Publish curated Unraid-AppOps-Gateway source from 21729207a161d87393cfb73e79582bc373aa19cf
This commit is contained in:
Public Source Publisher committed
1 parent
ab3fa553f0
commit
76d7249b5e
6 files changed
+1497
-37
No files matched your search
@@ -318,7 +318,10 @@ def _prepare_promotion_doubles(monkeypatch, tmp_path, *, config_valid=True):
|
||||
raise module.VolumeTransitionError("staged_config_invalid")
|
||||
|
||||
monkeypatch.setattr(module, "_validate_staged_configuration", validate_staged)
|
||||
monkeypatch.setattr(module, "_install_release_leaf", lambda *_args, **_kwargs: None)
|
||||
monkeypatch.setattr(
|
||||
module, "_install_release_leaf",
|
||||
lambda revision, *_args, **_kwargs: events.append(f"release_installed:{revision}"),
|
||||
)
|
||||
monkeypatch.setattr(module, "_read_root_compose", lambda: (ORIGINAL_COMPOSE, 0o644))
|
||||
monkeypatch.setattr(module, "_mirror_snapshot_tar", lambda: b"mirror")
|
||||
monkeypatch.setattr(
|
||||
@@ -329,6 +332,10 @@ def _prepare_promotion_doubles(monkeypatch, tmp_path, *, config_valid=True):
|
||||
module, "_verify_compose_image",
|
||||
lambda *_args, **_kwargs: events.append("compose_verified"),
|
||||
)
|
||||
monkeypatch.setattr(
|
||||
module, "_verify_promotion_source_attestation",
|
||||
lambda *_args, **_kwargs: events.append("source_attested"),
|
||||
)
|
||||
monkeypatch.setattr(
|
||||
module, "ensure_backup_volume",
|
||||
lambda **_kwargs: events.append("backup_volume_prepared"),
|
||||
@@ -360,6 +367,73 @@ def test_promotion_prepares_backup_volume_after_source_stage_controller_and_conf
|
||||
assert events.index("compose_rendered") < events.index("backup_volume_prepared")
|
||||
assert events.count("compose_verified") == 2
|
||||
assert events.index("compose_verified") < events.index("backup_volume_prepared")
|
||||
assert events.count("source_attested") == 4
|
||||
attestation_after_backup = events.index(
|
||||
"source_attested", events.index("backup_volume_prepared") + 1
|
||||
)
|
||||
assert attestation_after_backup < events.index("release_installed:" + "b" * 40)
|
||||
|
||||
|
||||
def test_promotion_rejects_config_leaf_change_during_staged_validation(monkeypatch, tmp_path):
|
||||
events = _prepare_promotion_doubles(monkeypatch, tmp_path)
|
||||
original_config = ({}, {"": 0o755})
|
||||
changed_config = ({"changed.json": (b"changed", 0o600)}, {"": 0o755})
|
||||
reads = 0
|
||||
|
||||
def read_config():
|
||||
nonlocal reads
|
||||
reads += 1
|
||||
if reads == 1:
|
||||
return original_config
|
||||
events.append("config_changed")
|
||||
return changed_config
|
||||
|
||||
monkeypatch.setattr(module, "_read_config_leaf", read_config)
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="controller_volume_config_changed"):
|
||||
module.prepare_promotion(
|
||||
tmp_path / "stage",
|
||||
source_revision="d" * 40,
|
||||
source_tree="e" * 40,
|
||||
controller_version="2.2.0",
|
||||
image_id=IMAGE_ID,
|
||||
)
|
||||
|
||||
assert reads == 2
|
||||
assert events.index("config_validated") < events.index("config_changed")
|
||||
assert not any(event.startswith("release_installed:") for event in events)
|
||||
|
||||
|
||||
def test_promotion_rejects_legacy_config_source_change_before_config_install(monkeypatch, tmp_path):
|
||||
events = _prepare_promotion_doubles(monkeypatch, tmp_path)
|
||||
monkeypatch.setattr(module, "_read_config_leaf", lambda: None)
|
||||
monkeypatch.setattr(
|
||||
module, "_config_tree",
|
||||
lambda entries, _directories, **_kwargs: (
|
||||
({"changed.json": (b"changed", 0o600)}, {"": 0o755})
