docs: publish Tend Compose continuity evidence
Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
@@ -0,0 +1,318 @@
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"compress/gzip"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"gamertan.com/tend/internal/config"
|
||||
"gamertan.com/tend/internal/packager"
|
||||
)
|
||||
|
||||
const maxArtifactSize int64 = 512 << 20
|
||||
|
||||
func prepareRelease(cfg config.Config, artifact, expected, approved string) (string, error) {
|
||||
if err := checkArtifact(artifact, expected, approved); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := ensureTree(cfg.Deployment.Root); err != nil {
|
||||
return "", err
|
||||
}
|
||||
releases := filepath.Join(cfg.Deployment.Root, "releases")
|
||||
release := filepath.Join(releases, "sha256-"+expected)
|
||||
if info, err := os.Lstat(release); err == nil {
|
||||
if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
|
||||
return "", errors.New("existing release is not a directory")
|
||||
}
|
||||
if err := validateRelease(cfg, release); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return release, nil
|
||||
} else if !os.IsNotExist(err) {
|
||||
return "", err
|
||||
}
|
||||
stage := filepath.Join(releases, ".tend-stage-"+expected)
|
||||
if err := os.Mkdir(stage, 0o700); err != nil {
|
||||
return "", err
|
||||
}
|
||||
ok := false
|
||||
defer func() {
|
||||
if !ok {
|
||||
_ = os.RemoveAll(stage)
|
||||
}
|
||||
}()
|
||||
if err := extractArtifact(artifact, stage); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := validateRelease(cfg, stage); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := os.Chmod(stage, 0o755); err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := os.Rename(stage, release); err != nil {
|
||||
return "", err
|
||||
}
|
||||
ok = true
|
||||
return release, nil
|
||||
}
|
||||
|
||||
func inspectArtifact(cfg config.Config, artifact, expected, approved string) error {
|
||||
if err := checkArtifact(artifact, expected, approved); err != nil {
|
||||
return err
|
||||
}
|
||||
stage, err := os.MkdirTemp("", "tend-inspect-")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer os.RemoveAll(stage)
|
||||
if err := extractArtifact(artifact, stage); err != nil {
|
||||
return err
|
||||
}
|
||||
return validateRelease(cfg, stage)
|
||||
}
|
||||
func checkArtifact(artifact, expected, approved string) error {
|
||||
if expected != approved || len(expected) != 64 {
|
||||
return errors.New("artifact digest was not explicitly approved")
|
||||
}
|
||||
if _, err := hex.DecodeString(expected); err != nil {
|
||||
return errors.New("artifact digest is not hexadecimal")
|
||||
}
|
||||
if !filepath.IsAbs(artifact) || filepath.Clean(artifact) != artifact {
|
||||
return errors.New("artifact path must be a clean absolute path")
|
||||
}
|
||||
info, err := os.Lstat(artifact)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Size() > maxArtifactSize {
|
||||
return errors.New("artifact must be a bounded regular file")
|
||||
}
|
||||
actual, err := fileSHA(artifact)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if actual != expected {
|
||||
return errors.New("artifact digest does not match")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func ensureTree(root string) error {
|
||||
if os.Geteuid() != 0 && strings.HasPrefix(root, "/opt/") {
|
||||
return errors.New("deployment under /opt requires root")
|
||||
}
|
||||
if err := rejectSymlinkAncestors(root); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.MkdirAll(filepath.Join(root, "releases"), 0o755); err != nil {
|
||||
return err
|
||||
}
|
||||
return rejectSymlinkAncestors(filepath.Join(root, "releases"))
|
||||
}
|
||||
func rejectSymlinkAncestors(path string) error {
|
||||
clean := filepath.Clean(path)
|
||||
parts := strings.Split(strings.TrimPrefix(clean, string(filepath.Separator)), string(filepath.Separator))
|
||||
current := string(filepath.Separator)
|
||||
for _, part := range parts {
|
||||
current = filepath.Join(current, part)
|
||||
info, err := os.Lstat(current)
|
||||
if os.IsNotExist(err) {
|
||||
continue
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if info.Mode()&os.ModeSymlink != 0 {
|
||||
return fmt.Errorf("symlink ancestor refused: %s", current)
|
||||
}
|
||||
if !info.IsDir() {
|
||||
return fmt.Errorf("non-directory ancestor refused: %s", current)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func extractArtifact(artifact, stage string) error {
|
||||
file, err := os.Open(artifact)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer file.Close()
|
||||
gz, err := gzip.NewReader(file)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer gz.Close()
|
||||
tr := tar.NewReader(io.LimitReader(gz, maxArtifactSize))
|
||||
files := 0
|
||||
var total int64
|
||||
for {
|
||||
header, err := tr.Next()
|
||||
if errors.Is(err, io.EOF) {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
clean := filepath.Clean(filepath.FromSlash(header.Name))
|
||||
parts := strings.Split(clean, string(filepath.Separator))
|
||||
if len(parts) == 1 && header.Typeflag == tar.TypeDir {
|
||||
continue
|
||||
}
|
||||
if len(parts) != 2 || parts[0] != "bundle" || parts[1] == "" || parts[1] == "." || parts[1] == ".." {
|
||||
return fmt.Errorf("unsafe archive path %q", header.Name)
|
||||
}
|
||||
if header.Typeflag != tar.TypeReg || header.Size < 0 {
|
||||
return errors.New("archive may contain only regular files")
|
||||
}
|
||||
files++
|
||||
total += header.Size
|
||||
if files > 16 || total > maxArtifactSize {
|
||||
return errors.New("artifact exceeds extraction bounds")
|
||||
}
|
||||
target := filepath.Join(stage, parts[1])
|
||||
mode := os.FileMode(0o644)
|
||||
if !strings.HasSuffix(parts[1], ".json") && parts[1] != "SHA256SUMS" {
|
||||
mode = 0o755
|
||||
}
|
||||
out, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := io.CopyN(out, tr, header.Size); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
// OpenFile modes are filtered through the caller's umask. Tend is
|
||||
// commonly invoked by a root account with umask 0077, while release
|
||||
// binaries must remain executable by their dedicated service users.
