mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 19:27:16 +01:00
Krzysztof kuhy Rudnicki
a2d672f7fd
Much of testsAndMisc/linux_configuration cannot be tested on the host: 15 files use `chattr +i` (so a bad test is not simply revertable), the shutdown installers write units that power the machine off, and boot_recovery installs pacman hooks. The repo's own CI says as much -- its Ubuntu job runs only the side-effect-free tests, noting the rest "drive pacman, /etc, systemd or adb". vmbox runs them in a throwaway Arch guest and verifies the result from the HOST, which is the part that is not obvious: a successful shutdown kills the connection carrying the report, and ssh returns 255 for a clean poweroff, a crash and a dropped link alike. So the verdict comes from two artefacts that outlive the VM -- a QMP event log written by a recorder attached at launch (attach later and qemu has already exited), and the serial console log. Five outcomes are distinguished: clean poweroff (SHUTDOWN guest:true plus a serial tail reaching "reboot: Power down"), dirty stop, guest-reset (rebooted instead of powering off), GUEST_PANICKED, and hung. A POWERDOWN event proves nothing -- it means the request was delivered, not that anything acted on it. Reset is a qcow2 backing-file trick: the golden image is built once and sealed (chmod 444 plus a sha256 sidecar verified on every launch, since booting the base would silently invalidate every overlay), and each sandbox is a thin overlay, so reset is rm + recreate. No root anywhere -- user-mode networking with per-VM forwarded ssh ports, and a socket multicast segment for VM-to-VM. The guest clock is pinned and re-applied on every launch, because the shutdown installers gate on a 21:00-05:00 window; NTP is masked in the image or it silently undoes the pin. Repos are cloned from a read-only share scoped to an explicit directory, never $HOME, and credentials are sentinel values. `vm build` ends by booting a throwaway sandbox off the sealed image and refusing to ship if ssh does not answer. Several distinct faults produced an identical "boots fine, connection reset" symptom; checks inside the build VM only prove state at seal time, so the gate has to be an end-to-end boot. Tests: 8 bats cases over the verdict table and name/meta/serial handling; shellcheck and ruff clean; every file within the 250-line cap. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VdyMBGCrGVGDWtJ9xe48f3
40 lines
1.5 KiB
Bash
Executable File
40 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# ============================================================================
|
|
# Provision SENTINEL credentials inside a sandbox.
|
|
#
|
|
# The guest must never hold real secrets: these repos reach live GitHub and
|
|
# Firebase, and a "test" run of an installer that syncs or pushes would hit
|
|
# production. Values are deliberately greppable, so if one ever shows up in a
|
|
# log or a request it is obvious where it came from.
|
|
# ============================================================================
|
|
|
|
set -euo pipefail
|
|
|
|
readonly SENTINEL="DUMMY-NOT-A-REAL-TOKEN-vmbox"
|
|
|
|
install -d -m 700 "$HOME/.config/crdt-sync"
|
|
cat > "$HOME/.config/crdt-sync/config.json" <<JSON
|
|
{
|
|
"_comment": "vmbox sandbox credentials. Not real. Never sync with these.",
|
|
"github_token": "$SENTINEL",
|
|
"firebase_api_key": "$SENTINEL",
|
|
"firebase_db_url": "https://vmbox-sandbox.invalid/"
|
|
}
|
|
JSON
|
|
chmod 600 "$HOME/.config/crdt-sync/config.json"
|
|
|
|
# A throwaway ssh key so anything expecting one finds it, without ever
|
|
# granting access to a real host.
|
|
if [[ ! -f "$HOME/.ssh/id_ed25519" ]]; then
|
|
install -d -m 700 "$HOME/.ssh"
|
|
ssh-keygen -t ed25519 -N '' -q -C 'vmbox-sandbox-throwaway' \
|
|
-f "$HOME/.ssh/id_ed25519"
|
|
fi
|
|
|
|
git config --global user.name "vmbox sandbox"
|
|
git config --global user.email "sandbox@vmbox.invalid"
|
|
# Any push attempt should fail loudly rather than reach a real remote.
|
|
git config --global url."https://vmbox-blocked.invalid/".insteadOf "https://github.com/"
|
|
|
|
echo "sandbox credentials provisioned (all sentinel values)"
|