|
||||
if "changed.json" in entries else ({}, {"": 0o755})
|
||||
),
|
||||
)
|
||||
identity = {
|
||||
"sourceRevision": "b" * 40,
|
||||
"sourceTree": "c" * 40,
|
||||
"controllerVersion": "2.1.0",
|
||||
}
|
||||
monkeypatch.setattr(
|
||||
module, "_capture_controller_source",
|
||||
lambda *_args: ({"changed.json": (b"changed", 0o600)}, {"": 0o755}, identity),
|
||||
)
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="controller_volume_config_changed"):
|
||||
module.prepare_promotion(
|
||||
tmp_path / "stage",
|
||||
source_revision="d" * 40,
|
||||
source_tree="e" * 40,
|
||||
controller_version="2.2.0",
|
||||
image_id=IMAGE_ID,
|
||||
)
|
||||
|
||||
assert not any(event.startswith("release_installed:") for event in events)
|
||||
|
||||
|
||||
def test_promotion_does_not_prepare_backup_volume_when_staged_configuration_fails(
|
||||
@@ -1226,16 +1300,489 @@ def test_drifted_tag_requires_healthy_current_controller_provenance(compose, mon
|
||||
elif damage == "interpolation":
|
||||
source_reference = "${CONTROLLER_IMAGE}"
|
||||
original = f"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: {source_reference}\n".encode()
|
||||
if damage:
|
||||
with pytest.raises(module.VolumeTransitionError, match="image_reference_(changed|invalid)"):
|
||||
module.rendered_model(original, REVISION, IMAGE_ID, current_container=current)
|
||||
else:
|
||||
rendered = json.loads(module.rendered_model(original, REVISION, IMAGE_ID, current_container=current))
|
||||
assert rendered["services"][module.SERVICE]["image"] == IMAGE_ID
|
||||
assert rendered["services"][module.SERVICE]["pull_policy"] == "never"
|
||||
with pytest.raises(module.VolumeTransitionError, match="image_reference_(changed|invalid)"):
|
||||
module.rendered_model(original, REVISION, IMAGE_ID, current_container=current)
|
||||
assert not any("up" in arguments or "pull" in arguments for arguments, _ in calls)
|
||||
|
||||
|
||||
def _tag_drift_container():
|
||||
return {
|
||||
"Id": "d" * 64,
|
||||
"Image": IMAGE_ID,
|
||||
"Name": f"/{module.CONTAINER}",
|
||||
"State": {"Running": True, "Health": {"Status": "healthy"}},
|
||||
"Config": {
|
||||
"Image": "docker.gitea.com/runner-images:ubuntu-latest",
|
||||
"Labels": {
|
||||
"com.docker.compose.project": "gitea-deploy-runners",
|
||||
"com.docker.compose.service": "deploy-control",
|
||||
"com.docker.compose.oneoff": "False",
|
||||
},
|
||||
},
|
||||
"Mounts": [
|
||||
{
|
||||
"Type": "bind",
|
||||
"Source": module.CONTROLLER_DIR.as_posix(),
|
||||
"Destination": module.EXECUTABLE_TARGET,
|
||||
"RW": False,
|
||||
},
|
||||
{
|
||||
"Type": "bind",
|
||||
"Source": module._expected_config_path().as_posix(),
|
||||
"Destination": module.CONFIG_TARGET,
|
||||
"RW": False,
|
||||
},
|
||||
{
|
||||
"Type": "volume",
|
||||
"Name": module.VOLUME,
|
||||
"Source": module.MOUNTPOINT.as_posix(),
|
||||
"Destination": module.TARGET,
|
||||
"RW": True,
|
||||
},
|
||||
],
|
||||
}
|
||||
|
||||
|
||||
_DEFAULT_SOURCE_IMAGE_ID = object()
|
||||
|
||||
|
||||
def _install_tag_drift_docker_fixture(
|
||||
monkeypatch, *, source_image_id=_DEFAULT_SOURCE_IMAGE_ID, source_reference=None,
|
||||
expected_image_output=IMAGE_ID, mutate=None
|
||||
):
|
||||
source_ref = "docker.gitea.com/runner-images:ubuntu-latest"
|
||||
if source_reference is not None:
|
||||
source_ref = source_reference
|
||||
if source_image_id is _DEFAULT_SOURCE_IMAGE_ID:
|
||||
source_image_id = "sha256:" + "c" * 64
|
||||
container = _tag_drift_container()
|
||||
if mutate is not None:
|
