8d554477ca
`swarm-bao-agent-pki` carried its own copy of the mtime-vs-start compare, with the same `stat -c %.6Y | tr -d .` read: on a comma-locale host the `-le` errored and, under `seal = "pkcs11"`, openbao was restarted on every run of the unit. The compare moves out of `refresh_unit` into `written_after_start` (0 newer, 1 not newer, 2 unreadable and logged at `err`), and both `refresh_unit` and the agent-pki unit call it. The agent-pki unit cannot call `refresh_unit` itself: it restarts with `restart`, not `try-restart`, runs a fail-closed check of the bundle between the compare and the restart, and under shamir prints the step instead of restarting. It acts only on 0, so an unreadable time skips the restart as `refresh_unit` does. `script-test-refresh-consumer` covers the three return codes in the agent-pki call shape; `module-eval-bao-basics` asserts both seal arms decide on that call and that no `%.6Y` read is left in the unit. Refs #5230
19 lines
698 B
Nix
19 lines
698 B
Nix
# `checks.script-test-refresh-consumer` — runs ../host-modules/lib/refresh-consumer.nix's
|
|
# `written_after_start`, `refresh_unit` and `refresh_consumer` against a stub
|
|
# `systemctl`, under a locale whose decimal separator is a comma. The cases
|
|
# are in ./refresh-consumer.sh.
|
|
#
|
|
# What runs is the rendered helper, sourced as its callers' scripts include it.
|
|
{
|
|
pkgs,
|
|
...
|
|
}:
|
|
pkgs.runCommand "hyperhive-script-test-refresh-consumer"
|
|
{
|
|
HELPER = pkgs.writeText "refresh-consumer.sh" (import ../host-modules/lib/refresh-consumer.nix { });
|
|
LOCALE_ARCHIVE = "${pkgs.glibcLocales}/lib/locale/locale-archive";
|
|
}
|
|
''
|
|
${pkgs.bash}/bin/bash ${./refresh-consumer.sh}
|
|
touch "$out"
|
|
''
|