e1359b1b5f
Close the producer/consumer certificate contract and advance the immutable correction release to alpha.14.
91 lines
3.6 KiB
Bash
91 lines
3.6 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
TAG="${1:-}"
|
|
|
|
if [[ -z "$TAG" ]]; then
|
|
echo "Usage: $0 <tag>"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Running positive installation test for $TAG..."
|
|
|
|
# Fetch smm-setup.sh
|
|
gh release download "$TAG" -p 'smm-setup.sh*'
|
|
|
|
# Verify checksum
|
|
sha256sum -c smm-setup.sh.sha256
|
|
|
|
# The archive is downloaded by verify-release or we must download it?
|
|
# In smm-setup.sh, the owner manually downloads the archive?
|
|
# Wait, let's look at docs: "загрузка bootstrap и архива из релиза, проверка контрольных сумм, проверка подписи manifest"
|
|
# Actually, the user does:
|
|
ARCHIVE="server-monitor-manager-linux-$(uname -m | sed -e 's/x86_64/x64/' -e 's/aarch64/arm64/').tar.gz"
|
|
gh release download "$TAG" -p "$ARCHIVE*"
|
|
gh release download "$TAG" -p "server-monitor-manager-manifest.json"
|
|
gh release download "$TAG" -p "server-monitor-manager-manifest.sig"
|
|
gh release download "$TAG" -p "server-monitor-manager-manifest.pem"
|
|
|
|
sha256sum -c "$ARCHIVE.sha256"
|
|
|
|
# Run setup steps through smm-setup.sh
|
|
# "preflight, verify-release, установка Control, mesh-init"
|
|
sudo bash smm-setup.sh preflight
|
|
sudo bash smm-setup.sh verify-manifest server-monitor-manager-manifest.json server-monitor-manager-manifest.sig server-monitor-manager-manifest.pem
|
|
sudo bash smm-setup.sh verify-release "$ARCHIVE"
|
|
sudo bash smm-setup.sh install-control "$ARCHIVE" 127.0.0.1 17443
|
|
sudo bash smm-setup.sh mesh-init 127.0.0.1 51820
|
|
|
|
echo "Checking Control healthz..."
|
|
for _ in {1..30}; do
|
|
if sudo curl --fail --silent \
|
|
--cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
|
|
"https://127.0.0.1:17443/healthz" >/dev/null; then
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
sudo curl --fail --silent --show-error \
|
|
--cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
|
|
"https://127.0.0.1:17443/healthz"
|
|
|
|
echo "Extracting node code and installing agent..."
|
|
NODE_CODE=$(sudo bash smm-setup.sh node-code test-node)
|
|
export SMM_ENROLL_CODE="$NODE_CODE"
|
|
export SMM_ACCEPT_CA_FINGERPRINT=1
|
|
sudo --preserve-env=SMM_ENROLL_CODE,SMM_ACCEPT_CA_FINGERPRINT bash smm-setup.sh install-node "$ARCHIVE"
|
|
|
|
sudo systemctl is-active --quiet ochenstarik-smm-agent.service
|
|
sudo systemctl is-active --quiet ochenstarik-smm-control.service
|
|
|
|
# Verify install-monitor
|
|
echo "Installing monitor..."
|
|
# Generate a dummy SSH key for the test
|
|
ssh-keygen -t ed25519 -N "" -f /tmp/monitor_key
|
|
MONITOR_PUB=$(cat /tmp/monitor_key.pub)
|
|
sudo bash smm-setup.sh install-monitor "$MONITOR_PUB"
|
|
|
|
echo "Verifying monitor user and forced command..."
|
|
# Run SSH locally as the monitor user (assuming ssh is configured, but actually we can just su into the user or run the forced command directly)
|
|
# The forced command is likely defined in ~smm-monitor/.ssh/authorized_keys
|
|
MONITOR_CMD=$(sudo cat /var/lib/ochenstarik-server-monitor-manager/monitor/.ssh/authorized_keys | grep -o 'command="[^"]*"' | cut -d'"' -f2)
|
|
SNAPSHOT=$(sudo -u ochenstarik-smm-monitor $MONITOR_CMD)
|
|
|
|
# Simple validation of snapshot fields (since actual values vary, we just check keys)
|
|
EXPECTED_KEYS=$(cat tests/contracts/monitor-snapshot-v1.txt | cut -d'=' -f1 | sort)
|
|
ACTUAL_KEYS=$(echo "$SNAPSHOT" | cut -d'=' -f1 | sort)
|
|
|
|
if [[ "$EXPECTED_KEYS" == "$ACTUAL_KEYS" ]]; then
|
|
echo "Monitor snapshot keys match contract."
|
|
else
|
|
echo "Monitor snapshot keys mismatch!"
|
|
diff <(echo "$EXPECTED_KEYS") <(echo "$ACTUAL_KEYS") || true
|
|
exit 1
|
|
fi
|
|
|
|
# Verify uninstall
|
|
sudo bash smm-setup.sh uninstall-monitor
|
|
sudo bash smm-setup.sh uninstall-agent --purge
|
|
sudo bash smm-setup.sh uninstall-control --confirm-destroy-control
|
|
|
|
echo "Positive installation test passed!"
|