makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

harden Phase 2B Stage 1 installation state

Browse source
This commit is contained in:
makearmy 2026-07-12 22:34:04 -04:00
parent 82e64cec43
commit df6b53e639
10 changed files with 1062 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/le-app-database-migration/phase2b-contained-runtime/tests/00-root-preinstall-validate.sh
View file

@ -44,7 +44,10 @@ if [ "$user_systemd_rc" -eq 0 ] || [ -z "$user_systemd_unexpected" ]; then pass
shell_failures=0
for file in "$artifact_root"/tests/*.sh "$artifact_root"/payload/usr/local/libexec/*; do
/bin/sh -n "$file" || shell_failures=$((shell_failures + 1))
case "$file" in
*/30-install-stage1.sh|*/31-rollback-stage1.sh|*/32-stage1-state-tests.sh|*/stage1-state-lib.sh) /bin/bash -n "$file" || shell_failures=$((shell_failures + 1)) ;;
*) /bin/sh -n "$file" || shell_failures=$((shell_failures + 1)) ;;
esac
done
if [ "$shell_failures" -eq 0 ]; then pass 'shell syntax'; else fail 'shell syntax'; fi
@ -89,10 +92,10 @@ expect_absent /srv/le-app-codex/phase2b-tests/run-inert-without-user-manager.sh
active_state=$(/usr/bin/systemctl show user@1200.service -p ActiveState --value 2>/dev/null)
if [ "$active_state" = inactive ]; then pass 'user@1200.service inactive'; else fail "user@1200.service state is ${active_state:-unknown}"; fi
if [ ! -e /var/lib/systemd/linger/le_app_codex ] && [ ! -e /var/lib/systemd/linger/1200 ]; then pass 'linger absent'; else fail 'linger present'; fi
if [ ! -e /var/lib/systemd/linger/le_app_codex ] && [ ! -L /var/lib/systemd/linger/le_app_codex ] && [ ! -e /var/lib/systemd/linger/1200 ] && [ ! -L /var/lib/systemd/linger/1200 ]; then pass 'linger absent'; else fail 'linger present'; fi
uid_processes=$(/usr/bin/pgrep -u 1200 2>/dev/null)
if [ -z "$uid_processes" ]; then pass 'UID 1200 has no processes'; else fail "UID 1200 processes found: $uid_processes"; fi
if [ ! -S /run/user/1200/docker.sock ]; then pass 'rootless Docker socket absent'; else fail 'rootless Docker socket exists'; fi
if [ ! -e /run/user/1200/docker.sock ] && [ ! -L /run/user/1200/docker.sock ]; then pass 'rootless Docker socket absent'; else fail 'rootless Docker socket path exists'; fi
public_ipv4=$(/usr/bin/curl -4fsS --max-time 10 https://api.ipify.org 2>/dev/null)
if [ "$public_ipv4" = 74.67.173.56 ]; then pass 'public/NAT IPv4 unchanged'; else fail "public/NAT IPv4 drift or lookup failure: ${public_ipv4:-unavailable}"; fi