vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep authelia's keys in bao, seeded from the existing key files

Browse source
This commit is contained in:
atlas 2026-10-27 12:23:41 +01:00 • committed by mara
commit 99fab06348
1 changed files with 557 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

63
nix/script-tests/store-seeded-secret.nix Normal file
View file

@ -0,0 +1,63 @@
# `checks.script-test-store-seeded-secret` — runs
# ../host-modules/lib/store-seeded-secret.nix's `store_seeded` against a stub
# `bao` that keeps its leaves in files. The cases are in
# ./store-seeded-secret.sh.
#
# What runs is the rendered helper, sourced as its callers' scripts include it.
{
pkgs,
...
}:
let
# `login` answers from `FAKE_BAO_LOGIN_RC`. `kv get` and `kv put -cas=0` act
# on a file per leaf under `FAKE_BAO_KV`; `FAKE_BAO_DENY_READ` and
# `FAKE_BAO_DENY_WRITE` answer 403 as a policy that grants neither does.
# `FAKE_BAO_RACE` has another run create the leaf between this one's read and
# its write. Every call is logged without the value `put` reads from stdin.
fakeBao = pkgs.writeShellScriptBin "bao" ''
echo "$*" >> "$FAKE_BAO_LOG"
case "$1 $2" in
"login -method=cert")
[ "$FAKE_BAO_LOGIN_RC" = 0 ] || { echo "fake bao: certificate refused" >&2; exit 2; }
printf 's.fake'
;;
"kv get")
[ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
[ -z "''${FAKE_BAO_DENY_READ-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
if [ -n "''${FAKE_BAO_RACE-}" ] && [ ! -e "$FAKE_BAO_KV/.raced" ]; then
touch "$FAKE_BAO_KV/.raced"
printf '%s' "$FAKE_BAO_RACE" > "$leaf"
echo "fake bao: no value found" >&2
exit 2
fi
[ -e "$leaf" ] || { echo "fake bao: no value found" >&2; exit 2; }
cat "$leaf"
;;
"kv put")
[ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
[ "$3" = -cas=0 ] || { echo "fake bao: put without -cas=0" >&2; exit 96; }
leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
[ -z "''${FAKE_BAO_DENY_WRITE-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
[ ! -e "$leaf" ] || { echo "fake bao: check-and-set parameter did not match" >&2; exit 2; }
cat > "$leaf"
;;
*)
echo "fake bao: unexpected call: $*" >&2
exit 98
;;
esac
'';
in
pkgs.runCommand "hyperhive-script-test-store-seeded-secret"
{
HELPER = pkgs.writeText "store-seeded-secret.sh" (
import ../host-modules/lib/store-seeded-secret.nix { }
);
FAKE_BAO_BIN = "${fakeBao}/bin";
nativeBuildInputs = [ pkgs.coreutils ];
}
''
${pkgs.bash}/bin/bash ${./store-seeded-secret.sh}
touch "$out"
''