vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

require both attic options, follow attic's cache-name rule, read the token from a file

Browse source
This commit is contained in:
atlas 2026-10-27 10:46:36 +01:00
commit bd214b9f3e
1 changed files with 156 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

117
swarm-builder/src/push.rs
View file

@ -1,10 +1,11 @@
//! The push of a built closure to the binary cache, with `attic push`.
//!
//! The cache is an attic instance outside the swarm. Its push token is read
//! from the secret store per push and written to an `attic` config file in a
//! directory only the builder's unit can enter, which `attic` finds through
//! `XDG_CONFIG_HOME`. `attic login <name> <url> <token>` is not used: it puts
//! the token in the process list. `attic` verifies the server's certificate
//! from the secret store per push and written to a file in a
//! directory only the builder's unit can enter, beside a config that names it with
//! `token-file`. `attic` finds the config through `XDG_CONFIG_HOME`.
//! `attic login <name> <url> <token>` is not used: it puts the token in the
//! process list. `attic` verifies the server's certificate
//! against the system roots.
//!
//! A push that does not happen or does not finish leaves the build green with
@ -54,13 +55,15 @@ impl Remote {
(Some(domain), Some(cache)) => (domain, cache),
_ => bail!("the cache domain and the cache name must be set together"),
};
let plain = |s: &str| {
!s.is_empty()
&& s.bytes()
.all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'-' | b'_' | b':'))
};
if !plain(&domain) || !plain(&cache) {
bail!("the cache domain {domain:?} and name {cache:?} must be plain names");
let plain_domain = !domain.is_empty()
&& domain
.bytes()
.all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'-' | b':'));
if !plain_domain {
bail!("the cache domain {domain:?} is not a host name with an optional port");
}
if !cache_name_ok(&cache) {
bail!("the cache name {cache:?} is not one attic accepts");
}
let Some(state_dir) = state_dir else {
bail!("a cache is set, but the unit has no runtime directory to hold its config");
@ -106,7 +109,7 @@ impl Remote {
}
/// `attic push` of `out_path`, reading its config from `config_home`. The
/// token is in the file there and in no argument or variable.
/// token is in a file beside it and in no argument or variable.
fn command(&self, config_home: &Path, out_path: &str) -> tokio::process::Command {
let mut cmd = tokio::process::Command::new(&self.attic);
cmd.arg("push")
@ -121,6 +124,16 @@ impl Remote {
}
}
/// Whether `name` is a cache name attic accepts, which is
/// `^[A-Za-z0-9][A-Za-z0-9-_+]{0,49}$`. `services.hyperhive.swarm.attic.cache`
/// states the same rule in nix.
fn cache_name_ok(name: &str) -> bool {
let mut bytes = name.bytes();
bytes.next().is_some_and(|b| b.is_ascii_alphanumeric())
&& name.len() <= 50
&& bytes.all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_' | b'+'))
}
/// Numbers the config directories of one process's pushes.
static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
@ -128,14 +141,14 @@ static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0)
struct ConfigHome(PathBuf);
impl ConfigHome {
/// `<parent>/push-<n>/attic/config.toml`, readable by this user alone.
/// `<parent>/push-<n>/attic/config.toml`, which names `token` beside it, both
/// readable by this user alone.
fn write(parent: &Path, domain: &str, token: &str) -> std::io::Result<Self> {
use std::io::Write as _;
use std::os::unix::fs::{DirBuilderExt as _, OpenOptionsExt as _};
// A quote or a control character would end the TOML string early.
if token.is_empty() || token.bytes().any(|b| b == b'"' || b == b'\\' || b < b' ') {
if token.is_empty() || token.bytes().any(|b| b < b' ') {
return Err(std::io::Error::other(
"the push token is empty or holds a character the config cannot",
