271 lines
13 KiB
Bash
Executable File
271 lines
13 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
WORK=$(mktemp -d)
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
fail() {
|
|
printf 'Install fixture failed: %s\n' "$1" >&2
|
|
exit 1
|
|
}
|
|
|
|
# Load only pure helper functions. The installer itself must never run in this fixture.
|
|
{
|
|
sed -n '/^decode_env_value()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^read_env_file()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^read_existing_env()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^read_setup_env()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^read_reinstall_env()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^port_is_listening()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^valid_app_port()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^configure_app_port()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^is_semver()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^write_env_file_preserving_unknown()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^azul_arch()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^sha256_file()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^prepare_java()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^download_release_url()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^release_asset_url()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
sed -n '/^download_release_asset()/,/^}/p' "$ROOT/deploy/install.sh"
|
|
} > "$WORK/helpers.sh"
|
|
# shellcheck disable=SC1090,SC1091
|
|
source "$WORK/helpers.sh"
|
|
|
|
# shellcheck disable=SC2034 # Referenced by the extracted installer helper.
|
|
REINSTALL=true
|
|
# shellcheck disable=SC2034 # Referenced by the extracted installer helper.
|
|
WORK_DIR=$WORK
|
|
# shellcheck disable=SC2034 # Referenced by the extracted installer helper.
|
|
CONFIG_ROOT=$WORK
|
|
STATE_ROOT=$WORK/state
|
|
mkdir -p "$STATE_ROOT/setup"
|
|
env_file="$WORK/kaidi.env"
|
|
cat > "$env_file" <<'ENV'
|
|
# operator-owned values must survive a reinstall
|
|
FINANCE_SESSION_ABSOLUTE_TIMEOUT="45m"
|
|
FILE_SCANNER_HOST="scanner.internal"
|
|
FILE_SCANNER_PORT="3310"
|
|
DB_URL="jdbc:mysql://old/kaidi_finance"
|
|
APP_VERSION="old"
|
|
ENV
|
|
|
|
# shellcheck disable=SC2016 # These shell characters must remain literal data.
|
|
literal_password='pw$HOME-$(touch PLACEHOLDER)-`id`-back\slash-"quote"'
|
|
literal_password=${literal_password/PLACEHOLDER/$WORK\/executed}
|
|
|
|
write_env_file_preserving_unknown "$env_file" \
|
|
DB_URL 'jdbc:mysql://new/kaidi_finance' \
|
|
DB_PASSWORD "$literal_password" \
|
|
APP_VERSION '1.0.0-preview.1'
|
|
|
|
grep -qx 'FINANCE_SESSION_ABSOLUTE_TIMEOUT="45m"' "$env_file" \
|
|
|| fail 'reinstall removed the custom session timeout'
|
|
grep -qx 'FILE_SCANNER_HOST="scanner.internal"' "$env_file" \
|
|
|| fail 'reinstall removed the custom scanner host'
|
|
grep -qx 'DB_URL="jdbc:mysql://new/kaidi_finance"' "$env_file" \
|
|
|| fail 'reinstall did not replace the managed database URL'
|
|
[ "$(grep -c '^DB_URL=' "$env_file")" -eq 1 ] || fail 'reinstall duplicated a managed key'
|
|
[ "$(grep -c '^APP_VERSION=' "$env_file")" -eq 1 ] || fail 'reinstall duplicated the application version'
|
|
[ "$(read_existing_env DB_PASSWORD)" = "$literal_password" ] \
|
|
|| fail 'reinstall changed literal shell characters in the database password'
|
|
[ ! -e "$WORK/executed" ] || fail 'reinstall executed database password content'
|
|
|
|
cat > "$STATE_ROOT/setup/application.env" <<'ENV'
|
|
DB_URL="jdbc:mysql://runtime/kaidi_finance"
|
|
DB_USERNAME="runtime-user"
|
|
DB_PASSWORD="runtime-password"
|
|
ENV
|
|
grep -qx 'jdbc:mysql://runtime/kaidi_finance' <(read_reinstall_env DB_URL) \
|
|
|| fail 'reinstall did not prefer the completed setup runtime database URL'
|
|
grep -qx 'runtime-user' <(read_reinstall_env DB_USERNAME) \
|
|
|| fail 'reinstall did not prefer the completed setup runtime database user'
|
|
|
|
for port in 1024 18080 65535; do
|
|
valid_app_port "$port" || fail "installer rejected valid application port $port"
|
|
done
|
|
for port in 0 80 1023 65536 invalid 18080.0; do
|
|
! valid_app_port "$port" || fail "installer accepted invalid application port $port"
