52 lines
3.3 KiB
Python
52 lines
3.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Exercise Bash and PowerShell image verification with real Compose config.
|
|
|
|
No images are pulled and no containers are created. Fixture settings are fake.
|
|
"""
|
|
import argparse
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import subprocess
|
|
import tempfile
|
|
import time
|
|
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument('--source', type=Path, default=Path(__file__).resolve().parent.parent)
|
|
args = parser.parse_args()
|
|
source = args.source.resolve()
|
|
started = time.monotonic()
|
|
version = '1.0.0.20261014'
|
|
image = 'registry.cn-shanghai.aliyuncs.com/comfy-ai/comfy-server'
|
|
secret = 'synthetic-config-value-must-not-be-printed'
|
|
|
|
with tempfile.TemporaryDirectory(prefix='easyai-image-config-') as temporary:
|
|
root = Path(temporary)
|
|
(root / '.env').write_text(f'SERVER_VERSION={version}\nFIXTURE_SECRET={secret}\n')
|
|
binaries = root / 'bin'
|
|
binaries.mkdir()
|
|
sudo = binaries / 'sudo'
|
|
sudo.write_text('#!/bin/sh\nexec "$@"\n')
|
|
sudo.chmod(0o755)
|
|
env = {**os.environ, 'PATH': str(binaries) + os.pathsep + os.environ['PATH'], 'UPDATE_SERVICES': 'easyai-server'}
|
|
reports = []
|
|
for correct in (True, False):
|
|
selected = f'{image}:${{SERVER_VERSION}}' if correct else f'{image}:latest'
|
|
# On the negative case a dependency deliberately has the expected image;
|
|
# checking membership in --images output would wrongly approve it.
|
|
dependency = 'redis:7-alpine' if correct else f'{image}:${{SERVER_VERSION}}'
|
|
(root / 'compose.yml').write_text(f'services:\n dependency:\n image: {dependency}\n easyai-server:\n image: {selected}\n depends_on:\n - dependency\n environment:\n FIXTURE_SECRET: ${{FIXTURE_SECRET}}\n')
|
|
config = subprocess.run(['docker','compose','config','--format','json','easyai-server'], cwd=root, env=env, text=True, capture_output=True, check=True)
|
|
assert json.loads(config.stdout)['services']['easyai-server']['image'] == (f'{image}:{version}' if correct else f'{image}:latest')
|
|
images = subprocess.run(['docker','compose','config','--images','easyai-server'], cwd=root, env=env, text=True, capture_output=True, check=True)
|
|
assert len(images.stdout.splitlines()) > 1, 'Compose fixture must include dependency images'
|
|
bash = ['bash','-c', '. "$1/scripts/init-security-env.sh"; . "$1/scripts/init-application-version-env.sh"; verify_application_version_images .env "docker compose"', 'fixture', str(source)]
|
|
powershell = ['pwsh','-NoProfile','-NonInteractive','-Command', f". '{source}/scripts/Initialize-ApplicationVersions.ps1'; Test-ApplicationVersionImages @([pscustomobject]@{{Service='easyai-server';Image='{image}';Version='{version}'}}) @('docker','compose')"]
|
|
for name, command in [('bash', bash), ('powershell', powershell)]:
|
|
result = subprocess.run(command, cwd=root, env=env, text=True, errors='backslashreplace', capture_output=True, timeout=30)
|
|
assert (result.returncode == 0) == correct, f'{name} incorrect verification: {result.stdout} {result.stderr}'
|
|
assert secret not in result.stdout + result.stderr, 'configuration leaked'
|
|
reports.append({'shell':name, 'correctImage':correct, 'expectedExitObserved':True})
|
|
|
|
print(json.dumps({'cases':reports,'seconds':round(time.monotonic()-started,3)}))
|