docs: publish Tend Compose continuity evidence
Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
Executable
+11
@@ -0,0 +1,11 @@
|
||||
#!/usr/bin/env bash
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
set -euo pipefail
|
||||
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
test -s "$root/LICENSE"
|
||||
test -s "$root/COPYRIGHT"
|
||||
test -s "$root/examples/LICENSE"
|
||||
while IFS= read -r file; do
|
||||
grep -Fq 'SPDX-License-Identifier: AGPL-3.0-only' "$file" || { echo "missing SPDX identifier: $file" >&2; exit 1; }
|
||||
done < <(find "$root/cmd" "$root/internal" -type f -name '*.go' -print | LC_ALL=C sort)
|
||||
echo "license boundaries verified"
|
||||
Executable
+30
@@ -0,0 +1,30 @@
|
||||
#!/usr/bin/env bash
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
set -euo pipefail
|
||||
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
allow=$root/scripts/public-snapshot.allow
|
||||
LC_ALL=C sort -c "$allow"
|
||||
[[ $(LC_ALL=C sort "$allow" | uniq -d | wc -l) -eq 0 ]]
|
||||
mapfile -t files <"$allow"
|
||||
[[ ${#files[@]} -gt 0 ]]
|
||||
for file in "${files[@]}"; do
|
||||
[[ -n $file && $file != /* && $file != *..* && $file != .gitea/* && $file != .github/* ]]
|
||||
git -C "$root" cat-file -e "HEAD:$file"
|
||||
done
|
||||
work=$(mktemp -d)
|
||||
trap 'rm -rf -- "$work"' EXIT
|
||||
mkdir -m 0700 "$work/tree"
|
||||
git -C "$root" archive HEAD -- "${files[@]}" | tar -xf - -C "$work/tree"
|
||||
test ! -e "$work/tree/.git"
|
||||
test ! -e "$work/tree/.gitea"
|
||||
test ! -e "$work/tree/.github"
|
||||
private_pattern='/home/[[:alnum:]_.-]+/|BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|gitea[-_]api[[:alnum:]_.-]*token'
|
||||
if (cd "$work/tree" && rg -n --hidden --glob '!scripts/export-public.sh' --glob '!scripts/check-public-tree.sh' "$private_pattern" .); then
|
||||
echo "private material found in public tree" >&2
|
||||
exit 1
|
||||
fi
|
||||
(cd "$work/tree" && ./scripts/check-licenses.sh)
|
||||
(cd "$work/tree" && GOWORK=off go test -count=1 ./...)
|
||||
(cd "$work/tree" && GOWORK=off go vet ./...)
|
||||
(cd "$work/tree" && GOWORK=off CGO_ENABLED=0 go build -buildvcs=false -mod=readonly -trimpath -o "$work/tend" ./cmd/tend)
|
||||
echo "public tree compiles independently"
|
||||
Executable
+54
@@ -0,0 +1,54 @@
|
||||
#!/usr/bin/env bash
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
set -euo pipefail
|
||||
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
usage(){ echo "Usage: export-public.sh --destination ABSOLUTE-PATH" >&2; }
|
||||
destination=
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case $1 in
|
||||
--destination) destination=$2; shift 2 ;;
|
||||
*) usage; exit 2 ;;
|
||||
esac
|
||||
done
|
||||
[[ $destination == /* && $destination != / && ! -e $destination ]] || { usage; exit 2; }
|
||||
destination=$(realpath -m "$destination");root=$(realpath -e "$root")
|
||||
case $destination/ in "$root"/*) echo "destination must be outside the private worktree" >&2;exit 1;;esac
|
||||
git_dir_raw=$(git -C "$root" rev-parse --git-dir)
|
||||
common_dir_raw=$(git -C "$root" rev-parse --git-common-dir)
|
||||
[[ $git_dir_raw == /* ]] || git_dir_raw=$root/$git_dir_raw
|
||||
[[ $common_dir_raw == /* ]] || common_dir_raw=$root/$common_dir_raw
|
||||
git_dir=$(realpath -e "$git_dir_raw")
|
||||
common_dir=$(realpath -e "$common_dir_raw")
|
||||
case $destination/ in "$git_dir"/*|"$common_dir"/*) echo "destination must be outside Git metadata" >&2;exit 1;;esac
|
||||
[[ -z $(git -C "$root" status --porcelain=v1 --untracked-files=all) ]] || { echo "private worktree is not clean" >&2;exit 1; }
|
||||
