d0c7249a0d
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
72 lines
3.1 KiB
Python
72 lines
3.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Capture only a completed, byte-identical and CRC-verified Forgejo ZIP."""
|
|
import argparse
|
|
import hashlib
|
|
from pathlib import Path
|
|
import secrets
|
|
import subprocess
|
|
import time
|
|
import zipfile
|
|
|
|
|
|
def validate_archive(path):
|
|
with zipfile.ZipFile(path) as archive:
|
|
names = set(archive.namelist())
|
|
if 'forgejo-db.sql' not in names or not any(n.startswith('repos/') for n in names):
|
|
raise ValueError('required archive content missing')
|
|
if archive.testzip() is not None:
|
|
raise ValueError('archive checksum failure')
|
|
|
|
|
|
def capture(namespace, pod, destination):
|
|
k = ['kubectl', 'exec', '--request-timeout=120s', '-n', namespace, pod, '-c', 'gitea', '--']
|
|
def call(args, timeout=150):
|
|
r = subprocess.run(k + args, capture_output=True, timeout=timeout)
|
|
if r.returncode: raise ValueError('capture command failed')
|
|
return r.stdout
|
|
remote = '/tmp/wp0029-backup-' + secrets.token_hex(12)
|
|
completed = False
|
|
try:
|
|
# Completion belongs to this exact process, not a global pgrep or file existence.
|
|
command = f'umask 077; forgejo dump -f {remote}.zip >{remote}.log 2>&1; result=$?; printf "%s" "$result" >{remote}.exit'
|
|
call(['sh','-c', 'nohup sh -c "$1" >/dev/null 2>&1 </dev/null &', 'sh', command])
|
|
for _ in range(180):
|
|
r = subprocess.run(k + ['cat',remote+'.exit'], capture_output=True, timeout=30)
|
|
if r.returncode == 0:
|
|
completed = True
|
|
if r.stdout.strip() != b'0': raise ValueError('dump process failed')
|
|
break
|
|
time.sleep(10)
|
|
else: raise ValueError('dump completion timeout')
|
|
size = int(call(['stat','-c%s',remote+'.zip']).strip())
|
|
expected = call(['sha256sum',remote+'.zip']).split()[0].decode()
|
|
if size <= 0: raise ValueError('empty archive')
|
|
chunk = 4*1024*1024
|
|
with destination.open('xb') as out:
|
|
destination.chmod(0o600)
|
|
for index in range((size+chunk-1)//chunk):
|
|
piece = call(['dd','if='+remote+'.zip','bs='+str(chunk),'skip='+str(index),'count=1'])
|
|
if len(piece) != min(chunk,size-index*chunk): raise ValueError('short archive chunk')
|
|
out.write(piece)
|
|
actual = hashlib.file_digest(destination.open('rb'),'sha256').hexdigest()
|
|
if actual != expected: raise ValueError('archive transfer mismatch')
|
|
validate_archive(destination)
|
|
finally:
|
|
# Do not remove a file while a timed-out producer may still be writing it.
|
|
if completed:
|
|
call(['rm','-f',remote+'.zip',remote+'.log',remote+'.exit'])
|
|
|
|
|
|
def main():
|
|
p=argparse.ArgumentParser(description=__doc__)
|
|
p.add_argument('--namespace',required=True); p.add_argument('--pod',required=True)
|
|
p.add_argument('--output',required=True,type=Path)
|
|
a=p.parse_args()
|
|
try: capture(a.namespace,a.pod,a.output)
|
|
except Exception:
|
|
print('ERROR: Forgejo archive capture or integrity validation failed')
|
|
return 1
|
|
print('Forgejo archive capture and integrity verified')
|
|
return 0
|
|
|
|
if __name__=='__main__': raise SystemExit(main())
|