40 lines
1.1 KiB
Bash
Executable File
40 lines
1.1 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")/.."
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
|
|
|
|
fake="$tmp/docker"
|
|
log="$tmp/docker.log"
|
|
cat >"$fake" <<'SH'
|
|
#!/bin/sh
|
|
set -eu
|
|
printf '%s\n' "$*" >>"$FAKE_DOCKER_LOG"
|
|
exit "${FAKE_DOCKER_EXIT:-0}"
|
|
SH
|
|
chmod 0755 "$fake"
|
|
|
|
printf '%s' old-password >"$tmp/old"
|
|
printf '%s' "new-'quoted-\$-password" >"$tmp/new"
|
|
cp "$tmp/old" "$tmp/original"
|
|
|
|
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" FAKE_DOCKER_EXIT=1 \
|
|
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
|
|
>"$tmp/out" 2>"$tmp/err"; then
|
|
echo "rotation unexpectedly succeeded when database verification failed" >&2
|
|
exit 1
|
|
fi
|
|
cmp "$tmp/old" "$tmp/original"
|
|
|
|
: >"$log"
|
|
PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
|
|
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
|
|
>"$tmp/out" 2>"$tmp/err"
|
|
cmp "$tmp/old" "$tmp/new"
|
|
grep -q '/run/secrets/bootstrap-old:ro' "$log"
|
|
grep -q '/run/secrets/bootstrap-new:ro' "$log"
|
|
grep -q 'atomically replaced only after verified database login' "$tmp/out"
|
|
|
|
echo "bootstrap rotation ordering and no-config-change failure contracts passed."
|