commit=$(git -C "$root" rev-parse HEAD);tree=$(git -C "$root" rev-parse HEAD^{tree})
|
||||
[[ $(git -C "$root" ls-remote --exit-code origin refs/heads/main | awk 'NR==1{print $1}') == "$commit" ]] || { echo "private HEAD is not exact pushed origin/main" >&2;exit 1; }
|
||||
allow=$root/scripts/public-snapshot.allow
|
||||
LC_ALL=C sort -c "$allow"
|
||||
[[ $(LC_ALL=C sort "$allow" | uniq -d | wc -l) -eq 0 ]]
|
||||
mapfile -t files <"$allow"
|
||||
[[ ${#files[@]} -gt 0 ]]
|
||||
for file in "${files[@]}"; do
|
||||
[[ -n $file && $file != /* && $file != *..* && $file != .gitea/* && $file != .github/* ]]
|
||||
git -C "$root" cat-file -e "$commit:$file"
|
||||
done
|
||||
parent=$(dirname "$destination")
|
||||
mkdir -p "$parent"
|
||||
stage=$(mktemp -d "$parent/.tend-public.XXXXXX")
|
||||
trap 'rm -rf -- "$stage"' EXIT
|
||||
git -C "$root" archive "$commit" -- "${files[@]}" | tar -xf - -C "$stage"
|
||||
while IFS= read -r file; do
|
||||
relative=${file#"$stage"/}
|
||||
cmp "$file" "$root/$relative"
|
||||
done < <(find "$stage" -type f -print | LC_ALL=C sort)
|
||||
epoch=$(git -C "$root" show -s --format=%ct "$commit")
|
||||
printf '{"schema_version":1,"source_commit":"%s","source_tree":"%s","source_date_epoch":%s,"file_count":%d}\n' "$commit" "$tree" "$epoch" "${#files[@]}" >"$stage/PUBLIC-SNAPSHOT.json"
|
||||
(cd "$stage" && sha256sum PUBLIC-SNAPSHOT.json >PUBLIC-SNAPSHOT.sha256)
|
||||
private_pattern='/home/[[:alnum:]_.-]+/|BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|gitea[-_]api[[:alnum:]_.-]*token'
|
||||
if (cd "$stage" && rg -n --hidden --glob '!.git/**' --glob '!PUBLIC-SNAPSHOT.json' --glob '!scripts/export-public.sh' "$private_pattern" .); then
|
||||
echo "private material found" >&2
|
||||
exit 1
|
||||
fi
|
||||
mv "$stage" "$destination"
|
||||
trap - EXIT
|
||||
printf 'destination=%s\nsource_commit=%s\nsource_tree=%s\n' "$destination" "$commit" "$tree"
|
||||
@@ -0,0 +1,81 @@
|
||||
.gitattributes
|
||||
.gitignore
|
||||
COPYRIGHT
|
||||
LICENSE
|
||||
README.md
|
||||
RELEASE.md
|
||||
SECURITY.md
|
||||
cmd/tend/main.go
|
||||
docs/ARCHITECTURE.md
|
||||
docs/DOGFOOD_EVIDENCE.md
|
||||
docs/DOGFOOD_FRICTION.md
|
||||
docs/PUBLIC_SNAPSHOT.md
|
||||
docs/SCHEMA_V2_MIGRATION.md
|
||||
docs/THREAT_MODEL.md
|
||||
docs/WALKTHROUGH.md
|
||||
examples/LICENSE
|
||||
examples/README.md
|
||||
examples/blue-green/caddy-handler.template
|
||||
examples/blue-green/example-site@.service
|
||||
examples/blue-green/tend.json
|
||||
examples/local/.env.example
|
||||
examples/server/authorized_keys.example
|
||||
examples/server/caddy/docs-site.template
|
||||
examples/server/caddy/example-site.template
|
||||
examples/server/environment/docs-site.env.example
|
||||
examples/server/environment/example-site.env.example
|
||||
examples/server/example-singleton.service
|
||||
examples/server/receive-policy.json
|
||||
examples/server/services/docs-site.json
|
||||
examples/server/services/example-site.json
|
||||
examples/server/slots/example-site-blue.env
|
||||
examples/server/slots/example-site-green.env
|
||||
examples/server/tend-receive.sudoers
|
||||
examples/singleton/caddy-handler.template
|
||||
examples/singleton/tend.json
|
||||
go.mod
|
||||
internal/config/config.go
|
||||
internal/config/config_test.go
|
||||
internal/deploy/deploy.go
|
||||
internal/deploy/deploy_test.go
|
||||
internal/deploy/lock_linux.go
|
||||
internal/deploy/lock_linux_test.go
|
||||
internal/deploy/lock_other.go
|
||||
internal/deploy/operator.go
|
||||
internal/deploy/operator_test.go
|
||||
internal/deploy/ownership_linux.go
|
||||
internal/deploy/ownership_other.go
|
||||
internal/deploy/reconcile.go
|
