admin
09ae93db05
gates / gates (push) Successful in 31s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
49 lines
4.9 KiB
Bash
Executable File
49 lines
4.9 KiB
Bash
Executable File
#!/bin/bash
|
|
# bake.sh <VER> — golden bake per RUNBOOK-manual-build §4.0/§4.1 (shape of evidence-golden-0283). Secrets: the Gitea token
|
|
# goes file -> file and is read INSIDE the VM; never on a command line here.
|
|
set -u
|
|
VER=$1; D=/mnt/5_hdd/felhom.eu/drill; Q=$D/drill.qcow2; K=$D/id_drill
|
|
EVG=/mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/evidence-golden-0286-2026-10-01
|
|
S="ssh -i $K -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ConnectTimeout=5 root@localhost"
|
|
say(){ echo "$*"; }
|
|
say "## $(date -u +%FT%TZ) golden $VER — bake in the drill VM (RUNBOOK-manual-build §4.0/§4.1)"
|
|
n=$(ps -eo comm | grep -c '^qemu-system-x86'); [ "$n" = 0 ] || { say "FATAL qemu already running ($n)"; exit 1; }
|
|
qemu-img snapshot -a virgin $Q && say " reverted to virgin (this also proves no qemu holds the qcow2)" || { say FATAL revert; exit 1; }
|
|
qemu-system-x86_64 -enable-kvm -cpu host -smp 4 -m 8192 \
|
|
-drive file=$Q,format=qcow2,if=virtio,cache=writeback \
|
|
-netdev user,id=n0,dhcpstart=10.0.2.30,hostfwd=tcp::2222-10.0.2.15:22 \
|
|
-device virtio-net-pci,netdev=n0 -display none -daemonize -pidfile $D/qemu.pid && say " cold boot started"
|
|
for i in $(seq 1 60); do $S true 2>/dev/null && break; sleep 5; done
|
|
say " ssh up: $($S pveversion 2>/dev/null)"
|
|
$S 'pveam update >/dev/null 2>&1; pveam available --section system | grep "debian-13-standard_.*_amd64"'
|
|
T=$($S 'pveam available --section system | grep -o "debian-13-standard_[^ ]*_amd64.tar.zst" | sort -V | tail -1')
|
|
say " template (current point release, listed not assumed): $T"
|
|
$S "pveam download local $T >/dev/null 2>&1 && echo ' template downloaded'"
|
|
scp -q -i $K -P 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null /mnt/5_hdd/felhom.eu/git/felhom-agent/configs/build-golden.sh root@localhost:/root/build-golden.sh
|
|
scp -q -i $K -P 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ~/.gitea-token root@localhost:/root/.gitea-token
|
|
$S "chmod 0700 /root/build-golden.sh; chmod 0600 /root/.gitea-token; cat > /root/bake-run.sh <<EOS
|
|
#!/bin/bash
|
|
GT=\\\$(cat /root/.gitea-token)
|
|
export GITEA_USER=admin GITEA_TOKEN=\"\\\$GT\" REGISTRY_USER=admin REGISTRY_TOKEN=\"\\\$GT\"
|
|
exec /root/build-golden.sh 9100 local:vztmpl/$T local-lvm local vmbr0 gitea.dooplex.hu/admin/felhom-controller:$VER
|
|
EOS
|
|
chmod 0700 /root/bake-run.sh; [ -s /root/.gitea-token ] && [ -x /root/build-golden.sh ] && echo ' script ('\$(grep -o 'v[0-9]\\.[0-9]\\.[0-9]' /root/build-golden.sh | head -1)') + token landed, non-empty, executable'"
|
|
$S 'systemd-run --unit=golden-bake --collect bash -c "/root/bake-run.sh > /root/bake.log 2>&1" >/dev/null 2>&1' && say " bake launched $(date -u +%FT%TZ)"
|
|
say " token leak check on the unit (needle non-empty): $($S '[ -s /root/.gitea-token ] && systemctl show golden-bake -p Environment -p ExecStart | grep -c -F "$(cat /root/.gitea-token)"')"
|
|
for i in $(seq 1 180); do st=$($S 'systemctl is-active golden-bake' 2>/dev/null); [ "$st" = active ] || [ "$st" = activating ] || break; sleep 10; done
|
|
say " unit state: ${st:-gone} at $(date -u +%FT%TZ)"
|
|
$S 'cat /root/bake.log' > $EVG/bake-full.log; say " log copied off the machine FIRST: $(wc -l < $EVG/bake-full.log) lines"
|
|
L=$EVG/bake-full.log
|
|
say " markers: overlay2=$(grep -c 'docker OK (overlay2' $L) mountpoints=$(grep -c 'including mount point' $L) upload=$(grep -c 'upload OK (HTTP 201)' $L) FATAL=$(grep -c FATAL $L) excluding=$(grep -c excluding $L)"
|
|
grep -E 'docker OK \(overlay2|including mount point|upload OK|^GOLDEN_' $L | sed 's/^/ /'
|
|
say " token-leak grep on the saved log: $(grep -c -F "$(cat ~/.gitea-token)" $L)"
|
|
cp $L /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/05c3d295-b388-481a-8c36-44a2a80b7d7d/scratchpad/pc.log; cat ~/.gitea-token >> /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/05c3d295-b388-481a-8c36-44a2a80b7d7d/scratchpad/pc.log
|
|
say " positive control (token appended to a throwaway copy): $(grep -c -F "$(cat ~/.gitea-token)" /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/05c3d295-b388-481a-8c36-44a2a80b7d7d/scratchpad/pc.log)"; shred -u /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/05c3d295-b388-481a-8c36-44a2a80b7d7d/scratchpad/pc.log
|
|
say " REGISTRY CHECK (the outcome, not the attempt): golden $VER -> http=$(curl -s -o /dev/null -w '%{http_code}' -r 0-0 https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/$VER/golden.tar.zst)"
|
|
say " secrets shredded (3 expected absent): $($S 'shred -u /root/.gitea-token /root/bake-run.sh /root/bake.log; n=0; for f in /root/.gitea-token /root/bake-run.sh /root/bake.log; do [ -e $f ] || n=$((n+1)); done; echo $n')"
|
|
$S 'pct destroy 9100 --purge >/dev/null 2>&1; true'; say " pct list lines after destroy: $($S 'pct list | tail -n +2 | wc -l')"
|
|
$S 'poweroff' 2>/dev/null; for i in $(seq 1 60); do [ "$(ps -eo comm | grep -c '^qemu-system-x86')" = 0 ] && break; sleep 3; done
|
|
say " qemu processes: $(ps -eo comm | grep -c '^qemu-system-x86')"
|
|
qemu-img snapshot -a virgin $Q && say " disk reverted to virgin"
|
|
say "## bake finished $(date -u +%FT%TZ)"
|