||
if identityErr != nil {
|
||||
add("active_identity_unreadable", "error", "The observed active release identity could not be validated.")
|
||||
} else {
|
||||
report.Observed.ActiveIdentity = &ObservedReleaseIdentity{Version: identity.Version, Commit: identity.Commit}
|
||||
}
|
||||
}
|
||||
expectedHandler, renderErr := renderHandler(template, activeAddress)
|
||||
actualHandler, readErr := os.ReadFile(handler)
|
||||
if renderErr != nil || readErr != nil {
|
||||
add("route_handler_unreadable", "error", "The configured Caddy handler or its template could not be validated.")
|
||||
} else {
|
||||
report.Observed.RouteHandlerMatches = bytes.Equal(expectedHandler, actualHandler)
|
||||
if report.Observed.RouteHandlerMatches {
|
||||
report.Observed.HandlerFileTarget = "installed"
|
||||
} else if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
candidateAddress := cfg.Deployment.Singleton.CandidateAddress
|
||||
if candidateLease != nil {
|
||||
candidateAddress = candidateLease.Address
|
||||
}
|
||||
candidateHandler, candidateErr := renderHandler(template, candidateAddress)
|
||||
if candidateErr == nil && bytes.Equal(candidateHandler, actualHandler) {
|
||||
report.Observed.HandlerFileTarget = "candidate"
|
||||
} else {
|
||||
report.Observed.HandlerFileTarget = "other"
|
||||
}
|
||||
}
|
||||
if !report.Observed.RouteHandlerMatches {
|
||||
add("route_handler_drift", "error", "The installed Caddy handler does not match the configured active upstream.")
|
||||
}
|
||||
}
|
||||
|
||||
if report.State != nil {
|
||||
if report.State.ActiveSlot != activeSlot || report.State.ActiveRelease != report.Observed.ActiveRelease {
|
||||
add("active_release_drift", "error", "Recorded active state does not match the observed active release pointer.")
|
||||
}
|
||||
if report.State.PreviousRelease != report.Observed.PreviousRelease {
|
||||
add("previous_release_drift", "warning", "Recorded rollback state does not match the observed previous release pointer.")
|
||||
}
|
||||
if cfg.Deployment.Strategy == "singleton_candidate" {
|
||||
leased := report.Observed.CandidateLease && candidateLease != nil
|
||||
candidateActive := report.Observed.CandidateUnitActive != nil && *report.Observed.CandidateUnitActive
|
||||
if candidateLease != nil && report.State.CandidateRelease == "" {
|
||||
add("candidate_lease_without_running_attempt", "error", "An operation-scoped candidate lease remains after the recorded attempt settled.")
|
||||
}
|
||||
if candidateLease != nil && report.State.CandidateRelease != "" && candidateLease.Release != report.State.CandidateRelease {
|
||||
add("candidate_lease_release_mismatch", "error", "The operation-scoped candidate lease does not match the recorded candidate release.")
|
||||
}
|
||||
if leased && report.Observed.CandidateUnitActive != nil && !candidateActive {
|
||||
add("inactive_candidate_lease", "error", "State retains a candidate lease but its operation-scoped unit is inactive.")
|
||||
}
|
||||
if !report.Observed.CandidateLease && candidateActive {
|
||||
add("unleased_candidate_active", "error", "A transient candidate unit is active without a matching running attempt.")
|
||||
}
|
||||
if leased && candidateActive && report.Observed.HandlerFileTarget == "candidate" {
|
||||
add("retained_candidate_routed", "warning", "The retained candidate appears in the handler file; do not stop it before establishing another healthy route.")
|
||||
}
|
||||
if leased && candidateActive && report.Observed.HandlerFileTarget != "candidate" {
|
||||
add("candidate_active_not_routed", "warning", "The leased candidate is active but the handler file does not target it; cleanup remains an explicit reviewed operation.")
|
||||
}
|
||||
}
|
||||
}
|
||||
switch {
|
||||
case !report.StateInitialized:
|
||||
report.Disposition = "state_uninitialized"
|
||||
case report.Observed.CandidateLease && report.Observed.CandidateUnit == "":
|
||||
report.Disposition = "legacy_or_invalid_candidate_lease"
|
||||
case report.Observed.CandidateLease && report.Observed.CandidateUnitActive != nil && *report.Observed.CandidateUnitActive && report.Observed.HandlerFileTarget == "candidate":
|
||||
report.Disposition = "retained_candidate_handler_file"
|
||||
case report.Observed.CandidateLease && report.Observed.CandidateUnitActive != nil && *report.Observed.CandidateUnitActive:
|
||||
report.Disposition = "candidate_active_not_in_handler_file"
|
||||
case report.Observed.CandidateLease:
|
||||
report.Disposition = "inactive_candidate_lease"
|
||||
case len(report.Findings) == 0:
|
||||
report.Disposition = "settled"
|
||||
default:
|
||||
report.Disposition = "manual_review_required"
|
||||
}
|
||||
report.Consistent = len(report.Findings) == 0
|
||||
return report, nil
|
||||
}
|
||||
|
||||
func observeReleaseLink(cfg config.Config, link string, required bool, add func(string, string, string)) string {
|
||||
release, err := resolveReleaseLink(cfg.Deployment.Root, link)
|
||||
if err == nil {
|
||||
return release
|
||||
}
|
||||
if !required && os.IsNotExist(err) {
|
||||
return ""
|
||||
}
|
||||
code := "previous_pointer_unreadable"
|
||||
message := "The configured previous release pointer could not be validated."
|
||||
severity := "warning"
|
||||
if required {
|
||||
code = "active_pointer_unreadable"
|
||||
message = "The configured active release pointer could not be validated."
|
||||
severity = "error"
|
||||
}
|
||||
add(code, severity, message)
|
||||
return ""
|
||||
}
|
||||
|
||||
func observeUnit(ctx context.Context, operator Operator, unit string, units map[string]bool, add func(string, string, string)) {
|
||||
active, err := operator.IsActive(ctx, unit)
|
||||
if err != nil {
|
||||
add("unit_unobservable", "error", "A configured service unit state could not be observed.")
|
||||
return
|
||||
}
|
||||
units[unit] = active
|
||||
}
|
||||
@@ -0,0 +1,182 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/state"
|
||||
)
|
||||
|
||||
func writeReleaseIdentity(t *testing.T, release, version, commit string) {
|
||||
t.Helper()
|
||||
body := `{"version":"` + version + `","commit":"` + commit + `"}`
|
||||
if err := os.WriteFile(filepath.Join(release, "RELEASE.json"), []byte(body), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
func storeSingletonState(t *testing.T, cfg config.Config, active, previous string) {
|
||||
t.Helper()
|
||||
record := state.Record{
|
||||
SchemaVersion: state.SchemaVersion,
|
||||
Strategy: "singleton_candidate",
|
||||
DesiredRelease: active,
|
||||
ActiveSlot: "singleton",
|
||||
ActiveRelease: active,
|
||||
PreviousRelease: previous,
|
||||
LastAttemptRelease: active,
|
||||
LastAttemptOutcome: "succeeded",
|
||||
LastAttemptAt: time.Unix(100, 0).UTC().Format(time.RFC3339),
|
||||
UpdatedAt: time.Unix(100, 0).UTC().Format(time.RFC3339),
|
||||
}
|
||||
if err := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, record); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
func reconciliationManager(operator Operator) Manager {
|
||||
return Manager{Operator: operator, ReadIdentity: readReleaseIdentity}
|
||||
}
|
||||
|
||||
func TestReconcileReportsHealthySingletonWithoutMutation(t *testing.T) {
|
||||
cfg, active, previous := baseConfig(t, "singleton_candidate")
|
||||
cfg.Deployment.Singleton, _ = singletonSettings(t, cfg, active)
|
||||
if err := replaceSymlink(cfg.Deployment.Singleton.PreviousLink, previous); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
commit := strings.Repeat("a", 40)
|
||||
writeReleaseIdentity(t, active, "v0.2.0-preview.2", commit)
|
||||
storeSingletonState(t, cfg, active, previous)
|
||||
operator := &fakeOperator{active: map[string]bool{
|
||||
cfg.Deployment.Singleton.Unit: true,
|
||||
cfg.Service.Name + "-tend-candidate.service": false,
|
||||
}}
|
||||
|
||||
report, err := reconciliationManager(operator).Reconcile(context.Background(), cfg)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !report.Consistent || report.Mutation != "none" || !report.StateInitialized || len(report.Findings) != 0 {
|
||||
t.Fatalf("report=%+v", report)
|
||||
}
|
||||
if report.Observed.ActiveRelease != active || report.Observed.PreviousRelease != previous || !report.Observed.RouteHandlerMatches {
|
||||
t.Fatalf("observed=%+v", report.Observed)
|
||||
}
|
||||
if report.Observed.ActiveIdentity == nil || report.Observed.ActiveIdentity.Version != "v0.2.0-preview.2" || report.Observed.ActiveIdentity.Commit != commit {
|
||||
t.Fatalf("identity=%+v", report.Observed.ActiveIdentity)
|
||||
}
|
||||
if !report.Observed.Units[cfg.Deployment.Singleton.Unit] || report.Observed.CandidateUnitActive == nil || *report.Observed.CandidateUnitActive {
|
||||
t.Fatalf("units=%#v candidate=%v", report.Observed.Units, report.Observed.CandidateUnitActive)
|
||||
}
|
||||
}
|
||||
|
||||
func TestReconcileReportsHealthyBlueGreenDeployment(t *testing.T) {
|
||||
cfg, active, previous := baseConfig(t, "blue_green")
|
||||
handler := filepath.Join(cfg.Deployment.Root, "handler.caddy")
|
||||
template := filepath.Join(cfg.Deployment.Root, "handler.template")
|
||||
if err := os.WriteFile(handler, []byte("reverse_proxy 127.0.0.1:8090\n"), 0o640); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(template, []byte("reverse_proxy {{UPSTREAM}}\n"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
blue := filepath.Join(cfg.Deployment.Root, "slots", "blue")
|
||||
green := filepath.Join(cfg.Deployment.Root, "slots", "green")
|
||||
if err := replaceSymlink(blue, active); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := replaceSymlink(green, previous); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
cfg.Deployment.BlueGreen = &config.BlueGreen{
|
||||
CaddyConfig: filepath.Join(cfg.Deployment.Root, "Caddyfile"), CaddyHandler: handler,
|
||||
CaddyHandlerTemplate: template, BootstrapActive: "blue",
|
||||
Blue: config.Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: blue},
|
||||
Green: config.Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: green},
|
||||
}
|
||||
writeReleaseIdentity(t, active, "v0.2.0-preview.2", strings.Repeat("c", 40))
|
||||
record := state.Record{
|
||||
SchemaVersion: state.SchemaVersion, Strategy: "blue_green", DesiredRelease: active,
|
||||
ActiveSlot: "blue", ActiveRelease: active, PreviousSlot: "green", PreviousRelease: previous,
|
||||
LastAttemptRelease: active, LastAttemptOutcome: "succeeded",
|
||||
LastAttemptAt: time.Unix(100, 0).UTC().Format(time.RFC3339), UpdatedAt: time.Unix(100, 0).UTC().Format(time.RFC3339),
|
||||
}
|
||||
if err := state.Store(cfg.Deployment.StateFile, cfg.Deployment.Root, record); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
operator := &fakeOperator{active: map[string]bool{
|
||||
"example-blue.service": true, "example-green.service": true,
|
||||
}}
|
||||
|
||||
report, err := reconciliationManager(operator).Reconcile(context.Background(), cfg)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !report.Consistent || report.Mutation != "none" || report.Observed.ActiveRelease != active || report.Observed.PreviousRelease != previous || !report.Observed.RouteHandlerMatches {
|
||||
t.Fatalf("report=%+v", report)
|
||||
}
|
||||
if report.Observed.CandidateUnit != "" || report.Observed.CandidateUnitActive != nil {
|
||||
t.Fatalf("unexpected candidate observation=%+v", report.Observed)
|
||||
}
|
||||
}
|
||||
|
||||
func TestReconcileExplainsDriftWithoutRepairingIt(t *testing.T) {
|
||||
cfg, recorded, observed := baseConfig(t, "singleton_candidate")
|
||||
var handler string
|
||||
cfg.Deployment.Singleton, handler = singletonSettings(t, cfg, recorded)
|
||||
if err := replaceSymlink(cfg.Deployment.Singleton.PreviousLink, observed); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
storeSingletonState(t, cfg, recorded, observed)
|
||||
if err := replaceSymlink(cfg.Deployment.Singleton.CurrentLink, observed); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
writeReleaseIdentity(t, observed, "v0.2.0-preview.3", strings.Repeat("b", 40))
|
||||
candidateHandler, err := renderHandler(cfg.Deployment.Singleton.CaddyHandlerTemplate, cfg.Deployment.Singleton.CandidateAddress)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(handler, candidateHandler, 0o640); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
beforeHandler, err := os.ReadFile(handler)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
operator := &fakeOperator{active: map[string]bool{
|
||||
cfg.Deployment.Singleton.Unit: false,
|
||||
cfg.Service.Name + "-tend-candidate.service": true,
|
||||
}}
|
||||
|
||||
report, err := reconciliationManager(operator).Reconcile(context.Background(), cfg)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if report.Consistent || report.Mutation != "none" {
|
||||
t.Fatalf("report=%+v", report)
|
||||
}
|
||||
codes := map[string]bool{}
|
||||
for _, finding := range report.Findings {
|
||||
codes[finding.Code] = true
|
||||
}
|
||||
for _, code := range []string{"active_release_drift", "active_unit_inactive", "route_handler_drift", "unleased_candidate_active"} {
|
||||
if !codes[code] {
|
||||
t.Fatalf("missing %s in %#v", code, report.Findings)
|
||||
}
|
||||
}
|
||||
target, err := resolveReleaseLink(cfg.Deployment.Root, cfg.Deployment.Singleton.CurrentLink)
|
||||
if err != nil || target != observed {
|
||||
t.Fatalf("current=%q err=%v", target, err)
|
||||
}
|
||||
afterHandler, err := os.ReadFile(handler)
|
||||
if err != nil || string(afterHandler) != string(beforeHandler) {
|
||||
t.Fatalf("handler changed err=%v", err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,318 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/packager"
|
||||
)
|
||||
|
||||
const maxArtifactSize int64 = 512 << 20
|
||||
|
||||
func prepareRelease(cfg config.Config, artifact, expected, approved string) (string, error) {
|
||||
if err := checkArtifact(artifact, expected, approved); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := ensureTree(cfg.Deployment.Root); err != nil {
|
||||
return "", err
|
||||
}
|
||||
releases := filepath.Join(cfg.Deployment.Root, "releases")
|
||||
release := filepath.Join(releases, "sha256-"+expected)
|
||||
if info, err := os.Lstat(release); err == nil {
|
||||
if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return "", errors.New("existing release is not a directory")
|
||||
}
|
||||
