chore: prepare repository for public launch
This commit is contained in:
Dorian
+201
-103
@@ -1,25 +1,26 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# validate-app-manifest.sh — Validate a community-submitted app manifest
|
||||
# validate-app-manifest.sh - validate an Archipelago app manifest.
|
||||
#
|
||||
# Usage: ./scripts/validate-app-manifest.sh <manifest.yml>
|
||||
# Usage:
|
||||
# ./scripts/validate-app-manifest.sh [--repo-audit] apps/my-app/manifest.yml
|
||||
#
|
||||
# Checks:
|
||||
# 1. Valid YAML syntax
|
||||
# 2. Required fields present (id, title, version, image, description)
|
||||
# 3. Image from trusted registry (docker.io, ghcr.io, quay.io)
|
||||
# 4. No :latest tag (must pin specific version)
|
||||
# 5. Resource limits specified (memory, cpu)
|
||||
# 6. Security: no privileged mode, no host networking
|
||||
# 7. No hardcoded secrets/passwords in environment
|
||||
# 8. Port conflicts with existing apps
|
||||
#
|
||||
# Exit 0 = valid, Exit 1 = issues found
|
||||
# This intentionally mirrors the public app contract documented in
|
||||
# docs/app-manifest-spec.md: manifests have a top-level `app:` block and are
|
||||
# ultimately validated by the Rust parser in core/container/src/manifest.rs.
|
||||
# This script is the contributor-friendly preflight; the Rust parser remains
|
||||
# canonical.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
if [[ $# -lt 1 ]]; then
|
||||
echo "Usage: $0 <manifest.yml>"
|
||||
REPO_AUDIT=0
|
||||
if [[ "${1:-}" == "--repo-audit" ]]; then
|
||||
REPO_AUDIT=1
|
||||
shift
|
||||
fi
|
||||
|
||||
if [[ $# -ne 1 ]]; then
|
||||
echo "Usage: $0 [--repo-audit] <manifest.yml>"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@@ -30,138 +31,235 @@ WARN=0
|
||||
|
||||
check() {
|
||||
local desc="$1" result="$2"
|
||||
if [[ "$result" == "pass" ]]; then
|
||||
PASS=$((PASS + 1))
|
||||
echo " PASS: $desc"
|
||||
elif [[ "$result" == "warn" ]]; then
|
||||
WARN=$((WARN + 1))
|
||||
echo " WARN: $desc"
|
||||
else
|
||||
FAIL=$((FAIL + 1))
|
||||
echo " FAIL: $desc"
|
||||
fi
|
||||
case "$result" in
|
||||
pass)
|
||||
PASS=$((PASS + 1))
|
||||
echo " PASS: $desc"
|
||||
;;
|
||||
warn)
|
||||
WARN=$((WARN + 1))
|
||||
echo " WARN: $desc"
|
||||
;;
|
||||
*)
|
||||
FAIL=$((FAIL + 1))
|
||||
echo " FAIL: $desc"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
yaml_eval() {
|
||||
ruby -ryaml -e '
|
||||
path, expr = ARGV
|
||||
data = YAML.load_file(path)
|
||||
app = data.is_a?(Hash) ? data["app"] : nil
|
||||
abort "missing top-level app block" unless app.is_a?(Hash)
|
||||
value = eval(expr)
|
||||
case value
|
||||
when Array
|
||||
puts value.join("\n")
|
||||
when Hash
|
||||
puts value.to_a.map { |k, v| "#{k}=#{v}" }.join("\n")
|
||||
when NilClass
|
||||
puts ""
|
||||
else
|
||||
puts value
|
||||
end
|
||||
' "$MANIFEST" "$1"
|
||||
}
|
||||
|
||||
echo "Validating: $MANIFEST"
|
||||
echo ""
|
||||
|
||||
# 1. File exists and is readable
|
||||
if [[ ! -f "$MANIFEST" ]]; then
|
||||
echo " FAIL: File not found: $MANIFEST"
|
||||
exit 1
|
||||
fi
|
||||
check "File exists" "pass"
|
||||
|
||||
# 2. Valid YAML
|
||||
if ! python3 -c "import yaml; yaml.safe_load(open('$MANIFEST'))" 2>/dev/null; then
|
||||
check "Valid YAML syntax" "fail"
|
||||
echo " Cannot continue with invalid YAML"
|
||||
if ! ruby -ryaml -e 'data = YAML.load_file(ARGV[0]); exit(data.is_a?(Hash) && data["app"].is_a?(Hash) ? 0 : 1)' "$MANIFEST" 2>/dev/null; then
|
||||
check "Valid YAML with top-level app block" "fail"
|
||||
echo ""
|
||||
echo "Results: $PASS passed, $FAIL failed, $WARN warnings"
|
||||
echo "STATUS: REJECTED - fix failures before resubmitting"
