126 lines
3.9 KiB
Bash
Executable File
126 lines
3.9 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")/.."
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
|
|
|
|
fake="$tmp/docker"
|
|
log="$tmp/docker.log"
|
|
cat >"$fake" <<'SH'
|
|
#!/bin/sh
|
|
set -eu
|
|
invocation=$*
|
|
test "${1:-}" = compose
|
|
shift
|
|
env_file=
|
|
while [ "$#" -gt 0 ]; do
|
|
case "$1" in
|
|
--env-file)
|
|
[ "$#" -ge 2 ] || exit 64
|
|
env_file=$2
|
|
shift 2
|
|
;;
|
|
--env-file=*)
|
|
env_file=${1#--env-file=}
|
|
shift
|
|
;;
|
|
*) shift ;;
|
|
esac
|
|
done
|
|
[ -n "$env_file" ] && [ -f "$env_file" ] || {
|
|
echo "fake docker rejected missing env file: $env_file" >&2
|
|
exit 64
|
|
}
|
|
printf '%s:%s\n' "${THT_VECTOR_BOOTSTRAP_USER:-unset}" "$invocation" >>"$FAKE_DOCKER_LOG"
|
|
exit "${FAKE_DOCKER_EXIT:-0}"
|
|
SH
|
|
chmod 0755 "$fake"
|
|
|
|
printf '%s' old-password >"$tmp/old"
|
|
printf '%s' "new-'quoted-\$-password" >"$tmp/new"
|
|
cp "$tmp/old" "$tmp/original"
|
|
|
|
printf 'invalid password\n' >"$tmp/whitespace"
|
|
printf '%s\n' 'THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/thoth-workspaces.git' \
|
|
>"$tmp/operator.env"
|
|
printf '%s\n' 'THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/unsafe.git' \
|
|
>"$tmp/unsafe.env"
|
|
ln -s "$tmp/operator.env" "$tmp/operator-link.env"
|
|
chmod 0600 "$tmp/old" "$tmp/new" "$tmp/original" "$tmp/whitespace" "$tmp/operator.env"
|
|
chmod 0660 "$tmp/unsafe.env"
|
|
|
|
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
|
|
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
|
|
>"$tmp/out" 2>"$tmp/err"; then
|
|
echo "rotation silently assumed an operator env file" >&2
|
|
exit 1
|
|
fi
|
|
grep -q 'requires --env-file or THT_VECTOR_OPERATOR_ENV_FILE' "$tmp/err"
|
|
test ! -s "$log"
|
|
|
|
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
|
|
./scripts/vector-rotate-bootstrap-password.sh --env-file "$tmp/missing.env" \
|
|
"$tmp/old" "$tmp/new" >"$tmp/out" 2>"$tmp/err"; then
|
|
echo "rotation accepted a nonexistent operator env file" >&2
|
|
exit 1
|
|
fi
|
|
grep -q 'operator env must be a readable regular file' "$tmp/err"
|
|
test ! -s "$log"
|
|
|
|
for unsafe_env in "$tmp/unsafe.env" "$tmp/operator-link.env"; do
|
|
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
|
|
./scripts/vector-rotate-bootstrap-password.sh --env-file "$unsafe_env" \
|
|
"$tmp/old" "$tmp/new" >"$tmp/out" 2>"$tmp/err"; then
|
|
echo "rotation accepted unsafe operator env file $unsafe_env" >&2
|
|
exit 1
|
|
fi
|
|
test ! -s "$log"
|
|
done
|
|
|
|
: >"$log"
|
|
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
|
|
./scripts/vector-rotate-bootstrap-password.sh --env-file "$tmp/operator.env" \
|
|
"$tmp/old" "$tmp/whitespace" \
|
|
>"$tmp/out" 2>"$tmp/err"; then
|
|
echo "rotation accepted a whitespace-containing secret" >&2
|
|
exit 1
|
|
fi
|
|
cmp "$tmp/old" "$tmp/original"
|
|
test ! -s "$log"
|
|
if find "$tmp" -name 'old.rotate.*' -print | grep -q .; then
|
|
echo "rotation staged a deployment file before secret validation" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" FAKE_DOCKER_EXIT=1 \
|
|
./scripts/vector-rotate-bootstrap-password.sh --env-file "$tmp/operator.env" \
|
|
"$tmp/old" "$tmp/new" \
|
|
>"$tmp/out" 2>"$tmp/err"; then
|
|
echo "rotation unexpectedly succeeded when database verification failed" >&2
|
|
exit 1
|
|
fi
|
|
cmp "$tmp/old" "$tmp/original"
|
|
|
|
: >"$log"
|
|
PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
|
|
./scripts/vector-rotate-bootstrap-password.sh --env-file "$tmp/operator.env" \
|
|
"$tmp/old" "$tmp/new" \
|
|
>"$tmp/out" 2>"$tmp/err"
|
|
cmp "$tmp/old" "$tmp/new"
|
|
grep -q -- "--env-file $tmp/operator.env" "$log"
|
|
grep -q '/run/secrets/bootstrap-old:ro' "$log"
|
|
grep -q '/run/secrets/bootstrap-new:ro' "$log"
|
|
grep -q '^custom_admin:' "$log"
|
|
grep -q 'atomically replaced only after verified database login' "$tmp/out"
|
|
|
|
printf '%s' old-password >"$tmp/old"
|
|
: >"$log"
|
|
PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
|
|
THT_VECTOR_OPERATOR_ENV_FILE="$tmp/operator.env" \
|
|
./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
|
|
>"$tmp/out" 2>"$tmp/err"
|
|
grep -q -- "--env-file $tmp/operator.env" "$log"
|
|
|
|
echo "bootstrap rotation env propagation, validation, ordering, and failure contracts passed."
|