if err := validateRelease(cfg, release); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return release, nil
|
||||
} else if !os.IsNotExist(err) {
|
||||
return "", err
|
||||
}
|
||||
stage := filepath.Join(releases, ".tend-stage-"+expected)
|
||||
if err := os.Mkdir(stage, 0o700); err != nil {
|
||||
return "", err
|
||||
}
|
||||
ok := false
|
||||
defer func() {
|
||||
if !ok {
|
||||
_ = os.RemoveAll(stage)
|
||||
}
|
||||
}()
|
||||
if err := extractArtifact(artifact, stage); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := validateRelease(cfg, stage); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := os.Chmod(stage, 0o755); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := os.Rename(stage, release); err != nil {
|
||||
return "", err
|
||||
}
|
||||
ok = true
|
||||
return release, nil
|
||||
}
|
||||
|
||||
func inspectArtifact(cfg config.Config, artifact, expected, approved string) error {
|
||||
if err := checkArtifact(artifact, expected, approved); err != nil {
|
||||
return err
|
||||
}
|
||||
stage, err := os.MkdirTemp("", "tend-inspect-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.RemoveAll(stage)
|
||||
if err := extractArtifact(artifact, stage); err != nil {
|
||||
return err
|
||||
}
|
||||
return validateRelease(cfg, stage)
|
||||
}
|
||||
func checkArtifact(artifact, expected, approved string) error {
|
||||
if expected != approved || len(expected) != 64 {
|
||||
return errors.New("artifact digest was not explicitly approved")
|
||||
}
|
||||
if _, err := hex.DecodeString(expected); err != nil {
|
||||
return errors.New("artifact digest is not hexadecimal")
|
||||
}
|
||||
if !filepath.IsAbs(artifact) || filepath.Clean(artifact) != artifact {
|
||||
return errors.New("artifact path must be a clean absolute path")
|
||||
}
|
||||
info, err := os.Lstat(artifact)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Size() > maxArtifactSize {
|
||||
return errors.New("artifact must be a bounded regular file")
|
||||
}
|
||||
actual, err := fileSHA(artifact)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if actual != expected {
|
||||
return errors.New("artifact digest does not match")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func ensureTree(root string) error {
|
||||
if os.Geteuid() != 0 && strings.HasPrefix(root, "/opt/") {
|
||||
return errors.New("deployment under /opt requires root")
|
||||
}
|
||||
if err := rejectSymlinkAncestors(root); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Join(root, "releases"), 0o755); err != nil {
|
||||
return err
|
||||
}
|
||||
return rejectSymlinkAncestors(filepath.Join(root, "releases"))
|
||||
}
|
||||
func rejectSymlinkAncestors(path string) error {
|
||||
clean := filepath.Clean(path)
|
||||
parts := strings.Split(strings.TrimPrefix(clean, string(filepath.Separator)), string(filepath.Separator))
|
||||
current := string(filepath.Separator)
|
||||
for _, part := range parts {
|
||||
current = filepath.Join(current, part)
|
||||
info, err := os.Lstat(current)
|
||||
if os.IsNotExist(err) {
|
||||
continue
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if info.Mode()&os.ModeSymlink != 0 {
|
||||
return fmt.Errorf("symlink ancestor refused: %s", current)
|
||||
}
|
||||
if !info.IsDir() {
|
||||
return fmt.Errorf("non-directory ancestor refused: %s", current)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func extractArtifact(artifact, stage string) error {
|
||||
file, err := os.Open(artifact)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer file.Close()
|
||||
gz, err := gzip.NewReader(file)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer gz.Close()
|
||||
tr := tar.NewReader(io.LimitReader(gz, maxArtifactSize))
|
||||
files := 0
|
||||
var total int64
|
||||
for {
|
||||
header, err := tr.Next()
|
||||
if errors.Is(err, io.EOF) {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
clean := filepath.Clean(filepath.FromSlash(header.Name))
|
||||
parts := strings.Split(clean, string(filepath.Separator))
|
||||
if len(parts) == 1 && header.Typeflag == tar.TypeDir {
|
||||
continue
|
||||
}
|
||||
if len(parts) != 2 || parts[0] != "bundle" || parts[1] == "" || parts[1] == "." || parts[1] == ".." {
|
||||
return fmt.Errorf("unsafe archive path %q", header.Name)
|
||||
}
|
||||
if header.Typeflag != tar.TypeReg || header.Size < 0 {
|
||||
return errors.New("archive may contain only regular files")
|
||||
}
|
||||
files++
|
||||
total += header.Size
|
||||
if files > 16 || total > maxArtifactSize {
|
||||
return errors.New("artifact exceeds extraction bounds")
|
||||
}
|
||||
target := filepath.Join(stage, parts[1])
|
||||
mode := os.FileMode(0o644)
|
||||
if !strings.HasSuffix(parts[1], ".json") && parts[1] != "SHA256SUMS" {
|
||||
mode = 0o755
|
||||
}
|
||||
out, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := io.CopyN(out, tr, header.Size); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
// OpenFile modes are filtered through the caller's umask. Tend is
|
||||
// commonly invoked by a root account with umask 0077, while release
|
||||
// binaries must remain executable by their dedicated service users.
|
||||
// Reapply the validated, name-derived mode explicitly before the file
|
||||
// becomes part of an immutable release.
|
||||
if err := out.Chmod(mode); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
if err := out.Sync(); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
if err := out.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if files < 5 {
|
||||
return errors.New("artifact is incomplete")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateRelease(cfg config.Config, release string) error {
|
||||
manifestPath := filepath.Join(release, "RELEASE.json")
|
||||
b, err := os.ReadFile(manifestPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
dec := json.NewDecoder(strings.NewReader(string(b)))
|
||||
dec.DisallowUnknownFields()
|
||||
var manifest packager.Manifest
|
||||
if err := dec.Decode(&manifest); err != nil {
|
||||
return err
|
||||
}
|
||||
var trailing any
|
||||
if err := dec.Decode(&trailing); !errors.Is(err, io.EOF) {
|
||||
return errors.New("release manifest contains trailing data")
|
||||
}
|
||||
if manifest.SchemaVersion != 1 || manifest.Service != cfg.Service.Name || manifest.Binary != cfg.Build.Binary || manifest.GOOS != "linux" || manifest.GOARCH != "amd64" || manifest.CGOEnabled {
|
||||
return errors.New("release manifest does not match configuration")
|
||||
}
|
||||
if matched, _ := regexp.MatchString(`^[0-9a-f]{40}$`, manifest.Commit); !matched {
|
||||
return errors.New("release manifest commit is invalid")
|
||||
}
|
||||
binary := filepath.Join(release, cfg.Build.Binary)
|
||||
sum, err := fileSHA(binary)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if sum != manifest.BinarySHA256 {
|
||||
return errors.New("release binary digest does not match manifest")
|
||||
}
|
||||
if err := verifySums(release); err != nil {
|
||||
return err
|
||||
}
|
||||
entries, err := os.ReadDir(release)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
allowed := map[string]bool{cfg.Build.Binary: true, "BUILDINFO.json": true, "RELEASE.json": true, "SBOM.spdx.json": true, "SHA256SUMS": true}
|
||||
if len(entries) != len(allowed) {
|
||||
return errors.New("release contains unexpected files")
|
||||
}
|
||||
for _, entry := range entries {
|
||||
if !allowed[entry.Name()] || !entry.Type().IsRegular() {
|
||||
return fmt.Errorf("unexpected release entry %s", entry.Name())
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func verifySums(release string) error {
|
||||
b, err := os.ReadFile(filepath.Join(release, "SHA256SUMS"))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
lines := strings.Split(strings.TrimSpace(string(b)), "\n")
|
||||
if len(lines) != 4 {
|
||||
return errors.New("SHA256SUMS must cover four release files")
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
for _, line := range lines {
|
||||
fields := strings.Fields(line)
|
||||
if len(fields) != 2 || len(fields[0]) != 64 {
|
||||
return errors.New("malformed SHA256SUMS")
|
||||
}
|
||||
name := fields[1]
|
||||
if filepath.Base(name) != name || seen[name] {
|
||||
return errors.New("unsafe or duplicate checksum entry")
|
||||
}
|
||||
seen[name] = true
|
||||
actual, err := fileSHA(filepath.Join(release, name))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if actual != fields[0] {
|
||||
return fmt.Errorf("checksum mismatch for %s", name)
|
||||
}
|
||||
}
|
||||
required := []string{"BUILDINFO.json", "RELEASE.json", "SBOM.spdx.json"}
|
||||
sort.Strings(required)
|
||||
for _, name := range required {
|
||||
if !seen[name] {
|
||||
return fmt.Errorf("checksum omitted %s", name)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func fileSHA(path string) (string, error) {
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer f.Close()
|
||||
h := sha256.New()
|
||||
if _, err := io.Copy(h, f); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return hex.EncodeToString(h.Sum(nil)), nil
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
//go:build linux
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"syscall"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestExtractArtifactAppliesReleaseModesUnderRestrictiveUmask(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
artifact := filepath.Join(dir, "release.tar.gz")
|
||||
file, err := os.OpenFile(artifact, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
gz := gzip.NewWriter(file)
|
||||
tw := tar.NewWriter(gz)
|
||||
entries := map[string][]byte{
|
||||
"bundle/app": []byte("executable"),
|
||||
"bundle/BUILDINFO.json": []byte("{}"),
|
||||
"bundle/RELEASE.json": []byte("{}"),
|
||||
"bundle/SBOM.spdx.json": []byte("{}"),
|
||||
"bundle/SHA256SUMS": []byte("checksums"),
|
||||
}
|
||||
for name, body := range entries {
|
||||
if err := tw.WriteHeader(&tar.Header{Name: name, Typeflag: tar.TypeReg, Mode: 0o600, Size: int64(len(body))}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := tw.Write(body); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
if err := tw.Close(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := gz.Close(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := file.Close(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
oldUmask := syscall.Umask(0o077)
|
||||
t.Cleanup(func() { syscall.Umask(oldUmask) })
|
||||
stage := filepath.Join(dir, "stage")
|
||||
if err := os.Mkdir(stage, 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := extractArtifact(artifact, stage); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
for name, want := range map[string]os.FileMode{
|
||||
"app": 0o755,
|
||||
"BUILDINFO.json": 0o644,
|
||||
"RELEASE.json": 0o644,
|
||||
"SBOM.spdx.json": 0o644,
|
||||
"SHA256SUMS": 0o644,
|
||||
} {
|
||||
info, err := os.Stat(filepath.Join(stage, name))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if got := info.Mode().Perm(); got != want {
|
||||
t.Fatalf("%s mode=%#o want=%#o", name, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func writeHostileArchive(t *testing.T, name string, typeflag byte) {
|
||||
t.Helper()
|
||||
path := filepath.Join(t.TempDir(), "bad.tar.gz")
|
||||
file, err := os.Create(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
gz := gzip.NewWriter(file)
|
||||
tw := tar.NewWriter(gz)
|
||||
body := []byte("x")
|
||||
if err := tw.WriteHeader(&tar.Header{Name: name, Typeflag: typeflag, Mode: 0o644, Size: int64(len(body))}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if typeflag == tar.TypeReg {
|
||||
_, _ = tw.Write(body)
|
||||
}
|
||||
_ = tw.Close()
|
||||
_ = gz.Close()
|
||||
_ = file.Close()
|
||||
stage := filepath.Join(t.TempDir(), "stage")
|
||||
_ = os.Mkdir(stage, 0o700)
|
||||
if err := extractArtifact(path, stage); err == nil {
|
||||
t.Fatalf("accepted hostile entry %q type %d", name, typeflag)
|
||||
}
|
||||
}
|
||||
func TestExtractionRejectsTraversalAndLinks(t *testing.T) {
|
||||
writeHostileArchive(t, "bundle/../../escape", tar.TypeReg)
|
||||
writeHostileArchive(t, "bundle/link", tar.TypeSymlink)
|
||||
}
|
||||
@@ -0,0 +1,115 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package eventlog
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
)
|
||||
|
||||
const Version = 1
|
||||
|
||||
var safeValue = regexp.MustCompile(`^[A-Za-z0-9._:/@+-]{1,256}$`)
|
||||
var hexDigest = regexp.MustCompile(`^[0-9a-f]{64}$`)
|
||||
var gitCommit = regexp.MustCompile(`^[0-9a-f]{40}$`)
|
||||
var operationID = regexp.MustCompile(`^[0-9a-f]{32}$`)
|
||||
|
||||
type Event struct {
|
||||
Version int `json:"version"`
|
||||
OperationID string `json:"operation_id"`
|
||||
Service string `json:"service"`
|
||||
ArtifactDigest string `json:"artifact_digest"`
|
||||
Commit string `json:"commit"`
|
||||
ReleaseVersion string `json:"release_version"`
|
||||
Phase string `json:"phase"`
|
||||
Slot string `json:"slot,omitempty"`
|
||||
DurationMillis int64 `json:"duration_ms"`
|
||||
Outcome string `json:"outcome"`
|
||||
ObservedAt string `json:"observed_at"`
|
||||
}
|
||||
|
||||
func OperationID() (string, error) {
|
||||
b := make([]byte, 16)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return "", errors.New("cryptographic randomness unavailable")
|
||||
}
|
||||
return hex.EncodeToString(b), nil
|
||||
}
|
||||
|
||||
func Append(path string, event Event) error {
|
||||
if err := event.validate(); err != nil {
|
||||
return err
|
||||
}
|
||||
if !filepath.IsAbs(path) || filepath.Clean(path) != path {
|
||||
return errors.New("event log path must be absolute and clean")
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
|
||||
return fmt.Errorf("create event directory: %w", err)
|
||||
}
|
||||
if info, err := os.Lstat(path); err == nil {
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Mode().Perm()&0o022 != 0 {
|
||||
return errors.New("event log must be a non-writable regular non-symlink file")
|
||||
}
|
||||
} else if !errors.Is(err, os.ErrNotExist) {
|
||||
return fmt.Errorf("inspect event log: %w", err)
|
||||
}
|
||||
b, err := json.Marshal(event)
|
||||
if err != nil {
|
||||
return fmt.Errorf("encode deployment event: %w", err)
|
||||
}
|
||||
if len(b) > 4096 {
|
||||
return errors.New("deployment event exceeds bound")
|
||||
}
|
||||
b = append(b, '\n')
|
||||
