vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare

Browse source 
`swarm-bao-agent-pki` carried its own copy of the mtime-vs-start compare,
with the same `stat -c %.6Y | tr -d .` read: on a comma-locale host the
`-le` errored and, under `seal = "pkcs11"`, openbao was restarted on
every run of the unit.

The compare moves out of `refresh_unit` into `written_after_start`
(0 newer, 1 not newer, 2 unreadable and logged at `err`), and both
`refresh_unit` and the agent-pki unit call it. The agent-pki unit cannot
call `refresh_unit` itself: it restarts with `restart`, not
`try-restart`, runs a fail-closed check of the bundle between the
compare and the restart, and under shamir prints the step instead of
restarting. It acts only on 0, so an unreadable time skips the restart
as `refresh_unit` does.

`script-test-refresh-consumer` covers the three return codes in the
agent-pki call shape; `module-eval-bao-basics` asserts both seal arms
decide on that call and that no `%.6Y` read is left in the unit.

Refs #5230
This commit is contained in:
atlas 2026-10-13 16:00:37 +02:00 • committed by mara
commit 8d554477ca
5 changed files with 67 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/script-tests/refresh-consumer.nix
View file

@ -1,7 +1,7 @@
# `checks.script-test-refresh-consumer` — runs ../host-modules/lib/refresh-consumer.nix's
# `refresh_unit` and `refresh_consumer` against a stub `systemctl`, under a
# locale whose decimal separator is a comma. The cases are in
# ./refresh-consumer.sh.
# `written_after_start`, `refresh_unit` and `refresh_consumer` against a stub
# `systemctl`, under a locale whose decimal separator is a comma. The cases
# are in ./refresh-consumer.sh.
#
# What runs is the rendered helper, sourced as its callers' scripts include it.
{

23
nix/script-tests/refresh-consumer.sh
View file

@ -126,5 +126,28 @@ check "a missing file restarts nothing and says so at err" "" \
"<3>cannot compare the mtime of $dir/missing ('') with the last start of gitea-runner-swarm.service ('$STARTED') — leaving gitea-runner-swarm.service as it is" \
refresh_unit gitea-runner-swarm.service "$dir/missing"
# compare <description> <want status> <path>. `written_after_start` as
# `swarm-bao-agent-pki` calls it, which acts only on 0.
compare() {
case=$1
count=$((count + 1))
local rc
(
set -e
written_after_start openbao.service "$3" --machine=swarm-bao 2>/dev/null
)
rc=$?
if [ "$rc" != "$2" ]; then fail "returned $rc, wanted $2"; fi
}
STARTED=$(systemd_ts 1791232900.000001)
compare "the compare is 1 for a file older than the start" 1 "$path"
STARTED=$(systemd_ts 1791232888.193158)
compare "the compare is 0 for a file newer than the start" 0 "$path"
STARTED="not a time"
compare "the compare is 2 for an unreadable start" 2 "$path"
STARTED=$(systemd_ts 1791232900.000001)
compare "the compare is 2 for a missing file" 2 "$dir/missing"
echo "$count cases, $failures failed"
[ "$failures" = 0 ]