mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: pass vector rotation operator env

Browse Source
This commit is contained in:
marcopan
2026-08-05 08:12:38 +02:00
parent 09834d5cd4
commit c01202f06c
4 changed files with 139 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/test-vector-bootstrap-rotation.sh
+75 -6
View File
@@ -10,7 +10,29 @@ log="$tmp/docker.log"
cat >"$fake" <<'SH'
#!/bin/sh
set -eu
printf '%s:%s\n' "${THT_VECTOR_BOOTSTRAP_USER:-unset}" "$*" >>"$FAKE_DOCKER_LOG"
invocation=$*
test "${1:-}" = compose
shift
env_file=
while [ "$#" -gt 0 ]; do
case "$1" in
--env-file)
[ "$#" -ge 2 ] || exit 64
env_file=$2
shift 2
;;
--env-file=*)
env_file=${1#--env-file=}
shift
;;
*) shift ;;
esac
done
[ -n "$env_file" ] && [ -f "$env_file" ] || {
echo "fake docker rejected missing env file: $env_file" >&2
exit 64
}
printf '%s:%s\n' "${THT_VECTOR_BOOTSTRAP_USER:-unset}" "$invocation" >>"$FAKE_DOCKER_LOG"
exit "${FAKE_DOCKER_EXIT:-0}"
SH
chmod 0755 "$fake"
@@ -20,10 +42,46 @@ printf '%s' "new-'quoted-\$-password" >"$tmp/new"
cp "$tmp/old" "$tmp/original"
printf 'invalid password\n' >"$tmp/whitespace"
chmod 0600 "$tmp/old" "$tmp/new" "$tmp/original" "$tmp/whitespace"
printf '%s\n' 'THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/thoth-workspaces.git' \
>"$tmp/operator.env"
printf '%s\n' 'THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/unsafe.git' \
>"$tmp/unsafe.env"
ln -s "$tmp/operator.env" "$tmp/operator-link.env"
chmod 0600 "$tmp/old" "$tmp/new" "$tmp/original" "$tmp/whitespace" "$tmp/operator.env"
chmod 0660 "$tmp/unsafe.env"
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
>"$tmp/out" 2>"$tmp/err"; then
echo "rotation silently assumed an operator env file" >&2
exit 1
fi
grep -q 'requires --env-file or THT_VECTOR_OPERATOR_ENV_FILE' "$tmp/err"
test ! -s "$log"
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
./scripts/vector-rotate-bootstrap-password.sh --env-file "$tmp/missing.env" \
"$tmp/old" "$tmp/new" >"$tmp/out" 2>"$tmp/err"; then
echo "rotation accepted a nonexistent operator env file" >&2
exit 1
fi
grep -q 'operator env must be a readable regular file' "$tmp/err"
test ! -s "$log"
for unsafe_env in "$tmp/unsafe.env" "$tmp/operator-link.env"; do
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
./scripts/vector-rotate-bootstrap-password.sh --env-file "$unsafe_env" \
"$tmp/old" "$tmp/new" >"$tmp/out" 2>"$tmp/err"; then
echo "rotation accepted unsafe operator env file $unsafe_env" >&2
exit 1
fi
test ! -s "$log"
done
: >"$log"
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/whitespace" \
./scripts/vector-rotate-bootstrap-password.sh --env-file "$tmp/operator.env" \
"$tmp/old" "$tmp/whitespace" \
>"$tmp/out" 2>"$tmp/err"; then
echo "rotation accepted a whitespace-containing secret" >&2
exit 1
@@ -36,7 +94,8 @@ if find "$tmp" -name 'old.rotate.*' -print | grep -q .; then
fi
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" FAKE_DOCKER_EXIT=1 \
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
./scripts/vector-rotate-bootstrap-password.sh --env-file "$tmp/operator.env" \
"$tmp/old" "$tmp/new" \
>"$tmp/out" 2>"$tmp/err"; then
echo "rotation unexpectedly succeeded when database verification failed" >&2
exit 1
@@ -45,12 +104,22 @@ cmp "$tmp/old" "$tmp/original"
: >"$log"
PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
./scripts/vector-rotate-bootstrap-password.sh --env-file "$tmp/operator.env" \
"$tmp/old" "$tmp/new" \
>"$tmp/out" 2>"$tmp/err"
cmp "$tmp/old" "$tmp/new"
grep -q -- "--env-file $tmp/operator.env" "$log"
grep -q '/run/secrets/bootstrap-old:ro' "$log"
grep -q '/run/secrets/bootstrap-new:ro' "$log"
grep -q '^custom_admin:' "$log"
grep -q 'atomically replaced only after verified database login' "$tmp/out"
echo "bootstrap rotation ordering and no-config-change failure contracts passed."
printf '%s' old-password >"$tmp/old"
: >"$log"
PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
THT_VECTOR_OPERATOR_ENV_FILE="$tmp/operator.env" \
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
>"$tmp/out" 2>"$tmp/err"
grep -q -- "--env-file $tmp/operator.env" "$log"
echo "bootstrap rotation env propagation, validation, ordering, and failure contracts passed."