admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-1300: SECURITY — cloudflared 2026.10.3 on main (same change as tag v0.345.1); build.sh may push from the pushed tag v<VERSION>
gates / gates (push) Successful in 1m19s
Details

Browse Source 
infra.CloudflaredImage 2026.9.3 -> 2026.10.3 (Cloudflare's eMudhra notice, 2026-10-20) and
TestEnsureCloudflared_ANewImageRecreatesTheTunnel (red-proved). build.sh: a --push may build from
the tag v<VERSION> as the server has it, pointing at HEAD (operator's yes 2026-10-26); four new
cases in test_build_push_once.sh, red-proved both ways. MinAgent 0.158.1 unchanged.
This commit is contained in:
authentik Default Admin
2026-10-26 21:01:40 +01:00
parent 2560cf1779
commit a1c65b3d81
5 changed files with 96 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/scripts/test_build_push_once.sh
+22
View File
@@ -141,6 +141,28 @@ run_build_in absent "$CLEAN_REPO" 0.999.0 --push
check "ahead of origin/main -> refuses" 1 "not at origin/main" "FAKE-DOCKER-REACHED"
rm -rf "$CLEAN_REPO"
# ── OR AT THE PUSHED TAG v<VERSION> (v0.345.1, 2026-10-26) ───────────────────────────────────────
# A patch release off a released commit while main holds unreleased work. The tag must be on the SERVER, name THIS version,
# and point at HEAD. RED-PROOF: with the tag branch accepting any tag the three refusals fail; with it removed the
# first case fails.
TAG_REPO="$(scratch_repo)"; TAG_ORIGIN="$(mktemp -d)"
git init -q --bare "$TAG_ORIGIN" 2>/dev/null; git -C "$TAG_REPO" remote add origin "$TAG_ORIGIN"
echo y > "$TAG_REPO/controller/f2"
git -C "$TAG_REPO" add -A >/dev/null; git -C "$TAG_REPO" commit -qm fix >/dev/null
git -C "$TAG_REPO" tag -a v0.999.1 -m t; git -C "$TAG_REPO" push -q origin v0.999.1 2>/dev/null
run_build_in absent "$TAG_REPO" 0.999.1 --push
check "at the pushed tag v<VERSION> -> proceeds" "$rc" "at the pushed tag v0.999.1" "refusing to push"
run_build_in absent "$TAG_REPO" 0.999.2 --push
check "a pushed tag of ANOTHER version -> refuses" 1 "nor at a pushed tag v0.999.2" "FAKE-DOCKER-REACHED"
git -C "$TAG_REPO" tag v0.999.3
run_build_in absent "$TAG_REPO" 0.999.3 --push
check "a tag only on this clone -> refuses" 1 "nor at a pushed tag v0.999.3" "FAKE-DOCKER-REACHED"
echo z > "$TAG_REPO/controller/f3"
git -C "$TAG_REPO" add -A >/dev/null; git -C "$TAG_REPO" commit -qm later >/dev/null
run_build_in absent "$TAG_REPO" 0.999.1 --push
check "the pushed tag on another commit -> refuses" 1 "nor at a pushed tag v0.999.1" "FAKE-DOCKER-REACHED"
rm -rf "$TAG_REPO" "$TAG_ORIGIN"
NOT_A_REPO="$(mktemp -d)"; mkdir -p "$NOT_A_REPO/controller"
run_build_in absent "$NOT_A_REPO" 0.999.0 --push
check "not a git checkout -> refuses" 1 "not a git checkout" "FAKE-DOCKER-REACHED"