diff --git a/deploy/smm-setup.sh b/deploy/smm-setup.sh index 5ef182e..c2ecdcc 100644 --- a/deploy/smm-setup.sh +++ b/deploy/smm-setup.sh @@ -3,7 +3,7 @@ set -Eeuo pipefail IFS=$'\n\t' readonly PROGRAM_NAME="smm-setup" -readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.9" +readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.10" readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager" readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh" @@ -22,7 +22,7 @@ asset from the selected immutable GitHub release. Common commands: backup-create | backup-restore | version Environment overrides: - SMM_TAG Release tag (default: v0.1.0-alpha.9) + SMM_TAG Release tag (default: v0.1.0-alpha.10) SMM_REPOSITORY GitHub repository (default: ochenstarik-ui/server-monitor-manager) SMM_CACHE_DIR Verified-download cache directory USAGE diff --git a/tests/release-verification/run-negative-tests.sh b/tests/release-verification/run-negative-tests.sh new file mode 100644 index 0000000..861f999 --- /dev/null +++ b/tests/release-verification/run-negative-tests.sh @@ -0,0 +1,79 @@ +#!/bin/bash +set -euo pipefail + +TAG="${1:-}" + +if [[ -z "$TAG" ]]; then + echo "Usage: $0 " + exit 1 +fi + +echo "Running negative tests against release $TAG..." + +# We will need smm-setup.sh or ochenstarik-server-monitor-manager.sh +# We'll download ochenstarik-server-monitor-manager.sh directly to test verify-release +gh release download "$TAG" -p 'ochenstarik-server-monitor-manager.sh' +chmod +x ochenstarik-server-monitor-manager.sh + +ARCHIVE="server-monitor-manager-linux-$(uname -m | sed -e 's/x86_64/x64/' -e 's/aarch64/arm64/').tar.gz" +gh release download "$TAG" -p "$ARCHIVE" +gh release download "$TAG" -p "server-monitor-manager-manifest.json" +gh release download "$TAG" -p "server-monitor-manager-manifest.sig" + +echo "Test 1: Altered byte in archive" +cp "$ARCHIVE" "corrupted-$ARCHIVE" +echo "corrupted" >> "corrupted-$ARCHIVE" +if ./ochenstarik-server-monitor-manager.sh verify-release "corrupted-$ARCHIVE" >/dev/null 2>&1; then + echo "FAIL: Altered archive was accepted!" + exit 1 +fi +echo "PASS: Altered archive rejected." +rm "corrupted-$ARCHIVE" + +echo "Test 2: Substituted hash in manifest without resigning" +cp server-monitor-manager-manifest.json corrupted-manifest.json +# Replace all hashes with zeros +sed -i 's/"[a-f0-9]\{64\}"/"0000000000000000000000000000000000000000000000000000000000000000"/g' corrupted-manifest.json +# Test verify-manifest directly +if ./ochenstarik-server-monitor-manager.sh verify-manifest corrupted-manifest.json server-monitor-manager-manifest.sig >/dev/null 2>&1; then + echo "FAIL: Manifest with substituted hash accepted!" + exit 1 +fi +echo "PASS: Substituted hash rejected." +rm corrupted-manifest.json + +echo "Test 3: Manifest without signature" +# We just pass an empty string for the signature file argument +if ./ochenstarik-server-monitor-manager.sh verify-manifest server-monitor-manager-manifest.json "" >/dev/null 2>&1; then + echo "FAIL: Manifest without signature accepted!" + exit 1 +fi +echo "PASS: Missing signature rejected." + +echo "Test 4: Signature made by another identity" +# Generate a local keypair and sign the manifest +export COSIGN_PASSWORD="" +cosign generate-key-pair +cosign sign-blob --yes --key cosign.key --output-signature fake.sig server-monitor-manager-manifest.json +# Verification must fail because ochenstarik-server-monitor-manager.sh enforces keyless OIDC identity! +if ./ochenstarik-server-monitor-manager.sh verify-manifest server-monitor-manager-manifest.json fake.sig >/dev/null 2>&1; then + echo "FAIL: Signature from wrong identity accepted!" + exit 1 +fi +echo "PASS: Wrong identity signature rejected." +rm cosign.key cosign.pub fake.sig + +echo "Test 5: Real alpha.8 manifest fallback matching (verify-release against older release)" +ALPHA8_ARCHIVE="alpha8-archive.tar.gz" +wget -qO "$ALPHA8_ARCHIVE" https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.8/server-monitor-manager-linux-x64.tar.gz +wget -qO server-monitor-manager-manifest.json https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.8/server-monitor-manager-manifest.json +wget -qO server-monitor-manager-manifest.sig https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.8/server-monitor-manager-manifest.sig + +if ! ./ochenstarik-server-monitor-manager.sh verify-release "$ALPHA8_ARCHIVE" >/dev/null 2>&1; then + echo "FAIL: Alpha.8 real release verification failed!" + exit 1 +fi +echo "PASS: Alpha.8 real release verification succeeded." +rm "$ALPHA8_ARCHIVE" server-monitor-manager-manifest.json server-monitor-manager-manifest.sig + +echo "All negative tests passed!" diff --git a/tests/release-verification/run-positive-installation.sh b/tests/release-verification/run-positive-installation.sh new file mode 100644 index 0000000..1796fb6 --- /dev/null +++ b/tests/release-verification/run-positive-installation.sh @@ -0,0 +1,89 @@ +#!