mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

store_seeded: report a failed read instead of minting over it

Browse source
This commit is contained in:
atlas 2026-11-03 13:26:02 +01:00 • committed by mara
commit 5f9629dfc7
1 changed files with 113 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/script-tests/store-seeded-secret.nix
View file

@ -11,7 +11,10 @@
let
# `login` answers from `FAKE_BAO_LOGIN_RC`. `kv get` and `kv put -cas=0` act
# on a file per leaf under `FAKE_BAO_KV`; `FAKE_BAO_DENY_READ` and
# `FAKE_BAO_DENY_WRITE` answer 403 as a policy that grants neither does.
# `FAKE_BAO_DENY_WRITE` answer 403 as a policy that grants neither does, and
# `FAKE_BAO_READ_TIMEOUT` is `timeout` ending the read: status 124, silent.
# `FAKE_BAO_READ_5XX` is a server error on the read. A leaf nobody wrote is
# "No value found at <path>", status 2, as `bao kv get` answers it.
# `FAKE_BAO_RACE` has another run create the leaf between this one's read and
# its write. Every call is logged without the value `put` reads from stdin.
fakeBao = pkgs.writeShellScriptBin "bao" ''
@ -24,14 +27,16 @@ let
"kv get")
[ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
[ -z "''${FAKE_BAO_READ_TIMEOUT-}" ] || exit 124
[ -z "''${FAKE_BAO_READ_5XX-}" ] || { echo "Error reading secret/data/x: Error making API request. Code: 503. Errors: * Vault is sealed" >&2; exit 2; }
[ -z "''${FAKE_BAO_DENY_READ-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
if [ -n "''${FAKE_BAO_RACE-}" ] && [ ! -e "$FAKE_BAO_KV/.raced" ]; then
touch "$FAKE_BAO_KV/.raced"
printf '%s' "$FAKE_BAO_RACE" > "$leaf"
echo "fake bao: no value found" >&2
echo "No value found at secret/data/x" >&2
exit 2
fi
[ -e "$leaf" ] || { echo "fake bao: no value found" >&2; exit 2; }
[ -e "$leaf" ] || { echo "No value found at secret/data/x" >&2; exit 2; }
cat "$leaf"
;;
"kv put")
@ -55,7 +60,10 @@ pkgs.runCommand "hyperhive-script-test-store-seeded-secret"
import ../host-modules/lib/store-seeded-secret.nix { }
);
FAKE_BAO_BIN = "${fakeBao}/bin";
nativeBuildInputs = [ pkgs.coreutils ];
nativeBuildInputs = [
pkgs.coreutils
pkgs.gnugrep
];
}
''
${pkgs.bash}/bin/bash ${./store-seeded-secret.sh}