"the push token is empty or holds a control character",
));
}
let home = Self(parent.join(format!(
@ -144,19 +157,30 @@ impl ConfigHome {
NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
)));
let dir = home.0.join("attic");
let token_file = dir.join("token");
let token_path = token_file.to_string_lossy();
// A quote or backslash in the path would end the TOML string early.
if token_path.contains(['"', '\\']) {
return Err(std::io::Error::other(
"the runtime directory's path holds a quote or a backslash",
));
}
std::fs::DirBuilder::new()
.recursive(true)
.mode(0o700)
.create(&dir)?;
let mut file = std::fs::OpenOptions::new()
.write(true)
.create_new(true)
.mode(0o600)
.open(dir.join("config.toml"))?;
let private = |name: &str| {
std::fs::OpenOptions::new()
.write(true)
.create_new(true)
.mode(0o600)
.open(dir.join(name))
};
private("token")?.write_all(token.as_bytes())?;
write!(
file,
private("config.toml")?,
"default-server = \"{SERVER}\"\n\n[servers.{SERVER}]\n\
endpoint = \"https://{domain}\"\ntoken = \"{token}\"\n"
endpoint = \"https://{domain}\"\ntoken-file = \"{token_path}\"\n"
)?;
Ok(home)
}
@ -378,19 +402,26 @@ mod tests {
}
#[test]
fn the_token_is_in_a_private_config_file_that_is_removed_after() {
fn the_token_is_in_a_private_file_the_config_names_and_both_are_removed_after() {
let parent = std::env::temp_dir().join(format!("push-test-{}", std::process::id()));
std::fs::create_dir_all(&parent).expect("parent");
let home = ConfigHome::write(&parent, "cache.example.org", TOKEN).expect("written");
let file = home.0.join("attic/config.toml");
let text = std::fs::read_to_string(&file).expect("reads");
assert!(text.contains(&format!("token = \"{TOKEN}\"")), "{text}");
let token_file = home.0.join("attic/token");
assert!(
text.contains(&format!("token-file = \"{}\"", token_file.display())),
"{text}"
);
assert!(!text.contains(TOKEN), "{text}");
assert_eq!(std::fs::read_to_string(&token_file).expect("reads"), TOKEN);
assert!(
text.contains("endpoint = \"https://cache.example.org\""),
"{text}"
);
let mode = |p: &Path| std::fs::metadata(p).expect("stat").permissions().mode() & 0o777;
assert_eq!(mode(&file), 0o600);
assert_eq!(mode(&token_file), 0o600);
assert_eq!(mode(&home.0), 0o700);
let root = home.0.clone();
drop(home);
@ -399,13 +430,42 @@ mod tests {
}
#[test]
fn a_token_that_would_end_the_config_string_is_refused() {
fn an_empty_token_or_one_with_a_control_character_is_refused() {
let parent = std::env::temp_dir();
for bad in ["", "a\"b", "a\\b", "a\nb"] {
for bad in ["", "a\nb", "a\0b"] {
assert!(ConfigHome::write(&parent, "h", bad).is_err(), "{bad:?}");
}
}
#[test]
fn a_path_that_would_end_the_config_string_is_refused() {
let parent = std::env::temp_dir().join("a\"b");
assert!(ConfigHome::write(&parent, "h", TOKEN).is_err());
assert!(!parent.exists());
}
#[test]
fn the_cache_name_rule_is_attics() {
let fifty = "a".repeat(50);
for ok in ["grid", "a", "A-b_c+d", "0", fifty.as_str()] {
assert!(cache_name_ok(ok), "{ok:?}");
}
let fifty_one = "a".repeat(51);
for bad in [
"",
"grid.v2",
"-x",
"_x",
"+x",
"a:b",
"a b",
"a/b",
fifty_one.as_str(),
] {
assert!(!cache_name_ok(bad), "{bad:?}");
}
}
#[tokio::test]
async fn a_path_that_is_not_a_store_path_is_not_pushed() {
let cache = cache_with("true");
@ -432,6 +492,9 @@ mod tests {
assert!(Remote::from_settings(None, some("grid"), state()).is_err());
assert!(Remote::from_settings(some("https://cache"), some("grid"), state()).is_err());
assert!(Remote::from_settings(some("cache"), some("a\"b"), state()).is_err());
assert!(Remote::from_settings(some("cache"), some("grid.v2"), state()).is_err());
assert!(Remote::from_settings(some("cache"), some("-grid"), state()).is_err());
assert!(Remote::from_settings(some("cache"), some("g_r+i-d"), state()).is_ok());
assert!(Remote::from_settings(some("cache"), some("grid"), None).is_err());
}
}