fd, err := syscall.Open(path, syscall.O_WRONLY|syscall.O_APPEND|syscall.O_CREAT|syscall.O_CLOEXEC|syscall.O_NOFOLLOW, 0o640)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open event log: %w", err)
|
||||
}
|
||||
file := os.NewFile(uintptr(fd), path)
|
||||
if file == nil {
|
||||
_ = syscall.Close(fd)
|
||||
return errors.New("open event log file")
|
||||
}
|
||||
defer file.Close()
|
||||
n, err := file.Write(b)
|
||||
if err != nil || n != len(b) {
|
||||
return errors.New("write complete deployment event")
|
||||
}
|
||||
if err := file.Sync(); err != nil {
|
||||
return fmt.Errorf("sync deployment event: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (e Event) validate() error {
|
||||
if e.Version != Version || !operationID.MatchString(e.OperationID) {
|
||||
return errors.New("deployment event identity is invalid")
|
||||
}
|
||||
if !hexDigest.MatchString(e.ArtifactDigest) || !gitCommit.MatchString(e.Commit) {
|
||||
return errors.New("deployment event provenance is invalid")
|
||||
}
|
||||
for label, value := range map[string]string{"service": e.Service, "artifact_digest": e.ArtifactDigest, "commit": e.Commit, "release_version": e.ReleaseVersion, "phase": e.Phase, "outcome": e.Outcome} {
|
||||
if !safeValue.MatchString(value) || strings.ContainsRune(value, '\x00') {
|
||||
return fmt.Errorf("deployment event %s is invalid", label)
|
||||
}
|
||||
}
|
||||
if e.Slot != "" && !safeValue.MatchString(e.Slot) {
|
||||
return errors.New("deployment event slot is invalid")
|
||||
}
|
||||
if e.DurationMillis < 0 {
|
||||
return errors.New("deployment event duration is invalid")
|
||||
}
|
||||
if _, err := time.Parse(time.RFC3339Nano, e.ObservedAt); err != nil {
|
||||
return errors.New("deployment event timestamp is invalid")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package eventlog
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestAppendBoundedEvent(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "events.jsonl")
|
||||
id, err := OperationID()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
event := Event{Version: 1, OperationID: id, Service: "site", ArtifactDigest: strings.Repeat("a", 64), Commit: strings.Repeat("b", 40), ReleaseVersion: "v0.2.0-preview.1", Phase: "activation", Slot: "green", Outcome: "succeeded", ObservedAt: time.Now().UTC().Format(time.RFC3339Nano)}
|
||||
if err := Append(path, event); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
b, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var decoded Event
|
||||
if err := json.Unmarshal(b, &decoded); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if decoded.OperationID != id || strings.Contains(string(b), "secret") {
|
||||
t.Fatalf("unexpected event: %s", b)
|
||||
}
|
||||
if info, _ := os.Stat(path); info.Mode().Perm() != 0o640 {
|
||||
t.Fatalf("mode=%04o", info.Mode().Perm())
|
||||
}
|
||||
}
|
||||
|
||||
func TestAppendRejectsUnboundedValuesAndSymlink(t *testing.T) {
|
||||
id, _ := OperationID()
|
||||
event := Event{Version: 1, OperationID: id, Service: "site\nsecret", ArtifactDigest: "digest", Commit: "commit", ReleaseVersion: "version", Phase: "activation", Outcome: "failed", ObservedAt: time.Now().UTC().Format(time.RFC3339Nano)}
|
||||
if err := Append(filepath.Join(t.TempDir(), "events.jsonl"), event); err == nil {
|
||||
t.Fatal("expected unsafe value rejection")
|
||||
}
|
||||
dir := t.TempDir()
|
||||
target := filepath.Join(dir, "target")
|
||||
if err := os.WriteFile(target, nil, 0o640); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
link := filepath.Join(dir, "events.jsonl")
|
||||
if err := os.Symlink(target, link); err != nil {
|
||||
t.Skip(err)
|
||||
}
|
||||
event.Service = "site"
|
||||
if err := Append(link, event); err == nil {
|
||||
t.Fatal("expected symlink rejection")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,399 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package packager
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"debug/buildinfo"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/process"
|
||||
"gamertan.com/tend/internal/provenance"
|
||||
)
|
||||
|
||||
var versionPattern = regexp.MustCompile(`^v[0-9]+\.[0-9]+\.[0-9]+-preview\.[1-9][0-9]*$`)
|
||||
|
||||
type Result struct {
|
||||
Artifact string `json:"artifact"`
|
||||
SHA256 string `json:"sha256"`
|
||||
Commit string `json:"commit"`
|
||||
Version string `json:"version"`
|
||||
}
|
||||
type Manifest struct {
|
||||
SchemaVersion int `json:"schema_version"`
|
||||
Service string `json:"service"`
|
||||
Version string `json:"version"`
|
||||
Commit string `json:"commit"`
|
||||
SourceEpoch int64 `json:"source_date_epoch"`
|
||||
GOOS string `json:"goos"`
|
||||
GOARCH string `json:"goarch"`
|
||||
CGOEnabled bool `json:"cgo_enabled"`
|
||||
Binary string `json:"binary"`
|
||||
BinarySHA256 string `json:"binary_sha256"`
|
||||
GoVersion string `json:"go_version"`
|
||||
ModulePath string `json:"module_path"`
|
||||
ModuleVersion string `json:"module_version"`
|
||||
}
|
||||
type buildRecord struct {
|
||||
GoVersion string `json:"go_version"`
|
||||
Path string `json:"path"`
|
||||
Main moduleRecord `json:"main"`
|
||||
Deps []moduleRecord `json:"dependencies"`
|
||||
Settings []settingRecord `json:"settings"`
|
||||
}
|
||||
type moduleRecord struct {
|
||||
Path string `json:"path"`
|
||||
Version string `json:"version"`
|
||||
Sum string `json:"sum,omitempty"`
|
||||
}
|
||||
type settingRecord struct {
|
||||
Key string `json:"key"`
|
||||
Value string `json:"value"`
|
||||
}
|
||||
type spdxDocument struct {
|
||||
SPDXVersion string `json:"spdxVersion"`
|
||||
DataLicense string `json:"dataLicense"`
|
||||
SPDXID string `json:"SPDXID"`
|
||||
Name string `json:"name"`
|
||||
DocumentNamespace string `json:"documentNamespace"`
|
||||
CreationInfo spdxCreation `json:"creationInfo"`
|
||||
Packages []spdxPackage `json:"packages"`
|
||||
Relationships []spdxRelationship `json:"relationships"`
|
||||
}
|
||||
type spdxCreation struct {
|
||||
Created string `json:"created"`
|
||||
Creators []string `json:"creators"`
|
||||
}
|
||||
type spdxPackage struct {
|
||||
Name string `json:"name"`
|
||||
SPDXID string `json:"SPDXID"`
|
||||
VersionInfo string `json:"versionInfo"`
|
||||
DownloadLocation string `json:"downloadLocation"`
|
||||
FilesAnalyzed bool `json:"filesAnalyzed"`
|
||||
LicenseConcluded string `json:"licenseConcluded"`
|
||||
LicenseDeclared string `json:"licenseDeclared"`
|
||||
}
|
||||
type spdxRelationship struct {
|
||||
SPDXElementID string `json:"spdxElementId"`
|
||||
RelationshipType string `json:"relationshipType"`
|
||||
RelatedSPDXElement string `json:"relatedSpdxElement"`
|
||||
}
|
||||
|
||||
func Package(ctx context.Context, runner process.Runner, cfg config.Config, sourceDir, outDir, version string) (Result, error) {
|
||||
if !versionPattern.MatchString(version) {
|
||||
return Result{}, errors.New("version must use vX.Y.Z-preview.N")
|
||||
}
|
||||
if !filepath.IsAbs(sourceDir) || !filepath.IsAbs(outDir) {
|
||||
return Result{}, errors.New("source and output directories must be absolute")
|
||||
}
|
||||
source, err := provenance.Inspect(ctx, runner, sourceDir, cfg.Build.Branch)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := verifyModules(ctx, runner, sourceDir); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
work, err := os.MkdirTemp("", "tend-package-")
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
defer os.RemoveAll(work)
|
||||
first := filepath.Join(work, "first", cfg.Build.Binary)
|
||||
second := filepath.Join(work, "second", cfg.Build.Binary)
|
||||
if err := build(ctx, runner, cfg, source, sourceDir, version, first); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := build(ctx, runner, cfg, source, sourceDir, version, second); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
firstSHA, err := fileSHA(first)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
secondSHA, err := fileSHA(second)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if firstSHA != secondSHA {
|
||||
return Result{}, errors.New("two clean builds were not byte-identical")
|
||||
}
|
||||
record, err := readBuildRecord(first)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if record.Main.Path == "" {
|
||||
return Result{}, errors.New("built binary has no main module provenance")
|
||||
}
|
||||
if err := verifyBuildSettings(record, source.Commit); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
manifest := Manifest{SchemaVersion: 1, Service: cfg.Service.Name, Version: version, Commit: source.Commit, SourceEpoch: source.Epoch, GOOS: "linux", GOARCH: "amd64", CGOEnabled: false, Binary: cfg.Build.Binary, BinarySHA256: firstSHA, GoVersion: record.GoVersion, ModulePath: record.Main.Path, ModuleVersion: record.Main.Version}
|
||||
bundle := filepath.Join(work, "bundle")
|
||||
if err := os.Mkdir(bundle, 0o700); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := copyFile(first, filepath.Join(bundle, cfg.Build.Binary), 0o755); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := writeJSON(filepath.Join(bundle, "RELEASE.json"), manifest, 0o644); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := writeJSON(filepath.Join(bundle, "BUILDINFO.json"), record, 0o644); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := writeJSON(filepath.Join(bundle, "SBOM.spdx.json"), makeSPDX(cfg, version, source, record), 0o644); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := writeSums(bundle, []string{cfg.Build.Binary, "BUILDINFO.json", "RELEASE.json", "SBOM.spdx.json"}); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := os.MkdirAll(outDir, 0o755); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
artifactName := fmt.Sprintf("%s-%s-linux-amd64.tar.gz", cfg.Service.Name, strings.TrimPrefix(version, "v"))
|
||||
artifact := filepath.Join(outDir, artifactName)
|
||||
if err := writeArchive(artifact, bundle, source.Epoch); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
artifactSHA, err := fileSHA(artifact)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
if err := os.WriteFile(artifact+".sha256", []byte(artifactSHA+" "+artifactName+"\n"), 0o644); err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
return Result{Artifact: artifact, SHA256: artifactSHA, Commit: source.Commit, Version: version}, nil
|
||||
}
|
||||
|
||||
func verifyModules(ctx context.Context, runner process.Runner, dir string) error {
|
||||
out, err := runner.Run(ctx, dir, map[string]string{"GOWORK": "off", "GOFLAGS": "-mod=readonly"}, "go", "list", "-m", "-json", "all")
|
||||
if err != nil {
|
||||
return fmt.Errorf("list modules: %w", err)
|
||||
}
|
||||
dec := json.NewDecoder(strings.NewReader(string(out)))
|
||||
count := 0
|
||||
for {
|
||||
var module struct {
|
||||
Path, Version string
|
||||
Main bool
|
||||
Replace *json.RawMessage
|
||||
}
|
||||
if err := dec.Decode(&module); errors.Is(err, io.EOF) {
|
||||
break
|
||||
} else if err != nil {
|
||||
return fmt.Errorf("decode module graph: %w", err)
|
||||
}
|
||||
count++
|
||||
if module.Replace != nil {
|
||||
return fmt.Errorf("module %s uses a replacement", module.Path)
|
||||
}
|
||||
if !module.Main && module.Version == "" {
|
||||
return fmt.Errorf("module %s is not pinned", module.Path)
|
||||
}
|
||||
}
|
||||
if count == 0 {
|
||||
return errors.New("module graph is empty")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func build(ctx context.Context, runner process.Runner, cfg config.Config, source provenance.Source, dir, version, output string) error {
|
||||
if err := os.MkdirAll(filepath.Dir(output), 0o700); err != nil {
|
||||
return err
|
||||
}
|
||||
ldflags := []string{"-s", "-w"}
|
||||
date := time.Unix(source.Epoch, 0).UTC().Format(time.RFC3339)
|
||||
pairs := [][2]string{{cfg.Build.VersionSymbol, version}, {cfg.Build.CommitSymbol, source.Commit}, {cfg.Build.DateSymbol, date}}
|
||||
for _, pair := range pairs {
|
||||
if pair[0] != "" {
|
||||
ldflags = append(ldflags, "-X", pair[0]+"="+pair[1])
|
||||
}
|
||||
}
|
||||
args := []string{"build", "-mod=readonly", "-trimpath", "-buildvcs=true", "-ldflags", strings.Join(ldflags, " "), "-o", output, cfg.Build.Package}
|
||||
env := map[string]string{"GOWORK": "off", "GOFLAGS": "-mod=readonly", "GOOS": "linux", "GOARCH": "amd64", "CGO_ENABLED": "0", "SOURCE_DATE_EPOCH": fmt.Sprint(source.Epoch)}
|
||||
if _, err := runner.Run(ctx, dir, env, "go", args...); err != nil {
|
||||
return fmt.Errorf("build candidate: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func readBuildRecord(path string) (buildRecord, error) {
|
||||
info, err := buildinfo.ReadFile(path)
|
||||
if err != nil {
|
||||
return buildRecord{}, fmt.Errorf("read Go build info: %w", err)
|
||||
}
|
||||
record := buildRecord{GoVersion: info.GoVersion, Path: info.Path, Main: moduleRecord{Path: info.Main.Path, Version: info.Main.Version, Sum: info.Main.Sum}}
|
||||
for _, dep := range info.Deps {
|
||||
if dep.Replace != nil {
|
||||
return buildRecord{}, fmt.Errorf("built binary contains replacement for %s", dep.Path)
|
||||
}
|
||||
record.Deps = append(record.Deps, moduleRecord{Path: dep.Path, Version: dep.Version, Sum: dep.Sum})
|
||||
}
|
||||
for _, setting := range info.Settings {
|
||||
record.Settings = append(record.Settings, settingRecord{Key: setting.Key, Value: setting.Value})
|
||||
}
|
||||
sort.Slice(record.Deps, func(i, j int) bool { return record.Deps[i].Path < record.Deps[j].Path })
|
||||
sort.Slice(record.Settings, func(i, j int) bool { return record.Settings[i].Key < record.Settings[j].Key })
|
||||
return record, nil
|
||||
}
|
||||
|
||||
func verifyBuildSettings(record buildRecord, commit string) error {
|
||||
settings := map[string]string{}
|
||||
for _, setting := range record.Settings {
|
||||
settings[setting.Key] = setting.Value
|
||||
}
|
||||
for key, expected := range map[string]string{"vcs.revision": commit, "vcs.modified": "false", "GOOS": "linux", "GOARCH": "amd64", "CGO_ENABLED": "0"} {
|
||||
if settings[key] != expected {
|
||||
return fmt.Errorf("build setting %s is %q, expected %q", key, settings[key], expected)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func makeSPDX(cfg config.Config, version string, source provenance.Source, record buildRecord) spdxDocument {
|
||||
created := time.Unix(source.Epoch, 0).UTC().Format("2006-01-02T15:04:05Z")
|
||||
modules := append([]moduleRecord{record.Main}, record.Deps...)