|
||||
exit 1
|
||||
fi
|
||||
check "Valid YAML syntax" "pass"
|
||||
check "Valid YAML with top-level app block" "pass"
|
||||
|
||||
# 3. Required fields
|
||||
CONTENT=$(python3 -c "
|
||||
import yaml, json
|
||||
with open('$MANIFEST') as f:
|
||||
d = yaml.safe_load(f)
|
||||
print(json.dumps(d))
|
||||
" 2>/dev/null)
|
||||
APP_ID="$(yaml_eval 'app["id"]')"
|
||||
APP_NAME="$(yaml_eval 'app["name"]')"
|
||||
APP_VERSION="$(yaml_eval 'app["version"]')"
|
||||
APP_DESCRIPTION="$(yaml_eval 'app["description"]')"
|
||||
APP_INTERNAL="$(yaml_eval 'app["internal"]')"
|
||||
IMAGE="$(yaml_eval '(app["container"] || {})["image"]')"
|
||||
BUILD_CONTEXT="$(yaml_eval '(((app["container"] || {})["build"] || {})["context"])')"
|
||||
BUILD_TAG="$(yaml_eval '(((app["container"] || {})["build"] || {})["tag"])')"
|
||||
|
||||
for field in id title version description; do
|
||||
val=$(echo "$CONTENT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$field',''))" 2>/dev/null)
|
||||
if [[ -n "$val" && "$val" != "None" ]]; then
|
||||
check "Required field '$field' present" "pass"
|
||||
else
|
||||
check "Required field '$field' present" "fail"
|
||||
fi
|
||||
done
|
||||
|
||||
# 4. Image reference
|
||||
IMAGE=$(echo "$CONTENT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('image','') or d.get('docker_image','') or '')" 2>/dev/null)
|
||||
if [[ -z "$IMAGE" || "$IMAGE" == "None" ]]; then
|
||||
check "Container image specified" "fail"
|
||||
if [[ "$APP_ID" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
|
||||
check "app.id is lowercase kebab-case ($APP_ID)" "pass"
|
||||
else
|
||||
check "Container image specified" "pass"
|
||||
check "app.id is lowercase kebab-case" "fail"
|
||||
fi
|
||||
|
||||
# Check trusted registry
|
||||
if [[ -n "$APP_NAME" ]]; then
|
||||
check "app.name present" "pass"
|
||||
else
|
||||
check "app.name present" "fail"
|
||||
fi
|
||||
|
||||
if [[ "$APP_VERSION" =~ [0-9] ]]; then
|
||||
check "app.version present and contains a digit" "pass"
|
||||
else
|
||||
check "app.version present and contains a digit" "fail"
|
||||
fi
|
||||
|
||||
if [[ -n "$APP_DESCRIPTION" ]]; then
|
||||
check "app.description present" "pass"
|
||||
else
|
||||
check "app.description present" "warn"
|
||||
fi
|
||||
|
||||
HAS_IMAGE=0
|
||||
HAS_BUILD=0
|
||||
[[ -n "$IMAGE" ]] && HAS_IMAGE=1
|
||||
[[ -n "$BUILD_CONTEXT" || -n "$BUILD_TAG" ]] && HAS_BUILD=1
|
||||
|
||||
if [[ "$HAS_IMAGE" -eq 1 && "$HAS_BUILD" -eq 0 ]]; then
|
||||
check "container.image specified" "pass"
|
||||
elif [[ "$HAS_IMAGE" -eq 0 && "$HAS_BUILD" -eq 1 ]]; then
|
||||
if [[ -n "$BUILD_CONTEXT" && -n "$BUILD_TAG" ]]; then
|
||||
check "container.build specified with context and tag" "pass"
|
||||
else
|
||||
check "container.build requires context and tag" "fail"
|
||||
fi
|
||||
else
|
||||
check "exactly one of container.image or container.build specified" "fail"
|
||||
fi
|
||||
|
||||
if [[ -n "$IMAGE" ]]; then
|
||||
TRUSTED=false
|
||||
for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "146.59.87.168:3000"; do
|
||||
if echo "$IMAGE" | grep -q "$reg"; then
|
||||
for reg in "docker.io" "ghcr.io" "quay.io" "registry.hub.docker.com" "146.59.87.168:3000" "localhost/"; do
|
||||
if [[ "$IMAGE" == *"$reg"* ]]; then
|
||||
TRUSTED=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
# Also allow short-form Docker Hub images (no registry prefix)
|
||||
if ! echo "$IMAGE" | grep -q "/"; then
|
||||
TRUSTED=true # single-name images are Docker Hub official
|
||||
fi
|
||||
if [[ "$TRUSTED" == "true" ]]; then
|
||||
check "Image from trusted registry" "pass"
|
||||
