mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(deploy): seed session CA in local smoke

Browse Source
This commit is contained in:
marcopan
2026-08-26 00:56:30 +02:00
parent 2ae11f26f2
commit 287ce91e67
2 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/unified-deployment-smoke.sh
+17 -7
View File
@@ -387,11 +387,21 @@ task13_write_environment() {
chmod 0600 "$TASK13_ENV_FILE"
}
task13_write_session_ca_fixture() {
cat >"$TASK13_SESSION_CA" <<'EOF'
-----BEGIN CERTIFICATE-----
VEFTSzEzLURJU1BPU0FCTEUtU0VTU0lPTi1DQQ==
-----END CERTIFICATE-----
EOF
chmod 0600 "$TASK13_SESSION_CA"
}
task13_write_fixture_files() {
printf '{}\n' >"$TASK13_PI_AUTH"
printf 'THT_MODEL_API_KEY=%s\n' "$TASK13_SECRET_VALUE" >"$TASK13_SECRETS"
printf '%s' "task13-runtime-password-$TASK13_RUN_ID" >"$TASK13_SESSION_RUNTIME_PASSWORD"
printf '%s' "$TASK13_AUTH_PASSWORD" >"$TASK13_AUTH_PASSWORD_FILE"
task13_write_session_ca_fixture
mkdir -p "$TASK13_AUTH_ROOT"
chmod 0600 "$TASK13_PI_AUTH"
chmod 0700 "$TASK13_AUTH_ROOT"
@@ -598,12 +608,8 @@ task13_write_server_fixture_files() {
"$TASK13_SECRET_VALUE" "$TASK13_OIDC_CLIENT_SECRET" "$TASK13_AUTHENTIK_API_TOKEN" >"$TASK13_SECRETS"
printf '%s' "$TASK13_SESSION_PASSWORD" >"$TASK13_SESSION_RUNTIME_PASSWORD"
printf '%s' "$TASK13_SESSION_MIGRATOR_PASSWORD" >"$TASK13_SESSION_MIGRATOR_PASSWORD_FILE"
cat >"$TASK13_SESSION_CA" <<'EOF'
-----BEGIN CERTIFICATE-----
VEFTSzEzLURJU1BPU0FCTEUtU0VTU0lPTi1DQQ==
-----END CERTIFICATE-----
EOF
chmod 0600 "$TASK13_PI_AUTH" "$TASK13_SESSION_CA"
task13_write_session_ca_fixture
chmod 0600 "$TASK13_PI_AUTH"
chmod 0600 "$TASK13_SECRETS" "$TASK13_SESSION_RUNTIME_PASSWORD" \
"$TASK13_SESSION_MIGRATOR_PASSWORD_FILE"
@@ -2518,7 +2524,7 @@ task13_self_test_source_contract() {
local auth_runtime_mount auth_root_mount auth_projection auth_runtime_owner
local pi_auth_bind pi_projection registry_runtime_mount registry_root_mount registry_projection
local application_secret_bind application_secret_mount application_secret_projection
local application_session_ca_source application_session_password_projection
local application_session_ca_fixture application_session_ca_source application_session_password_projection
local application_secret_parent_owner application_secret_file_owner
local image_evidence_environment image_evidence_initialization
local server_auth_projection_override server_auth_projection_descriptor
@@ -2542,6 +2548,7 @@ task13_self_test_source_contract() {
application_secret_bind='$TASK13_''SECRETS:/run/secrets/thothii.secrets:ro'
application_secret_mount='application-secrets:/run/''secrets:ro'
application_secret_projection='task13_prepare_local_application_''secrets'
application_session_ca_fixture='task13_write_session_ca_''fixture'
application_secret_parent_owner='chown 0:''0 /target'
application_session_ca_source='$TASK13_SESSION_''CA:/source/session_ca.pem:ro'
application_session_password_projection='cp /source/task13-runtime-password /target/session_''runtime_password'
@@ -2593,6 +2600,9 @@ task13_self_test_source_contract() {
[[ "$(grep -Ec "^${application_secret_projection}\\(\\)|^[[:space:]]+${application_secret_projection}$" \
"$root/scripts/unified-deployment-smoke.sh")" -eq 2 ]] \
|| task13_fail "the local application-secret projection must be defined and invoked once"
[[ "$(grep -Ec "^${application_session_ca_fixture}\\(\\)|^[[:space:]]+${application_session_ca_fixture}$" \
"$root/scripts/unified-deployment-smoke.sh")" -eq 3 ]] \
|| task13_fail "the session CA fixture must be defined and written for local and server smokes"
grep -Fq -- "$application_secret_parent_owner" "$root/scripts/unified-deployment-smoke.sh" \
|| task13_fail "the local application-secret mount root must remain root-owned"
grep -Fq -- "$application_session_ca_source" "$root/scripts/unified-deployment-smoke.sh" \