|
||||
doc := spdxDocument{SPDXVersion: "SPDX-2.3", DataLicense: "CC0-1.0", SPDXID: "SPDXRef-DOCUMENT", Name: cfg.Service.Name + "-" + version, DocumentNamespace: "https://gamertan.com/tend/sbom/" + source.Commit + "/" + cfg.Service.Name, CreationInfo: spdxCreation{Created: created, Creators: []string{"Tool: gamertan.com/tend"}}}
|
||||
for i, module := range modules {
|
||||
id := fmt.Sprintf("SPDXRef-Package-%d", i+1)
|
||||
versionInfo := module.Version
|
||||
if versionInfo == "" {
|
||||
versionInfo = source.Commit
|
||||
}
|
||||
doc.Packages = append(doc.Packages, spdxPackage{Name: module.Path, SPDXID: id, VersionInfo: versionInfo, DownloadLocation: "NOASSERTION", FilesAnalyzed: false, LicenseConcluded: "NOASSERTION", LicenseDeclared: "NOASSERTION"})
|
||||
doc.Relationships = append(doc.Relationships, spdxRelationship{SPDXElementID: "SPDXRef-DOCUMENT", RelationshipType: "DESCRIBES", RelatedSPDXElement: id})
|
||||
}
|
||||
return doc
|
||||
}
|
||||
func writeJSON(path string, value any, mode os.FileMode) error {
|
||||
b, err := json.MarshalIndent(value, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
b = append(b, '\n')
|
||||
return os.WriteFile(path, b, mode)
|
||||
}
|
||||
func writeSums(dir string, names []string) error {
|
||||
sort.Strings(names)
|
||||
var b strings.Builder
|
||||
for _, name := range names {
|
||||
sum, err := fileSHA(filepath.Join(dir, name))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Fprintf(&b, "%s %s\n", sum, name)
|
||||
}
|
||||
return os.WriteFile(filepath.Join(dir, "SHA256SUMS"), []byte(b.String()), 0o644)
|
||||
}
|
||||
func writeArchive(path, bundle string, epoch int64) error {
|
||||
tmp := path + ".tmp"
|
||||
_ = os.Remove(tmp)
|
||||
file, err := os.OpenFile(tmp, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o644)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
ok := false
|
||||
defer func() {
|
||||
_ = file.Close()
|
||||
if !ok {
|
||||
_ = os.Remove(tmp)
|
||||
}
|
||||
}()
|
||||
gz := gzip.NewWriter(file)
|
||||
gz.Header.ModTime = time.Unix(0, 0)
|
||||
gz.Header.OS = 255
|
||||
tw := tar.NewWriter(gz)
|
||||
entries, err := os.ReadDir(bundle)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
names := make([]string, 0, len(entries))
|
||||
for _, entry := range entries {
|
||||
if entry.Type().IsRegular() {
|
||||
names = append(names, entry.Name())
|
||||
}
|
||||
}
|
||||
sort.Strings(names)
|
||||
root := filepath.Base(bundle)
|
||||
if err := tw.WriteHeader(&tar.Header{Name: root + "/", Typeflag: tar.TypeDir, Mode: 0o755, ModTime: time.Unix(epoch, 0), Uid: 0, Gid: 0}); err != nil {
|
||||
return err
|
||||
}
|
||||
for _, name := range names {
|
||||
data, err := os.ReadFile(filepath.Join(bundle, name))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
mode := int64(0o644)
|
||||
if name != "BUILDINFO.json" && !strings.HasSuffix(name, ".json") && name != "SHA256SUMS" {
|
||||
mode = 0o755
|
||||
}
|
||||
if err := tw.WriteHeader(&tar.Header{Name: root + "/" + name, Typeflag: tar.TypeReg, Mode: mode, Size: int64(len(data)), ModTime: time.Unix(epoch, 0), Uid: 0, Gid: 0}); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := tw.Write(data); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if err := tw.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := gz.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := file.Sync(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := file.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Rename(tmp, path); err != nil {
|
||||
return err
|
||||
}
|
||||
ok = true
|
||||
return nil
|
||||
}
|
||||
func copyFile(source, target string, mode os.FileMode) error {
|
||||
in, err := os.Open(source)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer in.Close()
|
||||
out, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := io.Copy(out, in); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
if err := out.Sync(); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
return out.Close()
|
||||
}
|
||||
func fileSHA(path string) (string, error) {
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer f.Close()
|
||||
h := sha256.New()
|
||||
if _, err := io.Copy(h, f); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return hex.EncodeToString(h.Sum(nil)), nil
|
||||
}
|
||||
@@ -0,0 +1,77 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package packager
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"errors"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestVersionPattern(t *testing.T) {
|
||||
for _, v := range []string{"v0.1.0-preview.1", "v12.3.4-preview.99"} {
|
||||
if !versionPattern.MatchString(v) {
|
||||
t.Errorf("rejected %q", v)
|
||||
}
|
||||
}
|
||||
for _, v := range []string{"v0.1.0", "0.1.0-preview.1", "v0.1.0-preview.0", "v0.1.0-preview.01", "v0.1.0-preview.1+dirty"} {
|
||||
if versionPattern.MatchString(v) {
|
||||
t.Errorf("accepted %q", v)
|
||||
}
|
||||
}
|
||||
}
|
||||
func TestArchiveHasOnlyRegularBundleEntries(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
bundle := filepath.Join(dir, "bundle")
|
||||
if err := os.Mkdir(bundle, 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(bundle, "app"), []byte("binary"), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(bundle, "RELEASE.json"), []byte("{}\n"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
archive := filepath.Join(dir, "out.tar.gz")
|
||||
if err := writeArchive(archive, bundle, 1); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
f, err := os.Open(archive)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer f.Close()
|
||||
gz, err := gzip.NewReader(f)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer gz.Close()
|
||||
tr := tar.NewReader(gz)
|
||||
seen := 0
|
||||
for {
|
||||
h, err := tr.Next()
|
||||
if errors.Is(err, io.EOF) {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if h.Name == "bundle/" {
|
||||
continue
|
||||
}
|
||||
if h.Typeflag != tar.TypeReg {
|
||||
t.Fatalf("unexpected type %d", h.Typeflag)
|
||||
}
|
||||
if filepath.IsAbs(h.Name) || filepath.Clean(h.Name) != h.Name {
|
||||
t.Fatalf("unsafe path %q", h.Name)
|
||||
}
|
||||
seen++
|
||||
}
|
||||
if seen != 2 {
|
||||
t.Fatalf("saw %d files", seen)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package process
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"sort"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const maxOutput = 4 << 20
|
||||
|
||||
type Runner interface {
|
||||
Run(ctx context.Context, dir string, env map[string]string, name string, args ...string) ([]byte, error)
|
||||
}
|
||||
|
||||
type ExecRunner struct{}
|
||||
|
||||
func (ExecRunner) Run(ctx context.Context, dir string, env map[string]string, name string, args ...string) ([]byte, error) {
|
||||
cmd := exec.CommandContext(ctx, name, args...)
|
||||
cmd.Dir = dir
|
||||
cmd.Env = mergeEnv(os.Environ(), env)
|
||||
var output limitedBuffer
|
||||
cmd.Stdout = &output
|
||||
cmd.Stderr = &output
|
||||
err := cmd.Run()
|
||||
if err != nil {
|
||||
return output.Bytes(), fmt.Errorf("%s failed: %w: %s", name, err, strings.TrimSpace(output.String()))
|
||||
}
|
||||
return output.Bytes(), nil
|
||||
}
|
||||
|
||||
type limitedBuffer struct{ bytes.Buffer }
|
||||
|
||||
func (b *limitedBuffer) Write(p []byte) (int, error) {
|
||||
written := len(p)
|
||||
remaining := maxOutput - b.Len()
|
||||
if remaining > 0 {
|
||||
if len(p) > remaining {
|
||||
p = p[:remaining]
|
||||
}
|
||||
_, _ = b.Buffer.Write(p)
|
||||
}
|
||||
return written, nil
|
||||
}
|
||||
|
||||
func mergeEnv(base []string, extra map[string]string) []string {
|
||||
values := make(map[string]string, len(base)+len(extra))
|
||||
for _, pair := range base {
|
||||
key, value, ok := strings.Cut(pair, "=")
|
||||
if ok {
|
||||
values[key] = value
|
||||
}
|
||||
}
|
||||
for key, value := range extra {
|
||||
values[key] = value
|
||||
}
|
||||
keys := make([]string, 0, len(values))
|
||||
for key := range values {
|
||||
keys = append(keys, key)
|
||||
}
|
||||
sort.Strings(keys)
|
||||
out := make([]string, 0, len(keys))
|
||||
for _, key := range keys {
|
||||
out = append(out, key+"="+values[key])
|
||||
}
|
||||
return out
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package provenance
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"gamertan.com/tend/internal/process"
|
||||
)
|
||||
|
||||
type Source struct {
|
||||
Commit string
|
||||
Epoch int64
|
||||
}
|
||||
|
||||
func Inspect(ctx context.Context, runner process.Runner, dir, branch string) (Source, error) {
|
||||
gitDir, err := gitPath(ctx, runner, dir, "--git-dir")
|
||||
if err != nil {
|
||||
return Source{}, fmt.Errorf("inspect Git directory: %w", err)
|
||||
}
|
||||
commonDir, err := gitPath(ctx, runner, dir, "--git-common-dir")
|
||||
if err != nil {
|
||||
return Source{}, fmt.Errorf("inspect Git common directory: %w", err)
|
||||
}
|
||||
if gitDir != commonDir {
|
||||
return Source{}, errors.New("release packaging does not yet support linked Git worktrees; use a clean standalone clone of the exact pushed commit")
|
||||
}
|
||||
status, err := runner.Run(ctx, dir, nil, "git", "status", "--porcelain=v1", "--untracked-files=all")
|
||||
if err != nil {
|
||||
return Source{}, err
|
||||
}
|
||||
if len(status) != 0 {
|
||||
return Source{}, errors.New("source checkout is not clean")
|
||||
}
|
||||
commitOut, err := runner.Run(ctx, dir, nil, "git", "rev-parse", "HEAD")
|
||||
if err != nil {
|
||||
return Source{}, err
|
||||
}
|
||||
commit := strings.TrimSpace(string(commitOut))
|
||||
if len(commit) != 40 {
|
||||
return Source{}, errors.New("source commit is not a full SHA-1 object id")
|
||||
}
|
||||
remoteOut, err := runner.Run(ctx, dir, nil, "git", "ls-remote", "--exit-code", "origin", "refs/heads/"+branch)
|
||||
if err != nil {
|
||||
return Source{}, fmt.Errorf("verify pushed commit: %w", err)
|
||||
}
|
||||
fields := strings.Fields(string(remoteOut))
|
||||
if len(fields) != 2 || fields[0] != commit || fields[1] != "refs/heads/"+branch {
|
||||
return Source{}, errors.New("HEAD is not the exact pushed branch commit")
|
||||
}
|
||||
epochOut, err := runner.Run(ctx, dir, nil, "git", "show", "-s", "--format=%ct", commit)
|
||||
if err != nil {
|
||||
return Source{}, err
|
||||
}
|
||||
epoch, err := strconv.ParseInt(strings.TrimSpace(string(epochOut)), 10, 64)
|
||||
if err != nil || epoch <= 0 {
|
||||
return Source{}, errors.New("commit timestamp is invalid")
|
||||
}
|
||||
return Source{Commit: commit, Epoch: epoch}, nil
|
||||
}
|
||||
|
||||
func gitPath(ctx context.Context, runner process.Runner, dir, argument string) (string, error) {
|
||||
out, err := runner.Run(ctx, dir, nil, "git", "rev-parse", argument)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
path := strings.TrimSpace(string(out))
|
||||
if path == "" {
|
||||
return "", errors.New("Git returned an empty path")
|
||||
}
|
||||
if !filepath.IsAbs(path) {
|
||||
path = filepath.Join(dir, path)
|
||||
}
|
||||
return filepath.Clean(path), nil
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package provenance
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
type recordingRunner struct {
|
||||
responses map[string][]byte
|
||||
calls []string
|
||||
}
|
||||
|
||||
func (runner *recordingRunner) Run(_ context.Context, _ string, _ map[string]string, name string, args ...string) ([]byte, error) {
|
||||
key := name + " " + strings.Join(args, " ")
|
||||
runner.calls = append(runner.calls, key)
|
||||
response, ok := runner.responses[key]
|
||||
if !ok {
|
||||
return nil, errors.New("unexpected command: " + key)
|
||||
}
|
||||
return response, nil
|
||||
}
|
||||
|
||||
func TestInspectAcceptsStandaloneExactPushedCheckout(t *testing.T) {
|
||||
commit := strings.Repeat("a", 40)
|
||||
runner := &recordingRunner{responses: map[string][]byte{
|
||||
"git rev-parse --git-dir": []byte(".git\n"),
|
||||
"git rev-parse --git-common-dir": []byte(".git\n"),
|
||||
"git status --porcelain=v1 --untracked-files=all": nil,
|
||||
"git rev-parse HEAD": []byte(commit + "\n"),
|
||||
"git ls-remote --exit-code origin refs/heads/main": []byte(commit + "\trefs/heads/main\n"),
|
||||
"git show -s --format=%ct " + commit: []byte("1720000000\n"),
|
||||
}}
|
||||
result, err := Inspect(context.Background(), runner, "/source", "main")
|
||||
if err != nil || result.Commit != commit || result.Epoch != 1720000000 {
|
||||
t.Fatalf("result=%+v err=%v", result, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInspectExplainsUnsupportedLinkedWorktreeBeforeRemoteOrBuildWork(t *testing.T) {
|
||||
runner := &recordingRunner{responses: map[string][]byte{
|
||||
"git rev-parse --git-dir": []byte("/repo/.git/worktrees/release\n"),
|
||||
"git rev-parse --git-common-dir": []byte("/repo/.git\n"),
|
||||
}}
|
||||
_, err := Inspect(context.Background(), runner, "/source", "main")
|
||||
if err == nil || !strings.Contains(err.Error(), "linked Git worktrees") || len(runner.calls) != 2 {
|
||||
t.Fatalf("calls=%#v err=%v", runner.calls, err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
//go:build linux
|
||||
|
||||
package serverpolicy
|
||||
|
||||
import (
|
||||
"os"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
func rootOwned(info os.FileInfo) bool {
|
||||
stat, ok := info.Sys().(*syscall.Stat_t)
|
||||
return ok && stat.Uid == 0
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
//go:build !linux
|
||||
|
||||
package serverpolicy
|
||||
|
||||
import "os"
|
||||
|
||||
func rootOwned(os.FileInfo) bool { return false }
|
||||
@@ -0,0 +1,300 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
// Package serverpolicy validates the root-owned allowlist used by Tend's
|
||||
// restricted SSH receiver. It contains service names and paths, never secrets.
