andreas/vanlink
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deploy: apply helper hardening (signal ordering, timeout -k, self-cleanup, checked pristine mv)

Browse Source 
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9
This commit is contained in:
andreas
2026-09-23 19:01:25 -04:00
co-authored by Claude Sonnet 5
parent cefca06dac
commit 50ac006894
2 changed files with 25 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/check-templates.sh
+9 -2
View File
@@ -304,7 +304,7 @@ case " $* " in *" -I "*) exit "${STUB_GW_PING:-0}" ;; esac
exit "${STUB_NET_PING:-0}"
STUB
printf '#!/bin/bash\nexec /bin/sleep 0.05\n' > "$stubs/sleep"
printf '#!/bin/bash\nshift\nexec "$@"\n' > "$stubs/timeout"
printf '#!/bin/bash\n[ "$1" = -k ] && shift 2\nshift\nexec "$@"\n' > "$stubs/timeout"
printf '#!/bin/bash\nexit 0\n' >> "$stubs/systemctl"
chmod +x "$stubs"/*
stubs_ok=1
@@ -336,6 +336,7 @@ STUB
an_run
a_is "success: exit 0" "$rc" 0; a_is "success: status" "$(st_word)" ok
grep -q '^ping -c1 -W2 -I enP2p33s0 192.168.100.1$' "$sb/calls" && ok "apply helper success: gateway from the DHCP routers option" || bad "apply helper success: routers option not used"
[ ! -e "$sb/helper.sh" ] && ok "apply helper success: helper removed itself" || bad "apply helper success: helper file left behind"
grep -q 'route to 1.1.1.1:' "$sb/log" && ok "apply helper success: route logged" || bad "apply helper success: no route log"
grep -q 'apply-network OK' "$sb/log" && ok "apply helper success: log OK" || bad "apply helper success: log"
a_is "success: 50-van-wan.yaml mode" "$(stat -c %a "$sb/netplan/50-van-wan.yaml" 2>/dev/null)" 600
@@ -396,7 +397,6 @@ STUB
a_is "failed rollback, no connectivity: status" "$(st_word)" rollback-failed
grep -q '^systemctl reboot' "$sb/calls" && ok "apply helper: reboots when the rollback failed and connectivity is absent" || bad "apply helper: no reboot after failed rollback"
rm -rf "$sb"
chmod 600 "$sb/bak/60-other.yaml" 2>/dev/null || true; rm -rf "$sb"
# (8) TERM while a slow netplan apply is running: the trap restores, once
an_prep && {
: > "$sb/hold"
@@ -414,6 +414,13 @@ STUB
rm -rf "$sb"
}
rm -rf "$stubs"
# 18a. ordering that a behavioural test cannot reach (a signal at an exact instant), checked on the text
r1=$(echo "$h" | grep -A2 '^restore() {' | sed -n 2p)
[ "$r1" = " trap '' TERM INT HUP" ] && ok "apply helper: restore() ignores signals before its guard" || bad "apply helper: restore() must start with trap '' (got '$r1')"
so=$(echo "$h" | grep -n '^status ok$' | cut -d: -f1); tr=$(echo "$h" | grep -n '^trap - TERM INT HUP$' | cut -d: -f1)
[ -n "$so" ] && [ -n "$tr" ] && [ "$so" -lt "$tr" ] && ok "apply helper: status ok is written before the trap is removed" || bad "apply helper: status ok must precede trap removal"
echo "$h" | grep -q "^trap 'rm -f \"\$0\"' EXIT$" && ok "apply helper removes itself on exit" || bad "apply helper lacks the self-remove EXIT trap"
echo "$h" | grep -q 'timeout -k 10 30 netplan generate' && echo "$h" | grep -q 'timeout -k 10 90 netplan apply' && ok "apply helper: netplan under timeout -k" || bad "apply helper: netplan lacks timeout -k"
fi
# 18b. status file gate and STARLINK_IFACE validation
gs=$(mktemp -d)