|
|
done
|
|
port_is_listening() { return 1; }
|
|
log() { printf '%s\n' "$*" >/dev/null; }
|
|
# shellcheck disable=SC2329 # Invoked by the extracted installer helper.
|
|
die() { printf '%s\n' "$*" >&2; return 1; }
|
|
export APP_PORT=19090 SERVER_ADDRESS=127.0.0.1 HEALTH_URL='' APP_INDEX_URL='' REINSTALL=false
|
|
configure_app_port
|
|
[ "$HEALTH_URL" = 'http://127.0.0.1:19090/actuator/health' ] \
|
|
|| fail 'selected application port did not reach the health URL'
|
|
[ "$APP_INDEX_URL" = 'http://127.0.0.1:19090/' ] \
|
|
|| fail 'selected application port did not reach the frontend URL'
|
|
export APP_PORT=19091 SERVER_ADDRESS=::1 HEALTH_URL='' APP_INDEX_URL=''
|
|
configure_app_port
|
|
[ "$HEALTH_URL" = 'http://[::1]:19091/actuator/health' ] \
|
|
|| fail 'IPv6 bind address did not produce a bracketed health URL'
|
|
[ "$APP_INDEX_URL" = 'http://[::1]:19091/' ] \
|
|
|| fail 'IPv6 bind address did not produce a bracketed frontend URL'
|
|
[ "$PROXY_TARGET" = 'http://[::1]:19091' ] \
|
|
|| fail 'IPv6 bind address did not produce a bracketed reverse-proxy target'
|
|
|
|
for version in 0.0.0 1.2.3-alpha- 1.2.3--alpha 1.2.3-alpha+build.07; do
|
|
is_semver "$version" || fail "installer rejected valid SemVer $version"
|
|
"$ROOT/scripts/check-semver.sh" "$version" || fail "release workflow rejected valid SemVer $version"
|
|
done
|
|
for version in 01.2.3 1.02.3 1.2.03 1.2.3-01 1.2.3-alpha..1; do
|
|
! is_semver "$version" || fail "installer accepted invalid SemVer $version"
|
|
! "$ROOT/scripts/check-semver.sh" "$version" >/dev/null 2>&1 \
|
|
|| fail "release workflow accepted invalid SemVer $version"
|
|
done
|
|
|
|
ARCH_FIXTURE=
|
|
uname() {
|
|
if [ "${1:-}" = -m ]; then
|
|
printf '%s\n' "$ARCH_FIXTURE"
|
|
else
|
|
command uname "$@"
|
|
fi
|
|
}
|
|
die() {
|
|
return 1
|
|
}
|
|
for arch in i386 i486 i586 i686; do
|
|
ARCH_FIXTURE=$arch
|
|
[ "$(azul_arch)" = i686 ] || fail "$arch did not map to the Azul i686 runtime"
|
|
done
|
|
|
|
mkdir -p "$WORK/fake-jre/bin"
|
|
cat > "$WORK/fake-jre/bin/java" <<'JAVA'
|
|
#!/usr/bin/env sh
|
|
printf 'openjdk version "17-fixture"\n' >&2
|
|
JAVA
|
|
chmod 0755 "$WORK/fake-jre/bin/java"
|
|
tar -czf "$WORK/java-fixture.tar.gz" -C "$WORK" fake-jre
|
|
java_fixture_sha=$(sha256sum "$WORK/java-fixture.tar.gz" | awk '{print $1}')
|
|
cat > "$WORK/java-list.json" <<'JSON'
|
|
[{"name":"zulu17-fixture-linux_i686.tar.gz","package_uuid":"fixture-package"}]
|
|
JSON
|
|
cat > "$WORK/java-detail.json" <<JSON
|
|
{"download_url":"https://cdn.azul.com/zulu/bin/zulu17-fixture-linux_i686.tar.gz",
|
|
"sha256_hash":"$java_fixture_sha"}
|
|
JSON
|
|
download() {
|
|
case "$1" in
|
|
*'/packages/?'*) cp "$WORK/java-list.json" "$2" ;;
|
|
*/packages/fixture-package) cp "$WORK/java-detail.json" "$2" ;;
|
|
https://cdn.azul.com/*) cp "$WORK/java-fixture.tar.gz" "$2" ;;