|
||||
package serverpolicy
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
)
|
||||
|
||||
const SchemaVersion = 1
|
||||
|
||||
var servicePattern = regexp.MustCompile(`^[a-z][a-z0-9-]{1,62}$`)
|
||||
|
||||
type Policy struct {
|
||||
SchemaVersion int `json:"schema_version"`
|
||||
ConfigRoot string `json:"config_root"`
|
||||
IncomingRoot string `json:"incoming_root"`
|
||||
SharedLockFile string `json:"shared_lock_file"`
|
||||
Services map[string]ServicePolicy `json:"services"`
|
||||
}
|
||||
|
||||
type ServicePolicy struct {
|
||||
Config string `json:"config"`
|
||||
MaxArtifactBytes int64 `json:"max_artifact_bytes"`
|
||||
}
|
||||
|
||||
type CheckedService struct {
|
||||
Name string
|
||||
Config config.Config
|
||||
Policy ServicePolicy
|
||||
}
|
||||
|
||||
func Parse(reader io.Reader) (Policy, error) {
|
||||
limited := io.LimitReader(reader, 1<<20+1)
|
||||
body, err := io.ReadAll(limited)
|
||||
if err != nil {
|
||||
return Policy{}, err
|
||||
}
|
||||
if len(body) > 1<<20 {
|
||||
return Policy{}, errors.New("server policy exceeds 1 MiB")
|
||||
}
|
||||
decoder := json.NewDecoder(bytes.NewReader(body))
|
||||
decoder.DisallowUnknownFields()
|
||||
var policy Policy
|
||||
if err = decoder.Decode(&policy); err != nil {
|
||||
return Policy{}, fmt.Errorf("decode server policy: %w", err)
|
||||
}
|
||||
var trailing any
|
||||
if err = decoder.Decode(&trailing); !errors.Is(err, io.EOF) {
|
||||
return Policy{}, errors.New("server policy contains trailing data")
|
||||
}
|
||||
if err = policy.Validate(); err != nil {
|
||||
return Policy{}, err
|
||||
}
|
||||
return policy, nil
|
||||
}
|
||||
|
||||
func Load(path string) (Policy, error) {
|
||||
if err := secureDirectory(filepath.Dir(path), 0); err != nil {
|
||||
return Policy{}, fmt.Errorf("server policy directory: %w", err)
|
||||
}
|
||||
if err := secureFile(path, 0o600); err != nil {
|
||||
return Policy{}, fmt.Errorf("server policy: %w", err)
|
||||
}
|
||||
file, err := os.Open(path)
|
||||
if err != nil {
|
||||
return Policy{}, err
|
||||
}
|
||||
defer file.Close()
|
||||
return Parse(file)
|
||||
}
|
||||
|
||||
func (policy Policy) Validate() error {
|
||||
if policy.SchemaVersion != SchemaVersion {
|
||||
return fmt.Errorf("server policy schema_version must be %d", SchemaVersion)
|
||||
}
|
||||
if policy.ConfigRoot != "/etc/tend/services" {
|
||||
return errors.New("server policy config_root must be /etc/tend/services")
|
||||
}
|
||||
if policy.IncomingRoot != "/var/lib/tend/incoming" {
|
||||
return errors.New("server policy incoming_root must be /var/lib/tend/incoming")
|
||||
}
|
||||
if policy.SharedLockFile != config.SharedLockFile {
|
||||
return fmt.Errorf("server policy shared_lock_file must be %s", config.SharedLockFile)
|
||||
}
|
||||
if len(policy.Services) == 0 || len(policy.Services) > 128 {
|
||||
return errors.New("server policy must allow 1 to 128 services")
|
||||
}
|
||||
for name, service := range policy.Services {
|
||||
if !servicePattern.MatchString(name) {
|
||||
return fmt.Errorf("invalid service name %q", name)
|
||||
}
|
||||
expected := filepath.Join(policy.ConfigRoot, name+".json")
|
||||
if service.Config != expected {
|
||||
return fmt.Errorf("service %s config must be %s", name, expected)
|
||||
}
|
||||
if service.MaxArtifactBytes < 1<<20 || service.MaxArtifactBytes > 512<<20 {
|
||||
return fmt.Errorf("service %s artifact limit is invalid", name)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (policy Policy) CheckFiles() ([]CheckedService, error) {
|
||||
if err := policy.CheckDirectories(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
names := make([]string, 0, len(policy.Services))
|
||||
for name := range policy.Services {
|
||||
names = append(names, name)
|
||||
}
|
||||
sort.Strings(names)
|
||||
checked := make([]CheckedService, 0, len(names))
|
||||
for _, name := range names {
|
||||
service, err := policy.CheckService(name)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
checked = append(checked, service)
|
||||
}
|
||||
return checked, nil
|
||||
}
|
||||
|
||||
func (policy Policy) CheckDirectories() error {
|
||||
if err := secureDirectory(policy.ConfigRoot, 0); err != nil {
|
||||
return fmt.Errorf("config root: %w", err)
|
||||
}
|
||||
if err := secureDirectory(policy.IncomingRoot, 0o700); err != nil {
|
||||
return fmt.Errorf("incoming root: %w", err)
|
||||
}
|
||||
if err := secureDirectory("/etc/tend/environment", 0o700); err != nil {
|
||||
return fmt.Errorf("environment root: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (policy Policy) CheckService(name string) (CheckedService, error) {
|
||||
entry, ok := policy.Services[name]
|
||||
if !ok {
|
||||
return CheckedService{}, errors.New("service is not allowed by server policy")
|
||||
}
|
||||
if err := secureFile(entry.Config, 0); err != nil {
|
||||
return CheckedService{}, fmt.Errorf("service %s config: %w", name, err)
|
||||
}
|
||||
cfg, err := config.Load(entry.Config)
|
||||
if err != nil {
|
||||
return CheckedService{}, fmt.Errorf("service %s config: %w", name, err)
|
||||
}
|
||||
if cfg.Service.Name != name {
|
||||
return CheckedService{}, fmt.Errorf("service %s config identity does not match", name)
|
||||
}
|
||||
if cfg.Deployment.LockFile != policy.SharedLockFile {
|
||||
return CheckedService{}, fmt.Errorf("service %s does not use the host-wide lock", name)
|
||||
}
|
||||
if err = secureFile(cfg.Service.EnvironmentFile, 0o600); err != nil {
|
||||
return CheckedService{}, fmt.Errorf("service %s environment file: %w", name, err)
|
||||
}
|
||||
if cfg.Deployment.Singleton != nil {
|
||||
if err = rejectEnvironmentKey(cfg.Service.EnvironmentFile, cfg.Deployment.Singleton.ListenEnv); err != nil {
|
||||
return CheckedService{}, fmt.Errorf("service %s environment file: %w", name, err)
|
||||
}
|
||||
}
|
||||
return CheckedService{Name: name, Config: cfg, Policy: entry}, nil
|
||||
}
|
||||
|
||||
func CheckConfig(path string, cfg config.Config) error {
|
||||
expected := filepath.Join("/etc/tend/services", cfg.Service.Name+".json")
|
||||
if path != expected {
|
||||
return fmt.Errorf("production config must be %s", expected)
|
||||
}
|
||||
if err := secureDirectory("/etc/tend/services", 0); err != nil {
|
||||
return fmt.Errorf("config root: %w", err)
|
||||
}
|
||||
if err := secureDirectory("/etc/tend/environment", 0o700); err != nil {
|
||||
return fmt.Errorf("environment root: %w", err)
|
||||
}
|
||||
if err := secureFile(path, 0); err != nil {
|
||||
return fmt.Errorf("production config: %w", err)
|
||||
}
|
||||
if cfg.Deployment.LockFile != config.SharedLockFile {
|
||||
return fmt.Errorf("deployment lock must be %s", config.SharedLockFile)
|
||||
}
|
||||
if err := secureFile(cfg.Service.EnvironmentFile, 0o600); err != nil {
|
||||
return fmt.Errorf("environment file: %w", err)
|
||||
}
|
||||
if cfg.Deployment.Singleton != nil {
|
||||
if err := rejectEnvironmentKey(cfg.Service.EnvironmentFile, cfg.Deployment.Singleton.ListenEnv); err != nil {
|
||||
return fmt.Errorf("environment file: %w", err)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func rejectEnvironmentKey(path, key string) error {
|
||||
file, err := os.Open(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer file.Close()
|
||||
body, err := io.ReadAll(io.LimitReader(file, 1<<20+1))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if len(body) > 1<<20 {
|
||||
return errors.New("environment file exceeds 1 MiB")
|
||||
}
|
||||
for _, raw := range bytes.Split(body, []byte{'\n'}) {
|
||||
line := strings.TrimSpace(string(raw))
|
||||
if !strings.HasPrefix(line, key) {
|
||||
continue
|
||||
}
|
||||
remainder := strings.TrimSpace(strings.TrimPrefix(line, key))
|
||||
if strings.HasPrefix(remainder, "=") {
|
||||
return errors.New("singleton candidate listen key must not be set in the shared environment file")
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func secureFile(path string, exactMode os.FileMode) error {
|
||||
if !filepath.IsAbs(path) || filepath.Clean(path) != path || strings.ContainsRune(path, '\x00') {
|
||||
return errors.New("path must be clean and absolute")
|
||||
}
|
||||
if err := rejectSymlinkAncestors(filepath.Dir(path)); err != nil {
|
||||
return err
|
||||
}
|
||||
info, err := os.Lstat(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return errors.New("must be a regular non-symlink file")
|
||||
}
|
||||
if !rootOwned(info) {
|
||||
return errors.New("must be owned by root")
|
||||
}
|
||||
if exactMode != 0 && info.Mode().Perm() != exactMode {
|
||||
return fmt.Errorf("mode must be %04o", exactMode)
|
||||
}
|
||||
if exactMode == 0 && info.Mode().Perm()&0o022 != 0 {
|
||||
return errors.New("must not be group- or world-writable")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func secureDirectory(path string, exactMode os.FileMode) error {
|
||||
if !filepath.IsAbs(path) || filepath.Clean(path) != path || strings.ContainsRune(path, '\x00') {
|
||||
return errors.New("path must be clean and absolute")
|
||||
}
|
||||
if err := rejectSymlinkAncestors(filepath.Dir(path)); err != nil {
|
||||
return err
|
||||
}
|
||||
info, err := os.Lstat(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return errors.New("must be a real directory")
|
||||
}
|
||||
if !rootOwned(info) {
|
||||
return errors.New("must be owned by root")
|
||||
}
|
||||
if exactMode != 0 && info.Mode().Perm() != exactMode {
|
||||
return fmt.Errorf("mode must be %04o", exactMode)
|
||||
}
|
||||
if exactMode == 0 && info.Mode().Perm()&0o022 != 0 {
|
||||
return errors.New("must not be group- or world-writable")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func rejectSymlinkAncestors(path string) error {
|
||||
current := string(filepath.Separator)
|
||||
for _, part := range strings.Split(strings.TrimPrefix(filepath.Clean(path), string(filepath.Separator)), string(filepath.Separator)) {
|
||||
if part == "" {
|
||||
continue
|
||||
}
|
||||
current = filepath.Join(current, part)
|
||||
info, err := os.Lstat(current)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return fmt.Errorf("symlink or non-directory ancestor refused: %s", current)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package serverpolicy
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestParseAcceptsStrictServiceMap(t *testing.T) {
|
||||
body := `{"schema_version":1,"config_root":"/etc/tend/services","incoming_root":"/var/lib/tend/incoming","shared_lock_file":"/run/lock/tend-deploy.lock","services":{"example-site":{"config":"/etc/tend/services/example-site.json","max_artifact_bytes":1048576}}}`
|
||||
policy, err := Parse(strings.NewReader(body))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if policy.Services["example-site"].MaxArtifactBytes != 1<<20 {
|
||||
t.Fatalf("policy=%+v", policy)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRejectEnvironmentKeyProtectsSingletonCandidateOverride(t *testing.T) {
|
||||
directory := t.TempDir()
|
||||
path := filepath.Join(directory, "service.env")
|
||||
for _, test := range []struct {
|
||||
name string
|
||||
body string
|
||||
wantErr bool
|
||||
}{
|
||||
{name: "shared values only", body: "APP_SECRET=private\n"},
|
||||
{name: "exact listen key", body: "EXAMPLE_LISTEN=127.0.0.1:8092\n", wantErr: true},
|
||||
{name: "spaced listen key", body: " EXAMPLE_LISTEN = 127.0.0.1:8092\n", wantErr: true},
|
||||
{name: "commented listen key", body: "# EXAMPLE_LISTEN=127.0.0.1:8092\n"},
|
||||
{name: "longer key", body: "EXAMPLE_LISTENER=safe\n"},
|
||||
} {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
if err := os.WriteFile(path, []byte(test.body), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
err := rejectEnvironmentKey(path, "EXAMPLE_LISTEN")
|
||||
if (err != nil) != test.wantErr {
|
||||
t.Fatalf("error=%v wantErr=%v", err, test.wantErr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseRejectsUnknownAndForgedPaths(t *testing.T) {
|
||||
tests := []string{
|
||||
`{"schema_version":1,"config_root":"/etc/tend/services","incoming_root":"/var/lib/tend/incoming","shared_lock_file":"/run/lock/tend-deploy.lock","services":{"example-site":{"config":"/tmp/example.json","max_artifact_bytes":1048576}}}`,
|
||||
`{"schema_version":1,"config_root":"/etc/tend/services","incoming_root":"/var/lib/tend/incoming","shared_lock_file":"/run/lock/tend-deploy.lock","services":{},"surprise":true}`,
|
||||
}
|
||||
for _, body := range tests {
|
||||
if _, err := Parse(strings.NewReader(body)); err == nil {
|
||||
t.Fatalf("accepted %s", body)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,156 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package state