||||
internal/deploy/reconcile_test.go
|
||||
internal/deploy/release.go
|
||||
internal/deploy/release_mode_linux_test.go
|
||||
internal/deploy/release_test.go
|
||||
internal/eventlog/eventlog.go
|
||||
internal/eventlog/eventlog_test.go
|
||||
internal/packager/packager.go
|
||||
internal/packager/packager_test.go
|
||||
internal/process/run.go
|
||||
internal/provenance/git.go
|
||||
internal/provenance/git_test.go
|
||||
internal/serverpolicy/ownership_linux.go
|
||||
internal/serverpolicy/ownership_other.go
|
||||
internal/serverpolicy/policy.go
|
||||
internal/serverpolicy/policy_test.go
|
||||
internal/state/lease.go
|
||||
internal/state/lease_test.go
|
||||
internal/state/state.go
|
||||
internal/state/state_test.go
|
||||
internal/transport/protocol.go
|
||||
internal/transport/protocol_test.go
|
||||
internal/transport/push.go
|
||||
internal/transport/push_test.go
|
||||
internal/transport/receive.go
|
||||
internal/version/version.go
|
||||
internal/version/version_test.go
|
||||
release/tend.json
|
||||
scripts/check-licenses.sh
|
||||
scripts/check-public-tree.sh
|
||||
scripts/export-public.sh
|
||||
scripts/public-snapshot.allow
|
||||
scripts/test-public-snapshot.sh
|
||||
scripts/verify.sh
|
||||
Executable
+18
@@ -0,0 +1,18 @@
|
||||
#!/usr/bin/env bash
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
set -euo pipefail
|
||||
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
work=$(mktemp -d)
|
||||
trap 'rm -rf -- "$work"' EXIT
|
||||
destination=$work/public
|
||||
"$root/scripts/export-public.sh" --destination "$destination" >/dev/null
|
||||
test -f "$destination/PUBLIC-SNAPSHOT.json"
|
||||
test -f "$destination/PUBLIC-SNAPSHOT.sha256"
|
||||
(cd "$destination" && sha256sum -c PUBLIC-SNAPSHOT.sha256)
|
||||
test ! -e "$destination/.git"
|
||||
test ! -e "$destination/.gitea"
|
||||
test ! -e "$destination/.github"
|
||||
while IFS= read -r file; do
|
||||
cmp "$root/$file" "$destination/$file"
|
||||
done <"$root/scripts/public-snapshot.allow"
|
||||
echo "public snapshot isolation verified"
|
||||
Executable
+25
@@ -0,0 +1,25 @@
|
||||
#!/usr/bin/env bash
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
set -euo pipefail
|
||||
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
||||
cd "$root"
|
||||
./scripts/check-licenses.sh
|
||||
./scripts/check-public-tree.sh
|
||||
go test -count=1 ./...
|
||||
go test -race -count=1 ./...
|
||||
go vet ./...
|
||||
for script in scripts/*.sh; do bash -n "$script"; done
|
||||
work=$(mktemp -d); trap 'rm -rf -- "$work"' EXIT
|
||||
GOWORK=off CGO_ENABLED=0 go build -mod=readonly -trimpath -o "$work/tend-1" ./cmd/tend
|
||||
GOWORK=off CGO_ENABLED=0 go build -mod=readonly -trimpath -o "$work/tend-2" ./cmd/tend
|
||||
cmp "$work/tend-1" "$work/tend-2"
|
||||
"$work/tend-1" check --config "$root/examples/blue-green/tend.json" >/dev/null
|
||||
"$work/tend-1" check --config "$root/examples/singleton/tend.json" >/dev/null
|
||||
"$work/tend-1" check --config "$root/examples/server/services/example-site.json" >/dev/null
|
||||
"$work/tend-1" check --config "$root/examples/server/services/docs-site.json" >/dev/null
|
||||
"$work/tend-1" check --config "$root/release/tend.json" >/dev/null
|
||||
grep -Fqx 'Defaults:tend-deploy env_keep += "SSH_ORIGINAL_COMMAND"' "$root/examples/server/tend-receive.sudoers"
|
||||
grep -Fqx 'tend-deploy ALL=(root) NOPASSWD: /usr/local/bin/tend receive --policy /etc/tend/receive-policy.json' "$root/examples/server/tend-receive.sudoers"
|
||||
[[ $(GOWORK=off go list -m all | wc -l) -eq 1 ]]
|
||||
git diff --check
|
||||
echo "Tend verification passed"
|
||||
Reference in New Issue
Block a user