|
||||
// Reapply the validated, name-derived mode explicitly before the file
|
||||
// becomes part of an immutable release.
|
||||
if err := out.Chmod(mode); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
if err := out.Sync(); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
if err := out.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if files < 5 {
|
||||
return errors.New("artifact is incomplete")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func validateRelease(cfg config.Config, release string) error {
|
||||
manifestPath := filepath.Join(release, "RELEASE.json")
|
||||
b, err := os.ReadFile(manifestPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
dec := json.NewDecoder(strings.NewReader(string(b)))
|
||||
dec.DisallowUnknownFields()
|
||||
var manifest packager.Manifest
|
||||
if err := dec.Decode(&manifest); err != nil {
|
||||
return err
|
||||
}
|
||||
var trailing any
|
||||
if err := dec.Decode(&trailing); !errors.Is(err, io.EOF) {
|
||||
return errors.New("release manifest contains trailing data")
|
||||
}
|
||||
if manifest.SchemaVersion != 1 || manifest.Service != cfg.Service.Name || manifest.Binary != cfg.Build.Binary || manifest.GOOS != "linux" || manifest.GOARCH != "amd64" || manifest.CGOEnabled {
|
||||
return errors.New("release manifest does not match configuration")
|
||||
}
|
||||
if matched, _ := regexp.MatchString(`^[0-9a-f]{40}$`, manifest.Commit); !matched {
|
||||
return errors.New("release manifest commit is invalid")
|
||||
}
|
||||
binary := filepath.Join(release, cfg.Build.Binary)
|
||||
sum, err := fileSHA(binary)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if sum != manifest.BinarySHA256 {
|
||||
return errors.New("release binary digest does not match manifest")
|
||||
}
|
||||
if err := verifySums(release); err != nil {
|
||||
return err
|
||||
}
|
||||
entries, err := os.ReadDir(release)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
allowed := map[string]bool{cfg.Build.Binary: true, "BUILDINFO.json": true, "RELEASE.json": true, "SBOM.spdx.json": true, "SHA256SUMS": true}
|
||||
if len(entries) != len(allowed) {
|
||||
return errors.New("release contains unexpected files")
|
||||
}
|
||||
for _, entry := range entries {
|
||||
if !allowed[entry.Name()] || !entry.Type().IsRegular() {
|
||||
return fmt.Errorf("unexpected release entry %s", entry.Name())
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func verifySums(release string) error {
|
||||
b, err := os.ReadFile(filepath.Join(release, "SHA256SUMS"))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
lines := strings.Split(strings.TrimSpace(string(b)), "\n")
|
||||
if len(lines) != 4 {
|
||||
return errors.New("SHA256SUMS must cover four release files")
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
for _, line := range lines {
|
||||
fields := strings.Fields(line)
|
||||
if len(fields) != 2 || len(fields[0]) != 64 {
|
||||
return errors.New("malformed SHA256SUMS")
|
||||
}
|
||||
name := fields[1]
|
||||
if filepath.Base(name) != name || seen[name] {
|
||||
return errors.New("unsafe or duplicate checksum entry")
|
||||
}
|
||||
seen[name] = true
|
||||
actual, err := fileSHA(filepath.Join(release, name))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if actual != fields[0] {
|
||||
return fmt.Errorf("checksum mismatch for %s", name)
|
||||
}
|
||||
}
|
||||
required := []string{"BUILDINFO.json", "RELEASE.json", "SBOM.spdx.json"}
|
||||
sort.Strings(required)
|
||||
for _, name := range required {
|
||||
if !seen[name] {
|
||||
return fmt.Errorf("checksum omitted %s", name)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func fileSHA(path string) (string, error) {
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer f.Close()
|
||||
h := sha256.New()
|
||||
if _, err := io.Copy(h, f); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return hex.EncodeToString(h.Sum(nil)), nil
|
||||
}
|
||||
Reference in New Issue
Block a user