shadowdaoandClaude Sonnet 5.5
8a6a6d7b44
- scripts/image-label-amd64.sh: index-safe read of the amd64 image's labels (OCI index with attestations, Docker manifest list, single manifest). - scripts/php-emergency-guard.sh: used by both build-push.yaml guard sites; same decisions as the old inline step on single-platform images, but FAILS CLOSED when the labels cannot be read (only "tag not found" passes). - lsphp-source-emergency.yaml: push by digest + assemble (copy of HMB assemble-multiarch-index.sh); optional arm64; refuses to replace a multi-arch production tag with amd64-only unless allow_amd64_only. - Tests wired into Shell-Checks; main build matrix platforms unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb
107 lines
7.5 KiB
Bash
Executable File
107 lines
7.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
## image-label-amd64.test.sh — fixtures for scripts/image-label-amd64.sh and
|
|
## scripts/php-emergency-guard.sh, driven through a stub IMAGETOOLS.
|
|
## Proves: index-safe (two-platform OCI index WITH attestation children, Docker
|
|
## manifest list, single-platform manifest), fail-closed on malformed/ambiguous
|
|
## input, "not found" = proceed, and that for single-platform images the guard
|
|
## makes the SAME decision as the old inline step on every (src,cur,new) case.
|
|
set -euo pipefail
|
|
HERE=$(cd "$(dirname "$0")/.." && pwd)
|
|
T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
|
|
mkdir -p "$T/raw" "$T/cfg" "$T/err"
|
|
fail=0
|
|
chk() { if [ "$2" = "$3" ]; then echo "ok $1"; else echo "FAIL $1: got '$2' want '$3'"; fail=1; fi; }
|
|
|
|
# ---- stub: inspect --raw REF / inspect REF --format ... ; fixtures keyed by ref
|
|
key() { printf '%s' "$1" | tr '/:@' '___'; }
|
|
cat >"$T/it" <<'STUB'
|
|
#!/usr/bin/env bash
|
|
# args: inspect --raw REF | inspect REF --format F
|
|
d=$FIXDIR
|
|
[ "$1" = inspect ] || exit 2
|
|
if [ "$2" = --raw ]; then ref=$3; kind=raw; else ref=$2; kind=cfg; fi
|
|
k=$(printf '%s' "$ref" | tr '/:@' '___')
|
|
if [ -f "$d/err/$k" ]; then cat "$d/err/$k" >&2; exit 1; fi
|
|
[ -f "$d/$kind/$k" ] || { echo "ERROR: $ref: not found" >&2; exit 1; }
|
|
cat "$d/$kind/$k"
|
|
STUB
|
|
chmod +x "$T/it"
|
|
export FIXDIR=$T IMAGETOOLS="$T/it"
|
|
|
|
A=sha256:$(printf 'a%.0s' {1..64}); B=sha256:$(printf 'b%.0s' {1..64})
|
|
C=sha256:$(printf 'c%.0s' {1..64}); D=sha256:$(printf 'd%.0s' {1..64})
|
|
REPO=reg.example/org/img
|
|
put() { printf '%s' "$3" >"$T/$1/$(key "$2")"; }
|
|
cfg() { # arch src php -> image config json
|
|
printf '{"architecture":"%s","os":"linux","config":{"Labels":{"org.whp.lsphp-source":"%s","org.whp.php-version":"%s"}}}' "$1" "$2" "$3"; }
|
|
|
|
# 1. OCI index: amd64 + arm64 + two attestation children (unknown/unknown)
|
|
put raw $REPO:php85 '{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[
|
|
{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"'$A'","platform":{"architecture":"amd64","os":"linux"}},
|
|
{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"'$C'","platform":{"architecture":"unknown","os":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest","vnd.docker.reference.digest":"'$A'"}},
|
|
{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"'$B'","platform":{"architecture":"arm64","os":"linux"}},
|
|
{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"'$D'","platform":{"architecture":"unknown","os":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest","vnd.docker.reference.digest":"'$B'"}}]}'
|
|
put cfg $REPO@$A "$(cfg amd64 php.net 8.5.12)"
|
|
put cfg $REPO@$B "$(cfg arm64 php.net 8.5.99)" # must never be read
|
|
printf '%s\n%s\n' php.net 8.5.12 >"$T/want"
|
|
chk "index+attestations: amd64 labels" "$("$HERE/image-label-amd64.sh" $REPO:php85 org.whp.lsphp-source org.whp.php-version)" "$(cat "$T/want")"
|
|
|
|
# 2. Docker manifest list (no attestations)
|
|
put raw $REPO:ml '{"schemaVersion":2,"mediaType":"application/vnd.docker.distribution.manifest.list.v2+json","manifests":[
|
|
{"mediaType":"application/vnd.docker.distribution.manifest.v2+json","digest":"'$B'","platform":{"architecture":"arm64","os":"linux","variant":"v8"}},
|
|
{"mediaType":"application/vnd.docker.distribution.manifest.v2+json","digest":"'$A'","platform":{"architecture":"amd64","os":"linux"}}]}'
|
|
chk "docker manifest list" "$("$HERE/image-label-amd64.sh" $REPO:ml org.whp.php-version)" "8.5.12"
|
|
|
|
# 3. Single-platform manifest (today's amd64-only images); ref with digest too
|
|
put raw $REPO:single '{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"digest":"'$A'"},"layers":[]}'
|
|
put cfg $REPO:single "$(cfg amd64 litespeed 8.5.1)"
|
|
chk "single-platform manifest" "$("$HERE/image-label-amd64.sh" $REPO:single org.whp.lsphp-source org.whp.php-version | tr '\n' ,)" "litespeed,8.5.1,"
|
|
chk "absent label prints empty" "$("$HERE/image-label-amd64.sh" $REPO:single org.whp.nope)" ""
|
|
put raw $REPO:nolabels '{"mediaType":"x","config":{},"layers":[]}'
|
|
put cfg $REPO:nolabels '{"architecture":"amd64","config":{}}'
|
|
chk "config without Labels" "$("$HERE/image-label-amd64.sh" $REPO:nolabels org.whp.php-version)" ""
|
|
|
|
# 4. failures: each must exit non-zero (1) with nothing on stdout
|
|
bad() { # name ref
|
|
local out rc=0; out=$("$HERE/image-label-amd64.sh" "$2" org.whp.php-version 2>/dev/null) || rc=$?
