From 886faed8868833fb42b3a26bda0a33329866871d Mon Sep 17 00:00:00 2001 From: mptyl Date: Tue, 25 Aug 2026 21:26:07 +0200 Subject: [PATCH] fix(ci): project server auth in deployment smoke --- scripts/test-task13-runtime-fixtures.sh | 2 + scripts/unified-deployment-smoke.sh | 60 ++++++++++++++++++++++--- 2 files changed, 57 insertions(+), 5 deletions(-) diff --git a/scripts/test-task13-runtime-fixtures.sh b/scripts/test-task13-runtime-fixtures.sh index 5c8c6d83..501a0107 100755 --- a/scripts/test-task13-runtime-fixtures.sh +++ b/scripts/test-task13-runtime-fixtures.sh @@ -32,6 +32,7 @@ TASK13_INSTALLATION="$fixture/thothii-installation.yaml" TASK13_PI_AUTH="$fixture/pi-auth.json" TASK13_SECRETS="$fixture/thothii.secrets" TASK13_AUTH_ROOT="$fixture/auth" +TASK13_AUTH_RUNTIME_ROOT="$fixture/auth-runtime" TASK13_AUTH_PASSWORD_FILE="$fixture/local-auth-password" TASK13_AUTH_ADMIN=task13-admin TASK13_AUTH_PASSWORD="fixture-auth-password-$profile" @@ -84,6 +85,7 @@ else -f "$root/deploy/compose.server.yaml" -f "$root/deploy/compose.session-server.yaml.example" -f "$TASK13_OVERRIDE" + -f "$root/deploy/compose.auth-runtime-projection.yaml" ) fi diff --git a/scripts/unified-deployment-smoke.sh b/scripts/unified-deployment-smoke.sh index 1d682614..138bffe1 100755 --- a/scripts/unified-deployment-smoke.sh +++ b/scripts/unified-deployment-smoke.sh @@ -308,6 +308,7 @@ task13_compose_files() { -f "$TASK13_ROOT/deploy/compose.server.yaml" -f "$TASK13_ROOT/deploy/compose.session-server.yaml.example" -f "$TASK13_OVERRIDE" + -f "$TASK13_ROOT/deploy/compose.auth-runtime-projection.yaml" ) else TASK13_COMPOSE+=( @@ -684,12 +685,10 @@ EOF chmod 0600 "$TASK13_SERVER_WORKSPACE_CONFIG" mkdir -p "$TASK13_SERVER_DATA" "$TASK13_SERVER_PI_STATE" "$TASK13_SERVER_REGISTRY" - mkdir -p "$TASK13_AUTH_ROOT" "$TASK13_ROOT/scripts/prepare-server-pi-state.sh" \ "$TASK13_SERVER_PI_STATE" "$(id -u)" "$(id -g)" >>"$TASK13_LOG" chmod 0777 "$TASK13_SERVER_DATA" "$TASK13_SERVER_PI_STATE" \ "$TASK13_SERVER_PI_STATE/agent" "$TASK13_SERVER_REGISTRY" - chmod 0700 "$TASK13_AUTH_ROOT" data_root="$TASK13_SERVER_DATA" pi_root="$TASK13_SERVER_PI_STATE" registry_root="$TASK13_SERVER_REGISTRY" @@ -760,6 +759,7 @@ EOF printf 'PI_AUTH_FILE=%s\n' "$TASK13_PI_AUTH" printf 'THT_SECRETS_FILE=%s\n' "$TASK13_SECRETS" printf 'THT_AUTH_CONFIG_ROOT=%s\n' "$TASK13_AUTH_ROOT" + printf 'THT_AUTH_RUNTIME_ROOT=%s\n' "$TASK13_AUTH_RUNTIME_ROOT" printf 'THT_WORKSPACE_GIT_REMOTE=/fixtures/remote.git\n' printf 'THT_WORKSPACE_GIT_BRANCH=%s\n' "$TASK13_BRANCH" printf 'THT_DATA_ROOT=%s\n' "$data_root" @@ -785,6 +785,10 @@ projectDirectory: "$TASK13_ROOT" envFile: "$TASK13_ENV_FILE" authentication: configDirectory: "$TASK13_AUTH_ROOT" + runtimeProjection: + directory: "$TASK13_AUTH_RUNTIME_ROOT" + uid: 10001 + gid: 10001 overrides: - "$TASK13_ROOT/deploy/compose.session-server.yaml.example" - "$TASK13_OVERRIDE" @@ -934,7 +938,7 @@ task13_configure_local_authentication() { } task13_configure_server_oidc_authentication() { - task13_run_logged "configure fake server OIDC authentication" "$TASK13_THT" --installation "$TASK13_INSTALLATION" auth configure \ + task13_run_logged "configure fake server OIDC authentication" sudo -n -- "$TASK13_THT" --installation "$TASK13_INSTALLATION" auth configure \ --mode oidc --public-url "https://task13.example.invalid" \ --issuer "https://task13-fake-oidc:9443/application/o/task13/" --client-id task13-smoke-client \ --authentik-base-url "https://task13-fake-oidc:9443" --user-group task13-users --admin-group task13-admins @@ -1890,6 +1894,19 @@ task13_assert_built_image_ownership() { done } +task13_reclaim_server_fixture_ownership() { + local host_uid host_gid + [[ "${TASK13_PROFILE:-local}" == server ]] || return 0 + [[ -n "${TASK13_TMP:-}" && -d "$TASK13_TMP" ]] || return 0 + [[ "${TASK13_TMP%/*}" == "${TASK13_TMP_PARENT:-}" \ + && "${TASK13_TMP##*/}" == thothii-task13.* ]] \ + || task13_fail "refusing to reclaim an unexpected server fixture path" + host_uid="$(id -u)" + host_gid="$(id -g)" + task13_bounded "$TASK13_CLEANUP_TIMEOUT" "reclaim server fixture ownership" \ + sudo -n -- chown -hR "$host_uid:$host_gid" "$TASK13_TMP" +} + task13_cleanup() { local original_rc="$1" cleanup_rc=0 transaction="" leftovers="" image_id="" set +e @@ -1913,9 +1930,17 @@ task13_cleanup() { if [[ -n "${TASK13_PROJECT:-}" && -n "${TASK13_ROOT:-}" && -f "${TASK13_OVERRIDE:-}" ]]; then if task13_assert_project_ownership >>"${TASK13_LOG:-/dev/null}" 2>&1; then task13_compose_files - task13_bounded "$TASK13_CLEANUP_TIMEOUT" "stop owned Compose project" \ + if task13_bounded "$TASK13_CLEANUP_TIMEOUT" "stop owned Compose project" \ "${TASK13_COMPOSE[@]}" down --volumes --remove-orphans --timeout 10 \ - >>"${TASK13_LOG:-/dev/null}" 2>&1 || cleanup_rc=1 + >>"${TASK13_LOG:-/dev/null}" 2>&1; then + if ! { + task13_reclaim_server_fixture_ownership + } >>"${TASK13_LOG:-/dev/null}" 2>&1; then + cleanup_rc=1 + fi + else + cleanup_rc=1 + fi else cleanup_rc=1 fi @@ -2475,6 +2500,9 @@ task13_self_test_source_contract() { local application_secret_bind application_secret_mount application_secret_projection local application_secret_parent_owner application_secret_file_owner local image_evidence_environment image_evidence_initialization + local server_auth_projection_override server_auth_projection_descriptor + local server_auth_projection_environment server_auth_privileged_configure + local server_fixture_reclamation root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)" workflow="$root/.github/workflows/deployment.yml" runner_preparation="$root/scripts/prepare-linux-docker-runner.sh" @@ -2497,6 +2525,11 @@ task13_self_test_source_contract() { application_secret_file_owner='chown 10001:''10001 /target/thothii.secrets /target/task13-runtime-password' image_evidence_environment='TASK13_IMAGE_EVIDENCE_OUTPUT: ${{ runner.temp }}''/task13-images.json' image_evidence_initialization='TASK13_IMAGE_EVIDENCE_OUTPUT="${TASK13_IMAGE_EVIDENCE_OUTPUT:-$TASK13_ROOT/''.artifacts/task-15/unified-docker-images.json}"' + server_auth_projection_override='deploy/compose.auth-runtime-''projection.yaml' + server_auth_projection_descriptor='runtime''Projection:' + server_auth_projection_environment='THT_AUTH_RUNTIME_''ROOT=%s' + server_auth_privileged_configure='sudo -n -- "$TASK13_''THT"' + server_fixture_reclamation='task13_reclaim_server_fixture_''ownership' if rg -n 'docker[[:space:]]+(system[[:space:]]+)?prune' \ "$root/scripts/unified-deployment-smoke.sh" \ "$root/scripts/tht-update-smoke.sh" \ @@ -2554,6 +2587,17 @@ task13_self_test_source_contract() { || task13_fail "CI must write generated Docker image evidence outside the trusted checkout" grep -Fq -- "$image_evidence_initialization" "$root/scripts/unified-deployment-smoke.sh" \ || task13_fail "the Docker image evidence output must honor an explicit CI path" + grep -Fq -- "$server_auth_projection_override" "$root/scripts/unified-deployment-smoke.sh" \ + || task13_fail "the server smoke must mount the UID 10001 authentication projection" + grep -Fq -- "$server_auth_projection_descriptor" "$root/scripts/unified-deployment-smoke.sh" \ + || task13_fail "the server smoke installation must declare its authentication projection" + grep -Fq -- "$server_auth_projection_environment" "$root/scripts/unified-deployment-smoke.sh" \ + || task13_fail "the server smoke must export the authentication projection root" + grep -Fq -- "$server_auth_privileged_configure" "$root/scripts/unified-deployment-smoke.sh" \ + || task13_fail "the server smoke must publish projected authentication as root" + [[ "$(grep -Ec "^${server_fixture_reclamation}\\(\\)|^[[:space:]]+${server_fixture_reclamation}$" \ + "$root/scripts/unified-deployment-smoke.sh")" -eq 2 ]] \ + || task13_fail "the server smoke must reclaim its root- and core-owned fixture exactly once" [[ -x "$runner_preparation" ]] \ || task13_fail "the Linux Docker runner preparation must be executable" for path in /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup; do @@ -2707,6 +2751,7 @@ task13_initialize() { TASK13_PI_AUTH="$TASK13_TMP/pi-auth.json" TASK13_SECRETS="$TASK13_TMP/thothii.secrets" TASK13_AUTH_ROOT="$TASK13_TMP/auth" + TASK13_AUTH_RUNTIME_ROOT="$TASK13_TMP/auth-runtime" TASK13_AUTH_PASSWORD_FILE="$TASK13_TMP/local-auth-password" TASK13_AUTH_RUNTIME_VOLUME="${TASK13_PROJECT}_auth-runtime" TASK13_AUTH_PROJECTION_CONTAINER="$TASK13_PROJECT-auth-projection" @@ -2752,6 +2797,11 @@ task13_require_tools() { for command in bash git docker curl node openssl python3 sed awk grep rg sort; do command -v "$command" >/dev/null 2>&1 || task13_fail "$command is required" done + if [[ "${TASK13_PROFILE:-local}" == server ]]; then + command -v sudo >/dev/null 2>&1 || task13_fail "sudo is required for the Linux server smoke" + sudo -n -- true >/dev/null 2>&1 \ + || task13_fail "passwordless sudo is required for the Linux server smoke" + fi task13_run_logged "Docker daemon readiness" docker info task13_run_logged "Docker Compose readiness" docker compose version task13_self_test_source_contract