59 lines
3.8 KiB
Bash
59 lines
3.8 KiB
Bash
#!/usr/bin/env bash
|
|
# Explicit native component fixture, not the unrestricted C01 admission gate.
|
|
set -euo pipefail
|
|
ROOT=$(git rev-parse --show-toplevel)
|
|
ATTEMPT=${1:?unique attempt}
|
|
REPORT=${2:?new absolute receipt directory}
|
|
BINARY=${3:?current-source compiled native test executable}
|
|
[[ "$ATTEMPT" =~ ^[a-z0-9-]+$ && "$REPORT" = /* && ! -e "$REPORT" && "$BINARY" = /* && -x "$BINARY" ]]
|
|
[[ $(id -u) != 0 && $(podman info --format '{{.Host.Security.Rootless}}') == true ]]
|
|
NAME="qualification-d09-native-$ATTEMPT"
|
|
! podman container exists "$NAME"
|
|
umask 077
|
|
mkdir "$REPORT"
|
|
python3 -B scripts/tests/package_d09_native_fixture.py "$BINARY" "$REPORT"
|
|
python3 -B scripts/package-d09-c01.py "$REPORT/owners.tar"
|
|
sources=(scripts/d09-lifecycle-owner.py scripts/d09_handoff.py scripts/d09_c01.py scripts/d09_worker.py
|
|
scripts/d09_store.py scripts/d09_wire.py scripts/d09-wire-schema.json scripts/provision-d09-lifecycle.py
|
|
scripts/c01_access_generation.py scripts/c01_access.py scripts/c01_access_policy.py scripts/c01_d09.py
|
|
scripts/c01_runtime.py scripts/c01_network.py scripts/package-d09-c01.py
|
|
core/archipelago/src/d09_transport.rs core/archipelago/src/d09_transport_tests.rs
|
|
core/archipelago/src/c01_launcher.rs core/archipelago/src/c01_supervisor.rs
|
|
core/archipelago/src/d09_lifecycle.rs scripts/tests/package_d09_native_fixture.py
|
|
image-recipe/configs/archipelago-d09-lifecycle.service image-recipe/configs/50-d09-lifecycle.conf
|
|
image-recipe/configs/60-terminal-workspace.conf image-recipe/configs/prepare-terminal-workspace.sh
|
|
tests/regression/d09-c01-native.py scripts/test-d09-c01-native-isolated.sh)
|
|
sha256sum "${sources[@]}" > "$REPORT/source-sha256.txt"
|
|
IMAGE=$(podman image inspect localhost/archipelago-rootfs:latest --format '{{.Id}}')
|
|
printf '%s\n' "$IMAGE" > "$REPORT/image-id.txt"
|
|
cleanup() {
|
|
local status=$?
|
|
podman exec "$NAME" journalctl --no-pager > "$REPORT/journal.log" 2>&1 || true
|
|
podman logs "$NAME" > "$REPORT/container.log" 2>&1 || true
|
|
podman cp "$NAME:/var/lib/d09-native" "$REPORT/native-evidence" 2>/dev/null || true
|
|
podman cp "$NAME:/var/lib/archipelago-d09/ledger.json" "$REPORT/ledger.json" 2>/dev/null || true
|
|
podman cp "$NAME:/etc/archipelago-d09" "$REPORT/authority-bindings" 2>/dev/null || true
|
|
podman stop --time 10 "$NAME" > "$REPORT/stop.log" 2>&1 || true
|
|
printf '%s\n' "$status" > "$REPORT/exit-code.txt"
|
|
}
|
|
podman run --detach --tty --pull=never --name "$NAME" --hostname d09-native-qualification \
|
|
--network=none --cgroupns=private --systemd=always --cap-add=SYS_ADMIN --cap-add=SYS_PTRACE --cap-add=NET_ADMIN \
|
|
--memory=4g --cpus=2 --pids-limit=512 --tmpfs /run --tmpfs /tmp --entrypoint /sbin/init "$IMAGE" \
|
|
--unit=basic.target --log-target=console > "$REPORT/container-id.txt"
|
|
trap cleanup EXIT
|
|
podman exec "$NAME" install -d /opt/d09-native/scripts /opt/d09-native/tests/regression /opt/d09-native/image-recipe /opt/d09-native/core/archipelago/src
|
|
podman cp "$ROOT/scripts" "$NAME:/opt/d09-native/"
|
|
podman cp "$ROOT/image-recipe/configs" "$NAME:/opt/d09-native/image-recipe/"
|
|
podman cp "$ROOT/tests/regression/d09-c01-native.py" "$NAME:/opt/d09-native/tests/regression/"
|
|
podman cp "$REPORT/native-test.tar" "$NAME:/opt/d09-native/"
|
|
podman cp "$REPORT/owners.tar" "$NAME:/opt/d09-native/"
|
|
podman cp "$REPORT/native-artifact-sha256.json" "$NAME:/opt/d09-native/"
|
|
for source in "${sources[@]}"; do
|
|
if [[ "$source" == core/* ]]; then podman cp "$ROOT/$source" "$NAME:/opt/d09-native/$source"; fi
|
|
done
|
|
podman exec "$NAME" chown -R root:root /opt/d09-native
|
|
podman exec --workdir /opt/d09-native "$NAME" sha256sum "${sources[@]}" > "$REPORT/container-source-sha256.txt"
|
|
cmp "$REPORT/source-sha256.txt" "$REPORT/container-source-sha256.txt"
|
|
podman exec --env D09_NATIVE_PID1=1 "$NAME" python3 -B /opt/d09-native/tests/regression/d09-c01-native.py 2>&1 | tee "$REPORT/test.log"
|
|
sha256sum --check "$REPORT/source-sha256.txt" > "$REPORT/source-unchanged.txt"
|