106 lines
8.0 KiB
Python
106 lines
8.0 KiB
Python
#!/usr/bin/env python3
|
|
"""Prepared Fleet UI-only guard. Do not invoke deploy until backend qualification and live acceptance are complete."""
|
|
import hashlib,json,os,pathlib,shutil,shlex,subprocess,sys,tarfile,tempfile,time,urllib.request
|
|
P=pathlib.Path
|
|
mode, expected_host, receipt_path = sys.argv[1:4]
|
|
assert expected_host in ('archi-dev-box','yaya-server')
|
|
assert subprocess.check_output(['hostname'],text=True).strip()==expected_host
|
|
web=P('/opt/archipelago/web-ui');data=P('/var/lib/archipelago')
|
|
def digest(path):
|
|
with open(path,'rb') as f:return hashlib.file_digest(f,'sha256').hexdigest()
|
|
def run(*args):subprocess.run(args,check=True,stdout=subprocess.DEVNULL)
|
|
def inventory():
|
|
ids=subprocess.check_output(['podman','ps','-aq'],text=True).split()
|
|
rows=json.loads(subprocess.check_output(['podman','inspect',*ids])) if ids else []
|
|
return {c['Name']:{'id':c['Id'],'started_at':c['State']['StartedAt'],'status':c['State']['Status'],'running':c['State']['Running']} for c in rows}
|
|
def preservation():
|
|
names=[data/'remember_secret',data/'user-stopped.json',data/'user-uninstalled.json',data/'app-catalog.json',data/'node-app-catalog.json',data/'installed-apps.json']
|
|
for root in (data,web,data/'catalogs',data/'content',data/'qualification'):
|
|
if root.is_dir():names.extend(p for p in root.glob('*catalog*') if p.is_file())
|
|
for root in (web/'packages',web/'aiui',web/'catalogs',data/'identity'):
|
|
if root.is_dir():names.extend(p for p in root.rglob('*') if p.is_file())
|
|
return {str(p):digest(p) if p.is_file() else None for p in set(names)}
|
|
def manager():
|
|
def prop(name):return subprocess.check_output(['systemctl','show','archipelago','--value','-p',name],text=True).strip()
|
|
return {'pid':prop('MainPID'),'active_state':prop('ActiveState'),'sub_state':prop('SubState'),'started_at':prop('ExecMainStartTimestamp')}
|
|
def running_digest():
|
|
path='/proc/'+manager()['pid']+'/exe'
|
|
try:return digest(path)
|
|
except PermissionError:return subprocess.check_output(['sudo','-n','sha256sum',path],text=True).split()[0]
|
|
assert mode=='deploy' and len(sys.argv)==7, 'Use separate read-only preflight helper; deployment requires backend gate receipt'
|
|
before=json.loads(P(receipt_path).read_text());qualification=json.loads(P(sys.argv[4]).read_text());archive=P(sys.argv[5]);backend=json.loads(P(sys.argv[6]).read_text())
|
|
assert before['host']==expected_host
|
|
assert qualification['baseline_tests_passed']==1459 and qualification['baseline_test_files_passed']==177
|
|
assert qualification['delta_focused_tests_passed']==31 and qualification['delta_app_typecheck_passed']
|
|
assert qualification['production_build_passed'] and qualification['source_inputs_unchanged']
|
|
assert qualification['archive_sha256']=='063752912fdcae2d1abf2abaccd53bfad39acce23c9a5d896ce52ba1e1996080'
|
|
assert backend['host']==expected_host and backend['isolated_failed']==0 and backend['isolated_passed']>2006
|
|
assert backend['production_build_passed'] and backend['source_inputs_unchanged']
|
|
assert backend['test_source_manifest_sha256']==backend['build_source_manifest_sha256']
|
|
assert len(backend['test_source_manifest_sha256'])==64
|
|
required_tests={'unsigned_and_legacy_reports_cannot_assign_their_own_trust','collector_cannot_claim_another_record_identity_or_malformed_id','collector_history_suffix_cannot_overwrite_another_nodes_history','fleet_reads_do_not_promote_old_collector_spoofs_or_history'}
|
|
assert required_tests.issubset(set(backend['fleet_provenance_tests_passed']))
|
|
assert backend['contains_collector_provenance'] and backend['fleet_contract_readonly_checks_passed']
|
|
assert backend['deployment_preservation_passed'] and backend['embedded_helpers_match']
|
|
assert backend['running_sha256']==backend['binary_sha256']==before['backend_sha256']==before['running_backend_sha256']==running_digest()
|
|
assert backend['binary_sha256']!='7b85bb0135743200620963ae836867175283d57b6a8534fee2a19b72c3ce77c3', 'Old live backend is not qualified for Fleet labels'
|
|
assert manager()==before['manager'], 'Manager changed after fresh post-backend preflight'
|
|
assert digest(archive)==qualification['archive_sha256']
|
|
assert digest(web/'index.html')==before['index_sha256'],'Dashboard changed after preflight'
|
|
assert digest('/usr/local/bin/archipelago')==before['backend_sha256'],'Backend changed after preflight'
|
|
assert preservation()==before['preserved'],'Catalog or stopped/uninstalled intent changed after preflight'
|
|
assert inventory()==before['containers'],'Container changed after preflight'
|
|
backup=data/'support'/('fleet-ui-'+time.strftime('%Y%m%dT%H%M%SZ',time.gmtime())+'-'+str(os.getpid()))
|
|
run('sudo','-n','install','-d','-m','700',str(backup))
|
|
run('sudo','-n','tar','--exclude=./aiui','--exclude=./packages','-czf',str(backup/'web-ui.tar.gz'),'-C',str(web),'.')
