kami
810076451f
On the deployment deploy/README.md documents, source_dir and install_dir are
the same tree and the restart command rebuilds the image from it. The
Dockerfile builds from cmd/ and internal/ and .dockerignore keeps the host
binaries out, so restoring the snapshotted binaries restored bytes nothing
reads. A bad commit therefore cost two health timeouts and two image builds
and ended in ErrRollbackFailed with an instruction to copy files back by hand,
which would not have helped either.
A deployment that rebuilds from source now has to say how the source is put
back. source_rollback "git" records the commit before the update and checks it
back out before the rollback restart. It refuses a dirty tree, because the
recorded commit does not describe one and a forced checkout would delete his
work. A build-from-source config that says nothing is refused by Validate, at
startup, rather than at the one rollback that mattered.
Also in this change, all from the same review:
- MethodPing, the one method a locked daemon answers. Preflight passed on an
unlocked daemon and the post-restart Presence read failed on a locked one,
so a good update read as SHE IS PROBABLY DOWN once the env key is gone.
- A dial failure is reported apart from a read failure. The documented
socket is under /var/lib/docker, which a non-root operator cannot
traverse, and "she is not answering" was the wrong diagnosis.
- Verify refuses to run as root over a tree owned by someone else. It runs
make build and make test in place, and root-owned artifacts break his next
ordinary make.
- A rollback no longer reverts config_files. That undid every config edit
since the last apply, phraser.model_path among them.
- The verify-failure path no longer reports rolled_back for a compile error.
- waitHealthy caps each attempt at the remaining budget, so a 90s timeout
cannot run to 99s.
- tail cuts on a rune boundary. Russian test names showed the seam.
- The claim that mavend does not import internal/update is replaced with
what is enforced: mavend constructs no Updater and nothing can call Apply.
- snapshot_dir inside source_dir is refused. It landed in the build context.
Found in review of #69.
105 lines
3.5 KiB
Go
105 lines
3.5 KiB
Go
package update
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"syscall"
|
|
"time"
|
|
"unicode/utf8"
|
|
)
|
|
|
|
// Verification is "does this tree build and does it pass its own tests", run
|
|
// before a single byte is written to the install dir.
|
|
//
|
|
// It is `make build` and `make test`, not `go build`: the CGO daemons need the
|
|
// vendored toolchain and the whisper/piper include and library paths wired
|
|
// through the Makefile, and a bare `go build` on them fails in a way that has
|
|
// nothing to do with the change being deployed. `make test` is the -race suite
|
|
// with the CGO env set, and it is the only evidence available on a single box
|
|
// that the new code does what the old code did.
|
|
//
|
|
// This is not a substitute for a second environment. A test suite that passes
|
|
// says the code is self-consistent; it does not say the new build will start
|
|
// against this machine's actual models, sockets and encrypted store. That is
|
|
// what the post-restart health check is for, and it is why the install is
|
|
// reversible rather than merely careful.
|
|
|
|
// Step — one verification or orchestration step and how it went. Kept so the CLI
|
|
// can print a truthful account of what was done, including on the failure path.
|
|
type Step struct {
|
|
Name string
|
|
Argv []string
|
|
Took time.Duration
|
|
Err error
|
|
Output string // combined output, only retained for failures
|
|
}
|
|
|
|
// Verify runs the build and the test suite in SourceDir.
|
|
func (u *Updater) Verify(ctx context.Context) ([]Step, error) {
|
|
if err := u.refuseRootBuild(); err != nil {
|
|
return nil, err
|
|
}
|
|
ctx, cancel := context.WithTimeout(ctx, u.cfg.verifyTimeout())
|
|
defer cancel()
|
|
var steps []Step
|
|
for _, argv := range [][]string{{"make", "build"}, {"make", "test"}} {
|
|
u.log("verify: %v (this takes a while)", argv)
|
|
start := u.now()
|
|
out, err := u.run(ctx, u.cfg.SourceDir, argv)
|
|
st := Step{Name: argv[len(argv)-1], Argv: argv, Took: u.now().Sub(start), Err: err}
|
|
if err != nil {
|
|
st.Output = tail(out, 4000)
|
|
}
|
|
steps = append(steps, st)
|
|
if err != nil {
|
|
u.log("verify: %v FAILED after %s", argv, st.Took.Round(time.Second))
|
|
return steps, fmt.Errorf("%w: %v: %v", ErrVerifyFailed, argv, err)
|
|
}
|
|
u.log("verify: %v ok in %s", argv, st.Took.Round(time.Second))
|
|
}
|
|
return steps, nil
|
|
}
|
|
|
|
// refuseRootBuild stops a sudo'd apply from building in a tree it does not own.
|
|
//
|
|
// The seam is injected so the tests can drive both sides without a second uid.
|
|
func (u *Updater) refuseRootBuild() error {
|
|
uid, owner, err := u.ids(u.cfg.SourceDir)
|
|
if err != nil || uid != 0 || owner == 0 {
|
|
return nil // not root, or root's own tree, or we cannot tell
|
|
}
|
|
return fmt.Errorf("%w: %s is owned by uid %d", ErrRootOnHisTree, u.cfg.SourceDir, owner)
|
|
}
|
|
|
|
// realIDs — the running uid and the owner of dir. Split out for the tests.
|
|
func realIDs(dir string) (uid int, owner uint32, err error) {
|
|
fi, err := os.Stat(dir)
|
|
if err != nil {
|
|
return 0, 0, err
|
|
}
|
|
st, ok := fi.Sys().(*syscall.Stat_t)
|
|
if !ok {
|
|
return 0, 0, errors.New("update: cannot read directory ownership")
|
|
}
|
|
return os.Geteuid(), st.Uid, nil
|
|
}
|
|
|
|
// tail keeps the last n bytes — a failing `make test` prints far more than is
|
|
// useful, and the failure is always at the end.
|
|
//
|
|
// The cut is nudged forward to a rune boundary. Russian test names and fixture
|
|
// strings are the common case in this tree, and a slice landing mid-rune starts
|
|
// the log with a replacement character.
|
|
func tail(s string, n int) string {
|
|
if len(s) <= n {
|
|
return s
|
|
}
|
|
cut := len(s) - n
|
|
for cut < len(s) && !utf8.RuneStart(s[cut]) {
|
|
cut++
|
|
}
|
|
return "…" + s[cut:]
|
|
}
|