223 lines
8.1 KiB
JavaScript
223 lines
8.1 KiB
JavaScript
#!/usr/bin/env node
|
|
import { createHash } from "node:crypto";
|
|
import { spawnSync } from "node:child_process";
|
|
import {
|
|
cp,
|
|
lstat,
|
|
mkdir,
|
|
mkdtemp,
|
|
readFile,
|
|
rm,
|
|
writeFile,
|
|
} from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import { dirname, join, resolve } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const scriptDir = dirname(fileURLToPath(import.meta.url));
|
|
const fixtureRoot = resolve(scriptDir, "fixtures/gitea");
|
|
const artifactDir = resolve(
|
|
process.env.NODEDC_DEPLOY_ARTIFACT_DIR
|
|
|| resolve(scriptDir, "../deploy-artifacts"),
|
|
);
|
|
const [patchId = "gitea-fresh-install-20260813-001", ...extra] =
|
|
process.argv.slice(2);
|
|
|
|
if (extra.length || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId)) {
|
|
throw new Error("usage: build-gitea-fresh-install-artifact.mjs [patch-id]");
|
|
}
|
|
|
|
const composeRelative = "docker-compose.gitea.yml";
|
|
const descriptorRelative = "deployment/gitea-fresh-install-v1.json";
|
|
const files = [composeRelative, descriptorRelative];
|
|
const stage = await mkdtemp(join(tmpdir(), "nodedc-gitea-artifact-"));
|
|
const payload = join(stage, "payload");
|
|
const target = join(artifactDir, `nodedc-gitea-${patchId}.tgz`);
|
|
|
|
await assertFixtureContract();
|
|
|
|
try {
|
|
await mkdir(payload, { recursive: true });
|
|
for (const relative of files) {
|
|
const source = resolve(fixtureRoot, relative);
|
|
const sourceStat = await lstat(source);
|
|
if (sourceStat.isSymbolicLink() || !sourceStat.isFile()) {
|
|
throw new Error(`gitea_fixture_type_rejected:${relative}`);
|
|
}
|
|
const destination = join(payload, relative);
|
|
await mkdir(dirname(destination), { recursive: true });
|
|
await cp(source, destination, { force: true, verbatimSymlinks: true });
|
|
}
|
|
await writeFile(
|
|
join(stage, "manifest.env"),
|
|
`id=${patchId}\ncomponent=gitea\ntype=app-overlay\n`,
|
|
"utf8",
|
|
);
|
|
await writeFile(join(stage, "files.txt"), `${files.join("\n")}\n`, "utf8");
|
|
await mkdir(artifactDir, { recursive: true });
|
|
|
|
const tar = spawnSync(
|
|
"python3",
|
|
["-c", canonicalTarScript(), target, stage],
|
|
{ encoding: "utf8", maxBuffer: 16 * 1024 * 1024 },
|
|
);
|
|
if (tar.status !== 0) {
|
|
throw new Error(`tar_failed:${tar.stderr || tar.stdout}`);
|
|
}
|
|
|
|
const digest = sha256(await readFile(target));
|
|
console.log(JSON.stringify({
|
|
ok: true,
|
|
patchId,
|
|
artifact: target,
|
|
sha256: digest,
|
|
component: "gitea",
|
|
entries: files,
|
|
services: ["gitea"],
|
|
image: "docker.gitea.com/gitea:1.27.1-rootless@sha256:89dc3c214b3992e5bb01e05ad21139d7a8b302d3ea3d8942d3f7e904e92af148",
|
|
installMode: "fresh-only",
|
|
database: "fresh-sqlite-only",
|
|
lfs: "disabled-pending-reviewed-restore-transition",
