shadowdaoandClaude Sonnet 5.5
8a6a6d7b44
- scripts/image-label-amd64.sh: index-safe read of the amd64 image's labels (OCI index with attestations, Docker manifest list, single manifest). - scripts/php-emergency-guard.sh: used by both build-push.yaml guard sites; same decisions as the old inline step on single-platform images, but FAILS CLOSED when the labels cannot be read (only "tag not found" passes). - lsphp-source-emergency.yaml: push by digest + assemble (copy of HMB assemble-multiarch-index.sh); optional arm64; refuses to replace a multi-arch production tag with amd64-only unless allow_amd64_only. - Tests wired into Shell-Checks; main build matrix platforms unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb
55 lines
3.5 KiB
Bash
Executable File
55 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
## index-platforms.test.sh — scripts/index-platforms.sh and
|
|
## scripts/assemble-multiarch-index.sh (copy of haproxy-manager-base's) against a stub IMAGETOOLS.
|
|
set -euo pipefail
|
|
HERE=$(cd "$(dirname "$0")/.." && pwd)
|
|
T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
|
|
fail=0
|
|
chk() { if [ "$2" = "$3" ]; then echo "ok $1"; else echo "FAIL $1: got '$2' want '$3'"; fail=1; fi; }
|
|
A=sha256:$(printf 'a%.0s' {1..64}); B=sha256:$(printf 'b%.0s' {1..64}); C=sha256:$(printf 'c%.0s' {1..64})
|
|
cat >"$T/it" <<'STUB'
|
|
#!/usr/bin/env bash
|
|
# index-platforms mode: serves $FIX/<ref-with-/:@ as _> for "inspect --raw REF".
|
|
# assemble mode (STUB_LOG set): "inspect REF --format .." -> arch from $ARCHES (ref=arch lines);
|
|
# "create ..." -> appended to $STUB_LOG.
|
|
if [ -n "${STUB_LOG:-}" ]; then
|
|
if [ "$1" = create ]; then echo "create $*" >>"$STUB_LOG"; exit 0; fi
|
|
ref=$2; a=$(grep -F "$ref=" "$ARCHES" | head -1 | cut -d= -f2); [ -n "$a" ] || exit 1
|
|
printf '{"architecture":"%s"}' "$a"; exit 0
|
|
fi
|
|
[ "$2" = --raw ] || exit 2
|
|
k=$(printf '%s' "$3" | tr '/:@' '___')
|
|
if [ -f "$FIX/err_$k" ]; then cat "$FIX/err_$k" >&2; exit 1; fi
|
|
[ -f "$FIX/$k" ] || { echo "ERROR: $3: not found" >&2; exit 1; }
|
|
cat "$FIX/$k"
|
|
STUB
|
|
chmod +x "$T/it"; export IMAGETOOLS="$T/it" FIX=$T
|
|
w() { printf '%s' "$2" >"$T/$(printf '%s' "$1" | tr '/:@' '___')"; }
|
|
w r/i:idx '{"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"digest":"'$A'","platform":{"os":"linux","architecture":"amd64"}},{"digest":"'$B'","platform":{"os":"linux","architecture":"arm64"}},{"digest":"'$C'","platform":{"os":"unknown","architecture":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest"}}]}'
|
|
w r/i:amd '{"manifests":[{"digest":"'$A'","platform":{"os":"linux","architecture":"amd64"}},{"digest":"'$C'","platform":{"os":"unknown","architecture":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest"}}]}'
|
|
w r/i:one '{"config":{"digest":"'$A'"},"layers":[]}'
|
|
w r/i:bad 'garbage'
|
|
printf 'ERROR: denied\n' >"$T/err_r_i_den"
|
|
chk "two-platform index" "$("$HERE/index-platforms.sh" r/i:idx)" "index linux/amd64 linux/arm64"
|
|
chk "amd64 index with attestation" "$("$HERE/index-platforms.sh" r/i:amd)" "index linux/amd64"
|
|
chk "single manifest" "$("$HERE/index-platforms.sh" r/i:one)" "single"
|
|
for pair in "nosuch 3" "bad 1" "den 1"; do set -- $pair
|
|
rc=0; "$HERE/index-platforms.sh" r/i:$1 >/dev/null 2>&1 || rc=$?; chk "$1 -> rc $2" "$rc" "$2"; done
|
|
|
|
# ---- assemble-multiarch-index.sh (arm64 attach rules)
|
|
export STUB_LOG=$T/log ARCHES=$T/arches
|
|
R=reg/x
|
|
printf '%s\n' "$R@$A=amd64" "$R@$B=arm64" >"$ARCHES"
|
|
run() { : >"$STUB_LOG"; "$HERE/assemble-multiarch-index.sh" "$@" >/dev/null 2>&1; echo $?; }
|
|
chk "both ok -> rc 0" "$(run --amd64 $A --arm64 $B --arm64-outcome success --repo $R --tag t1 --tag t2)" 0
|
|
chk "both ok -> 1 create with 2 sources, 2 tags" "$(grep -c "create create -t $R:t1 -t $R:t2 $R@$A $R@$B\$" "$STUB_LOG")" 1
|
|
chk "arm64 failed (digest present, stale) -> amd64 only" "$(run --amd64 $A --arm64 $B --arm64-outcome failure --repo $R --tag t1)" 0
|
|
chk " ... create has no arm64 digest" "$(grep -c "$B" "$STUB_LOG" || true)" 0
|
|
run --amd64 $A --repo $R --tag t1 >/dev/null
|
|
chk "arm64 skipped -> amd64 only" "$(grep -c "$B" "$STUB_LOG" || true)" "0"
|
|
chk "malformed amd64 digest -> refuse" "$(run --amd64 nope --repo $R --tag t1)" 1
|
|
chk " ... nothing created" "$(grep -c create "$STUB_LOG" || true)" 0
|
|
printf '%s\n' "$R@$A=arm64" >"$ARCHES"
|
|
chk "amd64 digest that is not amd64 -> refuse" "$(run --amd64 $A --repo $R --tag t1)" 1
|
|
[ "$fail" -eq 0 ] && echo "ALL PASS" || { echo FAILURES; exit 1; }
|