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/netip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"time"
|
||||
)
|
||||
|
||||
const CandidateLeaseSchemaVersion = 1
|
||||
|
||||
var (
|
||||
leaseOperationPattern = regexp.MustCompile(`^[0-9a-f]{32}$`)
|
||||
leaseServicePattern = regexp.MustCompile(`^[a-z][a-z0-9-]{1,62}$`)
|
||||
)
|
||||
|
||||
type CandidateLease struct {
|
||||
SchemaVersion int `json:"schema_version"`
|
||||
Service string `json:"service"`
|
||||
OperationID string `json:"operation_id"`
|
||||
Release string `json:"release"`
|
||||
Unit string `json:"unit"`
|
||||
Address string `json:"address"`
|
||||
StartedAt string `json:"started_at"`
|
||||
}
|
||||
|
||||
func CandidateLeasePath(statePath string) string { return statePath + ".candidate-lease.json" }
|
||||
|
||||
func (l CandidateLease) Validate(root, service string) error {
|
||||
if l.SchemaVersion != CandidateLeaseSchemaVersion {
|
||||
return errors.New("candidate lease schema version is unsupported")
|
||||
}
|
||||
if !leaseServicePattern.MatchString(service) || l.Service != service {
|
||||
return errors.New("candidate lease service does not match configuration")
|
||||
}
|
||||
if !leaseOperationPattern.MatchString(l.OperationID) {
|
||||
return errors.New("candidate lease operation ID is invalid")
|
||||
}
|
||||
if err := releaseBelow(root, l.Release); err != nil {
|
||||
return fmt.Errorf("candidate lease release: %w", err)
|
||||
}
|
||||
expectedUnit := service + "-tend-candidate-" + l.OperationID[:12] + ".service"
|
||||
if l.Unit != expectedUnit {
|
||||
return errors.New("candidate lease unit does not match its operation")
|
||||
}
|
||||
address, err := netip.ParseAddrPort(l.Address)
|
||||
if err != nil || !address.Addr().IsLoopback() || address.Port() == 0 {
|
||||
return errors.New("candidate lease address is invalid")
|
||||
}
|
||||
if _, err := time.Parse(time.RFC3339, l.StartedAt); err != nil {
|
||||
return errors.New("candidate lease timestamp is invalid")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func LoadCandidateLease(path, root, service string) (CandidateLease, error) {
|
||||
info, err := os.Lstat(path)
|
||||
if err != nil {
|
||||
return CandidateLease{}, err
|
||||
}
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Size() > 64<<10 {
|
||||
return CandidateLease{}, errors.New("candidate lease must be a bounded regular file")
|
||||
}
|
||||
body, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return CandidateLease{}, err
|
||||
}
|
||||
decoder := json.NewDecoder(bytes.NewReader(body))
|
||||
decoder.DisallowUnknownFields()
|
||||
var lease CandidateLease
|
||||
if err := decoder.Decode(&lease); err != nil {
|
||||
return CandidateLease{}, fmt.Errorf("decode candidate lease: %w", err)
|
||||
}
|
||||
var extra any
|
||||
if err := decoder.Decode(&extra); !errors.Is(err, io.EOF) {
|
||||
return CandidateLease{}, errors.New("candidate lease contains trailing data")
|
||||
}
|
||||
if err := lease.Validate(root, service); err != nil {
|
||||
return CandidateLease{}, err
|
||||
}
|
||||
return lease, nil
|
||||
}
|
||||
|
||||
func StoreCandidateLease(path, root string, lease CandidateLease) error {
|
||||
if err := lease.Validate(root, lease.Service); err != nil {
|
||||
return err
|
||||
}
|
||||
if info, err := os.Lstat(path); err == nil && (!info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0) {
|
||||
return errors.New("candidate lease path must be a regular file, not a symlink")
|
||||
} else if err != nil && !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
body, err := json.MarshalIndent(lease, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
body = append(body, '\n')
|
||||
dir := filepath.Dir(path)
|
||||
if err := os.MkdirAll(dir, 0o755); err != nil {
|
||||
return err
|
||||
}
|
||||
temporary, err := os.CreateTemp(dir, ".tend-candidate-lease-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
name := temporary.Name()
|
||||
complete := false
|
||||
defer func() {
|
||||
_ = temporary.Close()
|
||||
if !complete {
|
||||
_ = os.Remove(name)
|
||||
}
|
||||
}()
|
||||
if err := temporary.Chmod(0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := temporary.Write(body); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := temporary.Sync(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := temporary.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Rename(name, path); err != nil {
|
||||
return err
|
||||
}
|
||||
complete = true
|
||||
return syncDir(dir)
|
||||
}
|
||||
|
||||
func RemoveCandidateLease(path string) error {
|
||||
info, err := os.Lstat(path)
|
||||
if os.IsNotExist(err) {
|
||||
return nil
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return errors.New("candidate lease path must be a regular file, not a symlink")
|
||||
}
|
||||
if err := os.Remove(path); err != nil {
|
||||
return err
|
||||
}
|
||||
return syncDir(filepath.Dir(path))
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package state
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestCandidateLeaseRoundTripAndRemoval(t *testing.T) {
|
||||
root := filepath.Join(t.TempDir(), "service")
|
||||
release := filepath.Join(root, "releases", "sha256-"+strings.Repeat("a", 64))
|
||||
if err := os.MkdirAll(release, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
path := CandidateLeasePath(filepath.Join(root, "state.json"))
|
||||
operation := strings.Repeat("d", 32)
|
||||
lease := CandidateLease{SchemaVersion: CandidateLeaseSchemaVersion, Service: "example-site", OperationID: operation, Release: release, Unit: "example-site-tend-candidate-" + operation[:12] + ".service", Address: "127.0.0.1:18092", StartedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
|
||||
if err := StoreCandidateLease(path, root, lease); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
loaded, err := LoadCandidateLease(path, root, "example-site")
|
||||
if err != nil || loaded != lease {
|
||||
t.Fatalf("loaded=%+v err=%v", loaded, err)
|
||||
}
|
||||
if err := RemoveCandidateLease(path); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := os.Lstat(path); !os.IsNotExist(err) {
|
||||
t.Fatalf("lease remains: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCandidateLeaseRejectsCrossServiceAndSymlink(t *testing.T) {
|
||||
root := filepath.Join(t.TempDir(), "service")
|
||||
release := filepath.Join(root, "releases", "sha256-"+strings.Repeat("a", 64))
|
||||
if err := os.MkdirAll(release, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
operation := strings.Repeat("d", 32)
|
||||
lease := CandidateLease{SchemaVersion: CandidateLeaseSchemaVersion, Service: "example-site", OperationID: operation, Release: release, Unit: "example-site-tend-candidate-" + operation[:12] + ".service", Address: "127.0.0.1:18092", StartedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
|
||||
if err := lease.Validate(root, "other-site"); err == nil {
|
||||
t.Fatal("expected service mismatch")
|
||||
}
|
||||
path := CandidateLeasePath(filepath.Join(root, "state.json"))
|
||||
if err := os.Symlink(filepath.Join(root, "elsewhere"), path); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := StoreCandidateLease(path, root, lease); err == nil {
|
||||
t.Fatal("expected symlink refusal")
|
||||
}
|
||||
if err := RemoveCandidateLease(path); err == nil {
|
||||
t.Fatal("expected symlink removal refusal")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCandidateLeasePreservesSchemaOneDeploymentState(t *testing.T) {
|
||||
root := filepath.Join(t.TempDir(), "service")
|
||||
release := filepath.Join(root, "releases", "sha256-"+strings.Repeat("a", 64))
|
||||
if err := os.MkdirAll(release, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
at := time.Unix(1, 0).UTC().Format(time.RFC3339)
|
||||
statePath := filepath.Join(root, "state.json")
|
||||
record := Record{SchemaVersion: SchemaVersion, Strategy: "singleton_candidate", DesiredRelease: release, CandidateRelease: release, ActiveSlot: "singleton", ActiveRelease: release, LastAttemptRelease: release, LastAttemptOutcome: "running", LastAttemptAt: at, UpdatedAt: at}
|
||||
if err := Store(statePath, root, record); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
operation := strings.Repeat("d", 32)
|
||||
lease := CandidateLease{SchemaVersion: CandidateLeaseSchemaVersion, Service: "example-site", OperationID: operation, Release: release, Unit: "example-site-tend-candidate-" + operation[:12] + ".service", Address: "127.0.0.1:18092", StartedAt: at}
|
||||
if err := StoreCandidateLease(CandidateLeasePath(statePath), root, lease); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
body, err := os.ReadFile(statePath)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Contains(body, []byte(`"schema_version": 1`)) || bytes.Contains(body, []byte("candidate_operation_id")) || bytes.Contains(body, []byte("candidate_unit")) {
|
||||
t.Fatalf("deployment state contract changed: %s", body)
|
||||
}
|
||||
loaded, err := Load(statePath, root, "singleton_candidate")
|
||||
if err != nil || loaded.SchemaVersion != 1 || loaded.CandidateRelease != release {
|
||||
t.Fatalf("loaded=%+v err=%v", loaded, err)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,172 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package state
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
const SchemaVersion = 1
|
||||
|
||||
type Record struct {
|
||||
SchemaVersion int `json:"schema_version"`
|
||||
Strategy string `json:"strategy"`
|
||||
DesiredRelease string `json:"desired_release,omitempty"`
|
||||
CandidateRelease string `json:"candidate_release,omitempty"`
|
||||
ActiveSlot string `json:"active_slot"`
|
||||
ActiveRelease string `json:"active_release"`
|
||||
PreviousSlot string `json:"previous_slot,omitempty"`
|
||||
PreviousRelease string `json:"previous_release,omitempty"`
|
||||
LastAttemptRelease string `json:"last_attempt_release,omitempty"`
|
||||
LastAttemptOutcome string `json:"last_attempt_outcome,omitempty"`
|
||||
LastAttemptAt string `json:"last_attempt_at,omitempty"`
|
||||
UpdatedAt string `json:"updated_at"`
|
||||
}
|
||||
|
||||
func Load(path, root, strategy string) (Record, error) {
|
||||
b, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return Record{}, err
|
||||
}
|
||||
dec := json.NewDecoder(bytes.NewReader(b))
|
||||
dec.DisallowUnknownFields()
|
||||
var record Record
|
||||
if err := dec.Decode(&record); err != nil {
|
||||
return Record{}, fmt.Errorf("decode state: %w", err)
|
||||
}
|
||||
var extra any
|
||||
if err := dec.Decode(&extra); !errors.Is(err, io.EOF) {
|
||||
return Record{}, errors.New("state contains trailing data")
|
||||
}
|
||||
if err := record.Validate(root, strategy); err != nil {
|
||||
return Record{}, err
|
||||
}
|
||||
return record, nil
|
||||
}
|
||||
|
||||
func (r Record) Validate(root, strategy string) error {
|
||||
if r.SchemaVersion != SchemaVersion {
|
||||
return errors.New("state schema version is unsupported")
|
||||
}
|
||||
if r.Strategy != strategy {
|
||||
return errors.New("state strategy does not match configuration")
|
||||
}
|
||||
if strategy == "blue_green" && (r.ActiveSlot != "blue" && r.ActiveSlot != "green") {
|
||||
return errors.New("active slot is invalid")
|
||||
}
|
||||
if strategy == "singleton_candidate" && r.ActiveSlot != "singleton" {
|
||||
return errors.New("singleton state slot is invalid")
|
||||
}
|
||||
if err := releaseBelow(root, r.ActiveRelease); err != nil {
|
||||
return fmt.Errorf("active release: %w", err)
|
||||
}
|
||||
if r.PreviousRelease != "" {
|
||||
if err := releaseBelow(root, r.PreviousRelease); err != nil {
|
||||
return fmt.Errorf("previous release: %w", err)
|
||||
}
|
||||
}
|
||||
for label, release := range map[string]string{"desired release": r.DesiredRelease, "candidate release": r.CandidateRelease, "last attempt release": r.LastAttemptRelease} {
|
||||
if release != "" {
|
||||
if err := releaseBelow(root, release); err != nil {
|
||||
return fmt.Errorf("%s: %w", label, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
if r.LastAttemptOutcome != "" {
|
||||
switch r.LastAttemptOutcome {
|
||||
case "running", "succeeded", "failed", "rolled_back":
|
||||
default:
|
||||
return errors.New("last attempt outcome is invalid")
|
||||
}
|
||||
if _, err := time.Parse(time.RFC3339, r.LastAttemptAt); err != nil {
|
||||
return errors.New("last attempt timestamp is invalid")
|
||||
}
|
||||
}
|
||||
if r.LastAttemptOutcome == "running" && r.CandidateRelease == "" {
|
||||
return errors.New("running attempt requires a candidate release")
|
||||
}
|
||||