||||
mutate(container)
|
||||
compose_model = model()
|
||||
compose_model["services"][module.SERVICE]["image"] = source_ref
|
||||
|
||||
def run(arguments, *, data=None, **_kwargs):
|
||||
if arguments[:2] == ["docker", "inspect"]:
|
||||
return json.dumps([container]).encode("utf-8")
|
||||
if arguments[:3] == ["docker", "image", "inspect"]:
|
||||
reference = arguments[-1]
|
||||
if reference == source_ref:
|
||||
if source_image_id is None:
|
||||
return b""
|
||||
return (source_image_id + "\n").encode("ascii")
|
||||
if reference == IMAGE_ID:
|
||||
return (expected_image_output + "\n").encode("ascii") if expected_image_output else b""
|
||||
return b"sha256:" + b"c" * 64 + b"\n"
|
||||
if arguments[-2:] == ["--format", "json"]:
|
||||
return json.dumps(compose_model).encode("utf-8")
|
||||
return b""
|
||||
|
||||
monkeypatch.setattr(module, "_run", run)
|
||||
return container, source_ref, source_image_id
|
||||
|
||||
|
||||
def test_observed_runner_tag_drift_proof_pins_both_rendered_models(monkeypatch):
|
||||
container, source_ref, source_image_id = _install_tag_drift_docker_fixture(monkeypatch)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
|
||||
proof = module._attest_observed_runner_tag_drift(original, container, IMAGE_ID)
|
||||
rollback = json.loads(module.rendered_model(
|
||||
original, REVISION, IMAGE_ID, source_tag_drift_proof=proof
|
||||
))
|
||||
forward = json.loads(module.rendered_model(
|
||||
original, "c" * 40, IMAGE_ID, source_tag_drift_proof=proof
|
||||
))
|
||||
|
||||
assert proof.source_reference == source_ref
|
||||
assert proof.source_image_id == source_image_id
|
||||
for rendered in (rollback, forward):
|
||||
assert rendered["services"][module.SERVICE]["image"] == IMAGE_ID
|
||||
assert rendered["services"][module.SERVICE]["pull_policy"] == "never"
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
("mutate", "source_image_id", "expected_error"),
|
||||
[
|
||||
(lambda item: item["Config"].__setitem__("Image", "wrong:tag"), None, "source_tag_drift_container_invalid"),
|
||||
(lambda item: item["Config"]["Labels"].__setitem__("com.docker.compose.project", "other"), None, "source_tag_drift_container_invalid"),
|
||||
(lambda item: item["Config"]["Labels"].__setitem__("com.docker.compose.service", "runner"), None, "source_tag_drift_container_invalid"),
|
||||
(lambda item: item["Config"]["Labels"].__setitem__("com.docker.compose.oneoff", "True"), None, "source_tag_drift_container_invalid"),
|
||||
(lambda item: item["State"].__setitem__("Running", False), None, "container_not_running"),
|
||||
(lambda item: item.__setitem__("Name", "/renamed-controller"), None, "container_image_changed"),
|
||||
(lambda item: item["Mounts"].__setitem__(0, {"Type": "bind", "Source": "/unsafe", "Destination": module.EXECUTABLE_TARGET, "RW": False}), None, "executable_mount_invalid"),
|
||||
(lambda item: item["Mounts"][1].__setitem__("RW", True), None, "config_alias_invalid"),
|
||||
(None, None, "image_reference_invalid"),
|
||||
(None, IMAGE_ID, "source_tag_drift_not_observed"),
|
||||
(None, "not-an-image-id", "image_reference_invalid"),
|
||||
],
|
||||
)
|
||||
def test_observed_runner_tag_drift_rejects_unattested_or_non_drift_cases(
|
||||
monkeypatch, mutate, source_image_id, expected_error
|
||||
):
|
||||
container, _source_ref, _observed_id = _install_tag_drift_docker_fixture(
|
||||
monkeypatch, source_image_id=source_image_id, mutate=mutate
|
||||
)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match=expected_error):
|
||||