|
|
transport: "unix:/run/gitea/gitea.sock",
|
|
networkMode: "none",
|
|
minimumComposeVersion: "2.20.1",
|
|
preserved: ["legacy-gitea-root-unread-and-untouched"],
|
|
excluded: [
|
|
"secrets",
|
|
"runtime-data",
|
|
"database",
|
|
"repositories",
|
|
"users",
|
|
"tokens",
|
|
"ssh-keys",
|
|
"hooks",
|
|
],
|
|
}, null, 2));
|
|
} finally {
|
|
await rm(stage, { recursive: true, force: true });
|
|
}
|
|
|
|
async function assertFixtureContract() {
|
|
const composeBytes = await readFile(resolve(fixtureRoot, composeRelative));
|
|
const compose = composeBytes.toString("utf8");
|
|
const descriptor = JSON.parse(
|
|
await readFile(resolve(fixtureRoot, descriptorRelative), "utf8"),
|
|
);
|
|
const expectedImage =
|
|
"docker.gitea.com/gitea:1.27.1-rootless@sha256:89dc3c214b3992e5bb01e05ad21139d7a8b302d3ea3d8942d3f7e904e92af148";
|
|
const required = [
|
|
`image: ${expectedImage}`,
|
|
"platform: linux/amd64",
|
|
"pull_policy: never",
|
|
"network_mode: none",
|
|
'user: "1000:1000"',
|
|
"stop_grace_period: 30s",
|
|
"driver: json-file",
|
|
'max-size: "10m"',
|
|
'max-file: "3"',
|
|
"GITEA__server__PROTOCOL: http+unix",
|
|
"GITEA__server__HTTP_ADDR: /run/gitea/gitea.sock",
|
|
'GITEA__server__UNIX_SOCKET_PERMISSION: "0666"',
|
|
"GITEA__server__LOCAL_ROOT_URL: http://unix/",
|
|
'GITEA__server__DISABLE_SSH: "true"',
|
|
'GITEA__server__LFS_START_SERVER: "false"',
|
|
'GITEA__server__LFS_ALLOW_PURE_SSH: "false"',
|
|
"GITEA__security__SECRET_KEY_URI: file:/run/secrets/gitea_secret_key",
|
|
"GITEA__security__INTERNAL_TOKEN_URI: file:/run/secrets/gitea_internal_token",
|
|
"GITEA__security__TWO_FACTOR_AUTH: enforced",
|
|
'GITEA__security__REVERSE_PROXY_LIMIT: "1"',
|
|
"GITEA__security__ALLOWED_HOST_LIST: loopback",
|
|
"GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: 127.0.0.0/8,::1/128",
|
|
'GITEA__service__DISABLE_REGISTRATION: "true"',
|
|
'GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION: "false"',
|
|
'GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION_API: "false"',
|
|
'GITEA__service__ENABLE_REVERSE_PROXY_AUTO_REGISTRATION: "false"',
|
|
'GITEA__service__ENABLE_BASIC_AUTHENTICATION: "false"',
|
|
'GITEA__admin__DISABLE_REGULAR_ORG_CREATION: "true"',
|
|
"GITEA__admin__USER_DISABLED_FEATURES: deletion,manage_ssh_keys,manage_gpg_keys,change_username",
|
|
'GITEA__security__DISABLE_GIT_HOOKS: "true"',
|
|
'GITEA__security__DISABLE_WEBHOOKS: "true"',
|
|
'GITEA__repository__DISABLE_MIGRATIONS: "true"',
|
|
'GITEA__packages__ENABLED: "false"',
|
|
'GITEA__oauth2__ENABLED: "false"',
|
|
'GITEA__openid__ENABLE_OPENID_SIGNIN: "false"',
|
|
'GITEA__cron.update_checker__ENABLED: "false"',
|
|
"source: /volume1/docker/nodedc-gitea/socket",
|
|
"target: /run/gitea",
|
|
"create_host_path: false",
|
|
"read_only: true",
|
|
"no-new-privileges:true",
|
|
];
|
|
for (const fragment of required) {
