admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-1300: SECURITY — cloudflared 2026.10.3 on main (same change as tag v0.345.1); build.sh may push from the pushed tag v<VERSION>
gates / gates (push) Successful in 1m19s
Details

Browse Source 
infra.CloudflaredImage 2026.9.3 -> 2026.10.3 (Cloudflare's eMudhra notice, 2026-10-20) and
TestEnsureCloudflared_ANewImageRecreatesTheTunnel (red-proved). build.sh: a --push may build from
the tag v<VERSION> as the server has it, pointing at HEAD (operator's yes 2026-10-26); four new
cases in test_build_push_once.sh, red-proved both ways. MinAgent 0.158.1 unchanged.
This commit is contained in:
authentik Default Admin
2026-10-26 21:01:40 +01:00
parent 2560cf1779
commit a1c65b3d81
5 changed files with 96 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/build.sh
+19 -6
View File
@@ -153,14 +153,27 @@ if [[ "${ACTION}" == "--push" || "${ACTION}" == "--multiarch" ]]; then
fi
head_sha=$(cd "${REPO_DIR}" && git rev-parse HEAD 2>/dev/null || echo unknown)
main_sha=$(cd "${REPO_DIR}" && git rev-parse origin/main 2>/dev/null || echo unknown)
# The one other source that can be fetched again: the tag v<VERSION> AS THE SERVER HAS IT, pointing at HEAD. That
# is a patch release built off a released version while main holds unreleased work (v0.345.1, R-1300, cloudflared's
# security bump, 2026-10-26 — operator's yes in that session). Only the tag that names THIS version counts; a tag
# only on this clone, a tag on another commit, or a server that cannot be asked is a refusal. Pinned by
# scripts/test_build_push_once.sh („tag" cases).
if [[ "${head_sha}" != "${main_sha}" ]]; then
error "${REPO_DIR} is not at origin/main — refusing to push."
error " HEAD ${head_sha}"
error " origin/main ${main_sha}"
error "An unpushed change does not exist; an image built from one cannot be fetched again."
exit 1
tag_sha=$(cd "${REPO_DIR}" && GIT_TERMINAL_PROMPT=0 git ls-remote origin "refs/tags/v${VERSION}" "refs/tags/v${VERSION}^{}" 2>/dev/null \
| awk '$2 ~ /\^\{\}$/ {peeled=$1} $2 !~ /\^\{\}$/ {plain=$1} END {print (peeled != "" ? peeled : plain)}') || tag_sha="" # no origin / unreachable: the error below, not set -e
if [[ -n "${tag_sha}" && "${tag_sha}" == "${head_sha}" ]]; then
info "Source tree is clean and at the pushed tag v${VERSION} (not origin/main)."
else
error "${REPO_DIR} is not at origin/main, nor at a pushed tag v${VERSION} — refusing to push."
error " HEAD ${head_sha}"
error " origin/main ${main_sha}"
error " v${VERSION} on origin ${tag_sha:-<none>}"
error "An unpushed change does not exist; an image built from one cannot be fetched again."
exit 1
fi
else
info "Source tree is clean and at origin/main."
fi
info "Source tree is clean and at origin/main."
else
error "${REPO_DIR} is not a git checkout — refusing to push a build whose source cannot be identified."
exit 1