133 lines
7.5 KiB
Bash
133 lines
7.5 KiB
Bash
#!/usr/bin/env bash
|
||
# 更新器从镜像仓库取签名清单的测试：用一个假的 podman（只实现 pull 和 image inspect）和真的 openssl，
|
||
# 不需要容器引擎、网络或 root。运行：bash packaging/update/tests/feed-test.sh
|
||
# 覆盖：正常取到、仓库里的清单被篡改、用别的密钥签的、旧的 seq、换钥（next_key）、仓库不可用时回退到信箱、FEED=off。
|
||
set -eu
|
||
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||
ROOT="$(cd "$HERE/../../.." && pwd)"
|
||
T="$(mktemp -d)"
|
||
trap 'rm -rf "$T"' EXIT
|
||
mkdir -p "$T/bin" "$T/feed" "$T/data/update" "$T/state" "$T/conf"
|
||
fail=0
|
||
|
||
# 假的 flock 和 podman：feed 目录下有 <引用>/labels 文件（"manifest_b64|signature"）就算拉得到
|
||
printf '#!/bin/sh\nexit 0\n' > "$T/bin/flock"
|
||
cat > "$T/bin/podman" <<'STUB'
|
||
#!/bin/sh
|
||
dir="$FAKE_FEED"
|
||
case "$1" in
|
||
pull) for last; do :; done; key="$(printf '%s' "$last" | tr '/:@' '___')"; [ -f "$dir/$key" ] ;;
|
||
image) for last; do :; done; key="$(printf '%s' "$last" | tr '/:@' '___')"; cat "$dir/$key" ;;
|
||
*) exit 1 ;;
|
||
esac
|
||
STUB
|
||
chmod +x "$T/bin/flock" "$T/bin/podman"
|
||
export PATH="$T/bin:$PATH" FAKE_FEED="$T/feed" MOSHIRO_UPDATE_CONF_DIR="$T/conf"
|
||
|
||
for k in a b c; do
|
||
openssl ecparam -name prime256v1 -genkey -noout -out "$T/$k.pem" 2>/dev/null
|
||
openssl ec -in "$T/$k.pem" -pubout -out "$T/$k.pub" 2>/dev/null
|
||
done
|
||
REPO=registry.example/moshiro-dev/moshiro-agent
|
||
REF_KEY="$(printf '%s' "$REPO-manifest:dev" | tr '/:@' '___')"
|
||
cat > "$T/conf/agent.conf" <<EOF
|
||
DATA_DIR=$T/data
|
||
IMAGE_REPO=$REPO
|
||
UNIT=x
|
||
PUBKEY=$T/a.pub
|
||
ENV_FILE=$T/env
|
||
STATE_DIR=$T/state
|
||
POLICY=manual
|
||
ENGINE=podman
|
||
EOF
|
||
DIGEST="sha256:$(printf 'a%.0s' $(seq 64))"
|
||
|
||
# publish <签名私钥> <seq> [next 公钥]：写出仓库里的清单标签，和 CI 的 release-manifest.sh + publish-manifest.sh 产出同样的格式
|
||
publish() {
|
||
local next=""
|
||
if [ -n "${3:-}" ]; then next=",\"next_key\":\"$(openssl pkey -pubin -in "$3" -outform DER | base64 -w0)\""; fi
|
||
printf '{"schema":1,"component":"agent","channel":"dev","image":"%s","digest":"%s","tag":"dev-%s","version":"0.2.0","commit":"x","built_at":"t","seq":%s%s}' "$REPO" "$DIGEST" "$2" "$2" "$next" > "$T/m.json"
|
||
openssl dgst -sha256 -sign "$1" -out "$T/s.bin" "$T/m.json"
|
||
printf '%s|%s' "$(base64 -w0 "$T/m.json")" "$(base64 -w0 "$T/s.bin")" > "$T/feed/$REF_KEY"
|
||
}
|
||
status() { sed -n 's/.*"state":"\([^"]*\)".*"error":"\([^"]*\)".*/\1|\2/p' "$T/data/update-status/status.json"; }
|
||
check() { sh "$ROOT/packaging/update/moshiro-update.sh" check agent >/dev/null 2>&1 || true; status; }
|
||
expect() { # 名称 期望的状态前缀 实际
|
||
if [[ "$3" == "$2"* ]]; then echo "ok $1 ($3)"; else echo "FAIL $1: expected $2*, got '$3'"; fail=1; fi
|
||
}
|
||
|
||
publish "$T/a.pem" 10
|
||
expect "valid manifest from the registry" "available|" "$(check)"
|
||
|
||
publish "$T/a.pem" 10; sed -i 's/^\(.\{40\}\)./\1X/' "$T/feed/$REF_KEY"
|
||
expect "tampered manifest is rejected, not ignored" "invalid|" "$(check)"
|
||
|
||
publish "$T/c.pem" 11
|
||
expect "manifest signed by another key" "invalid|signature check failed" "$(check)"
|
||
|
||
printf '%s' "$DIGEST" > "$T/state/agent.installed.tmp"; printf '99999\n%s\n' "$DIGEST" > "$T/state/agent.installed"
|
||
publish "$T/a.pem" 12
|
||
expect "stale seq is just up to date" "up_to_date|" "$(check)"
|
||
rm -f "$T/state/agent.installed"
|
||
|
||
publish "$T/a.pem" 20 "$T/b.pub"
|
||
expect "manifest carrying next_key" "available|" "$(check)"
|
||
publish "$T/a.pem" 21
|
||
expect "old key no longer accepted after rotation" "invalid|signature check failed" "$(check)"
|
||
publish "$T/b.pem" 22
|
||
expect "new key accepted" "available|" "$(check)"
|
||
|
||
rm -f "$T/feed/$REF_KEY"
|
||
expect "registry unavailable and empty mailbox" "up_to_date|" "$(check)"
|
||
|
||
# 信箱回退：仓库不可用，面板放进信箱的清单照样能用（用新钥签）
|
||