|
|
*) fail "unexpected Java fixture URL: $1" ;;
|
|
esac
|
|
}
|
|
ARCH_FIXTURE=i686
|
|
prepare_java >/dev/null 2>&1
|
|
[ -x "$JAVA_STAGED_DIR/bin/java" ] || fail 'verified i686 Java runtime was not staged'
|
|
|
|
export RELEASE_API_URL=https://gitea.fixture.invalid/api/v1/repos/ERP-Team/kaidi/releases/latest
|
|
RELEASE_TOKEN=fixture-read-only-token
|
|
RELEASE_AUTH_HEADER_FILE=$WORK/release-auth-header
|
|
printf 'Authorization: token %s\n' "$RELEASE_TOKEN" > "$RELEASE_AUTH_HEADER_FILE"
|
|
chmod 0600 "$RELEASE_AUTH_HEADER_FILE"
|
|
cat > "$WORK/release-api.json" <<'JSON'
|
|
{"tag_name":"v1.0.0-preview.11","assets":[
|
|
{"name":"release-manifest.json","browser_download_url":"https://gitea.fixture.invalid/assets/release-manifest.json"}
|
|
]}
|
|
JSON
|
|
printf 'signed manifest fixture\n' > "$WORK/release-manifest.fixture"
|
|
: > "$WORK/release-curl.log"
|
|
curl() {
|
|
local output='' url='' header_file='' argument=''
|
|
printf '%s\n' "$*" >> "$WORK/release-curl.log"
|
|
for argument in "$@"; do
|
|
case "$argument" in
|
|
@*) header_file=${argument#@} ;;
|
|
https://*) url=$argument ;;
|
|
esac
|
|
done
|
|
while [ "$#" -gt 0 ]; do
|
|
case "$1" in
|
|
-o) shift; output=$1 ;;
|
|
esac
|
|
shift
|
|
done
|
|
[ "$header_file" = "$RELEASE_AUTH_HEADER_FILE" ] || return 90
|
|
grep -Fqx "Authorization: token $RELEASE_TOKEN" "$header_file" || return 91
|
|
[ "$url" = https://gitea.fixture.invalid/ERP-Team/kaidi/releases/download/v1.0.0-preview.11/release-manifest.json ] \
|
|
|| return 92
|
|
cp "$WORK/release-manifest.fixture" "$output"
|
|
}
|
|
[ "$(release_asset_url release-manifest.json)" = \
|
|
https://gitea.fixture.invalid/ERP-Team/kaidi/releases/download/v1.0.0-preview.11/release-manifest.json ] \
|
|
|| fail 'installer did not construct the trusted Gitea release asset URL'
|
|
download_release_asset release-manifest.json "$WORK/downloaded-manifest.json"
|
|
cmp -s "$WORK/release-manifest.fixture" "$WORK/downloaded-manifest.json" \
|
|
|| fail 'installer did not download the private Gitea release asset'
|
|
! grep -Fq "$RELEASE_TOKEN" "$WORK/release-curl.log" \
|
|
|| fail 'installer leaked the private Gitea token into curl process arguments'
|
|
! grep -Fq -- '--location' "$WORK/release-curl.log" \
|
|
|| fail 'installer allowed authenticated Gitea redirects'
|
|
|
|
jq '.assets[0].browser_download_url = "https://assets.fixture.invalid/release-manifest.json"' \
|
|
"$WORK/release-api.json" > "$WORK/release-api.cross-origin.json"
|
|
mv "$WORK/release-api.cross-origin.json" "$WORK/release-api.json"
|
|
[ "$(release_asset_url release-manifest.json)" = \
|
|
https://gitea.fixture.invalid/ERP-Team/kaidi/releases/download/v1.0.0-preview.11/release-manifest.json ] \
|
|
|| fail 'installer trusted the cross-origin browser download URL'
