82 lines
3.8 KiB
Bash
Executable File
82 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Opt-in 2GiB contract qualification. Disposable storage, bounded constant-memory
|
|
# payload, network-none, synthetic keys. Never starts or modifies an installed app.
|
|
set -euo pipefail
|
|
repo=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
|
|
image=${BLOSSOM_FIXTURE_IMAGE:?Set full immutable candidate image ID}
|
|
[[ $image =~ ^(sha256:)?[a-f0-9]{64}$ ]] || exit 2
|
|
name="archy-blossom-upload-$(date +%s)-$$"
|
|
volume="$name-data"
|
|
work=$(mktemp -d)
|
|
owned=0
|
|
volume_owned=0
|
|
cleanup() {
|
|
if ((owned)); then podman rm -f --volumes "$name-key" "$name" >/dev/null 2>&1 || true; fi
|
|
if ((volume_owned)); then podman volume rm "$volume" >/dev/null 2>&1 || true; fi
|
|
rm -rf -- "$work"
|
|
}
|
|
trap cleanup EXIT
|
|
trap 'exit 130' INT
|
|
trap 'exit 143' TERM
|
|
podman image exists "$image"
|
|
[[ $(podman image inspect --format '{{.Config.User}}' "$image") == '1000:1000' ]]
|
|
entrypoint=$(podman image inspect --format '{{json .Config.Entrypoint}}' "$image")
|
|
[[ $entrypoint == *'--cached-only'*'--frozen'*'--deny-run'* ]]
|
|
! podman container exists "$name"
|
|
! podman container exists "$name-key"
|
|
! podman volume exists "$volume"
|
|
# Refuse a known-insufficient filesystem before allocating disposable 2GiB data.
|
|
graph=$(podman info --format '{{.Store.GraphRoot}}')
|
|
python3 - "$graph" <<'PY'
|
|
import shutil,sys
|
|
assert shutil.disk_usage(sys.argv[1]).free > 5*1024**3, 'Need >5GiB free for disposable size qualification'
|
|
PY
|
|
owned=1
|
|
printf '{}\n' > "$work/config.json"
|
|
printf 'window.nostr = { syntheticFixtureOnly: true };\n' > "$work/nostr-provider.js"
|
|
common=(--pull=never --image-volume=ignore --network=none --read-only --cap-drop=all --security-opt=no-new-privileges --cpus=1 --memory=512m --memory-swap=512m --pids-limit=128 --timeout=600 --http-proxy=false --tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m)
|
|
pubkey=$(podman run --rm --name "$name-key" "${common[@]}" --entrypoint deno "$image" eval --cached-only --frozen 'import {getPublicKey} from "nostr-tools"; console.log(getPublicKey(new Uint8Array(32).fill(1)))')
|
|
[[ $pubkey =~ ^[a-f0-9]{64}$ ]]
|
|
podman volume create "$volume" >/dev/null
|
|
volume_owned=1
|
|
start() {
|
|
local env_args=()
|
|
if [[ $1 == large ]]; then env_args+=(--env ARCHY_BLOSSOM_MAX_UPLOAD_BYTES=2147483648); fi
|
|
podman run -d --name "$name" "${common[@]}" "${env_args[@]}" \
|
|
--volume "$volume:/data:U" --volume "$work/config.json:/config/config.json:ro" \
|
|
--volume "$work/nostr-provider.js:/bridge/nostr-provider.js:ro" \
|
|
--volume "$repo/tests/apps/blossom/protocol.ts:/app/archy-protocol-test.ts:ro" \
|
|
--volume "$repo/tests/apps/blossom/upload-size.ts:/app/archy-upload-size.ts:ro" \
|
|
--env "ARCHY_BLOSSOM_PUBKEYS=$pubkey" "$image" >/dev/null
|
|
for _ in $(seq 1 80); do
|
|
if podman exec "$name" deno eval --cached-only --frozen 'const r=await fetch("http://127.0.0.1:3000/healthz");if(!r.ok)Deno.exit(1)' >/dev/null 2>&1; then return; fi
|
|
sleep 0.25
|
|
done
|
|
podman logs "$name" >&2; return 1
|
|
}
|
|
phase() {
|
|
podman exec --env "BLOSSOM_FIXTURE_PHASE=$1" "$name" deno run --cached-only --frozen --allow-env=BLOSSOM_FIXTURE_PHASE --allow-net=127.0.0.1 /app/archy-protocol-test.ts
|
|
}
|
|
size_phase() {
|
|
podman exec --env "BLOSSOM_SIZE_PHASE=$1" "$name" deno run --cached-only --frozen --allow-env=BLOSSOM_SIZE_PHASE --allow-net=127.0.0.1 /app/archy-upload-size.ts
|
|
}
|
|
peak() {
|
|
podman exec "$name" sh -c 'for f in memory.peak memory.events memory.max memory.swap.max; do printf "%s: " "$f"; test ! -r /sys/fs/cgroup/$f || cat /sys/fs/cgroup/$f; done'
|
|
}
|
|
start default
|
|
phase seed
|
|
size_phase default
|
|
podman rm -f --volumes "$name" >/dev/null
|
|
start default
|
|
phase verify
|
|
phase cleanup
|
|
podman rm -f --volumes "$name" >/dev/null
|
|
start large
|
|
size_phase seed
|
|
peak
|
|
podman rm -f --volumes "$name" >/dev/null
|
|
start large
|
|
size_phase verify-cleanup
|
|
peak
|
|
echo 'PASS bounded default/explicit 2GiB package contract and retained bytes; no manager/native/mobile/physical/deployment acceptance'
|