|
|
chk "$1 -> rc $3" "$rc" "$3"; chk "$1 -> no stdout" "$out" ""
|
|
}
|
|
bad "tag not found" $REPO:nosuch 3
|
|
put raw $REPO:garbage 'this is not json'; bad "malformed JSON" $REPO:garbage 1
|
|
put raw $REPO:arr '[1,2]'; bad "JSON not an object" $REPO:arr 1
|
|
put raw $REPO:unk '{"foo":"bar"}'; bad "neither index nor manifest" $REPO:unk 1
|
|
put raw $REPO:armonly '{"manifests":[{"digest":"'$B'","platform":{"architecture":"arm64","os":"linux"}}]}'; bad "index without amd64" $REPO:armonly 1
|
|
put raw $REPO:two '{"manifests":[{"digest":"'$A'","platform":{"architecture":"amd64","os":"linux"}},{"digest":"'$D'","platform":{"architecture":"amd64","os":"linux"}}]}'; bad "ambiguous amd64" $REPO:two 1
|
|
put raw $REPO:baddig '{"manifests":[{"digest":"sha256:short","platform":{"architecture":"amd64","os":"linux"}}]}'; bad "malformed child digest" $REPO:baddig 1
|
|
put raw $REPO:badcfg '{"manifests":[{"digest":"'$D'","platform":{"architecture":"amd64","os":"linux"}}]}'
|
|
put cfg $REPO@$D 'not json'; bad "malformed config" $REPO:badcfg 1
|
|
put raw $REPO:wrongarch '{"manifests":[{"digest":"'$C'","platform":{"architecture":"amd64","os":"linux"}}]}'
|
|
put cfg $REPO@$C "$(cfg arm64 php.net 8.5.12)"; bad "amd64 slot with arm64 config" $REPO:wrongarch 1
|
|
printf 'ERROR: denied: requested access to the resource is denied\n' >"$T/err/$(key $REPO:denied)"; bad "auth/network error is NOT 'not found'" $REPO:denied 1
|
|
put raw $REPO:orphan '{"manifests":[{"digest":"'$B'","platform":{"architecture":"amd64","os":"linux"}}]}'; bad "child listed but missing" $REPO:orphan 1
|
|
|
|
# 5. Guard == old inline logic on single-platform fixtures, all combos
|
|
old() { # src cur new -> proceed|refuse (verbatim predicate of the old step)
|
|
local src=$1 cur=$2 new=$3
|
|
if [ "$src" = "php.net" ] && [ "$cur" != "$new" ] && [ "$(printf '%s\n%s\n' "$cur" "$new" | sort -V | tail -n1)" = "$cur" ]; then echo refuse; else echo proceed; fi; }
|
|
n=0
|
|
for src in php.net litespeed ""; do for cur in "" 8.5.11 8.5.12 8.5.13 8.4.99 8.10.0; do for new in 8.5.12 8.5.9 8.6.0; do
|
|
put raw $REPO:g '{"mediaType":"x","config":{},"layers":[]}'
|
|
put cfg $REPO:g "$(cfg amd64 "$src" "$cur")"
|
|
rc=0; "$HERE/php-emergency-guard.sh" $REPO:g "$new" >/dev/null 2>&1 || rc=$?
|
|
got=proceed; [ "$rc" -ne 0 ] && got=refuse
|
|
w=$(old "$src" "$cur" "$new"); n=$((n+1))
|
|
[ "$got" = "$w" ] || { echo "FAIL guard vs old: src='$src' cur='$cur' new='$new' got=$got old=$w"; fail=1; }
|
|
done; done; done
|
|
echo "ok guard == old inline logic on $n single-platform combos"
|
|
|
|
# 6. Guard on a multi-arch index: refuses the rollback (old logic could not even read it)
|
|
rc=0; "$HERE/php-emergency-guard.sh" $REPO:php85 8.5.9 >/dev/null 2>&1 || rc=$?; chk "index: emergency 8.5.12 vs packaged 8.5.9 refused" "$rc" 1
|
|
rc=0; "$HERE/php-emergency-guard.sh" $REPO:php85 8.6.0 >/dev/null 2>&1 || rc=$?; chk "index: packaged newer proceeds" "$rc" 0
|
|
# 7. fail closed vs first build
|
|
rc=0; "$HERE/php-emergency-guard.sh" $REPO:nosuch 8.5.9 >/dev/null 2>&1 || rc=$?; chk "tag absent: proceed (first build)" "$rc" 0
|
|
for t in garbage denied armonly orphan wrongarch; do
|
|
rc=0; "$HERE/php-emergency-guard.sh" $REPO:$t 8.5.9 >/dev/null 2>&1 || rc=$?; chk "unreadable ($t): FAIL CLOSED" "$rc" 1
|
|
done
|
|
[ "$fail" -eq 0 ] && echo "ALL PASS" || { echo "FAILURES"; exit 1; }
|