|
|
|
|
# shellcheck disable=SC2016 # Match literal installer source.
|
|
grep -Fq '[ "$APP_ROOT" = /opt/kaidi ]' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer no longer rejects unsupported custom roots'
|
|
grep -Fq '8.4.*) ;;' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer no longer enforces MySQL 8.4.x'
|
|
# shellcheck disable=SC2016 # Match literal installer source.
|
|
grep -Fq 'write_env_file_preserving_unknown "$CONFIG_ROOT/kaidi.env"' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer no longer uses the reinstall-safe environment writer'
|
|
# shellcheck disable=SC2016 # Match literal installer source.
|
|
grep -Fq 'download "$api" "$java_metadata"' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer no longer applies the restricted downloader to Java metadata'
|
|
# shellcheck disable=SC2016 # Match literal installer source.
|
|
grep -Fq 'java_sha256=$(jq -er' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer no longer obtains the Java runtime SHA-256'
|
|
# shellcheck disable=SC2016 # Match literal installer source.
|
|
grep -Fq '[ "$actual_sha256" = "$java_sha256" ]' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer no longer verifies the Java runtime SHA-256'
|
|
grep -Fq 'https://git.awaioi.com/api/v1/repos/ERP-Team/kaidi/releases/latest' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer default release source is not the public Gitea latest API'
|
|
# shellcheck disable=SC2016 # Match literal installer source.
|
|
grep -Fq 'TRUSTED_PUBLIC_KEY_SHA256=${KAIDI_RELEASE_PUBLIC_KEY_SHA256:-807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9}' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer does not pin the default release public-key fingerprint'
|
|
# shellcheck disable=SC2016 # Match literal installer source.
|
|
grep -Fq 'SETUP_WIZARD=${KAIDI_SETUP_WIZARD:-true}' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer does not enable the first-run setup wizard by default'
|
|
! grep -Fq 'docker run' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer must not create a MySQL container'
|
|
! grep -Fq 'install_docker' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer must not install Docker or MySQL automatically'
|
|
grep -Fq 'An external MySQL 8.4 database is required' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer does not require an operator-managed external MySQL database'
|
|
grep -Fq 'KAIDI_RELEASE_TOKEN_FILE' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer no longer supports a protected initial Gitea token file'
|
|
grep -Fq 'KAIDI_SETUP_WIZARD' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer no longer supports first-run setup mode'
|
|
grep -Fq 'FINANCE_SETUP_TOKEN_SHA256' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer no longer writes the one-time setup-code hash'
|
|
# shellcheck disable=SC2016 # Match literal installer source.
|
|
grep -Fq 'SERVER_PORT "$APP_PORT"' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer does not persist the selected application port'
|
|
# shellcheck disable=SC2016 # Match literal installer source.
|
|
grep -Fq 'SERVER_ADDRESS "$SERVER_ADDRESS"' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer does not persist the selected bind address'
|
|
! grep -Eqi 'nginx|/etc/nginx/' "$ROOT/deploy/install.sh" \
|
|
|| fail 'installer must not install, start, or modify Nginx'
|
|
grep -Fq 'EnvironmentFile=-/var/lib/kaidi/setup/application.env' \
|
|
"$ROOT/deploy/systemd/kaidi-finance.service" \
|
|
|| fail 'application service no longer loads the setup-completion environment'
|
|
grep -Fq 'EnvironmentFile=-/var/lib/kaidi/setup/application.env' \
|
|
"$ROOT/deploy/systemd/kaidi-update.service" \
|
|
|| fail 'update service no longer loads setup database overrides'
|
|
# shellcheck disable=SC2016 # Match the literal installer source.
|
|
grep -Fq 'chown root:kaidi "$UPDATE_STATE_ROOT"' "$ROOT/deploy/install.sh" \
|
|
|| fail 'update state parent is not group-accessible to the application user'
|
|
grep -Fq 'install.sh | sudo bash' "$ROOT/README.md" \
|
|
|| fail 'README does not document the public one-line setup-wizard install path'
|
|
|
|
printf 'Install configuration, custom port, public Gitea, optional private token, i686, setup wizard, and MySQL 8.4 fixtures passed\n'
|