if [[ "$TRUSTED" == "true" || "$IMAGE" != */* ]]; then
|
||||
check "image registry is recognized" "pass"
|
||||
else
|
||||
check "Image from trusted registry ($IMAGE)" "warn"
|
||||
check "image registry is not in the reviewed list ($IMAGE)" "warn"
|
||||
fi
|
||||
|
||||
# Check no :latest
|
||||
if echo "$IMAGE" | grep -q ":latest$"; then
|
||||
check "No :latest tag (pin specific version)" "fail"
|
||||
elif ! echo "$IMAGE" | grep -q ":"; then
|
||||
check "No version tag specified (should pin version)" "warn"
|
||||
if [[ "$IMAGE" == *":latest" ]]; then
|
||||
if [[ "$APP_INTERNAL" == "true" || "$IMAGE" == localhost/* ]]; then
|
||||
check "internal/local build uses :latest ($IMAGE)" "warn"
|
||||
elif [[ "$REPO_AUDIT" -eq 1 ]]; then
|
||||
check "existing manifest uses :latest and must be pinned before public app submission ($IMAGE)" "warn"
|
||||
else
|
||||
check "image tag is pinned and not :latest ($IMAGE)" "fail"
|
||||
fi
|
||||
elif [[ "$IMAGE" != *:* ]]; then
|
||||
check "image tag is explicit ($IMAGE)" "warn"
|
||||
else
|
||||
check "Version tag pinned" "pass"
|
||||
check "image tag is pinned" "pass"
|
||||
fi
|
||||
fi
|
||||
|
||||
# 5. Security checks
|
||||
PRIVILEGED=$(echo "$CONTENT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('privileged', False))" 2>/dev/null)
|
||||
if [[ "$PRIVILEGED" == "True" ]]; then
|
||||
check "No privileged mode" "fail"
|
||||
MEMORY_LIMIT="$(yaml_eval '((app["resources"] || {})["memory_limit"] || (app["resources"] || {})["memory"])')"
|
||||
CPU_LIMIT="$(yaml_eval '((app["resources"] || {})["cpu_limit"] || (app["resources"] || {})["cpu"])')"
|
||||
[[ -n "$MEMORY_LIMIT" ]] && check "resources.memory_limit specified ($MEMORY_LIMIT)" "pass" || check "resources.memory_limit specified" "warn"
|
||||
[[ -n "$CPU_LIMIT" ]] && check "resources.cpu_limit specified ($CPU_LIMIT)" "pass" || check "resources.cpu_limit specified" "warn"
|
||||
|
||||
READONLY_ROOT="$(yaml_eval '((app["security"] || {})["readonly_root"])')"
|
||||
NO_NEW_PRIVS="$(yaml_eval '((app["security"] || {})["no_new_privileges"])')"
|
||||
NETWORK_POLICY="$(yaml_eval '((app["security"] || {})["network_policy"])')"
|
||||
CONTAINER_NETWORK="$(yaml_eval '((app["container"] || {})["network"])')"
|
||||
|
||||
if [[ "$READONLY_ROOT" == "true" || -z "$READONLY_ROOT" ]]; then
|
||||
check "security.readonly_root true (explicit or Rust default)" "pass"
|
||||
else
|
||||
check "No privileged mode" "pass"
|
||||
check "security.readonly_root true or explicitly justified" "warn"
|
||||
fi
|
||||
|
||||
HOST_NET=$(echo "$CONTENT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('host_network', d.get('network_mode','')))" 2>/dev/null)
|
||||
if [[ "$HOST_NET" == "host" ]]; then
|
||||
check "No host networking" "fail"
|
||||
if [[ "$NO_NEW_PRIVS" == "true" || -z "$NO_NEW_PRIVS" ]]; then
|
||||
check "security.no_new_privileges true (explicit or Rust default)" "pass"
|
||||
elif [[ "$REPO_AUDIT" -eq 1 ]]; then
|
||||
check "existing manifest disables security.no_new_privileges and needs review" "warn"
|
||||
else
|
||||
check "No host networking" "pass"
|
||||
check "security.no_new_privileges true" "fail"
|
||||
fi
|
||||
|
||||
# 6. Check for hardcoded secrets in env vars
|
||||
ENV_VARS=$(echo "$CONTENT" | python3 -c "
|
||||
import sys,json
|
||||
d=json.load(sys.stdin)
|
||||
env = d.get('environment', d.get('env', {}))
|
||||
if isinstance(env, dict):
|
||||
for k,v in env.items():
|
||||
print(f'{k}={v}')
|
||||
elif isinstance(env, list):
|
||||
for e in env:
|
||||
print(e)
|
||||
" 2>/dev/null || echo "")
|
||||
|
||||
SECRET_PATTERNS="password|secret|api_key|private_key|token"
|
||||