module._attest_observed_runner_tag_drift(original, container, IMAGE_ID)
|
||||
|
||||
|
||||
def test_observed_runner_tag_drift_rejects_wrong_source_tag(monkeypatch):
|
||||
container, _source_ref, _observed_id = _install_tag_drift_docker_fixture(
|
||||
monkeypatch, source_reference="docker.gitea.com/runner-images@sha256:" + "c" * 64
|
||||
)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images@sha256:" + b"c" * 64 + b"\n"
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="source_tag_drift_reference_invalid"):
|
||||
module._attest_observed_runner_tag_drift(original, container, IMAGE_ID)
|
||||
|
||||
|
||||
def test_observed_runner_tag_drift_rejects_missing_local_expected_image(monkeypatch):
|
||||
container, _source_ref, _observed_id = _install_tag_drift_docker_fixture(
|
||||
monkeypatch, expected_image_output=""
|
||||
)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="source_tag_drift_expected_image_missing"):
|
||||
module._attest_observed_runner_tag_drift(original, container, IMAGE_ID)
|
||||
|
||||
|
||||
def test_rendered_model_rejects_altered_drift_proof(monkeypatch):
|
||||
container, _source_ref, _observed_id = _install_tag_drift_docker_fixture(monkeypatch)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
proof = module._attest_observed_runner_tag_drift(original, container, IMAGE_ID)
|
||||
altered = proof._replace(compose_sha256="0" * 64)
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="source_tag_drift_proof_invalid"):
|
||||
module.rendered_model(original, REVISION, IMAGE_ID, source_tag_drift_proof=altered)
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
("mutate", "expected_error"),
|
||||
[
|
||||
(lambda item: item.__setitem__("Id", "e" * 64), "container_changed_during_tag_drift_check"),
|
||||
(lambda item: item.__setitem__("Image", "sha256:" + "e" * 64), "container_image_changed"),
|
||||
(lambda item: item["Config"].__setitem__("Image", "other:tag"), "source_tag_drift_container_invalid"),
|
||||
(lambda item: item["Config"]["Labels"].__setitem__("com.docker.compose.project", "other"), "source_tag_drift_container_invalid"),
|
||||
(lambda item: item["Mounts"][1].__setitem__("RW", True), "config_alias_invalid"),
|
||||
(lambda item: item["Mounts"].append({"Type": "bind", "Source": "/other", "Destination": "/extra", "RW": False}), "source_tag_drift_proof_invalid"),
|
||||
(lambda item: item["Config"].__setitem__("User", "unexpected"), "source_tag_drift_proof_invalid"),
|
||||
],
|
||||
)
|
||||
def test_rendered_model_revalidates_live_container_and_mount_proof(
|
||||
monkeypatch, mutate, expected_error
|
||||
):
|
||||
container, _source_ref, _observed_id = _install_tag_drift_docker_fixture(monkeypatch)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
proof = module._attest_observed_runner_tag_drift(original, container, IMAGE_ID)
|
||||
mutate(container)
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match=expected_error):
|
||||
module.rendered_model(original, REVISION, IMAGE_ID, source_tag_drift_proof=proof)
|
||||
|
||||
|
||||
def test_rendered_model_rejects_tag_that_resolves_back_to_expected_image(monkeypatch):
|
||||
container, source_ref, _observed_id = _install_tag_drift_docker_fixture(monkeypatch)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
proof = module._attest_observed_runner_tag_drift(original, container, IMAGE_ID)
|
||||
original_run = module._run
|
||||
|
||||
def moved_tag(arguments, **kwargs):
|
||||
if arguments[:3] == ["docker", "image", "inspect"] and arguments[-1] == source_ref:
|
||||
return (IMAGE_ID + "\n").encode("ascii")
