56 lines
1.7 KiB
Bash
Executable File
56 lines
1.7 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")/.."
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
|
|
|
|
fake="$tmp/docker"
|
|
log="$tmp/docker.log"
|
|
cat >"$fake" <<'SH'
|
|
#!/bin/sh
|
|
set -eu
|
|
printf '%s:%s\n' "${THT_VECTOR_BOOTSTRAP_USER:-unset}" "$*" >>"$FAKE_DOCKER_LOG"
|
|
exit "${FAKE_DOCKER_EXIT:-0}"
|
|
SH
|
|
chmod 0755 "$fake"
|
|
|
|
printf '%s' old-password >"$tmp/old"
|
|
printf '%s' "new-'quoted-\$-password" >"$tmp/new"
|
|
cp "$tmp/old" "$tmp/original"
|
|
|
|
printf 'invalid password\n' >"$tmp/whitespace"
|
|
: >"$log"
|
|
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
|
|
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/whitespace" \
|
|
>"$tmp/out" 2>"$tmp/err"; then
|
|
echo "rotation accepted a whitespace-containing secret" >&2
|
|
exit 1
|
|
fi
|
|
cmp "$tmp/old" "$tmp/original"
|
|
test ! -s "$log"
|
|
if find "$tmp" -name 'old.rotate.*' -print | grep -q .; then
|
|
echo "rotation staged a deployment file before secret validation" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" FAKE_DOCKER_EXIT=1 \
|
|
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
|
|
>"$tmp/out" 2>"$tmp/err"; then
|
|
echo "rotation unexpectedly succeeded when database verification failed" >&2
|
|
exit 1
|
|
fi
|
|
cmp "$tmp/old" "$tmp/original"
|
|
|
|
: >"$log"
|
|
PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
|
|
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
|
|
>"$tmp/out" 2>"$tmp/err"
|
|
cmp "$tmp/old" "$tmp/new"
|
|
grep -q '/run/secrets/bootstrap-old:ro' "$log"
|
|
grep -q '/run/secrets/bootstrap-new:ro' "$log"
|
|
grep -q '^custom_admin:' "$log"
|
|
grep -q 'atomically replaced only after verified database login' "$tmp/out"
|
|
|
|
echo "bootstrap rotation ordering and no-config-change failure contracts passed."
|