40 lines
2.1 KiB
Bash
40 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
|
# Invoke inside the same resource-limited durable systemd job as native fixtures.
|
|
set -euo pipefail
|
|
ROOT=$(git rev-parse --show-toplevel)
|
|
PRIOR=${1:?native fixture receipt}
|
|
REPORT=${2:?fresh receipt directory}
|
|
IMAGE=${3:?pinned existing NTS principal image}
|
|
NAME=${4:?unique fixture container}
|
|
[[ "$NAME" =~ ^qualification-c01-nts-[a-z0-9-]+$ && "$REPORT" = /* && ! -e "$REPORT" ]]
|
|
exec 9>/tmp/opencode/release-heavy.lock
|
|
flock 9
|
|
python3 -B "$ROOT/scripts/tests/package_c01_nts_fixture.py" "$ROOT" "$PRIOR" "$REPORT"
|
|
cleanup() {
|
|
status=$?
|
|
trap - EXIT
|
|
if podman container exists "$NAME"; then
|
|
podman cp "$NAME:/opt/c01-nts" "$REPORT/evidence" || true
|
|
podman inspect "$NAME" > "$REPORT/container.json" || true
|
|
podman stop --time 10 "$NAME" > "$REPORT/stop.log" 2>&1 || true
|
|
fi
|
|
printf '%s\n' "$status" > "$REPORT/exit-code.txt"
|
|
exit "$status"
|
|
}
|
|
trap cleanup EXIT
|
|
hosts=()
|
|
while read -r name address; do hosts+=(--add-host "$name:$address"); done < <(
|
|
python3 -c 'import json,sys; x=json.load(open(sys.argv[1])); [print(n,a) for n,v in x["addresses"].items() for a in v]' "$REPORT/source.json")
|
|
CONTAINERS_CONF_OVERRIDE="$REPORT/containers.conf" podman run --detach --pull=never --name "$NAME" --hostname c01-nts-composed \
|
|
--network=pasta --http-proxy=false --cap-drop=ALL --cap-add=CHOWN,DAC_OVERRIDE,FOWNER,SETUID,SETGID,SYS_PTRACE,NET_BIND_SERVICE,KILL,NET_ADMIN \
|
|
--security-opt=no-new-privileges --cpus=2 --memory=8g --memory-swap=8g --pids-limit=128 \
|
|
--tmpfs=/run:rw,size=32m,mode=755 --tmpfs=/tmp:rw,size=32m "${hosts[@]}" \
|
|
--entrypoint=/usr/bin/sleep "$IMAGE" infinity > "$REPORT/container-id.txt"
|
|
podman exec "$NAME" mkdir /opt/c01-nts
|
|
podman cp "$PRIOR/normal-native.tar" "$NAME:/opt/c01-nts/native.tar"
|
|
for file in dependencies.tar probe.py c01_nts.py egress.nft; do podman cp "$REPORT/$file" "$NAME:/opt/c01-nts/$file"; done
|
|
podman exec "$NAME" tar -xf /opt/c01-nts/native.tar -C /
|
|
podman exec "$NAME" tar -xf /opt/c01-nts/dependencies.tar -C /
|
|
podman exec "$NAME" chown -R root:root /opt/c01-nts
|
|
podman exec "$NAME" python3 -B /opt/c01-nts/probe.py > "$REPORT/probe.log" 2>&1
|