|
||||
return original_run(arguments, **kwargs)
|
||||
|
||||
monkeypatch.setattr(module, "_run", moved_tag)
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="source_tag_drift_changed"):
|
||||
module.rendered_model(original, REVISION, IMAGE_ID, source_tag_drift_proof=proof)
|
||||
|
||||
|
||||
def test_rendered_model_rejects_missing_expected_image_after_proof(monkeypatch):
|
||||
container, _source_ref, _observed_id = _install_tag_drift_docker_fixture(monkeypatch)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
proof = module._attest_observed_runner_tag_drift(original, container, IMAGE_ID)
|
||||
original_run = module._run
|
||||
|
||||
def missing_expected(arguments, **kwargs):
|
||||
if arguments[:3] == ["docker", "image", "inspect"] and arguments[-1] == IMAGE_ID:
|
||||
return b""
|
||||
return original_run(arguments, **kwargs)
|
||||
|
||||
monkeypatch.setattr(module, "_run", missing_expected)
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="source_tag_drift_expected_image_missing"):
|
||||
module.rendered_model(original, REVISION, IMAGE_ID, source_tag_drift_proof=proof)
|
||||
|
||||
|
||||
def test_rendered_model_rejects_reuse_with_changed_captured_compose_bytes(monkeypatch):
|
||||
container, _source_ref, _observed_id = _install_tag_drift_docker_fixture(monkeypatch)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
proof = module._attest_observed_runner_tag_drift(original, container, IMAGE_ID)
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="source_tag_drift_proof_invalid"):
|
||||
module.rendered_model(original + b"# changed captured source\n", REVISION,
|
||||
IMAGE_ID, source_tag_drift_proof=proof)
|
||||
|
||||
|
||||
def test_observed_runner_tag_drift_rechecks_same_container_around_image_inspection(monkeypatch):
|
||||
source_ref = "docker.gitea.com/runner-images:ubuntu-latest"
|
||||
first = _tag_drift_container()
|
||||
second = _tag_drift_container()
|
||||
second["Id"] = "e" * 64
|
||||
compose_model = model()
|
||||
compose_model["services"][module.SERVICE]["image"] = source_ref
|
||||
inspect_count = 0
|
||||
|
||||
def run(arguments, *, data=None, **_kwargs):
|
||||
nonlocal inspect_count
|
||||
if arguments[:2] == ["docker", "inspect"]:
|
||||
inspect_count += 1
|
||||
return json.dumps([first if inspect_count == 1 else second]).encode("utf-8")
|
||||
if arguments[:3] == ["docker", "image", "inspect"]:
|
||||
reference = arguments[-1]
|
||||
return (("sha256:" + "c" * 64) if reference == source_ref else IMAGE_ID).encode("ascii")
|
||||
if arguments[-2:] == ["--format", "json"]:
|
||||
return json.dumps(compose_model).encode("utf-8")
|
||||
return b""
|
||||
|
||||
monkeypatch.setattr(module, "_run", run)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="container_changed_during_tag_drift_check"):
|
||||
module._attest_observed_runner_tag_drift(original, first, IMAGE_ID)
|
||||
|
||||
|
||||
def test_observed_runner_tag_drift_rejects_mount_change_during_tag_inspection(monkeypatch):
|
||||
source_ref = "docker.gitea.com/runner-images:ubuntu-latest"
|
||||
first = _tag_drift_container()
|
||||
second = _tag_drift_container()
|
||||
second["Mounts"][1]["RW"] = True
|
||||
compose_model = model()
|
||||
compose_model["services"][module.SERVICE]["image"] = source_ref
|
||||
inspect_count = 0
|
||||
|
||||
def run(arguments, *, data=None, **_kwargs):
|
||||
nonlocal inspect_count
|
||||
if arguments[:2] == ["docker", "inspect"]:
|
||||
inspect_count += 1
|
||||
return json.dumps([first if inspect_count == 1 else second]).encode("utf-8")
|
||||
