151 lines
11 KiB
Python
151 lines
11 KiB
Python
#!/usr/bin/env python3
|
|
"""Verification-only orchestration. Fresh exact revision-3 founder approval required."""
|
|
import argparse
|
|
from datetime import datetime, timezone
|
|
import hashlib
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import shlex
|
|
import subprocess
|
|
import sys
|
|
|
|
HERE=Path(__file__).resolve().parent
|
|
DIGEST='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
|
|
STAGE='/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017'
|
|
STORE='/home/tegwick/.helixforge-factory/runtimes'
|
|
DURABLE_RECEIPT=STAGE+'.receipt.json'
|
|
|
|
READ_TARGET=r'''import json,os,pwd,stat,subprocess,shutil,time,ctypes,gzip,sys
|
|
from pathlib import Path
|
|
store=Path('/home/tegwick/.helixforge-factory/runtimes'); stage=Path('/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017');digest='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
|
|
def meta(p):
|
|
try:
|
|
s=p.lstat();return {'uid':s.st_uid,'gid':s.st_gid,'mode':oct(stat.S_IMODE(s.st_mode)),'device':s.st_dev,'inode':s.st_ino,'directory':stat.S_ISDIR(s.st_mode),'symlink':stat.S_ISLNK(s.st_mode)}
|
|
except FileNotFoundError:return None
|
|
cp=subprocess.run(['/usr/local/bin/kubectl','get','nodes','-o','json'],capture_output=True,timeout=20)
|
|
assert cp.returncode==0
|
|
nodes=json.loads(cp.stdout)['items'];assert len(nodes)==1
|
|
mem=dict(x.split(':',1) for x in Path('/proc/meminfo').read_text().splitlines())
|
|
read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]]
|
|
a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)];busy=1-(d[3]+d[4])/sum(d)
|
|
help_result=subprocess.run(['/usr/bin/bwrap','--help'],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=10)
|
|
version=subprocess.run(['/usr/bin/bwrap','--version'],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=10)
|
|
manual=gzip.decompress(Path('/usr/share/man/man1/bwrap.1.gz').read_bytes()).decode();i=manual.find('die\\-with\\-parent')
|
|
fd=os.pidfd_open(os.getpid());os.close(fd);value=ctypes.c_int();subreaper_get=ctypes.CDLL(None).prctl(37,ctypes.byref(value),0,0,0)
|
|
reader={};exec(compile(sys.argv[1],'reviewed_public_digest_reader','exec'),reader)
|
|
native_digest=reader['runtime_digest'](store/digest)
|
|
print(json.dumps({'installed_complete_digest':native_digest,'durable_receipt':meta(Path(str(stage)+'.receipt.json')),'bwrap_version':version.stdout.decode().strip(),'bwrap_die_with_parent_supported':help_result.returncode==0 and b'--die-with-parent' in help_result.stdout,'primary_manual_contract_excerpt':manual[max(0,i-20):i+430] if i>=0 else 'absent','pidfd_available':True,'subreaper_get_supported':subreaper_get==0,'account':pwd.getpwuid(os.getuid()).pw_name,'uid':os.getuid(),'gid':os.getgid(),'store':meta(store),'destination':meta(store/digest),'stage':meta(stage),'memory_available_bytes':int(mem['MemAvailable'].split()[0])*1024,'disk_free_bytes':shutil.disk_usage(store).free,'load_average':list(os.getloadavg()),'cpu_count':os.cpu_count(),'cpu_busy_fraction':busy,'cpu_sample_seconds':1,'node_addresses':nodes[0]['status']['addresses'],'node_ready':any(c['type']=='Ready' and c['status']=='True' for c in nodes[0]['status']['conditions'])}))'''
|
|
|
|
|
|
def sha(path):
|
|
with path.open('rb') as stream:return 'sha256:'+hashlib.file_digest(stream,'sha256').hexdigest()
|
|
|
|
|
|
def command(argv,timeout=60):
|
|
cp=subprocess.run(argv,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=timeout)
|
|
if cp.returncode:raise RuntimeError('command_failed')
|
|
return cp.stdout
|
|
|
|
|
|
def ssh(code,args=(),timeout=60):
|
|
remote='/usr/bin/python3 -I -B -c '+shlex.quote(code)
