ff24aceaa3
- test-bootstrap-contract: Generate signed manifest.json with cosign test key - systemd smoke tests: Pass SMM_ALLOW_UNSIGNED=1 fallback when manifest is missing (for CI PR runs)
119 lines
4.6 KiB
Bash
Executable file
119 lines
4.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
IFS=$'\n\t'
|
|
|
|
archive="${1:?usage: run-native-systemd-smoke.sh ARCHIVE BOOTSTRAP}"
|
|
bootstrap="${2:?usage: run-native-systemd-smoke.sh ARCHIVE BOOTSTRAP}"
|
|
port="${SMM_SMOKE_PORT:-17443}"
|
|
system_bootstrap="/usr/local/sbin/ochenstarik-server-monitor-manager.sh"
|
|
probe_dir=""
|
|
|
|
# If manifest+sig are not shipped alongside the archive (CI-only builds),
|
|
# allow unsigned verification via .sha256 fallback.
|
|
archive_dir="$(dirname "$archive")"
|
|
if [[ ! -f "$archive_dir/server-monitor-manager-manifest.json" || ! -f "$archive_dir/server-monitor-manager-manifest.sig" ]]; then
|
|
export SMM_ALLOW_UNSIGNED=1
|
|
fi
|
|
|
|
cleanup() {
|
|
if [[ -n "$probe_dir" ]]; then
|
|
rm -rf -- "$probe_dir"
|
|
fi
|
|
sudo "$system_bootstrap" uninstall-agent --purge >/dev/null 2>&1 || true
|
|
sudo "$system_bootstrap" uninstall-control --confirm-destroy-control >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
sudo "$bootstrap" preflight
|
|
sudo "$bootstrap" verify-release "$archive"
|
|
sudo "$bootstrap" install-control "$archive" 127.0.0.1 "$port"
|
|
sudo test -x "$system_bootstrap"
|
|
sudo test -x /usr/local/sbin/ochenstarik-smm-emergency
|
|
sudo /usr/local/sbin/ochenstarik-smm-emergency status
|
|
|
|
for _ in {1..30}; do
|
|
if sudo curl --fail --silent \
|
|
--cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
|
|
"https://127.0.0.1:$port/healthz" >/dev/null; then
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
sudo curl --fail --silent --show-error \
|
|
--cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
|
|
"https://127.0.0.1:$port/healthz"
|
|
|
|
probe_dir="$(mktemp -d -t smm-agent-probe.XXXXXXXX)"
|
|
tar -xzf "$archive" -C "$probe_dir" agent
|
|
set +e
|
|
probe_output="$(env SMM_NodeId=INVALID_UPPER \
|
|
"$probe_dir/agent/ochenstarik-smm-agent" 2>&1)"
|
|
probe_status=$?
|
|
set -e
|
|
[[ "$probe_status" -eq 2 ]] || {
|
|
printf 'trimmed Agent invalid-environment probe returned %s, expected 2\n' "$probe_status" >&2
|
|
exit 1
|
|
}
|
|
grep -Fq 'NodeId must contain lowercase letters, digits, or hyphens.' <<<"$probe_output"
|
|
if grep -Fq 'agent.pfx' <<<"$probe_output"; then
|
|
printf '%s\n' 'trimmed Agent ignored SMM_NodeId and attempted to load agent.pfx' >&2
|
|
exit 1
|
|
fi
|
|
|
|
set +e
|
|
probe_output="$(env SMM_NodeId=smoke-probe SMM_ControlUrl=http://127.0.0.1:1 \
|
|
"$probe_dir/agent/ochenstarik-smm-agent" 2>&1)"
|
|
probe_status=$?
|
|
set -e
|
|
[[ "$probe_status" -eq 2 ]] || {
|
|
printf 'trimmed Agent plaintext-ControlUrl probe returned %s, expected 2\n' "$probe_status" >&2
|
|
exit 1
|
|
}
|
|
grep -Fq 'Agent ControlUrl must be a secure HTTPS origin.' <<<"$probe_output"
|
|
if grep -Eq 'agent\.pfx|Connection refused|127\.0\.0\.1' <<<"$probe_output"; then
|
|
printf '%s\n' 'trimmed Agent plaintext-ControlUrl probe reached certificate or network access' >&2
|
|
exit 1
|
|
fi
|
|
rm -rf -- "$probe_dir"
|
|
probe_dir=""
|
|
|
|
node_code="$(sudo "$system_bootstrap" node-code smoke-node)"
|
|
[[ "$node_code" == SMMNODE1.* || "$node_code" == SMMNODE2.* ]]
|
|
export SMM_ENROLL_CODE="$node_code"
|
|
export SMM_ACCEPT_CA_FINGERPRINT=1
|
|
sudo --preserve-env=SMM_ENROLL_CODE,SMM_ACCEPT_CA_FINGERPRINT \
|
|
"$system_bootstrap" install-node "$archive"
|
|
unset SMM_ENROLL_CODE SMM_ACCEPT_CA_FINGERPRINT
|
|
node_code=""
|
|
sudo test -s /var/lib/ochenstarik-server-monitor-manager/agent/agent.pfx
|
|
sudo systemctl is-active --quiet ochenstarik-smm-agent.service
|
|
sudo systemctl is-active --quiet ochenstarik-smm-control.service
|
|
|
|
[[ "$(sudo stat -c '%a:%U:%G' /var/lib/ochenstarik-server-monitor-manager)" == '711:root:root' ]]
|
|
[[ "$(sudo stat -c '%a:%U:%G' /var/lib/ochenstarik-server-monitor-manager/control)" \
|
|
== '700:ochenstarik-smm-control:ochenstarik-smm-control' ]]
|
|
[[ "$(sudo stat -c '%a:%U:%G' /var/lib/ochenstarik-server-monitor-manager/agent)" \
|
|
== '700:ochenstarik-smm-agent:ochenstarik-smm-agent' ]]
|
|
if sudo -u ochenstarik-smm-agent test -r \
|
|
/var/lib/ochenstarik-server-monitor-manager/control/control.db; then
|
|
printf '%s\n' 'Agent can read the Control database' >&2
|
|
exit 1
|
|
fi
|
|
if sudo -u ochenstarik-smm-agent id -nG | tr ' ' '\n' | \
|
|
grep -Fxq ochenstarik-smm-control; then
|
|
printf '%s\n' 'Agent unexpectedly belongs to the Control group' >&2
|
|
exit 1
|
|
fi
|
|
|
|
device_code="$(sudo "$system_bootstrap" control-device-code smoke-device)"
|
|
[[ "$device_code" == SMMDEV1-* ]]
|
|
device_code=""
|
|
|
|
sudo "$system_bootstrap" update-control "$archive"
|
|
sudo systemctl is-active --quiet ochenstarik-smm-control.service
|
|
sudo systemctl is-active --quiet ochenstarik-smm-agent.service
|
|
sudo curl --fail --silent --show-error --retry 15 --retry-all-errors --retry-delay 1 \
|
|
--cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
|
|
"https://127.0.0.1:$port/healthz"
|
|
|
|
printf '%s\n' "NATIVE_SYSTEMD_SMOKE=PASS"
|