64 lines
3.0 KiB
Bash
Executable File
64 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Parent-side packaged fixture. Synthetic key/data only; never contacts a relay.
|
|
set -euo pipefail
|
|
|
|
repo=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
|
|
image=${BLOSSOM_FIXTURE_IMAGE:-localhost/archipelago-blossom:6.4.1-archy.4}
|
|
name="archy-blossom-fixture-$$"
|
|
volume="${name}-data"
|
|
work=$(mktemp -d)
|
|
cleanup() {
|
|
podman rm -f "$name-key" >/dev/null 2>&1 || true
|
|
podman rm -f "$name" >/dev/null 2>&1 || true
|
|
podman volume rm -f "$volume" >/dev/null 2>&1 || true
|
|
rm -rf -- "$work"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
command -v podman >/dev/null
|
|
grep -Fq 'ghcr.io/denoland/deno:debian-2.9.7@sha256:fa335acdf6b72106eda2cb6a8cb5f4187e7630e357467489db4b2e7352d5e432' "$repo/docker/blossom/Dockerfile"
|
|
podman image exists "$image"
|
|
user=$(podman image inspect --format '{{.Config.User}}' "$image")
|
|
test "$user" = '1000:1000' || { echo 'Blossom package must explicitly run as UID/GID 1000' >&2; exit 1; }
|
|
entrypoint=$(podman image inspect --format '{{json .Config.Entrypoint}}' "$image")
|
|
case "$entrypoint" in *'--cached-only'*'--frozen'*'--deny-run'*) ;; *) echo "unexpected Blossom entrypoint: $entrypoint" >&2; exit 1;; esac
|
|
|
|
printf '{}\n' >"$work/config.json"
|
|
printf '%s\n' 'window.nostr = { syntheticFixtureOnly: true };' >"$work/nostr-provider.js"
|
|
pubkey=$(podman run --rm --name "$name-key" --network none --cpus 1 --memory 256m --pids-limit 128 \
|
|
--cap-drop all --security-opt no-new-privileges --read-only --tmpfs /tmp:rw,nosuid,nodev,size=32m --entrypoint deno "$image" eval --cached-only --frozen \
|
|
'import {getPublicKey} from "nostr-tools"; console.log(getPublicKey(new Uint8Array(32).fill(1)))')
|
|
[[ "$pubkey" =~ ^[a-f0-9]{64}$ ]]
|
|
podman volume create "$volume" >/dev/null
|
|
|
|
start() {
|
|
podman run -d --name "$name" --network none --cpus 1 --memory 512m --pids-limit 256 \
|
|
--cap-drop all --security-opt no-new-privileges --read-only \
|
|
--tmpfs /tmp:rw,noexec,nosuid,size=64m \
|
|
--volume "$volume:/data:U" \
|
|
--volume "$work/config.json:/config/config.json:ro,Z" \
|
|
--volume "$work/nostr-provider.js:/bridge/nostr-provider.js:ro,Z" \
|
|
--volume "$repo/tests/apps/blossom/protocol.ts:/app/archy-protocol-test.ts:ro,Z" \
|
|
--env "ARCHY_BLOSSOM_PUBKEYS=$pubkey" "$image" >/dev/null
|
|
for _ in $(seq 1 50); do
|
|
if podman exec "$name" deno eval 'const r=await fetch("http://127.0.0.1:3000/healthz");if(!r.ok)Deno.exit(1)' >/dev/null 2>&1; then return; fi
|
|
sleep 0.2
|
|
done
|
|
podman logs "$name" >&2
|
|
return 1
|
|
}
|
|
phase() {
|
|
podman exec --env "BLOSSOM_FIXTURE_PHASE=$1" "$name" \
|
|
deno run --cached-only --frozen --allow-env=BLOSSOM_FIXTURE_PHASE --allow-net=127.0.0.1 /app/archy-protocol-test.ts
|
|
}
|
|
|
|
start
|
|
phase seed
|
|
podman rm -f "$name" >/dev/null
|
|
start
|
|
phase verify
|
|
phase cleanup
|
|
podman exec "$name" sh -eu -c \
|
|
'grep -Fq "const pruneEnabled = false;" /app/main.ts; grep -Fq "if (pruneEnabled)" /app/main.ts; ! grep -Fq "const pruneEnabled = config.storage.rules" /app/main.ts'
|
|
echo 'PASS disposable Blossom package: exact pin/user/entrypoint, auth negatives, restart retention, explicit cleanup, prune disabled'
|