|
|
if args:remote+=' '+' '.join(shlex.quote(str(x)) for x in args)
|
|
return json.loads(command(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01',remote],timeout))
|
|
|
|
|
|
def preflight():
|
|
inputs=json.loads((HERE/'action-inputs.json').read_text())
|
|
for name,expected in inputs['helper_hashes'].items():
|
|
if sha(HERE/name)!=expected:raise ValueError('helper_changed')
|
|
observation=ssh(READ_TARGET,args=((HERE/'runtime.py').read_text(),))
|
|
store=observation['store']
|
|
expected={'device':2049,'inode':4751222}
|
|
checks={
|
|
'bwrap_parent_death_contract':observation['bwrap_die_with_parent_supported'] and observation['bwrap_version']=='bubblewrap 0.9.0' and 'PR_SET_PDEATHSIG' in observation['primary_manual_contract_excerpt'],
|
|
'supervision_primitives':observation['pidfd_available'] and observation['subreaper_get_supported'],
|
|
'account':observation['account']=='tegwick' and observation['uid']==1000 and observation['gid']==1000,
|
|
'protected_store':store['uid']==1000 and store['gid']==1000 and store['mode']=='0o700' and store['directory'] and not store['symlink'] and store['device']==expected['device'] and store['inode']==expected['inode'],
|
|
'exact_installed_runtime':observation['destination'] is not None and observation['destination']['directory'] and not observation['destination']['symlink'] and observation['destination']['uid']==1000 and observation['destination']['gid']==1000 and observation['installed_complete_digest']==DIGEST,
|
|
'durable_receipt_absent':observation['durable_receipt'] is None,
|
|
'staging_absent':observation['stage'] is None,
|
|
'exact_ready_node':observation['node_ready'] and any(x['address']=='92.205.62.239' for x in observation['node_addresses']),
|
|
'disk_headroom':observation['disk_free_bytes']>=2*1024**3,
|
|
'memory_headroom':observation['memory_available_bytes']>=1024**3,
|
|
'load_headroom':observation['load_average'][0]<=2*observation['cpu_count'],
|
|
'cpu_headroom':observation['cpu_busy_fraction']<=0.85,
|
|
}
|
|
observation['checks']=checks
|
|
return inputs,observation
|
|
|
|
|
|
def save(path,value):
|
|
fd=os.open(path,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
|
|
with os.fdopen(fd,'w') as stream:json.dump(value,stream,indent=2);stream.write('\n')
|
|
|
|
|
|
def main():
|
|
parser=argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument('--apply',action='store_true');parser.add_argument('--dry-run',action='store_true')
|
|
args=parser.parse_args()
|
|
if args.apply and args.dry_run:raise ValueError('conflicting_modes')
|
|
inputs,observation=preflight()
|
|
if not args.apply:
|
|
report={'status':'read_only_dry_run_passed' if all(observation['checks'].values()) else 'read_only_dry_run_blocked','proposal_id':inputs['proposal_id'],'revision':3,
|
|
'observed_at':datetime.now(timezone.utc).isoformat(),'target':observation,
|
|
'installed_runtime_complete_digest_verified':observation['installed_complete_digest']==DIGEST,
|
|
'remote_mutations':0,'provider_calls':0,'private_configuration_reads':False,
|
|
'next_exact_command':'python3 -I -B '+str(HERE/'execute-verify.py')+' --apply'}
|
|
print(json.dumps(report,sort_keys=True));return 0 if all(observation['checks'].values()) else 2
|
|
if not all(observation['checks'].values()):raise ValueError('target_headroom_or_identity_refused')
|
|
receipt=HERE/'execution-receipt.json'
|
|
if receipt.exists():raise ValueError('prior_attempt_requires_reconciliation')
|
|
save(receipt,{'status':'intent_recorded','proposal_id':inputs['proposal_id'],'revision':3,
|
|
'automatic_retry':False,'observed_at':datetime.now(timezone.utc).isoformat()})