if arguments[:3] == ["docker", "image", "inspect"]:
|
||||
reference = arguments[-1]
|
||||
return (("sha256:" + "c" * 64) if reference == source_ref else IMAGE_ID).encode("ascii")
|
||||
if arguments[-2:] == ["--format", "json"]:
|
||||
return json.dumps(compose_model).encode("utf-8")
|
||||
return b""
|
||||
|
||||
monkeypatch.setattr(module, "_run", run)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="config_alias_invalid"):
|
||||
module._attest_observed_runner_tag_drift(original, first, IMAGE_ID)
|
||||
|
||||
|
||||
def test_observed_runner_tag_drift_rejects_config_change_during_tag_inspection(monkeypatch):
|
||||
source_ref = "docker.gitea.com/runner-images:ubuntu-latest"
|
||||
first = _tag_drift_container()
|
||||
second = _tag_drift_container()
|
||||
second["Config"]["User"] = "unexpected"
|
||||
compose_model = model()
|
||||
compose_model["services"][module.SERVICE]["image"] = source_ref
|
||||
inspect_count = 0
|
||||
|
||||
def run(arguments, *, data=None, **_kwargs):
|
||||
nonlocal inspect_count
|
||||
if arguments[:2] == ["docker", "inspect"]:
|
||||
inspect_count += 1
|
||||
return json.dumps([first if inspect_count == 1 else second]).encode("utf-8")
|
||||
if arguments[:3] == ["docker", "image", "inspect"]:
|
||||
reference = arguments[-1]
|
||||
return (("sha256:" + "c" * 64) if reference == source_ref else IMAGE_ID).encode("ascii")
|
||||
if arguments[-2:] == ["--format", "json"]:
|
||||
return json.dumps(compose_model).encode("utf-8")
|
||||
return b""
|
||||
|
||||
monkeypatch.setattr(module, "_run", run)
|
||||
original = b"name: gitea-deploy-runners\nservices:\n deploy-control:\n image: docker.gitea.com/runner-images:ubuntu-latest\n"
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="container_changed_during_tag_drift_check"):
|
||||
module._attest_observed_runner_tag_drift(original, first, IMAGE_ID)
|
||||
|
||||
|
||||
def test_cli_explicit_tag_drift_switch_is_accepted_only_for_prepare(monkeypatch, tmp_path):
|
||||
calls = []
|
||||
monkeypatch.setattr(sys, "argv", [
|
||||
"prepare_controller_hub_release_volume.py", "prepare",
|
||||
"--stage-root", str(tmp_path), "--source-revision", REVISION,
|
||||
"--source-tree", REVISION, "--controller-version", "2.1.13",
|
||||
"--image-id", IMAGE_ID, "--allow-observed-runner-tag-drift",
|
||||
])
|
||||
monkeypatch.setattr(
|
||||
module, "prepare_promotion",
|
||||
lambda *args, **kwargs: calls.append(kwargs) or tmp_path / "backup",
|
||||
)
|
||||
|
||||
module.main()
|
||||
|
||||
assert len(calls) == 1
|
||||
assert {key: value for key, value in calls[0].items() if key != "on_phase"} == {
|
||||
"source_revision": REVISION,
|
||||
"source_tree": REVISION,
|
||||
"controller_version": "2.1.13",
|
||||
"image_id": IMAGE_ID,
|
||||
"allow_observed_runner_tag_drift": True,
|
||||
}
|
||||
assert callable(calls[0]["on_phase"])
|
||||
|
||||
|
||||
def test_cli_rejects_tag_drift_switch_for_non_prepare_operation(monkeypatch):
|
||||
monkeypatch.setattr(sys, "argv", [
|
||||
"prepare_controller_hub_release_volume.py", "activate",
|
||||
"--backup", "/unused", "--allow-observed-runner-tag-drift",
|
||||
])
|
||||
|
||||
with pytest.raises(SystemExit, match="source_tag_recovery_operation_invalid"):
|
||||
module.main()
|
||||
|
||||
|
||||
@pytest.mark.parametrize("allow_recovery", [False, True])
|
||||
def test_promotion_image_proof_failures_precede_persistent_volume_writes(
|
||||
monkeypatch, tmp_path, allow_recovery
|
||||
):
|
||||
original = b"captured source compose with exact original bytes\n"
|
||||
