55 lines
1.9 KiB
Bash
55 lines
1.9 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Verify that the socktop binary baked into a built image understands every
|
||
|
|
# --flag the restricted/session shells pass to it.
|
||
|
|
#
|
||
|
|
# Why this exists: image 0.3.9 shipped with a cached apt layer holding socktop
|
||
|
|
# 1.60.1, while restricted-shell.sh had started passing --no-kill (added in
|
||
|
|
# 1.60.2). 1.60.1 parsed the unknown flag as the positional websocket URL,
|
||
|
|
# prompted to overwrite the 'local' profile with url "--no-kill", and broke the
|
||
|
|
# demo. This check fails the build whenever the shells and the installed
|
||
|
|
# binary disagree about the CLI.
|
||
|
|
#
|
||
|
|
# Usage: verify-image-socktop-flags.sh IMAGE
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
IMAGE="${1:?usage: verify-image-socktop-flags.sh IMAGE}"
|
||
|
|
cd "$(dirname "$0")/.."
|
||
|
|
|
||
|
|
# Every --flag appearing on a socktop invocation line in the shells.
|
||
|
|
FLAGS=$(grep -hE '/usr/bin/socktop' docker/restricted-shell.sh docker/session-shell.sh 2>/dev/null |
|
||
|
|
grep -oE -- '--[a-z][a-z-]*' | sort -u)
|
||
|
|
if [ -z "$FLAGS" ]; then
|
||
|
|
echo "ERROR: found no socktop flags to verify — did the shells move?" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
# The image is arm64-only; pin the platform so the check behaves the same on
|
||
|
|
# the arm64 CI runner and on an amd64 box with qemu binfmt.
|
||
|
|
run_socktop() {
|
||
|
|
docker run --rm --platform linux/arm64 --entrypoint /usr/bin/socktop "$IMAGE" "$@" 2>&1
|
||
|
|
}
|
||
|
|
|
||
|
|
if ! VERSION=$(run_socktop --version); then
|
||
|
|
echo "ERROR: could not run socktop from ${IMAGE}:" >&2
|
||
|
|
echo "$VERSION" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
HELP=$(run_socktop --help || true)
|
||
|
|
echo "image socktop: ${VERSION}"
|
||
|
|
|
||
|
|
rc=0
|
||
|
|
for flag in $FLAGS; do
|
||
|
|
if printf '%s' "$HELP" | grep -q -- "$flag"; then
|
||
|
|
echo " ok: $flag"
|
||
|
|
else
|
||
|
|
echo " MISSING: installed socktop does not document $flag" >&2
|
||
|
|
rc=1
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
if [ "$rc" -ne 0 ]; then
|
||
|
|
echo "FAIL: the image's socktop predates flags the shells pass." >&2
|
||
|
|
echo "Bump SOCKTOP_VERSION in the Dockerfile to a release that has them." >&2
|
||
|
|
fi
|
||
|
|
exit $rc
|