if strategy == "blue_green" && r.PreviousRelease != "" && r.PreviousSlot == r.ActiveSlot {
|
||||
return errors.New("previous slot must differ from active slot")
|
||||
}
|
||||
if _, err := time.Parse(time.RFC3339, r.UpdatedAt); err != nil {
|
||||
return errors.New("state timestamp is invalid")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func Store(path, root string, record Record) error {
|
||||
if err := record.Validate(root, record.Strategy); err != nil {
|
||||
return err
|
||||
}
|
||||
if info, err := os.Lstat(path); err == nil && info.Mode()&os.ModeSymlink != 0 {
|
||||
return errors.New("state file must not be a symlink")
|
||||
} else if err != nil && !os.IsNotExist(err) {
|
||||
return err
|
||||
}
|
||||
b, err := json.MarshalIndent(record, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
b = append(b, '\n')
|
||||
dir := filepath.Dir(path)
|
||||
if err := os.MkdirAll(dir, 0o755); err != nil {
|
||||
return err
|
||||
}
|
||||
tmp, err := os.CreateTemp(dir, ".tend-state-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
name := tmp.Name()
|
||||
ok := false
|
||||
defer func() {
|
||||
_ = tmp.Close()
|
||||
if !ok {
|
||||
_ = os.Remove(name)
|
||||
}
|
||||
}()
|
||||
if err := tmp.Chmod(0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := tmp.Write(b); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tmp.Sync(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tmp.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Rename(name, path); err != nil {
|
||||
return err
|
||||
}
|
||||
ok = true
|
||||
return syncDir(dir)
|
||||
}
|
||||
|
||||
func releaseBelow(root, path string) error {
|
||||
if !filepath.IsAbs(path) || filepath.Clean(path) != path {
|
||||
return errors.New("must be a clean absolute path")
|
||||
}
|
||||
releases := filepath.Join(root, "releases")
|
||||
rel, err := filepath.Rel(releases, path)
|
||||
if err != nil || rel == "." || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || strings.ContainsRune(rel, filepath.Separator) {
|
||||
return errors.New("must be one direct child of the release directory")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func syncDir(path string) error {
|
||||
dir, err := os.Open(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer dir.Close()
|
||||
return dir.Sync()
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package state
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestStoreLoadRoundTripAndRejectSymlink(t *testing.T) {
|
||||
root := filepath.Join(t.TempDir(), "service")
|
||||
release := filepath.Join(root, "releases", "sha256-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
|
||||
if err := os.MkdirAll(release, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
path := filepath.Join(root, "state.json")
|
||||
at := time.Unix(1, 0).UTC().Format(time.RFC3339)
|
||||
record := Record{SchemaVersion: SchemaVersion, Strategy: "singleton_candidate", DesiredRelease: release, ActiveSlot: "singleton", ActiveRelease: release, LastAttemptRelease: release, LastAttemptOutcome: "succeeded", LastAttemptAt: at, UpdatedAt: at}
|
||||
if err := Store(path, root, record); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
loaded, err := Load(path, root, "singleton_candidate")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if loaded.ActiveRelease != release || loaded.DesiredRelease != release || loaded.LastAttemptOutcome != "succeeded" {
|
||||
t.Fatalf("state=%+v", loaded)
|
||||
}
|
||||
if err := os.Remove(path); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.Symlink(filepath.Join(root, "elsewhere"), path); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := Store(path, root, record); err == nil {
|
||||
t.Fatal("expected symlink refusal")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRecordRequiresCandidateForRunningAttempt(t *testing.T) {
|
||||
root := filepath.Join(t.TempDir(), "service")
|
||||
release := filepath.Join(root, "releases", "sha256-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
|
||||
record := Record{SchemaVersion: SchemaVersion, Strategy: "singleton_candidate", DesiredRelease: release, ActiveSlot: "singleton", ActiveRelease: release, LastAttemptRelease: release, LastAttemptOutcome: "running", LastAttemptAt: time.Unix(1, 0).UTC().Format(time.RFC3339), UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
|
||||
if err := record.Validate(root, "singleton_candidate"); err == nil {
|
||||
t.Fatal("expected missing candidate rejection")
|
||||
}
|
||||
}
|
||||
func TestRecordRejectsReleaseOutsideRoot(t *testing.T) {
|
||||
record := Record{SchemaVersion: SchemaVersion, Strategy: "singleton_candidate", ActiveSlot: "singleton", ActiveRelease: "/tmp/other/release", UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
|
||||
if err := record.Validate("/opt/example", "singleton_candidate"); err == nil {
|
||||
t.Fatal("expected path refusal")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,123 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
// Package transport implements Tend's bounded, versioned deployment stream.
|
||||
package transport
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"crypto/sha256"
|
||||
"encoding/binary"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const (
|
||||
Protocol = "tend-receive-v1"
|
||||
MaxArtifactBytes = 512 << 20
|
||||
maxHeaderBytes = 64 << 10
|
||||
maxArtifactName = 128
|
||||
)
|
||||
|
||||
var (
|
||||
servicePattern = regexp.MustCompile(`^[a-z][a-z0-9-]{1,62}$`)
|
||||
artifactPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)
|
||||
)
|
||||
|
||||
type Header struct {
|
||||
Protocol string `json:"protocol"`
|
||||
Service string `json:"service"`
|
||||
ArtifactName string `json:"artifact_name"`
|
||||
Size int64 `json:"size"`
|
||||
SHA256 string `json:"sha256"`
|
||||
ApprovedSHA256 string `json:"approved_sha256"`
|
||||
Activate bool `json:"activate"`
|
||||
}
|
||||
|
||||
func (h Header) Validate(maxBytes int64) error {
|
||||
if h.Protocol != Protocol {
|
||||
return errors.New("unsupported receive protocol")
|
||||
}
|
||||
if !servicePattern.MatchString(h.Service) {
|
||||
return errors.New("invalid service name")
|
||||
}
|
||||
if len(h.ArtifactName) > maxArtifactName || !artifactPattern.MatchString(h.ArtifactName) {
|
||||
return errors.New("invalid artifact name")
|
||||
}
|
||||
if h.Size <= 0 || h.Size > maxBytes {
|
||||
return errors.New("artifact size exceeds policy")
|
||||
}
|
||||
if h.SHA256 != h.ApprovedSHA256 || len(h.SHA256) != 64 || strings.ToLower(h.SHA256) != h.SHA256 {
|
||||
return errors.New("artifact digest was not explicitly approved")
|
||||
}
|
||||
if _, err := hex.DecodeString(h.SHA256); err != nil {
|
||||
return errors.New("artifact digest is not hexadecimal")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func Prefix(header Header) ([]byte, error) {
|
||||
if err := header.Validate(MaxArtifactBytes); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
body, err := json.Marshal(header)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if len(body) > maxHeaderBytes {
|
||||
return nil, errors.New("receive header exceeds limit")
|
||||
}
|
||||
prefix := make([]byte, 4+len(body))
|
||||
binary.BigEndian.PutUint32(prefix[:4], uint32(len(body)))
|
||||
copy(prefix[4:], body)
|
||||
return prefix, nil
|
||||
}
|
||||
|
||||
func ReadHeader(reader *bufio.Reader) (Header, error) {
|
||||
var size [4]byte
|
||||
if _, err := io.ReadFull(reader, size[:]); err != nil {
|
||||
return Header{}, fmt.Errorf("read receive header length: %w", err)
|
||||
}
|
||||
length := binary.BigEndian.Uint32(size[:])
|
||||
if length == 0 || length > maxHeaderBytes {
|
||||
return Header{}, errors.New("receive header length is invalid")
|
||||
}
|
||||
body := make([]byte, length)
|
||||
if _, err := io.ReadFull(reader, body); err != nil {
|
||||
return Header{}, fmt.Errorf("read receive header: %w", err)
|
||||
}
|
||||
decoder := json.NewDecoder(bytes.NewReader(body))
|
||||
decoder.DisallowUnknownFields()
|
||||
var header Header
|
||||
if err := decoder.Decode(&header); err != nil {
|
||||
return Header{}, fmt.Errorf("decode receive header: %w", err)
|
||||
}
|
||||
var trailing any
|
||||
if err := decoder.Decode(&trailing); !errors.Is(err, io.EOF) {
|
||||
return Header{}, errors.New("receive header contains trailing data")
|
||||
}
|
||||
return header, nil
|
||||
}
|
||||
|
||||
func CopyArtifact(destination io.Writer, reader *bufio.Reader, header Header, maxBytes int64) error {
|
||||
if err := header.Validate(maxBytes); err != nil {
|
||||
return err
|
||||
}
|
||||
hash := sha256.New()
|
||||
written, err := io.CopyN(io.MultiWriter(destination, hash), reader, header.Size)
|
||||
if err != nil || written != header.Size {
|
||||
return errors.New("artifact stream ended before declared size")
|
||||
}
|
||||
if _, err = reader.ReadByte(); !errors.Is(err, io.EOF) {
|
||||
return errors.New("artifact stream contains trailing bytes")
|
||||
}
|
||||
if hex.EncodeToString(hash.Sum(nil)) != header.SHA256 {
|
||||
return errors.New("artifact stream digest does not match")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package transport
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func validFrame(t *testing.T, artifact string) ([]byte, Header) {
|
||||
t.Helper()
|
||||
hash := sha256.Sum256([]byte(artifact))
|
||||
digest := hex.EncodeToString(hash[:])
|
||||
header := Header{Protocol: Protocol, Service: "example-site", ArtifactName: "example.tar.gz", Size: int64(len(artifact)), SHA256: digest, ApprovedSHA256: digest, Activate: true}
|
||||
prefix, err := Prefix(header)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return append(prefix, artifact...), header
|
||||
}
|
||||
|
||||
func TestProtocolRoundTrip(t *testing.T) {
|
||||
frame, expected := validFrame(t, "artifact")
|
||||
reader := bufio.NewReader(bytes.NewReader(frame))
|
||||
header, err := ReadHeader(reader)
|
||||
if err != nil || header != expected {
|
||||
t.Fatalf("header=%+v err=%v", header, err)
|
||||
}
|
||||
var artifact bytes.Buffer
|
||||
if err = CopyArtifact(&artifact, reader, header, 1<<20); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if artifact.String() != "artifact" {
|
||||
t.Fatalf("artifact=%q", artifact.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestProtocolRejectsTrailingAndForgedInputs(t *testing.T) {
|
||||
frame, header := validFrame(t, "artifact")
|
||||
reader := bufio.NewReader(bytes.NewReader(append(frame, 'x')))
|
||||
read, _ := ReadHeader(reader)
|
||||
if err := CopyArtifact(&bytes.Buffer{}, reader, read, 1<<20); err == nil {
|
||||
t.Fatal("accepted trailing bytes")
|
||||
}
|
||||
header.Service = "../../root"
|
||||
if _, err := Prefix(header); err == nil {
|
||||
t.Fatal("accepted forged service")
|
||||
}
|
||||
header.Service = "example-site"
|
||||
header.ApprovedSHA256 = strings.Repeat("0", 64)
|
||||
if _, err := Prefix(header); err == nil {
|
||||
t.Fatal("accepted unapproved digest")
|
||||
}
|
||||
}
|
||||
|
||||
func FuzzProtocolFraming(f *testing.F) {
|
||||
hash := sha256.Sum256([]byte("artifact"))
|
||||
digest := hex.EncodeToString(hash[:])
|
||||
prefix, err := Prefix(Header{Protocol: Protocol, Service: "example-site", ArtifactName: "example.tar.gz", Size: 8, SHA256: digest, ApprovedSHA256: digest})
|
||||
if err != nil {
|
||||
f.Fatal(err)
|
||||
}
|
||||
frame := append(prefix, []byte("artifact")...)
|
||||
f.Add(frame)
|
||||
f.Add([]byte{0, 0, 0, 0})
|
||||
f.Fuzz(func(t *testing.T, input []byte) {
|
||||
if len(input) > 2<<20 {
|
||||
t.Skip()
|
||||
}
|
||||
reader := bufio.NewReader(bytes.NewReader(input))
|
||||
header, err := ReadHeader(reader)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
_ = CopyArtifact(&bytes.Buffer{}, reader, header, 1<<20)
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,153 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package transport
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
)
|
||||
|
||||
var targetPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]*@[A-Za-z0-9][A-Za-z0-9.-]*$`)
|
||||
|
||||
type PushOptions struct {
|
||||
Target string
|
||||
Port int
|
||||
KnownHosts string
|
||||
Identity string
|
||||
Service string
|
||||
Artifact string
|
||||
SHA256 string
|
||||
ApprovedSHA256 string
|
||||
Activate bool
|
||||
}
|
||||
|
||||
type SSHRunner interface {
|
||||
Run(context.Context, string, []string, io.Reader) ([]byte, error)
|
||||
}
|
||||
|
||||
type ExecSSHRunner struct{}
|
||||
|
||||
func (ExecSSHRunner) Run(ctx context.Context, name string, args []string, stdin io.Reader) ([]byte, error) {
|
||||
command := exec.CommandContext(ctx, name, args...)