|
|
rollback_args=['tar','--exclude=./packages','--exclude=./aiui','--exclude=./catalogs']
|
|
rollback_args.extend('--exclude=./'+p.name for p in web.glob('*catalog*'))
|
|
rollback_args.extend(['-xzf',str(backup/'web-ui.tar.gz'),'-C',str(web)])
|
|
rollback='#!/bin/sh\nset -eu\n'+shlex.join(rollback_args)+'\n'
|
|
subprocess.run(['sudo','-n','tee',str(backup/'rollback.sh')],input=rollback.encode(),check=True,stdout=subprocess.DEVNULL)
|
|
run('sudo','-n','chmod','700',str(backup/'rollback.sh'))
|
|
staging=P(tempfile.mkdtemp(prefix='archy-fleet-ui-',dir='/var/tmp'));source=staging/'dist'
|
|
try:
|
|
with tarfile.open(archive) as tar:
|
|
for member in tar.getmembers():
|
|
path=P(member.name)
|
|
assert not path.is_absolute() and '..' not in path.parts and path.parts[0]=='dist'
|
|
assert member.isfile() or member.isdir()
|
|
tar.extractall(staging,filter='data')
|
|
assert digest(source/'index.html')==qualification['index_sha256']
|
|
# Keep node-specific catalogs and existing standard/versioned package downloads.
|
|
copy_code="""import pathlib,shutil,sys
|
|
s=pathlib.Path(sys.argv[1]);d=pathlib.Path('/opt/archipelago/web-ui')
|
|
for p in s.rglob('*'):
|
|
r=p.relative_to(s)
|
|
if r.parts[0] in ('aiui','packages','catalogs') or (len(r.parts)==1 and 'catalog' in p.name):continue
|
|
if p.is_dir():(d/r).mkdir(parents=True,exist_ok=True)
|
|
elif not (p.parent==s and p.name in ('index.html','sw.js','registerSW.js')):shutil.copy2(p,d/r)
|
|
"""
|
|
run('sudo','-n','python3','-c',copy_code,str(source))
|
|
for name in ('registerSW.js','sw.js','index.html'):
|
|
if (source/name).exists():
|
|
target=str(web/name)
|
|
run('sudo','-n','install','-m','644',str(source/name),target+'.next')
|
|
run('sudo','-n','mv',target+'.next',target)
|
|
assert digest('/usr/local/bin/archipelago')==before['backend_sha256']
|
|
assert preservation()==before['preserved'],'Catalog/session/intent preservation check failed'
|
|
assert inventory()==before['containers'],'Container preservation check failed'
|
|
assert manager()==before['manager'] and running_digest()==backend['binary_sha256']
|
|
with urllib.request.urlopen('http://127.0.0.1/',timeout=30) as response:served=hashlib.file_digest(response,'sha256').hexdigest()
|
|
assert served==qualification['index_sha256']
|
|
with urllib.request.urlopen('http://127.0.0.1:5678/health',timeout=15) as response:assert response.status==200
|
|
time.sleep(15)
|
|
assert digest('/usr/local/bin/archipelago')==before['backend_sha256']
|
|
assert preservation()==before['preserved'],'Delayed catalog/session/intent/package/aiui check failed'
|
|
assert inventory()==before['containers'],'Delayed container preservation check failed'
|
|
assert manager()==before['manager'] and running_digest()==backend['binary_sha256']
|
|
print(json.dumps({'host':expected_host,'deployed':True,'index_sha256':served,'backend_unchanged':True,
|
|
'catalog_session_intents_packages_aiui_preserved':True,'delayed_stability_seconds':15,'containers_unchanged':True,'rollback':str(backup/'rollback.sh')}))
|
|
except BaseException:
|
|
run('sudo','-n',str(backup/'rollback.sh'))
|
|
assert digest(web/'index.html')==before['index_sha256'],'Rollback index mismatch'
|
|
print(json.dumps({'host':expected_host,'deployed':False,'rolled_back':True,'restored_index_sha256':digest(web/'index.html')}))
|
|
raise
|
|
finally:shutil.rmtree(staging)
|