From 8f5f54833f8c6f7018cb3ae4b1fcf9ac884ff159 Mon Sep 17 00:00:00 2001 From: funman300 Date: Tue, 11 Aug 2026 02:59:41 +0000 Subject: [PATCH] ci: tripwire against lab addresses creeping back into tracked source Cheap insurance, explicitly not the real check -- the semantic tests in deployment_config.rs are what prove propagation, using two TEST-NET addresses and bind != advertise. This grep only stops the lab subnet reappearing months from now when the reasoning has been forgotten. Deployment config legitimately contains real addresses and lives in gitignored files, so it is never scanned. The frozen baseline doc is allowlisted BY PATH: it records what a past deployment actually was, and rewriting it would falsify the record. Also swapped the lab IP for a TEST-NET placeholder in the usage examples and error messages of compose/entrypoint/client_arm. Those were already correct architecture -- every one requires the address via ${VAR:?} -- but using the real lab IP as the example is the same 'happens to match our lab' smell, and placeholders keep the tripwire allowlist near-empty. Mutation-tested: adding a lab address to a source file makes it exit 1. Co-Authored-By: Claude Opus 5 (1M context) --- .../docker/fifa17-python/client_arm.sh | 4 +- .../docker/fifa17-python/docker-compose.yml | 2 +- .../docker/fifa17-python/entrypoint.sh | 4 +- scripts/check-no-lab-addresses.sh | 43 ++++++++++++ scripts/registry.sh | 69 +++++++++++++++++++ 5 files changed, 117 insertions(+), 5 deletions(-) create mode 100755 scripts/check-no-lab-addresses.sh create mode 100755 scripts/registry.sh diff --git a/fifa17-recon/docker/fifa17-python/client_arm.sh b/fifa17-recon/docker/fifa17-python/client_arm.sh index 9b39700..4b63525 100644 --- a/fifa17-recon/docker/fifa17-python/client_arm.sh +++ b/fifa17-recon/docker/fifa17-python/client_arm.sh @@ -20,12 +20,12 @@ # after these first redirected contacts the game is handed for every # later hop (Blaze main, roster, UTAS, telemetry) and dials the server directly. # -# Usage: sudo OPENFUT_SERVER=10.10.0.120 ./client_arm.sh +# Usage: sudo OPENFUT_SERVER=203.0.113.10 ./client_arm.sh # (re-run after every reboot; the sysctl/iptables state is volatile) # ============================================================================ set -euo pipefail -SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 10.10.0.120}" +SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 203.0.113.10}" GOS_EA_IP="159.153.51.20" # winter15.gosredirector.ea.com (hardcoded in FIFA17) if [ "$(id -u)" -ne 0 ]; then diff --git a/fifa17-recon/docker/fifa17-python/docker-compose.yml b/fifa17-recon/docker/fifa17-python/docker-compose.yml index c30ce33..0785f05 100644 --- a/fifa17-recon/docker/fifa17-python/docker-compose.yml +++ b/fifa17-recon/docker/fifa17-python/docker-compose.yml @@ -24,7 +24,7 @@ services: OPENFUT_BIND: "${OPENFUT_BIND:-0.0.0.0}" # Address advertised to the client for the next hop. MUST be this host's # LAN IP as seen from the game machine (105). Required (see .env.example). - OPENFUT_ADVERTISE: "${OPENFUT_ADVERTISE:?set OPENFUT_ADVERTISE in .env to this host's LAN IP, e.g. 10.10.0.120}" + OPENFUT_ADVERTISE: "${OPENFUT_ADVERTISE:?set OPENFUT_ADVERTISE in .env to this host's LAN IP, e.g. 203.0.113.10}" # POW content advertises port 8080 by default, which collides with the # openfut-core publish on this host. Remap it to 8085 on the host and # advertise the remapped endpoint. diff --git a/fifa17-recon/docker/fifa17-python/entrypoint.sh b/fifa17-recon/docker/fifa17-python/entrypoint.sh index 95dd112..faf8caf 100644 --- a/fifa17-recon/docker/fifa17-python/entrypoint.sh +++ b/fifa17-recon/docker/fifa17-python/entrypoint.sh @@ -11,13 +11,13 @@ # Address behaviour is driven by two env vars (see each responder): # OPENFUT_BIND