|
|
# No native attempt is retried by this helper. Intent survives an SSH loss.
|
|
create=r'''import json,os,stat,time
|
|
from pathlib import Path
|
|
assert os.getuid()==1000 and os.getgid()==1000
|
|
store=Path('/home/tegwick/.helixforge-factory/runtimes');s=store.lstat()
|
|
assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_ino==4751222 and s.st_dev==2049
|
|
assert (store/'f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d').is_dir()
|
|
assert not Path('/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017.receipt.json').exists()
|
|
read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]]
|
|
a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)];assert 1-(d[3]+d[4])/sum(d)<=0.85
|
|
stage=Path('/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017');stage.mkdir(mode=0o700)
|
|
s=stage.lstat();print(json.dumps({'inode':s.st_ino,'device':s.st_dev}))'''
|
|
created=ssh(create)
|
|
receipt.write_text(json.dumps({'status':'staging_created','phase':'before_transfer','proposal_id':inputs['proposal_id'],'revision':3,'automatic_retry':False,'staging_identity':created,'staging_path':STAGE},indent=2)+'\n')
|
|
command(['scp','-q',str(HERE/'runtime.py'),str(HERE/'verify-installed.py'),str(HERE/'process_supervision.py'),'railiance01:'+STAGE+'/'],120)
|
|
execute=r'''import hashlib,json,os,stat,sys
|
|
from pathlib import Path
|
|
stage=Path('/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017');s=stage.lstat()
|
|
assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_ino==int(sys.argv[1]) and s.st_dev==2049
|
|
expected=json.loads(sys.argv[2]);assert {p.name for p in stage.iterdir()}==set(expected)
|
|
for name,want in expected.items():
|
|
p=stage/name;s=p.lstat();assert stat.S_ISREG(s.st_mode) and s.st_uid==1000 and not stat.S_ISLNK(s.st_mode)
|
|
with p.open('rb') as stream:assert hashlib.file_digest(stream,'sha256').hexdigest()==want
|
|
p.chmod(0o600)
|
|
os.execve('/usr/bin/python3',['python3','-I','-B',str(stage/'verify-installed.py'),'--stage-inode',sys.argv[1]],{'HOME':'/home/tegwick','PATH':'/usr/bin:/bin','LANG':'C.UTF-8','PYTHONDONTWRITEBYTECODE':'1'})'''
|
|
hashes={'runtime.py':inputs['helper_hashes']['runtime.py'].removeprefix('sha256:'),
|
|
'verify-installed.py':inputs['helper_hashes']['verify-installed.py'].removeprefix('sha256:'),
|
|
'process_supervision.py':inputs['helper_hashes']['process_supervision.py'].removeprefix('sha256:')}
|
|
# Parse the structured final helper return even when its action failed.
|
|
remote='/usr/bin/python3 -I -B -c '+shlex.quote(execute)+' '+shlex.quote(str(created['inode']))+' '+shlex.quote(json.dumps(hashes,separators=(',',':')))
|
|
receipt.write_text(json.dumps({'status':'remote_execution_started','proposal_id':inputs['proposal_id'],'revision':3,'automatic_retry':False,'staging_identity':created,'staging_path':STAGE},indent=2)+'\n')
|
|
cp=subprocess.run(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01',remote],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=600)
|
|
try:result=json.loads(cp.stdout)
|
|
except Exception:raise RuntimeError('remote_outcome_uncertain') from None
|
|
result['ssh_exit_code']=cp.returncode;result['staging_identity']=created
|
|
# Replace only our exact local intent receipt, never a previous attempt.
|
|
receipt.write_text(json.dumps(result,indent=2)+'\n');receipt.chmod(0o600)
|
|
print(json.dumps(result,sort_keys=True))
|
|
return 0 if cp.returncode==0 and result.get('status')=='installed_runtime_offline_rehearsal_verified' else 1
|
|
|
|
|
|
if __name__=='__main__':
|
|
try:raise SystemExit(main())
|
|
except Exception as exc:
|
|
print(json.dumps({'status':'failed_or_uncertain','failure_type':type(exc).__name__,
|
|
'automatic_retry':False,'private_diagnostics_suppressed':True}))
|
|
raise SystemExit(1) from None
|