|
||||
command.Stdin = stdin
|
||||
var output, diagnostic boundedBuffer
|
||||
command.Stdout = &output
|
||||
command.Stderr = &diagnostic
|
||||
err := command.Run()
|
||||
if err != nil {
|
||||
return output.Bytes(), fmt.Errorf("ssh failed: %w: %s", err, strings.TrimSpace(diagnostic.String()))
|
||||
}
|
||||
return output.Bytes(), nil
|
||||
}
|
||||
|
||||
type boundedBuffer struct{ bytes.Buffer }
|
||||
|
||||
func (b *boundedBuffer) Write(value []byte) (int, error) {
|
||||
written := len(value)
|
||||
remaining := (1 << 20) - b.Len()
|
||||
if remaining > 0 {
|
||||
if len(value) > remaining {
|
||||
value = value[:remaining]
|
||||
}
|
||||
_, _ = b.Buffer.Write(value)
|
||||
}
|
||||
return written, nil
|
||||
}
|
||||
|
||||
func Push(ctx context.Context, runner SSHRunner, options PushOptions) (json.RawMessage, error) {
|
||||
if !targetPattern.MatchString(options.Target) || strings.HasPrefix(options.Target, "-") {
|
||||
return nil, errors.New("target must be user@host without shell syntax")
|
||||
}
|
||||
if options.Port < 1 || options.Port > 65535 {
|
||||
return nil, errors.New("SSH port is invalid")
|
||||
}
|
||||
if err := safeClientFile(options.KnownHosts, false); err != nil {
|
||||
return nil, fmt.Errorf("known-hosts file: %w", err)
|
||||
}
|
||||
if options.Identity != "" {
|
||||
if err := safeClientFile(options.Identity, true); err != nil {
|
||||
return nil, fmt.Errorf("identity file: %w", err)
|
||||
}
|
||||
}
|
||||
if !filepath.IsAbs(options.Artifact) || filepath.Clean(options.Artifact) != options.Artifact || strings.ContainsAny(options.Artifact, "\x00\r\n\t") {
|
||||
return nil, errors.New("artifact path must be clean and absolute")
|
||||
}
|
||||
artifactInfo, err := os.Lstat(options.Artifact)
|
||||
if err != nil || !artifactInfo.Mode().IsRegular() || artifactInfo.Mode()&os.ModeSymlink != 0 || artifactInfo.Size() <= 0 || artifactInfo.Size() > MaxArtifactBytes {
|
||||
return nil, errors.New("artifact must be a bounded regular non-symlink file")
|
||||
}
|
||||
artifact, err := os.Open(options.Artifact)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer artifact.Close()
|
||||
info, err := artifact.Stat()
|
||||
if err != nil || !info.Mode().IsRegular() || !os.SameFile(artifactInfo, info) {
|
||||
return nil, errors.New("artifact must be a bounded regular file")
|
||||
}
|
||||
hash := sha256.New()
|
||||
if _, err = io.Copy(hash, artifact); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
actual := hex.EncodeToString(hash.Sum(nil))
|
||||
if actual != options.SHA256 || options.SHA256 != options.ApprovedSHA256 {
|
||||
return nil, errors.New("artifact digest was not explicitly approved")
|
||||
}
|
||||
if _, err = artifact.Seek(0, io.SeekStart); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
header := Header{Protocol: Protocol, Service: options.Service, ArtifactName: filepath.Base(options.Artifact), Size: info.Size(), SHA256: options.SHA256, ApprovedSHA256: options.ApprovedSHA256, Activate: options.Activate}
|
||||
prefix, err := Prefix(header)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
args := []string{"-F", os.DevNull, "-T", "-p", strconv.Itoa(options.Port), "-o", "BatchMode=yes", "-o", "ClearAllForwardings=yes", "-o", "ExitOnForwardFailure=yes", "-o", "ForwardAgent=no", "-o", "IdentitiesOnly=yes", "-o", "LogLevel=ERROR", "-o", "PermitLocalCommand=no", "-o", "ProxyCommand=none", "-o", "RequestTTY=no", "-o", "StrictHostKeyChecking=yes", "-o", "UserKnownHostsFile=" + options.KnownHosts}
|
||||
if options.Identity != "" {
|
||||
args = append(args, "-i", options.Identity)
|
||||
}
|
||||
args = append(args, options.Target, Protocol)
|
||||
output, err := runner.Run(ctx, "ssh", args, io.MultiReader(bytes.NewReader(prefix), artifact))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !json.Valid(output) {
|
||||
return nil, errors.New("receiver returned invalid JSON")
|
||||
}
|
||||
return json.RawMessage(output), nil
|
||||
}
|
||||
|
||||
func safeClientFile(path string, private bool) error {
|
||||
if !filepath.IsAbs(path) || filepath.Clean(path) != path || strings.ContainsAny(path, "\x00\r\n\t") {
|
||||
return errors.New("path must be clean and absolute")
|
||||
}
|
||||
parent, err := os.Lstat(filepath.Dir(path))
|
||||
if err != nil || !parent.IsDir() || parent.Mode()&os.ModeSymlink != 0 || parent.Mode().Perm()&0o022 != 0 {
|
||||
return errors.New("parent must be a real directory not writable by group or others")
|
||||
}
|
||||
info, err := os.Lstat(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return errors.New("must be a regular non-symlink file")
|
||||
}
|
||||
if info.Mode().Perm()&0o022 != 0 {
|
||||
return errors.New("must not be group- or world-writable")
|
||||
}
|
||||
if private && info.Mode().Perm()&0o077 != 0 {
|
||||
return errors.New("must not be accessible by group or others")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package transport
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"slices"
|
||||
"testing"
|
||||
)
|
||||
|
||||
type captureRunner struct {
|
||||
name string
|
||||
args []string
|
||||
input []byte
|
||||
calls int
|
||||
}
|
||||
|
||||
func (runner *captureRunner) Run(_ context.Context, name string, args []string, input io.Reader) ([]byte, error) {
|
||||
runner.calls++
|
||||
runner.name = name
|
||||
runner.args = append([]string(nil), args...)
|
||||
runner.input, _ = io.ReadAll(input)
|
||||
return []byte(`{"validated":true,"mutation":"activated"}`), nil
|
||||
}
|
||||
|
||||
func TestPushUsesPinnedSSHAndExactFrame(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
knownHosts := filepath.Join(dir, "known_hosts")
|
||||
identity := filepath.Join(dir, "identity")
|
||||
artifact := filepath.Join(dir, "release.tar.gz")
|
||||
if err := os.WriteFile(knownHosts, []byte("host key\n"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(identity, []byte("private\n"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
content := []byte("artifact")
|
||||
if err := os.WriteFile(artifact, content, 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
hash := sha256.Sum256(content)
|
||||
digest := hex.EncodeToString(hash[:])
|
||||
runner := &captureRunner{}
|
||||
result, err := Push(context.Background(), runner, PushOptions{Target: "tend-deploy@example.test", Port: 2222, KnownHosts: knownHosts, Identity: identity, Service: "example-site", Artifact: artifact, SHA256: digest, ApprovedSHA256: digest, Activate: true})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Contains(result, []byte(`"activated"`)) || runner.calls != 1 || runner.name != "ssh" {
|
||||
t.Fatalf("result=%s calls=%d name=%q", result, runner.calls, runner.name)
|
||||
}
|
||||
if !slices.Contains(runner.args, "ProxyCommand=none") || !slices.Contains(runner.args, "StrictHostKeyChecking=yes") || runner.args[len(runner.args)-1] != Protocol {
|
||||
t.Fatalf("args=%#v", runner.args)
|
||||
}
|
||||
reader := bufio.NewReader(bytes.NewReader(runner.input))
|
||||
header, err := ReadHeader(reader)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var copied bytes.Buffer
|
||||
if err = CopyArtifact(&copied, reader, header, 1<<20); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if copied.String() != string(content) || header.Service != "example-site" || !header.Activate {
|
||||
t.Fatalf("header=%+v body=%q", header, copied.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestPushRejectsShellTargetBeforeExecution(t *testing.T) {
|
||||
runner := &captureRunner{}
|
||||
_, err := Push(context.Background(), runner, PushOptions{Target: "root@example.test;touch", Port: 22})
|
||||
if err == nil || runner.calls != 0 {
|
||||
t.Fatalf("err=%v calls=%d", err, runner.calls)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package transport
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
|
||||
"gamertan.com/tend/internal/deploy"
|
||||
"gamertan.com/tend/internal/serverpolicy"
|
||||
)
|
||||
|
||||
func Receive(ctx context.Context, input io.Reader, policy serverpolicy.Policy, manager deploy.Manager) (deploy.Report, error) {
|
||||
if err := policy.CheckDirectories(); err != nil {
|
||||
return deploy.Report{}, err
|
||||
}
|
||||
reader := bufio.NewReaderSize(input, maxHeaderBytes+4)
|
||||
header, err := ReadHeader(reader)
|
||||
if err != nil {
|
||||
return deploy.Report{}, err
|
||||
}
|
||||
service, err := policy.CheckService(header.Service)
|
||||
if err != nil {
|
||||
return deploy.Report{}, err
|
||||
}
|
||||
if err = header.Validate(service.Policy.MaxArtifactBytes); err != nil {
|
||||
return deploy.Report{}, err
|
||||
}
|
||||
file, err := os.CreateTemp(policy.IncomingRoot, ".tend-receive-"+header.Service+"-")
|
||||
if err != nil {
|
||||
return deploy.Report{}, err
|
||||
}
|
||||
path := file.Name()
|
||||
defer os.Remove(path)
|
||||
if err = file.Chmod(0o600); err == nil {
|
||||
err = CopyArtifact(file, reader, header, service.Policy.MaxArtifactBytes)
|
||||
}
|
||||
if closeErr := file.Close(); err == nil {
|
||||
err = closeErr
|
||||
}
|
||||
if err != nil {
|
||||
return deploy.Report{}, fmt.Errorf("receive artifact: %w", err)
|
||||
}
|
||||
return manager.Deploy(ctx, service.Config, deploy.Request{Artifact: path, SHA256: header.SHA256, ApprovedSHA256: header.ApprovedSHA256, Activate: header.Activate})
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package version
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
"runtime/debug"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const developmentVersion = "v0.1.0-dev"
|
||||
|
||||
var (
|
||||
Version = developmentVersion
|
||||
Commit = "unknown"
|
||||
Date = "unknown"
|
||||
)
|
||||
|
||||
var (
|
||||
taggedVersionPattern = regexp.MustCompile(`^v(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$`)
|
||||
pseudoVersionSuffixPattern = regexp.MustCompile(`(?:^|[.-])(?:0\.)?[0-9]{14}-[0-9a-f]{12,}$`)
|
||||
)
|
||||
|
||||
func init() {
|
||||
information, ok := debug.ReadBuildInfo()
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
Version = selectVersion(Version, information.Main.Version)
|
||||
for _, setting := range information.Settings {
|
||||
switch setting.Key {
|
||||
case "vcs.revision":
|
||||
if Commit == "unknown" && setting.Value != "" {
|
||||
Commit = setting.Value
|
||||
}
|
||||
case "vcs.time":
|
||||
if Date == "unknown" && setting.Value != "" {
|
||||
Date = setting.Value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func selectVersion(linkerValue, moduleVersion string) string {
|
||||
if linkerValue != developmentVersion {
|
||||
return linkerValue
|
||||
}
|
||||
moduleVersion = strings.TrimSpace(moduleVersion)
|
||||
if !isTaggedVersion(moduleVersion) {
|
||||
return linkerValue
|
||||
}
|
||||
return moduleVersion
|
||||
}
|
||||
|
||||
func isTaggedVersion(value string) bool {
|
||||
matches := taggedVersionPattern.FindStringSubmatch(value)
|
||||
if matches == nil {
|
||||
return false
|
||||
}
|
||||
prerelease := matches[1]
|
||||
if pseudoVersionSuffixPattern.MatchString(prerelease) {
|
||||
return false
|
||||
}
|
||||
for _, identifier := range strings.Split(prerelease, ".") {
|
||||
if len(identifier) > 1 && identifier[0] == '0' && allDecimal(identifier) {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
func allDecimal(value string) bool {
|
||||
if value == "" {
|
||||
return false
|
||||
}
|
||||
for _, character := range value {
|
||||
if character < '0' || character > '9' {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package version
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestSelectVersion(t *testing.T) {
|
||||
t.Parallel()
|
||||
tests := []struct {
|
||||
name, linker, module, want string
|
||||
}{
|
||||
{"local build", developmentVersion, "(devel)", developmentVersion},
|
||||
{"missing build info", developmentVersion, "", developmentVersion},
|
||||
{"preview one install", developmentVersion, "v0.1.0-preview.1", "v0.1.0-preview.1"},
|
||||
{"preview two install", developmentVersion, "v0.1.0-preview.2", "v0.1.0-preview.2"},
|
||||
{"release install", developmentVersion, "v1.0.0", "v1.0.0"},
|
||||
{"linker override", "v0.1.0-preview.2", "(devel)", "v0.1.0-preview.2"},
|
||||
{"pseudo version", developmentVersion, "v0.0.0-20260814120000-0123456789ab", developmentVersion},
|
||||
{"pseudo after release", developmentVersion, "v0.1.1-0.20260814120000-0123456789ab", developmentVersion},
|
||||
{"build metadata", developmentVersion, "v0.1.0+dirty", developmentVersion},
|
||||
{"leading zero release", developmentVersion, "v00.1.0", developmentVersion},
|
||||
{"leading zero prerelease", developmentVersion, "v0.1.0-preview.02", developmentVersion},
|
||||
}
|
||||
for _, test := range tests {
|
||||
test := test
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
if got := selectVersion(test.linker, test.module); got != test.want {
|
||||
t.Fatalf("selectVersion(%q, %q)=%q want %q", test.linker, test.module, got, test.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user