printf '{"schema":1,"component":"agent","channel":"dev","image":"%s","digest":"%s","tag":"dev-30","version":"0.2.0","commit":"x","built_at":"t","seq":30}' "$REPO" "$DIGEST" > "$T/data/update/offer.manifest"
|
||
openssl dgst -sha256 -sign "$T/b.pem" -out "$T/s.bin" "$T/data/update/offer.manifest"
|
||
base64 -w0 "$T/s.bin" > "$T/data/update/offer.sig"
|
||
expect "mailbox still works without the registry" "available|" "$(check)"
|
||
|
||
# FEED=off：仓库里有更新的清单也不看
|
||
publish "$T/b.pem" 40
|
||
echo "FEED=off" >> "$T/conf/agent.conf"
|
||
out="$(check)"
|
||
if grep -q '"seq":40' "$T/data/update-status/status.json"; then echo "FAIL FEED=off still read the registry"; fail=1; else echo "ok FEED=off ignores the registry ($out)"; fi
|
||
|
||
# --- deploy-node.sh 的首次安装：从仓库取清单、用随脚本带的发布公钥验签，再按清单里的 digest 固定镜像
|
||
mkdir -p "$T/pkg/update"
|
||
cp "$T/b.pub" "$T/pkg/update/release-key.pub.pem"
|
||
sed -n '/^pull_quiet() {/,/^if \[ -z "\$IMAGE" \]; then/p' "$ROOT/packaging/container/deploy-node.sh" | sed '$d' > "$T/resolve.sh"
|
||
resolve() { # 签名私钥 组件 镜像仓库
|
||
rm -f "$T/feed"/*
|
||
printf '{"schema":1,"component":"%s","channel":"dev","image":"%s","digest":"%s","tag":"dev-1","version":"0.2.0","commit":"x","built_at":"t","seq":1}' "$2" "$3" "$DIGEST" > "$T/m.json"
|
||
openssl dgst -sha256 -sign "$1" -out "$T/s.bin" "$T/m.json"
|
||
printf '%s|%s' "$(base64 -w0 "$T/m.json")" "$(base64 -w0 "$T/s.bin")" > "$T/feed/$(printf '%s' "$REPO-manifest:dev" | tr '/:@' '___')"
|
||
: > "$T/feed/$(printf '%s' "$REPO@$DIGEST" | tr '/:@' '___')"
|
||
( ENGINE=podman AUTHFILE="" REPO="$REPO" CHANNEL="" ROLE=agent PACKAGING="$T/pkg" IMAGE=""
|
||
. "$T/resolve.sh"
|
||
resolve_verified >/dev/null 2>&1 && printf '%s' "$IMAGE" || printf 'REFUSED' )
|
||
}
|
||
expect "first install: signed manifest pins the digest" "$REPO@$DIGEST" "$(resolve "$T/b.pem" agent "$REPO")"
|
||
expect "first install: wrong signing key is refused" "REFUSED" "$(resolve "$T/c.pem" agent "$REPO")"
|
||
expect "first install: manifest for another component is refused" "REFUSED" "$(resolve "$T/b.pem" probe "$REPO")"
|
||
expect "first install: manifest naming another repository is refused" "REFUSED" "$(resolve "$T/b.pem" agent "registry.evil/moshiro-dev/moshiro-agent")"
|
||
|
||
# --- 第一次部署：正在跑的镜像就是清单里的这个 digest → 记成已安装（不当作有更新），并把验过的清单交给节点握手时带上
|
||
sed -i '/^FEED=off/d' "$T/conf/agent.conf"
|
||
rm -f "$T/state/agent.installed" "$T/state/agent.installed.manifest" "$T/state/agent.installed.sig" "$T/data/update-status/installed."* "$T/data/update/offer."*
|
||
printf 'IMAGE=%s@%s\n' "$REPO" "$DIGEST" > "$T/env"
|
||
publish "$T/b.pem" 50
|
||
expect "first deploy: the running image is already up to date" "up_to_date|" "$(check)"
|
||
if [ "$(sed -n 2p "$T/state/agent.installed" 2>/dev/null)" = "$DIGEST" ]; then echo "ok first deploy: install record seeded from the running image"; else echo "FAIL first deploy: no install record"; fail=1; fi
|
||
label="$(cat "$T/feed/$REF_KEY")"
|
||
if [ "$(cat "$T/data/update-status/installed.manifest" 2>/dev/null | base64 -w0)" = "${label%%|*}" ] && [ "$(cat "$T/data/update-status/installed.sig" 2>/dev/null)" = "${label#*|}" ]; then
|
||
echo "ok the verified manifest is left for the node to present at its handshake"
|
||
else
|
||
echo "FAIL installed.manifest / installed.sig missing or different"; fail=1
|
||
fi
|
||
# 老版本的更新器没写过：同一份（seq 相同）下次检查补上
|
||
rm -f "$T/data/update-status/installed."* "$T/state/agent.installed.manifest" "$T/state/agent.installed.sig"
|
||
expect "already installed: still up to date" "up_to_date|" "$(check)"
|
||
if [ -s "$T/data/update-status/installed.manifest" ] && [ -s "$T/data/update-status/installed.sig" ]; then echo "ok a missing copy is written again for the node"; else echo "FAIL the copy was not written again"; fail=1; fi
|
||
|
||
exit "$fail"
|