current = _tag_drift_container()
|
||||
old_revision = "c" * 40
|
||||
config_tree = ({"projects.json": (b"{}", 0o600)}, {"": 0o755})
|
||||
compose_model = model()
|
||||
compose_model["services"][module.SERVICE]["image"] = "docker.gitea.com/runner-images:ubuntu-latest"
|
||||
proof = module._ObservedRunnerTagDriftProof(
|
||||
current["Id"], IMAGE_ID, module.OBSERVED_RUNNER_IMAGE_REF,
|
||||
"sha256:" + "c" * 64, module._hash(original),
|
||||
module._tag_drift_config_identity(current), (),
|
||||
)
|
||||
stage_validation = []
|
||||
writes = []
|
||||
|
||||
monkeypatch.setattr(module, "_validate_private_stage", lambda *_args: None)
|
||||
monkeypatch.setattr(module, "ensure_volume", lambda **_kwargs: None)
|
||||
monkeypatch.setattr(module, "ensure_backup_volume", lambda **_kwargs: None)
|
||||
monkeypatch.setattr(module, "_controller_image_inspect", lambda *_args, **_kwargs: current)
|
||||
monkeypatch.setattr(module, "_snapshot_attested_controller", lambda *_args: (
|
||||
{"controller-release.json": (b"captured release", 0o644)},
|
||||
{"": 0o755},
|
||||
{"sourceRevision": old_revision, "sourceTree": "d" * 40},
|
||||
))
|
||||
monkeypatch.setattr(module, "_read_root_compose", lambda: (original, 0o600))
|
||||
monkeypatch.setattr(module, "_attest_observed_runner_tag_drift", lambda *_args: proof)
|
||||
monkeypatch.setattr(module, "_validate_previous_private_tls", lambda *_args: None)
|
||||
monkeypatch.setattr(module, "_release_tree", lambda *_args: ({"deploy.py": (b"old", 0o644)}, {"": 0o755}))
|
||||
monkeypatch.setattr(module, "_config_tree", lambda *_args, **_kwargs: config_tree)
|
||||
monkeypatch.setattr(module, "_read_config_leaf", lambda: None)
|
||||
monkeypatch.setattr(module, "_prepare_merged_tree", lambda *_args: ({"deploy.py": (b"new", 0o644)}, {"": 0o755}))
|
||||
monkeypatch.setattr(module, "_validate_staged_configuration", lambda *_args: stage_validation.append(True))
|
||||
monkeypatch.setattr(module, "_mirror_snapshot_tar", lambda: b"mirror")
|
||||
monkeypatch.setattr(module, "_source_compose_model", lambda _original: (
|
||||
compose_model, compose_model["services"][module.SERVICE]
|
||||
))
|
||||
if allow_recovery:
|
||||
def invalidate_after_stage(*_args):
|
||||
assert stage_validation
|
||||
raise module.VolumeTransitionError("controller_volume_source_tag_drift_changed")
|
||||
|
||||
monkeypatch.setattr(module, "_verify_tag_drift_proof", invalidate_after_stage)
|
||||
else:
|
||||
monkeypatch.setattr(
|
||||
module, "_verify_source_compose_image",
|
||||
lambda *_args: (_ for _ in ()).throw(
|
||||
module.VolumeTransitionError("controller_volume_image_reference_changed")
|
||||
),
|
||||
)
|
||||
monkeypatch.setattr(module, "_verify_compose_image", lambda *_args: None)
|
||||
monkeypatch.setattr(module, "_install_config_tree", lambda *_args: writes.append("config"))
|
||||
monkeypatch.setattr(module, "_install_release_leaf", lambda *_args: writes.append("release"))
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError):
|
||||
module.prepare_promotion(
|
||||
tmp_path, source_revision=REVISION, source_tree="e" * 40,
|
||||
controller_version="2.1.13", image_id=IMAGE_ID,
|
||||
allow_observed_runner_tag_drift=allow_recovery,
|
||||
)
|
||||
|
||||
assert stage_validation
|
||||
assert writes == []
|
||||
|
||||
|
||||
def test_promotion_revalidates_drift_proof_immediately_before_first_volume_write(
|
||||
monkeypatch, tmp_path
|
||||
):
|
||||
original = b"captured source compose with exact original bytes\n"
|
||||
current = _tag_drift_container()
|
||||