/bin/bash +set -euo pipefail + +TAG="${1:-}" + +if [[ -z "$TAG" ]]; then + echo "Usage: $0 " + exit 1 +fi + +echo "Running positive installation test for $TAG..." + +# Fetch smm-setup.sh +gh release download "$TAG" -p 'smm-setup.sh*' + +# Verify checksum +sha256sum -c smm-setup.sh.sha256 + +# The archive is downloaded by verify-release or we must download it? +# In smm-setup.sh, the owner manually downloads the archive? +# Wait, let's look at docs: "загрузка bootstrap и архива из релиза, проверка контрольных сумм, проверка подписи manifest" +# Actually, the user does: +ARCHIVE="server-monitor-manager-linux-$(uname -m | sed -e 's/x86_64/x64/' -e 's/aarch64/arm64/').tar.gz" +gh release download "$TAG" -p "$ARCHIVE*" +gh release download "$TAG" -p "server-monitor-manager-manifest.*" + +sha256sum -c "$ARCHIVE.sha256" + +# Run setup steps through smm-setup.sh +# "preflight, verify-release, установка Control, mesh-init" +sudo bash smm-setup.sh preflight +sudo bash smm-setup.sh verify-manifest server-monitor-manager-manifest.json server-monitor-manager-manifest.sig +sudo bash smm-setup.sh verify-release "$ARCHIVE" +sudo bash smm-setup.sh install-control "$ARCHIVE" 127.0.0.1 17443 +sudo bash smm-setup.sh mesh-init 127.0.0.1 51820 + +echo "Checking Control healthz..." +for _ in {1..30}; do + if sudo curl --fail --silent \ + --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \ + "https://127.0.0.1:17443/healthz" >/dev/null; then + break + fi + sleep 1 +done +sudo curl --fail --silent --show-error \ + --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \ + "https://127.0.0.1:17443/healthz" + +echo "Extracting node code and installing agent..." +NODE_CODE=$(sudo bash smm-setup.sh node-code test-node) +export SMM_ENROLL_CODE="$NODE_CODE" +export SMM_ACCEPT_CA_FINGERPRINT=1 +sudo --preserve-env=SMM_ENROLL_CODE,SMM_ACCEPT_CA_FINGERPRINT bash smm-setup.sh install-node "$ARCHIVE" + +sudo systemctl is-active --quiet ochenstarik-smm-agent.service +sudo systemctl is-active --quiet ochenstarik-smm-control.service + +# Verify install-monitor +echo "Installing monitor..." +# Generate a dummy SSH key for the test +ssh-keygen -t ed25519 -N "" -f /tmp/monitor_key +MONITOR_PUB=$(cat /tmp/monitor_key.pub) +sudo bash smm-setup.sh install-monitor "$MONITOR_PUB" + +echo "Verifying monitor user and forced command..." +# Run SSH locally as the monitor user (assuming ssh is configured, but actually we can just su into the user or run the forced command directly) +# The forced command is likely defined in ~smm-monitor/.ssh/authorized_keys +MONITOR_CMD=$(sudo cat /var/lib/ochenstarik-server-monitor-manager/monitor/.ssh/authorized_keys | grep -o 'command="[^"]*"' | cut -d'"' -f2) +SNAPSHOT=$(sudo -u ochenstarik-smm-monitor $MONITOR_CMD) + +# Simple validation of snapshot fields (since actual values vary, we just check keys) +EXPECTED_KEYS=$(cat tests/contracts/monitor-snapshot-v1.txt | cut -d'=' -f1 | sort) +ACTUAL_KEYS=$(echo "$SNAPSHOT" | cut -d'=' -f1 | sort) + +if [[ "$EXPECTED_KEYS" == "$ACTUAL_KEYS" ]]; then + echo "Monitor snapshot keys match contract." +else + echo "Monitor snapshot keys mismatch!" + diff <(echo "$EXPECTED_KEYS") <(echo "$ACTUAL_KEYS") || true + exit 1 +fi + +# Verify uninstall +sudo bash smm-setup.sh uninstall-monitor +sudo bash smm-setup.sh uninstall-agent --purge +sudo bash smm-setup.sh uninstall-control --confirm-destroy-control + +echo "Positive installation test passed!" diff --git a/tests/release-verification/verify-assets.sh b/tests/release-verification/verify-assets.sh new file mode 100644 index 0000000..719f619 --- /dev/null +++ b/tests/release-verification/verify-assets.sh @@ -0,0 +1,51 @@ +#!/bin/bash +set -euo pipefail + +TAG="${1:-}" + +if [[ -z "$TAG" ]]; then + echo "Usage: $0 " + exit 1 +fi + +echo "Verifying assets for release $TAG..." + +# Fetch the list of assets from the release +ACTUAL_ASSETS=$(gh release view "$TAG" --json assets -q '.assets[].name' | sort) + +EXPECTED_ASSETS=$(cat <