44 lines
2.3 KiB
Bash
44 lines
2.3 KiB
Bash
 
|
#!/usr/bin/env bash
|
||
|
|
## php-emergency-guard.sh REF NEW_PHP
|
||
|
|
##
|
||
|
|
## "Do not roll back a newer php.net emergency image." REF is the published
|
||
|
|
## :phpNN tag a normal build is about to overwrite; NEW_PHP is the PHP version
|
||
|
|
## the normal build packages. Exit 0 = go ahead, 1 = refuse (or cannot tell).
|
||
|
|
##
|
||
|
|
## Decision (same predicate as the old inline step, evaluated on the amd64
|
||
|
|
## image only, so it is correct for a single-platform image AND a multi-arch
|
||
|
|
## index):
|
||
|
|
## REF does not exist yet (registry "not found") -> proceed (nothing to protect)
|
||
|
|
## labels read, source != php.net -> proceed
|
||
|
|
## labels read, source = php.net, cur == new -> proceed
|
||
|
|
## labels read, source = php.net, cur > new (sort -V) -> REFUSE
|
||
|
|
## labels read, source = php.net, cur < new -> proceed
|
||
|
|
## labels absent (older image without them) -> proceed (as before)
|
||
|
|
## ANYTHING ELSE (registry/auth/network error, malformed manifest, index
|
||
|
|
## without exactly one linux/amd64 image, non-amd64 config) -> REFUSE
|
||
|
|
## (FAIL CLOSED; the old step failed open and silently disabled the guard).
|
||
|
|
## Env: LABEL_SCRIPT (tests), IMAGETOOLS passed through.
|
||
|
|
set -euo pipefail
|
||
|
|
ref=${1:?usage: php-emergency-guard.sh REF NEW_PHP}
|
||
|
|
new=${2-}
|
||
|
|
here=$(cd "$(dirname "$0")" && pwd)
|
||
|
|
labeler=${LABEL_SCRIPT:-$here/image-label-amd64.sh}
|
||
|
|
|
||
|
|
rc=0
|
||
|
|
out=$("$labeler" "$ref" org.whp.lsphp-source org.whp.php-version) || rc=$?
|
||
|
|
if [ "$rc" -eq 3 ]; then
|
||
|
|
echo "published $ref: not found (first build); this build: packaged $new. Nothing to protect."
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
if [ "$rc" -ne 0 ]; then
|
||
|
|
echo "::error::cannot read the php.net-emergency labels of the amd64 image behind $ref (rc=$rc). Refusing to overwrite it blind (fail closed). Retry the run; if it persists check registry access and the manifest."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
src=$(printf '%s\n' "$out" | sed -n 1p)
|
||
|
|
cur=$(printf '%s\n' "$out" | sed -n 2p)
|
||
|
|
echo "published $ref (amd64): source=${src:-?} php=${cur:-?}; this build: packaged $new"
|
||
|
|
if [ "$src" = "php.net" ] && [ "$cur" != "$new" ] && [ "$(printf '%s\n%s\n' "$cur" "$new" | sort -V | tail -n1)" = "$cur" ]; then
|
||
|
|
echo "::error::$ref is a php.net emergency build of PHP $cur; LiteSpeed still ships $new. Not overwriting it with an older PHP. Re-run lsphp-source-emergency.yaml for a newer fix, or wait for LiteSpeed."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
exit 0
|