185 lines
4.1 KiB
Bash
Executable File
185 lines
4.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(
|
|
cd "$(dirname "${BASH_SOURCE[0]}")/.." &&
|
|
pwd
|
|
)"
|
|
|
|
cd "$ROOT"
|
|
|
|
echo "========================================"
|
|
echo " managed-container release test suite"
|
|
echo "========================================"
|
|
|
|
echo
|
|
echo ">>> Entrypoint / shell structure"
|
|
./tests/test-entrypoint-structure.sh
|
|
|
|
echo
|
|
echo ">>> Python syntax"
|
|
|
|
while IFS= read -r -d '' file; do
|
|
python3 -m py_compile "$file"
|
|
done < <(
|
|
find ocf \
|
|
-type f \
|
|
-name '*.py' \
|
|
-print0
|
|
)
|
|
|
|
echo "PYTHON_SYNTAX_OK=1"
|
|
|
|
echo
|
|
echo ">>> Host helper shell syntax"
|
|
|
|
for file in postgres-host/*; do
|
|
[[ -f "$file" ]] || continue
|
|
|
|
case "$file" in
|
|
*.sh|*/postgres-ha-bootstrap)
|
|
bash -n "$file"
|
|
;;
|
|
esac
|
|
done
|
|
|
|
echo "HOST_HELPER_SYNTAX_OK=1"
|
|
|
|
echo
|
|
echo ">>> Secret-content guard"
|
|
|
|
python3 - <<'PY_SECRET_GUARD'
|
|
from pathlib import Path
|
|
import re
|
|
import sys
|
|
|
|
roots = [Path("quadlet"), Path("postgres-host")]
|
|
|
|
credential_key = re.compile(
|
|
r'^[A-Z0-9_]*(?:PASSWORD|PASSWD|SECRET|TOKEN)[A-Z0-9_]*$'
|
|
)
|
|
|
|
private_key = re.compile(
|
|
r'-----BEGIN (?:OPENSSH|RSA|EC|DSA) PRIVATE KEY-----'
|
|
)
|
|
|
|
errors = []
|
|
|
|
for root in roots:
|
|
if not root.exists():
|
|
continue
|
|
|
|
for path in root.rglob("*"):
|
|
if not path.is_file():
|
|
continue
|
|
|
|
try:
|
|
text = path.read_text(errors="replace")
|
|
except Exception as exc:
|
|
errors.append(f"{path}: unable to read: {exc}")
|
|
continue
|
|
|
|
if private_key.search(text):
|
|
errors.append(f"{path}: contains private-key material")
|
|
|
|
for lineno, raw in enumerate(text.splitlines(), 1):
|
|
line = raw.strip()
|
|
|
|
if not line or line.startswith("#"):
|
|
continue
|
|
|
|
# Only inspect configuration-style assignments whose KEY itself
|
|
# is uppercase and explicitly credential-related.
|
|
m = re.match(
|
|
r'^([A-Z][A-Z0-9_]*)\s*=\s*(.*)$',
|
|
line
|
|
)
|
|
|
|
if not m:
|
|
continue
|
|
|
|
key, value = m.groups()
|
|
|
|
if not credential_key.match(key):
|
|
continue
|
|
|
|
value = value.strip()
|
|
|
|
# Empty values are not embedded credentials.
|
|
if not value:
|
|
continue
|
|
|
|
# References, secret-file paths, templates and placeholders
|
|
# are acceptable.
|
|
safe_prefixes = (
|
|
"$",
|
|
"${",
|
|
"/run/secrets/",
|
|
"/etc/",
|
|
"<",
|
|
"CHANGE_ME",
|
|
)
|
|
|
|
unquoted = value.strip("'\"")
|
|
|
|
if value.startswith(safe_prefixes) or unquoted.startswith(safe_prefixes):
|
|
continue
|
|
|
|
errors.append(
|
|
f"{path}:{lineno}: possible literal credential assignment: {key}=..."
|
|
)
|
|
|
|
if errors:
|
|
for error in errors:
|
|
print(error, file=sys.stderr)
|
|
|
|
print(
|
|
"ERROR: possible embedded credential material found",
|
|
file=sys.stderr
|
|
)
|
|
sys.exit(1)
|
|
|
|
print("SECRET_GUARD_OK=1")
|
|
PY_SECRET_GUARD
|
|
|
|
echo
|
|
echo ">>> Checksum manifest"
|
|
|
|
if [[ ! -f checksums/SHA256SUMS ]]; then
|
|
echo "ERROR: checksums/SHA256SUMS is missing" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if grep -Eq '\.pre-|\.new($|[[:space:]])' checksums/SHA256SUMS; then
|
|
echo "ERROR: checksum manifest contains development artifacts" >&2
|
|
exit 1
|
|
fi
|
|
|
|
while read -r expected file; do
|
|
[[ -n "${expected:-}" && -n "${file:-}" ]] || continue
|
|
|
|
if [[ ! -f "$file" ]]; then
|
|
echo "ERROR: checksum target is missing: $file" >&2
|
|
exit 1
|
|
fi
|
|
|
|
actual="$(sha256sum "$file" | awk '{print $1}')"
|
|
|
|
if [[ "$actual" != "$expected" ]]; then
|
|
echo "ERROR: checksum mismatch: $file" >&2
|
|
echo " expected=$expected" >&2
|
|
echo " actual=$actual" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! git ls-files --error-unmatch "$file" >/dev/null 2>&1; then
|
|
echo "ERROR: checksum manifest references untracked file: $file" >&2
|
|
exit 1
|
|
fi
|
|
done < checksums/SHA256SUMS
|
|
|
|
echo "CHECKSUM_MANIFEST_OK=1"
|
|
|
|
echo
|
|
echo "ALL_TESTS_PASS=1"
|