if echo "$ENV_VARS" | grep -iqE "$SECRET_PATTERNS"; then
|
||||
check "No hardcoded secrets in environment" "warn"
|
||||
if [[ "$NETWORK_POLICY" == "isolated" || "$NETWORK_POLICY" == "bridge" || "$NETWORK_POLICY" == "host" || -z "$NETWORK_POLICY" ]]; then
|
||||
check "security.network_policy valid" "pass"
|
||||
else
|
||||
check "No hardcoded secrets in environment" "pass"
|
||||
check "security.network_policy valid" "fail"
|
||||
fi
|
||||
|
||||
# 7. Memory limit
|
||||
MEM=$(echo "$CONTENT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('memory', d.get('mem_limit', d.get('resources',{}).get('memory',''))))" 2>/dev/null)
|
||||
if [[ -n "$MEM" && "$MEM" != "None" && "$MEM" != "" ]]; then
|
||||
check "Memory limit specified ($MEM)" "pass"
|
||||
if [[ "$CONTAINER_NETWORK" == container:* || "$CONTAINER_NETWORK" == ns:* ]]; then
|
||||
check "container.network does not share another namespace" "fail"
|
||||
else
|
||||
check "Memory limit specified" "warn"
|
||||
check "container.network does not share another namespace" "pass"
|
||||
fi
|
||||
|
||||
SECRET_ENV="$(yaml_eval '(app["environment"] || [])')"
|
||||
if echo "$SECRET_ENV" | grep -iqE '^[A-Z0-9_]*(PASSWORD|PASS|SECRET|TOKEN|API_KEY|PRIVATE_KEY)[A-Z0-9_]*=.+$'; then
|
||||
check "no hardcoded secret-like values in app.environment" "warn"
|
||||
else
|
||||
check "no hardcoded secret-like values in app.environment" "pass"
|
||||
fi
|
||||
|
||||
if [[ -n "$APP_ID" && -n "$MANIFEST" ]]; then
|
||||
EXPECTED_DIR="$(basename "$(dirname "$MANIFEST")")"
|
||||
if [[ "$EXPECTED_DIR" == "$APP_ID" ]]; then
|
||||
check "app.id matches directory name" "pass"
|
||||
elif [[ "$REPO_AUDIT" -eq 1 ]]; then
|
||||
check "existing manifest app.id differs from directory name ($EXPECTED_DIR)" "warn"
|
||||
else
|
||||
check "app.id matches directory name ($EXPECTED_DIR)" "fail"
|
||||
fi
|
||||
fi
|
||||
|
||||
PORT_CHECK="$(ruby -ryaml -e '
|
||||
current = ARGV[0]
|
||||
current_id = File.basename(File.dirname(current))
|
||||
ports = {}
|
||||
Dir.glob("apps/*/manifest.yml").sort.each do |path|
|
||||
data = YAML.load_file(path)
|
||||
app = data.is_a?(Hash) ? data["app"] : nil
|
||||
next unless app.is_a?(Hash)
|
||||
id = app["id"] || File.basename(File.dirname(path))
|
||||
next if id == current_id
|
||||
Array(app["ports"]).each do |p|
|
||||
next unless p.is_a?(Hash)
|
||||
proto = p["protocol"] || "tcp"
|
||||
bind = p["bind"] || ""
|
||||
host = p["host"]
|
||||
ports[[host, proto, bind]] = id if host
|
||||
end
|
||||
end
|
||||
data = YAML.load_file(current)
|
||||
app = data["app"]
|
||||
conflicts = []
|
||||
Array(app["ports"]).each do |p|
|
||||
next unless p.is_a?(Hash)
|
||||
key = [p["host"], p["protocol"] || "tcp", p["bind"] || ""]
|
||||
conflicts << "#{key[2].empty? ? "*" : key[2]}:#{key[0]}/#{key[1]} already used by #{ports[key]}" if ports.key?(key)
|
||||
end
|
||||
puts conflicts.join("\n")
|
||||
' "$MANIFEST")"
|
||||
if [[ -n "$PORT_CHECK" ]]; then
|
||||
while IFS= read -r conflict; do
|
||||
check "port conflict: $conflict" "warn"
|
||||
done <<< "$PORT_CHECK"
|
||||
else
|
||||
check "no duplicate host port bindings" "pass"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Results: $PASS passed, $FAIL failed, $WARN warnings"
|
||||
|
||||
if [[ "$FAIL" -gt 0 ]]; then
|
||||
echo "STATUS: REJECTED — fix failures before resubmitting"
|
||||
echo "STATUS: REJECTED - fix failures before resubmitting"
|
||||
exit 1
|
||||
else
|
||||
echo "STATUS: APPROVED (with $WARN warnings)"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "STATUS: APPROVED (with $WARN warnings)"
|
||||
|
||||
Reference in New Issue
Block a user