54 lines
3.1 KiB
Python
54 lines
3.1 KiB
Python
#!/usr/bin/python3
|
|
"""One new immutable attempt lane; bounded own service/private fixture realm."""
|
|
import hashlib
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
import time
|
|
|
|
repo = Path(__file__).resolve().parents[2]
|
|
base = Path('/home/archipelago/Reports/opencode-full-release-20261029')
|
|
assert len(sys.argv) == 3 and sys.argv[1].isalnum() and sys.argv[2] in ('sshparse', 'recovery', 'preflight', 'drift', 'stall', 'expiry')
|
|
lane = base / ('c01-access-owner-' + sys.argv[1])
|
|
lane.mkdir(mode=0o700, exist_ok=False)
|
|
paths = list((repo / 'scripts').glob('c01_access*.py'))
|
|
paths += list((repo / 'scripts/tests').glob('*access_owner*.py'))
|
|
paths += list((repo / 'scripts/tests').glob('test_c01_access*.py'))
|
|
paths += list((repo / 'image-recipe/configs').glob('*c01*access*'))
|
|
frozen = [repo / 'scripts' / name for name in ('c01_supervisor.py', 'c01_children.py', 'c01_views.py',
|
|
'c01_nts.py', 'c01_recovery.py', 'c01_host_watch.py', 'runtime_owner.py',
|
|
'c01_runtime.py', 'c01_runtime_groups.py', 'c01_runtime_view.py')]
|
|
def hashes(items):
|
|
return {str(p.relative_to(repo)): hashlib.sha256(p.read_bytes()).hexdigest() for p in items}
|
|
before, frozen_before = hashes(paths), hashes(frozen)
|
|
(lane / 'source.json').write_text(json.dumps(before, indent=2))
|
|
(lane / 'frozen.json').write_text(json.dumps(frozen_before, indent=2))
|
|
unit = 'c01-access-fixture-' + sys.argv[1] + '-' + str(os.getpid())
|
|
command = ['sudo', '-n', 'systemd-run', '--quiet', '--wait', '--pipe', '--collect', '--unit=' + unit,
|
|
'-p', 'Delegate=yes', '-p', 'DelegateSubgroup=supervisor', '-p', 'PrivateMounts=yes',
|
|
'-p', 'PrivateNetwork=yes', '-p', 'ProtectSystem=strict', '-p', 'NoNewPrivileges=no',
|
|
'-p', 'TemporaryFileSystem=/etc /run /home /root /var/lib /var/spool /tmp /var/tmp /opt',
|
|
'-p', f'BindReadOnlyPaths={repo}:/opt/source',
|
|
'-p', 'CPUAffinity=2 3', '-p', 'AllowedCPUs=2-3', '-p', 'CPUQuota=200%',
|
|
'-p', 'MemoryMax=2G', '-p', 'MemorySwapMax=0', '-p', 'TasksMax=128',
|
|
'-p', 'RuntimeMaxSec=120', '-p', 'TimeoutStopSec=10',
|
|
'--setenv=C01_ACCESS_FIXTURE=1', '--setenv=C01_ACCESS_CASE=' + sys.argv[2],
|
|
'--setenv=PYTHONDONTWRITEBYTECODE=1', '/usr/bin/unshare', '--pid', '--fork', '--mount-proc',
|
|
'/usr/bin/python3', '-B', '/opt/source/scripts/tests/access_owner_fixture.py']
|
|
(lane / 'command.json').write_text(json.dumps(command, indent=2))
|
|
start = time.monotonic()
|
|
with (lane / 'stdout.log').open('wb') as out, (lane / 'stderr.log').open('wb') as err:
|
|
try:
|
|
code = subprocess.run(command, stdout=out, stderr=err, timeout=145).returncode
|
|
except subprocess.TimeoutExpired:
|
|
code = 124
|
|
subprocess.run(['sudo', '-n', 'systemctl', 'stop', unit], timeout=20, check=False)
|
|
receipt = {'exit_code': code, 'seconds': time.monotonic() - start,
|
|
'source_unchanged': hashes(paths) == before, 'frozen_unchanged': hashes(frozen) == frozen_before,
|
|
'compiler_run': False, 'installed_acceptance': False}
|
|
(lane / 'result.json').write_text(json.dumps(receipt, indent=2))
|
|
print(lane, json.dumps(receipt), flush=True)
|
|
raise SystemExit(code)
|