mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 19:07:17 +01:00
Krzysztof kuhy Rudnicki
a2d672f7fd
Much of testsAndMisc/linux_configuration cannot be tested on the host: 15 files use `chattr +i` (so a bad test is not simply revertable), the shutdown installers write units that power the machine off, and boot_recovery installs pacman hooks. The repo's own CI says as much -- its Ubuntu job runs only the side-effect-free tests, noting the rest "drive pacman, /etc, systemd or adb". vmbox runs them in a throwaway Arch guest and verifies the result from the HOST, which is the part that is not obvious: a successful shutdown kills the connection carrying the report, and ssh returns 255 for a clean poweroff, a crash and a dropped link alike. So the verdict comes from two artefacts that outlive the VM -- a QMP event log written by a recorder attached at launch (attach later and qemu has already exited), and the serial console log. Five outcomes are distinguished: clean poweroff (SHUTDOWN guest:true plus a serial tail reaching "reboot: Power down"), dirty stop, guest-reset (rebooted instead of powering off), GUEST_PANICKED, and hung. A POWERDOWN event proves nothing -- it means the request was delivered, not that anything acted on it. Reset is a qcow2 backing-file trick: the golden image is built once and sealed (chmod 444 plus a sha256 sidecar verified on every launch, since booting the base would silently invalidate every overlay), and each sandbox is a thin overlay, so reset is rm + recreate. No root anywhere -- user-mode networking with per-VM forwarded ssh ports, and a socket multicast segment for VM-to-VM. The guest clock is pinned and re-applied on every launch, because the shutdown installers gate on a 21:00-05:00 window; NTP is masked in the image or it silently undoes the pin. Repos are cloned from a read-only share scoped to an explicit directory, never $HOME, and credentials are sentinel values. `vm build` ends by booting a throwaway sandbox off the sealed image and refusing to ship if ssh does not answer. Several distinct faults produced an identical "boots fine, connection reset" symptom; checks inside the build VM only prove state at seal time, so the gate has to be an end-to-end boot. Tests: 8 bats cases over the verdict table and name/meta/serial handling; shellcheck and ruff clean; every file within the 250-line cap. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VdyMBGCrGVGDWtJ9xe48f3
63 lines
2.0 KiB
Bash
63 lines
2.0 KiB
Bash
#!/bin/bash
|
|
# ============================================================================
|
|
# vmbox: cloud-init NoCloud seed ISO generation.
|
|
#
|
|
# The seed ISO is how the golden image gets its user, SSH key and provisioning
|
|
# script. It is used ONLY during `vm build`; the sealed base disables
|
|
# cloud-init, so per-VM boots never touch it.
|
|
# ============================================================================
|
|
|
|
# shellcheck source=common.sh
|
|
source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
|
|
|
|
# Generate the throwaway keypair the host uses to reach guests. This key is
|
|
# sandbox-only and is never the user's real ~/.ssh key.
|
|
seed_ensure_key() {
|
|
[[ -f "$VMBOX_SSH_KEY" ]] && return 0
|
|
log "Generating sandbox SSH key (throwaway, sandbox-only)"
|
|
install -d -m 700 "$VMBOX_BASE_DIR"
|
|
ssh-keygen -t ed25519 -N '' -q -C 'vmbox-sandbox-key' -f "$VMBOX_SSH_KEY"
|
|
ok "key: $VMBOX_SSH_KEY"
|
|
}
|
|
|
|
# Write user-data + meta-data and pack them into a CIDATA volume.
|
|
# $1 = output ISO path, $2 = directory to build in.
|
|
seed_build_iso() {
|
|
local iso="$1" workdir="$2" pubkey
|
|
pubkey="$(cat "${VMBOX_SSH_KEY}.pub")"
|
|
|
|
# NOPASSWD sudo is load-bearing, not a convenience: without it every
|
|
# `vm run` that uses sudo blocks forever on an invisible password prompt.
|
|
cat > "$workdir/user-data" <<UD
|
|
#cloud-config
|
|
users:
|
|
- name: ${VMBOX_GUEST_USER}
|
|
groups: [wheel]
|
|
shell: /bin/bash
|
|
sudo: ["ALL=(ALL) NOPASSWD:ALL"]
|
|
lock_passwd: false
|
|
ssh_authorized_keys:
|
|
- ${pubkey}
|
|
|
|
# Password login on the serial console, for debugging a guest whose sshd is
|
|
# broken. Harmless: the VM is unreachable from outside the host.
|
|
chpasswd:
|
|
expire: false
|
|
list: |
|
|
${VMBOX_GUEST_USER}:vmbox
|
|
root:vmbox
|
|
|
|
ssh_pwauth: true
|
|
preserve_hostname: false
|
|
UD
|
|
|
|
cat > "$workdir/meta-data" <<MD
|
|
instance-id: vmbox-golden
|
|
local-hostname: vmbox
|
|
MD
|
|
|
|
xorrisofs -output "$iso" -volid CIDATA -joliet -rational-rock \
|
|
-quiet "$workdir/user-data" "$workdir/meta-data"
|
|
[[ -s "$iso" ]] || die "seed ISO generation produced an empty file"
|
|
}
|