refresh Phase 2A transaction and readiness gates
This commit is contained in:
parent
2cf249d6f2
commit
da03be61a9
23 changed files with 2409 additions and 37 deletions
|
|
@ -44,6 +44,75 @@ optional_shell() {
|
|||
return 0
|
||||
}
|
||||
|
||||
capture_failed_unit_fingerprint() {
|
||||
output=$1
|
||||
: > "$output"
|
||||
systemctl --failed --no-legend --plain --no-pager | awk '{print $1}' | LC_ALL=C sort |
|
||||
while IFS= read -r unit; do
|
||||
[ -n "$unit" ] || continue
|
||||
id=$(systemctl show "$unit" -p Id --value --no-pager)
|
||||
type=$(systemctl show "$unit" -p Type --value --no-pager)
|
||||
load=$(systemctl show "$unit" -p LoadState --value --no-pager)
|
||||
active=$(systemctl show "$unit" -p ActiveState --value --no-pager)
|
||||
sub=$(systemctl show "$unit" -p SubState --value --no-pager)
|
||||
result=$(systemctl show "$unit" -p Result --value --no-pager)
|
||||
invocation=$(systemctl show "$unit" -p InvocationID --value --no-pager)
|
||||
changed=$(systemctl show "$unit" -p StateChangeTimestamp --value --no-pager)
|
||||
fragment=$(systemctl show "$unit" -p FragmentPath --value --no-pager)
|
||||
code=$(systemctl show "$unit" -p ExecMainCode --value --no-pager)
|
||||
status=$(systemctl show "$unit" -p ExecMainStatus --value --no-pager)
|
||||
printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s\n' \
|
||||
"$id" "$type" "$load" "$active" "$sub" "$result" "$invocation" \
|
||||
"$changed" "$fragment" "$code" "$status"
|
||||
done > "$output"
|
||||
return ${PIPESTATUS[0]}
|
||||
}
|
||||
|
||||
validate_failed_unit_disposition() {
|
||||
allowlist_dir=$script_dir/failed-unit-disposition
|
||||
allowlist=$allowlist_dir/drkonqi-failed-units.allowlist.psv
|
||||
allowlist_hashes=$allowlist_dir/SHA256SUMS
|
||||
(cd "$allowlist_dir" && sha256sum -c SHA256SUMS > "$record/failed-unit-allowlist-checksum.txt" 2>&1)
|
||||
rc=$?
|
||||
if [ "$rc" -ne 0 ]; then add_failure "failed-unit-allowlist-checksum|rc=$rc"; return 0; fi
|
||||
capture_failed_unit_fingerprint "$record/failed-units-fingerprint.psv"
|
||||
rc=$?
|
||||
if [ "$rc" -ne 0 ]; then add_failure "failed-unit-fingerprint|rc=$rc"; return 0; fi
|
||||
cp "$allowlist" "$allowlist_hashes" "$record/"
|
||||
rc=$?
|
||||
if [ "$rc" -ne 0 ]; then add_failure "failed-unit-allowlist-copy|rc=$rc"; return 0; fi
|
||||
diff -u "$allowlist" "$record/failed-units-fingerprint.psv" > "$record/failed-unit-disposition.diff" 2>&1
|
||||
rc=$?
|
||||
if [ "$rc" -ne 0 ]; then
|
||||
add_failure 'failed-unit-disposition|set-state-or-invocation-fingerprint-changed'
|
||||
fi
|
||||
count=$(wc -l < "$record/failed-units-fingerprint.psv")
|
||||
[ "$count" = 234 ] || add_failure "failed-unit-disposition|expected=234|actual=$count"
|
||||
return 0
|
||||
}
|
||||
|
||||
validate_snapper_readiness() {
|
||||
btrfs subvolume show /.snapshots > "$record/snapshots-subvolume.txt" 2>&1
|
||||
rc=$?
|
||||
if [ "$rc" -ne 0 ]; then add_failure "snapshots-btrfs-subvolume|rc=$rc"; return 0; fi
|
||||
stat -c 'path=%n|uid=%u|gid=%g|mode=%a|type=%F' /.snapshots > "$record/snapshots-stat.txt" 2>&1
|
||||
rc=$?
|
||||
if [ "$rc" -ne 0 ]; then add_failure "snapshots-stat|rc=$rc"; return 0; fi
|
||||
owner_mode=$(stat -c '%u:%g:%a' /.snapshots 2>/dev/null)
|
||||
[ "$owner_mode" = 0:0:750 ] || add_failure "snapshots-owner-mode|expected=0:0:750|actual=$owner_mode"
|
||||
snapper list --columns number,type,pre-number,date,user,cleanup,description \
|
||||
> "$record/snapper-snapshots-before.txt" 2>&1
|
||||
rc=$?
