fix(vector): harden backup restore parity gates

2026-07-12 02:29:53 +02:00
parent e4db2ea5e1
commit 015c496bda
9 changed files with 300 additions and 36 deletions
@@ -0,0 +1,72 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+fakebin="$tmp/bin"
+mkdir "$fakebin"
+printf '%s' secret >"$tmp/password"
+
+cat >"$fakebin/pg_dump" <<'SH'
+#!/bin/sh
+set -eu
+for arg in "$@"; do case "$arg" in --file=*) output=${arg#--file=} ;; esac; done
+printf 'custom dump' >"$output"
+SH
+chmod 0755 "$fakebin/pg_dump"
+
+victim="$tmp/victim"
+output="$tmp/vector.dump"
+printf 'sentinel' >"$victim"
+ln -s "$victim" "$output.partial"
+PATH="$fakebin:$PATH" ./scripts/vector-backup.sh --host source --database thoth --user admin \
+  --password-file "$tmp/password" --output "$output" >/dev/null
+test "$(cat "$victim")" = sentinel
+test "$(cat "$output")" = 'custom dump'
+test -L "$output.partial"
+
+cat >"$fakebin/psql" <<'SH'
+#!/bin/sh
+set -eu
+case "$*" in
+  *pg_control_system*)
+    echo same-cluster ;;
+  *) echo 0 ;;
+esac
+SH
+cat >"$fakebin/pg_restore" <<'SH'
+#!/bin/sh
+printf '%s\n' "$*" >"$RESTORE_LOG"
+SH
+chmod 0755 "$fakebin/psql" "$fakebin/pg_restore"
+printf 'archive' >"$tmp/input"
+if PATH="$fakebin:$PATH" RESTORE_LOG="$tmp/restore.log" ./scripts/vector-restore.sh \
+    --active-host source --active-database active --active-user admin \
+    --active-password-file "$tmp/password" --target-host target --target-database restore \
+    --target-user admin --target-password-file "$tmp/password" --input "$tmp/input" \
+    >"$tmp/out" 2>"$tmp/err"; then
+  echo "restore accepted a target on the active PostgreSQL cluster" >&2
+  exit 1
+fi
+grep -q 'same PostgreSQL cluster' "$tmp/err"
+test ! -e "$tmp/restore.log"
+
+cat >"$fakebin/psql" <<'SH'
+#!/bin/sh
+set -eu
+case "$*" in
+  *pg_control_system*)
+    case "$*" in *--host=source*) echo same-cluster ;; *) echo other-cluster ;; esac ;;
+  *) echo 0 ;;
+esac
+SH
+chmod 0755 "$fakebin/psql"
+PATH="$fakebin:$PATH" RESTORE_LOG="$tmp/restore.log" ./scripts/vector-restore.sh \
+  --active-host source --active-database active --active-user admin \
+  --active-password-file "$tmp/password" --target-host target --target-database restore \
+  --target-user admin --target-password-file "$tmp/password" --input "$tmp/input" >/dev/null
+grep -q -- '--single-transaction' "$tmp/restore.log"
+grep -q -- '--exit-on-error' "$tmp/restore.log"
+
+echo "vector backup/restore filesystem, identity, and transaction contracts passed."