old_revision = "c" * 40
|
||||
config_tree = ({"projects.json": (b"{}", 0o600)}, {"": 0o755})
|
||||
stage_validation = []
|
||||
proof = module._ObservedRunnerTagDriftProof(
|
||||
current["Id"], IMAGE_ID, module.OBSERVED_RUNNER_IMAGE_REF,
|
||||
"sha256:" + "c" * 64, module._hash(original),
|
||||
module._tag_drift_config_identity(current), (),
|
||||
)
|
||||
writes = []
|
||||
proof_checks = 0
|
||||
image_checks = 0
|
||||
|
||||
def source_model(_original):
|
||||
compose_model = model()
|
||||
compose_model["services"][module.SERVICE]["image"] = module.OBSERVED_RUNNER_IMAGE_REF
|
||||
return compose_model, compose_model["services"][module.SERVICE]
|
||||
|
||||
monkeypatch.setattr(module, "_validate_private_stage", lambda *_args: None)
|
||||
monkeypatch.setattr(module, "ensure_volume", lambda **_kwargs: None)
|
||||
monkeypatch.setattr(module, "ensure_backup_volume", lambda **_kwargs: None)
|
||||
monkeypatch.setattr(module, "_controller_image_inspect", lambda *_args, **_kwargs: current)
|
||||
monkeypatch.setattr(module, "_snapshot_attested_controller", lambda *_args: (
|
||||
{"controller-release.json": (b"captured release", 0o644)},
|
||||
{"": 0o755},
|
||||
{"sourceRevision": old_revision, "sourceTree": "d" * 40},
|
||||
))
|
||||
monkeypatch.setattr(module, "_read_root_compose", lambda: (original, 0o600))
|
||||
monkeypatch.setattr(module, "_attest_observed_runner_tag_drift", lambda *_args: proof)
|
||||
monkeypatch.setattr(module, "_validate_previous_private_tls", lambda *_args: None)
|
||||
monkeypatch.setattr(module, "_release_tree", lambda *_args: ({"deploy.py": (b"old", 0o644)}, {"": 0o755}))
|
||||
monkeypatch.setattr(module, "_config_tree", lambda *_args, **_kwargs: config_tree)
|
||||
monkeypatch.setattr(module, "_read_config_leaf", lambda: config_tree)
|
||||
monkeypatch.setattr(module, "_prepare_merged_tree", lambda *_args: ({"deploy.py": (b"new", 0o644)}, {"": 0o755}))
|
||||
monkeypatch.setattr(module, "_validate_staged_configuration", lambda *_args: stage_validation.append(True))
|
||||
monkeypatch.setattr(module, "_mirror_snapshot_tar", lambda: b"mirror")
|
||||
monkeypatch.setattr(module, "_source_compose_model", source_model)
|
||||
monkeypatch.setattr(module, "_compose", lambda *_args, **_kwargs: b"")
|
||||
|
||||
def verify_tag_proof(*_args):
|
||||
nonlocal proof_checks
|
||||
proof_checks += 1
|
||||
assert stage_validation
|
||||
if proof_checks == 4:
|
||||
raise module.VolumeTransitionError("controller_volume_source_tag_drift_changed")
|
||||
|
||||
def verify_image(*_args):
|
||||
nonlocal image_checks
|
||||
image_checks += 1
|
||||
|
||||
monkeypatch.setattr(module, "_verify_tag_drift_proof", verify_tag_proof)
|
||||
monkeypatch.setattr(module, "_verify_compose_image", verify_image)
|
||||
monkeypatch.setattr(module, "_install_config_tree", lambda *_args: writes.append("config"))
|
||||
monkeypatch.setattr(module, "_install_release_leaf", lambda *_args: writes.append("release"))
|
||||
|
||||
with pytest.raises(module.VolumeTransitionError, match="source_tag_drift_changed"):
|
||||
module.prepare_promotion(
|
||||
tmp_path, source_revision=REVISION, source_tree="e" * 40,
|
||||
controller_version="2.1.13", image_id=IMAGE_ID,
|
||||
allow_observed_runner_tag_drift=True,
|
||||
)
|
||||
|
||||
assert proof_checks == 4
|
||||
assert image_checks == 2
|
||||
assert writes == []
|
||||
|
||||
def test_config_snapshot_has_exact_allowlist_and_broker_token():
|
||||
entries = {
|
||||
"projects.json": (b"{}", 0o600),
|
||||
|
||||
Reference in new issue
Block a user