tooling: observe client connection ATTEMPTS; make the build guard reject bad args

openfut-observe.sh answers the one question no server log can: when a gate fails and a service logged nothing, did the client try and fail, or never try? Both look like silence. Two redirector gates were lost to that ambiguity -- "roster server logged nothing" was equally consistent with a broken roster service, a wrong roster URL, and a client that never asked. Built on iptables packet counters because this box has no tcpdump, no conntrack, and no readable kernel log. That last one is verified rather than assumed: an initial LOG-based version installed correctly and its rules matched (counters proved it), but the output went nowhere -- journalctl -k has no entries and dmesg is empty. Counters are also lower volume and record only SYNs, so no payload can be captured even in principle. Validated against the live client, not a loopback stand-in: an initial self-test using this host's own address counted almost nothing, because locally-generated packets never traverse PREROUTING. Against the real remote client it counts 8081 at ~4/min, matching the roster server's own log. Known gap, recorded rather than hidden: the catch-all TOTAL runs well above the sum of the named ports, so the client makes steady background attempts to ports not tracked here. It is present during a working session, so it is not the failure signature, and it is not chased further here. verify-build-identity.sh now rejects an argument that is not a commit hash. Passing the binary path instead of its stamp previously produced a plausible "REFUSING: binary was built from ./target/release/... but HEAD is <sha>", which reads as a real stale-build finding rather than a caller mistake -- and a safeguard that cries wolf is one people learn to route around. Usage error is now exit 2, distinct from a genuine stale build (1) and success (0).
2026-08-11 04:22:40 +00:00
parent e2c4ca6d56
commit 5bc39e902d
2 changed files with 150 additions and 0 deletions
@@ -21,6 +21,16 @@ cd "$(dirname "$(readlink -f "$0")")/.."
 STAMPED="${1:-}"
 [[ -n "$STAMPED" ]] || { echo "usage: verify-build-identity.sh <binary-commit>" >&2; exit 2; }

+# Reject anything that is not a commit BEFORE comparing. Passing the binary
+# path instead of its stamp otherwise produces a perfectly plausible-looking
+# REFUSING line, which reads as a real finding rather than a caller mistake —
+# and a safeguard that cries wolf is one people learn to work around.
+if [[ ! "$STAMPED" =~ ^[0-9a-f]{7,40}$ ]]; then
+  echo "usage error: expected a commit hash, got '$STAMPED'" >&2
+  echo "  (to check a binary: verify-build-identity.sh \"\$(BIN --identity | sed -nE 's/.*commit=([0-9a-f]+).*/\\1/p')\")" >&2
+  exit 2
+fi
+
 CRATES=(openfut-protocol-blaze openfut-adapter-fifa17 openfut-host-config
        openfut-blaze-host openfut-redirector-host)