|
|
if (!compose.includes(fragment)) {
|
|
throw new Error(`gitea_compose_boundary_missing:${fragment}`);
|
|
}
|
|
}
|
|
for (const forbidden of [
|
|
"4022",
|
|
"2222:2222",
|
|
"0.0.0.0:3000",
|
|
"ports:",
|
|
"networks:",
|
|
"/var/run/docker.sock",
|
|
"/volume1/docker/gitea",
|
|
"privileged: true",
|
|
"pull_policy: always",
|
|
"__FILE",
|
|
"GITEA__security__SECRET_KEY:",
|
|
"GITEA__security__INTERNAL_TOKEN:",
|
|
"GITEA__server__LFS_JWT_SECRET:",
|
|
"GITEA__server__LFS_JWT_SECRET_URI",
|
|
"gitea_lfs_jwt_secret",
|
|
"lfs-jwt-secret",
|
|
"GITEA__server__REVERSE_PROXY_LIMIT",
|
|
"GITEA__server__REVERSE_PROXY_TRUSTED_PROXIES",
|
|
"GITEA__security__ENABLE_REVERSE_PROXY_AUTHENTICATION",
|
|
"GITEA__security__ENABLE_REVERSE_PROXY_AUTHENTICATION_API",
|
|
"GITEA__security__ENABLE_REVERSE_PROXY_AUTO_REGISTRATION",
|
|
"GITEA__service__DISABLE_REGULAR_ORG_CREATION",
|
|
"GITEA__service__USER_DISABLED_FEATURES",
|
|
]) {
|
|
if (compose.includes(forbidden)) {
|
|
throw new Error(`gitea_compose_boundary_violation:${forbidden}`);
|
|
}
|
|
}
|
|
if (
|
|
descriptor.schemaVersion !== "nodedc.gitea.fresh-install.v1"
|
|
|| descriptor.action !== "fresh-install"
|
|
|| descriptor.component !== "gitea"
|
|
|| descriptor.compose?.sha256 !== sha256(composeBytes)
|
|
|| descriptor.runtime?.image !== expectedImage
|
|
|| descriptor.runtime?.minimumComposeVersion !== "2.20.1"
|
|
|| descriptor.runtime?.lfs !== "disabled-pending-reviewed-restore-transition"
|
|
|| descriptor.runtime?.transport !== "unix:/run/gitea/gitea.sock"
|
|
|| descriptor.runtime?.networkMode !== "none"
|
|
|| descriptor.runtime?.logging !== "bounded-json-file-10m-x3"
|
|
|| descriptor.runtime?.stopGracePeriod !== "30s"
|
|
|| descriptor.trust?.artifactSecrets !== "forbidden"
|
|
|| descriptor.trust?.legacyRootAccess !== "forbidden"
|
|
) {
|
|
throw new Error("gitea_descriptor_contract_mismatch");
|
|
}
|
|
}
|
|
|
|
function sha256(bytes) {
|
|
return createHash("sha256").update(bytes).digest("hex");
|
|
}
|
|
|
|
function canonicalTarScript() {
|
|
return [
|
|
"import gzip,io,pathlib,sys,tarfile",
|
|
"root=pathlib.Path(sys.argv[2])",
|
|
"with open(sys.argv[1],'wb') as out:",
|
|
" with gzip.GzipFile(filename='',mode='wb',fileobj=out,compresslevel=9,mtime=0) as gz:",
|
|
" with tarfile.open(fileobj=gz,mode='w',format=tarfile.PAX_FORMAT) as tar:",
|
|
" for top in ('manifest.env','files.txt','payload'):",
|
|
" p=root/top; paths=[p]+(sorted(p.rglob('*')) if p.is_dir() else [])",
|
|
" for x in paths:",
|
|
" info=tar.gettarinfo(str(x),arcname=x.relative_to(root).as_posix())",
|
|
" info.uid=info.gid=0; info.uname=info.gname='root'; info.mtime=0; info.mode=0o755 if info.isdir() else 0o644",
|
|
" with (open(x,'rb') if info.isfile() else io.BytesIO()) as src: tar.addfile(info,src if info.isfile() else None)",
|
|
].join("\n");
|
|
}
|