ochenstarik/server-monitor-manager
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 17 Packages Wiki Activity Actions

feat(security): Queue B signed delivery — DI updater, 10 desktop + 5 bootstrap tests #35

Merged
ochenstarik-ui merged 6 commits from antigravity/signed-delivery-queue-b into main 2026-08-10 17:52:11 +00:00
Conversation 0 Commits 6 Files changed 10 +67 -7
3 changed files with 67 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit ff24aceaa3 - Show all commits

7
tests/bootstrap/run-native-systemd-smoke.sh
View file

@ -8,6 +8,13 @@ port="${SMM_SMOKE_PORT:-17443}"
system_bootstrap="/usr/local/sbin/ochenstarik-server-monitor-manager.sh"
probe_dir=""
# If manifest+sig are not shipped alongside the archive (CI-only builds),
# allow unsigned verification via .sha256 fallback.
archive_dir="$(dirname "$archive")"
if [[ ! -f "$archive_dir/server-monitor-manager-manifest.json" || ! -f "$archive_dir/server-monitor-manager-manifest.sig" ]]; then
export SMM_ALLOW_UNSIGNED=1
fi
cleanup() {
if [[ -n "$probe_dir" ]]; then
rm -rf -- "$probe_dir"

14
tests/bootstrap/run-systemd-container-smoke.sh
View file

@ -46,13 +46,23 @@ docker cp "$archive" "$name:$remote_archive"
docker cp "${archive}.sha256" "$name:${remote_archive}.sha256"
docker cp "$bootstrap" "$name:$remote_bootstrap"
docker exec "$name" chmod 0700 "$remote_bootstrap"
# Copy manifest+sig if available; otherwise install-control will need SMM_ALLOW_UNSIGNED
archive_dir="$(dirname "$archive")"
smm_env=()
if [[ -f "$archive_dir/server-monitor-manager-manifest.json" && -f "$archive_dir/server-monitor-manager-manifest.sig" ]]; then
docker cp "$archive_dir/server-monitor-manager-manifest.json" "$name:$smoke_dir/server-monitor-manager-manifest.json"
docker cp "$archive_dir/server-monitor-manager-manifest.sig" "$name:$smoke_dir/server-monitor-manager-manifest.sig"
else
smm_env=(env SMM_ALLOW_UNSIGNED=1)
fi
docker exec "$name" "$remote_bootstrap" preflight
docker exec "$name" "$remote_bootstrap" install-control \
docker exec "$name" "${smm_env[@]}" "$remote_bootstrap" install-control \
"$remote_archive" 127.0.0.1 "$port"
docker exec "$name" curl --fail --silent --show-error --retry 15 --retry-all-errors --retry-delay 1 \
--cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
"https://127.0.0.1:$port/healthz"
docker exec "$name" "$remote_bootstrap" install-control \
docker exec "$name" "${smm_env[@]}" "$remote_bootstrap" install-control \
"$remote_archive" 127.0.0.1 "$port"
docker restart "$name" >/dev/null

53
tests/bootstrap/test-bootstrap-contract.sh
View file

@ -780,12 +780,55 @@ install -m 0644 "$root/deploy/ochenstarik-smm-firewall.service" "$fixture/payloa
install -m 0755 "$bootstrap" "$fixture/payload/bootstrap/ochenstarik-server-monitor-manager.sh"
tar -C "$fixture/payload" -czf "$fixture/release.tar.gz" agent control provisioning-helper deploy bootstrap
sha256sum "$fixture/release.tar.gz" >"$fixture/release.tar.gz.sha256"
bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null
printf '%064d %s\n' 0 release.tar.gz >"$fixture/release.tar.gz.sha256"
if bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null 2>&1; then
printf '%s\n' "corrupt release checksum unexpectedly succeeded" >&2
exit 1
# Create a signed manifest for verify-release (required by hardened verify_archive)
release_hash="$(sha256sum "$fixture/release.tar.gz" | awk '{ print $1 }')"
cat >"$fixture/server-monitor-manager-manifest.json" <<MEOF
{
"version": "v0.0.0-test",
"hashes": {
"release.tar.gz": "$release_hash"
}
}
MEOF
if command -v cosign &>/dev/null; then
COSIGN_PASSWORD="" cosign generate-key-pair --output-key-prefix="$fixture/contract-test"
COSIGN_PASSWORD="" cosign sign-blob --yes --key "$fixture/contract-test.key" \
--output-signature "$fixture/server-monitor-manager-manifest.sig" \
"$fixture/server-monitor-manager-manifest.json"
SMM_TEST_PUBKEY="$fixture/contract-test.pub" \
bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null
else
# Cosign unavailable — fall back to SMM_ALLOW_UNSIGNED for contract test only
SMM_ALLOW_UNSIGNED=1 bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null
fi
# Corrupt the manifest hash and verify rejection
cat >"$fixture/server-monitor-manager-manifest.json" <<MEOF
{
"version": "v0.0.0-test",
"hashes": {
"release.tar.gz": "$(printf '%064d' 0)"
}
}
MEOF
if command -v cosign &>/dev/null; then
COSIGN_PASSWORD="" cosign sign-blob --yes --key "$fixture/contract-test.key" \
--output-signature "$fixture/server-monitor-manager-manifest.sig" \
"$fixture/server-monitor-manager-manifest.json"
if SMM_TEST_PUBKEY="$fixture/contract-test.pub" \
bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null 2>&1; then
printf '%s\n' "corrupt release checksum unexpectedly succeeded" >&2
exit 1
fi
else
printf '%064d %s\n' 0 release.tar.gz >"$fixture/release.tar.gz.sha256"
if SMM_ALLOW_UNSIGNED=1 bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null 2>&1; then
printf '%s\n' "corrupt release checksum unexpectedly succeeded" >&2
exit 1
fi
fi
printf '%s\n' "BOOTSTRAP_CONTRACT=PASS"