|
||||
[ "$rc" -eq 0 ] || add_failure "snapper-list|rc=$rc"
|
||||
btrfs qgroup show / > "$record/btrfs-quota-observation.txt" 2>&1
|
||||
rc=$?
|
||||
if [ "$rc" -ne 0 ]; then
|
||||
printf 'btrfs-quota-accounting|unavailable-or-disabled|rc=%s|snapshot-validity-not-affected\n' "$rc" \
|
||||
>> "$record/warnings.txt"
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
validate_health_urls() {
|
||||
: > "$record/health-urls.sanitized"
|
||||
if [ -z "${PUBLIC_HEALTH_URLS:-}" ]; then
|
||||
|
|
@ -210,6 +279,7 @@ main() {
|
|||
return 10
|
||||
fi
|
||||
umask 077
|
||||
script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
|
||||
install -d -o root -g root -m 0700 /var/log/le-phase2a-preflight
|
||||
rc=$?
|
||||
if [ "$rc" -ne 0 ]; then
|
||||
|
|
@ -245,7 +315,8 @@ main() {
|
|||
mandatory 'filesystem-inodes' filesystem-inodes.txt df -hi / /boot /var/cache/pacman/pkg /tmp
|
||||
mandatory 'installed-package-inventory' packages-before.txt pacman -Q
|
||||
mandatory 'failed-unit-inventory' failed-units-before.txt systemctl --failed --no-legend --plain --no-pager
|
||||
if [ -s "$record/failed-units-before.txt" ]; then add_failure 'failed-units|present'; fi
|
||||
validate_failed_unit_disposition
|
||||
validate_snapper_readiness
|
||||
mandatory_shell 'kernel-initramfs-inventory' kernel-initramfs-before.txt \
|
||||
"find /usr/lib/modules /boot -maxdepth 2 -type f \\
|
||||
\( -name vmlinuz -o -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' -o -name pkgbase \) \\
|
||||
|
|
@ -277,10 +348,10 @@ main() {
|
|||
"find /etc -xdev -type f \( -name '*.pacnew' -o -name '*.pacsave' \) -printf '%p\\n' | sort"
|
||||
mandatory_shell 'migration-git-state' migration-git-state.txt \
|
||||
'git -C /srv/codex-work/lasereverything.net.db/.worktrees/payload-migration status --short --branch; git -C /srv/codex-work/lasereverything.net.db/.worktrees/payload-migration rev-parse HEAD; git -C /srv/codex-work/lasereverything.net.db/.worktrees/payload-migration rev-parse origin/migration/le-app-database'
|
||||
mandatory_shell 'preview-report-integrity' preview-report-checksum.txt \
|
||||
"printf '%s %s\\n' 195d74afe121556294318d0ed49e3fb5504088dbb31a4c0786b8adea44f1369d /tmp/le-phase2-package-decision-20260712.Mn7mIx/phase2-package-decision-report.md | sha256sum -c -"
|
||||
mandatory_shell 'approved-transaction-integrity' approved-transaction-checksum.txt \
|
||||
"cd '$script_dir/approved-transaction' && sha256sum -c SHA256SUMS"
|
||||
|
||||
inventory_files='packages-before.txt failed-units-before.txt kernel-initramfs-before.txt bootloader-inventory.txt containers-all.psv running-containers-before.txt critical-units-baseline.psv database-baseline.psv database-readiness-before.txt health-urls.sanitized public-health.txt network-firewall-before.txt pacman-Dk-before.txt pacman-Qkk-before.txt pacman-Qkk-missing-or-unreadable-before.txt pacnew-pacsave-before.txt migration-git-state.txt preview-report-checksum.txt'
|
||||
inventory_files='packages-before.txt failed-units-before.txt failed-units-fingerprint.psv failed-unit-disposition.diff failed-unit-allowlist-checksum.txt snapshots-subvolume.txt snapshots-stat.txt snapper-snapshots-before.txt btrfs-quota-observation.txt kernel-initramfs-before.txt bootloader-inventory.txt containers-all.psv running-containers-before.txt critical-units-baseline.psv database-baseline.psv database-readiness-before.txt health-urls.sanitized public-health.txt network-firewall-before.txt pacman-Dk-before.txt pacman-Qkk-before.txt pacman-Qkk-missing-or-unreadable-before.txt pacnew-pacsave-before.txt migration-git-state.txt approved-transaction-checksum.txt'
|
||||
(
|
||||
cd "$record" || return 1
|
||||
sha256sum $inventory_files > inventory-hashes.sha256
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue