coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keep isolated SQL import on trusted container socket
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-06 01:25:14 +02:00
parent 3614985c5a
commit 603c2926fa
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/restore_forgejo_offsite_locally.py
View file

@ -107,14 +107,16 @@ LEVEL = Error
docker('run','-d','--name',db,'--network',network,'--log-driver','none','--memory','1g',
'-e','POSTGRES_PASSWORD','-e','POSTGRES_USER=forgejo','-e','POSTGRES_DB=forgejo',POSTGRES,env=env)
resources.append(('container',db))
# Initialization uses a temporary socket-only server; wait for final TCP.
# Then use the disposable container's trusted local socket for import.
for _ in range(30):
if docker('exec',db,'pg_isready','-h','127.0.0.1','-U','forgejo',check=False).returncode==0: break
time.sleep(2)
else: raise ValueError('database_not_ready')
sql=(staging/'forgejo-db.sql').read_bytes()
docker('exec','-i',db,'psql','-h','127.0.0.1','-U','forgejo','-d','forgejo','--single-transaction','-v','ON_ERROR_STOP=1',payload=sql,timeout=900)
docker('exec','-i',db,'psql','-U','forgejo','-d','forgejo','--single-transaction','-v','ON_ERROR_STOP=1',payload=sql,timeout=900)
receipt['database_import']=True
counts=docker('exec',db,'psql','-h','127.0.0.1','-U','forgejo','-d','forgejo','-Atqc',
counts=docker('exec',db,'psql','-U','forgejo','-d','forgejo','-Atqc',
'SELECT (SELECT count(*) FROM repository),(SELECT count(*) FROM "user"),(SELECT count(*) FROM package_blob);').stdout.decode().strip()
numbers=[int(n) for n in counts.split('|')]
if min(numbers[:2]) <= 0: raise ValueError('empty_database')
@ -136,7 +138,7 @@ LEVEL = Error
receipt['application_health']=True
receipt['stage']='repository_recovery'
# Select restored public repositories only, keeping payloads out of evidence.
rows=docker('exec',db,'psql','-h','127.0.0.1','-U','forgejo','-d','forgejo','-Atqc',
rows=docker('exec',db,'psql','-U','forgejo','-d','forgejo','-Atqc',
'SELECT u.lower_name || \'/\' || r.lower_name FROM repository r JOIN "user" u ON u.id=r.owner_id WHERE NOT r.is_private AND NOT r.is_empty LIMIT 2;').stdout.decode().splitlines()
if not rows: raise ValueError('public_repository_fixture_missing')
receipt['repositories_verified']=[]
@ -150,7 +152,7 @@ LEVEL = Error
receipt['repositories_verified'].append(repo)
receipt['stage']='package_blob_recovery'
# Each stored blob must survive extraction and match its database digest.
rows=docker('exec',db,'psql','-h','127.0.0.1','-U','forgejo','-d','forgejo','-Atqc','SELECT hash_sha256 FROM package_blob;').stdout.decode().splitlines()
rows=docker('exec',db,'psql','-U','forgejo','-d','forgejo','-Atqc','SELECT hash_sha256 FROM package_blob;').stdout.decode().splitlines()
files=list((staging/'data'/'packages').rglob('*')) if (staging/'data'/'packages').exists() else []
available={p.name:p for p in files if p.is_file()}
verified=0