Lyncoln
ec2077f979
Extract PostgreSQL, Podman runtime and systemd lifecycle adapters while preserving existing lifecycle and scoring behavior. Update RPM layout and add guarded operator-run lab harnesses. Record successful manual stop/start, promotion, demotion and rewind-only rejoin with pinned installed hashes. The unfenced lab does not validate automatic failover, Pacemaker-managed transitions or divergent-data rewind. Validation: 103 offline tests, original-function differential checks, checksum manifest and whitespace checks passed.
46 lines
2.0 KiB
Python
46 lines
2.0 KiB
Python
#!/usr/bin/env python3
|
|
"""Read-only checks after installing the RPM in a disposable build container."""
|
|
from pathlib import Path
|
|
import stat
|
|
import subprocess
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
PROVIDER = Path('/usr/lib/ocf/resource.d/loxthelion')
|
|
AGENT = PROVIDER / 'managed-container'
|
|
PACKAGE = 'ocf-managed-container'
|
|
|
|
|
|
def output(*args):
|
|
return subprocess.check_output(args, text=True)
|
|
|
|
|
|
assert output('rpm', '-q', '--qf', '%{ARCH}', PACKAGE) == 'noarch'
|
|
assert output('rpm', '-q', '--scripts', PACKAGE) == ''
|
|
subprocess.run(['rpm', '-V', PACKAGE], check=True)
|
|
expected = {AGENT: ROOT / 'refactored/managed-container'}
|
|
for path in (ROOT / 'refactored/managed-container.d').rglob('*'):
|
|
if not path.is_file() or path.suffix not in ('.sh', '.py'):
|
|
continue
|
|
expected[PROVIDER / path.relative_to(ROOT / 'refactored')] = path
|
|
assert len(expected) == 15
|
|
for path, source in expected.items():
|
|
assert path.read_bytes() == source.read_bytes(), path
|
|
info = path.stat()
|
|
assert (info.st_uid, info.st_gid) == (0, 0), path
|
|
assert stat.S_IMODE(info.st_mode) == (0o755 if path == AGENT else 0o644), path
|
|
|
|
owned = set(output('rpm', '-ql', PACKAGE).splitlines())
|
|
allowed = {str(path) for path in expected} | {str(PROVIDER), str(PROVIDER / 'managed-container.d')}
|
|
for path in expected:
|
|
allowed.update(str(parent) for parent in path.parents if parent == PROVIDER or PROVIDER in parent.parents)
|
|
for directory in allowed - {str(path) for path in expected}:
|
|
info = Path(directory).stat()
|
|
assert (info.st_uid, info.st_gid, stat.S_IMODE(info.st_mode)) == (0, 0, 0o755), directory
|
|
unexpected = {path for path in owned - allowed if not path.startswith('/usr/share/doc/' + PACKAGE)}
|
|
assert not unexpected, unexpected
|
|
|
|
reference = output(str(ROOT / 'refactored/managed-container'), 'meta-data')
|
|
installed = subprocess.check_output([str(AGENT), 'meta-data'], cwd='/tmp', text=True)
|
|
assert installed == reference
|
|
print('PASS installed RPM: noarch, file integrity, root ownership, modes, payload, no scriptlets, metadata/module loading')
|