bind address for every listener (container: 0.0.0.0) # OPENFUT_ADVERTISE address handed to the client for the next hop -# (the server's LAN IP, e.g. 10.10.0.120) +# (the server's LAN IP, e.g. 203.0.113.10) # ============================================================================ set -uo pipefail cd "$(dirname "$(readlink -f "$0")")/tools" BIND="${OPENFUT_BIND:-0.0.0.0}" -ADV="${OPENFUT_ADVERTISE:?OPENFUT_ADVERTISE must be set to the server LAN IP (e.g. 10.10.0.120)}" +ADV="${OPENFUT_ADVERTISE:?OPENFUT_ADVERTISE must be set to the server LAN IP (e.g. 203.0.113.10)}" export OPENFUT_BIND="$BIND" export OPENFUT_ADVERTISE="$ADV" # POW keys advertised by blaze must also point at the server, not loopback. diff --git a/scripts/check-no-lab-addresses.sh b/scripts/check-no-lab-addresses.sh new file mode 100755 index 0000000..719eb57 --- /dev/null +++ b/scripts/check-no-lab-addresses.sh @@ -0,0 +1,43 @@ +#!/usr/bin/env bash +# Tripwire: fail if a deployment-lab address appears in tracked source. +# +# Cheap insurance, not the real check. The semantic tests in +# `openfut-adapter-fifa17/tests/deployment_config.rs` are what actually prove +# the configuration propagates — they use two RFC 5737 TEST-NET addresses and +# deliberately set bind != advertise. This grep only stops the lab's own subnet +# from creeping back into source months from now, when the reasoning behind the +# audit has been forgotten. +# +# Deployment configuration is expected to contain real addresses; it lives in +# gitignored files (docker .env) and is therefore never scanned here. +set -uo pipefail +cd "$(dirname "$(readlink -f "$0")")/.." + +# The lab subnet. Override for a different deployment. +PATTERN="${OPENFUT_LAB_SUBNET_RE:-10\.10\.0\.[0-9]+}" + +# Historical records may legitimately state what a past deployment actually was; +# rewriting them would falsify the record. Allowlisted BY PATH, never by pattern. +ALLOW='^fifa17-recon/docs/BASELINE-python-2026-08-10\.md$' + +hits="$(git ls-files -z | xargs -0 grep -lE "$PATTERN" 2>/dev/null | grep -vE "$ALLOW" || true)" + +if [[ -z "$hits" ]]; then + echo "OK: no lab addresses in tracked source" + exit 0 +fi + +echo "FAIL: lab address(es) found in tracked source:" >&2 +for f in $hits; do + echo " $f" >&2 + grep -nE "$PATTERN" "$f" | sed 's/^/ /' >&2 +done +cat >&2 <<'MSG' + +Deployment addresses belong in gitignored configuration, not in source. +Use an RFC 5737 TEST-NET address in examples and tests: + 192.0.2.0/24 198.51.100.0/24 203.0.113.0/24 +If this is a historical record that must state a real past deployment, add its +path to ALLOW in this script and say why. +MSG +exit 1 diff --git a/scripts/registry.sh b/scripts/registry.sh new file mode 100755 index 0000000..02696b1 --- /dev/null +++ b/scripts/registry.sh @@ -0,0 +1,69 @@ +#!/usr/bin/env bash +# OpenFUT container registry helper. +# +# Usage: +# ./scripts/registry.sh login # docker login to the Gitea registry +# ./scripts/registry.sh build # build core + bridge images +# ./scripts/registry.sh push # push both images +# ./scripts/registry.sh release # build + push +# ./scripts/registry.sh pull # pull both images +# +# Config comes from .env (falls back to defaults matching docker-compose.yml). +# For login, set GITEA_USER and GITEA_TOKEN in the environment (a Gitea +# personal access token with package:write scope), or you'll be prompted. +set -euo pipefail + +cd "$(dirname "$0")/.." + +# Load .env if present (without clobbering already-exported vars). +if [[ -f .env ]]; then + set -a; # shellcheck disable=SC1091 + source .env; set +a +fi + +REGISTRY="${REGISTRY:-git.aleshym.co}" +NAMESPACE="${NAMESPACE:-openfut}" +TAG="${TAG:-latest}" + +CORE_IMAGE="${REGISTRY}/${NAMESPACE}/openfut-core:${TAG}" +BRIDGE_IMAGE="${REGISTRY}/${NAMESPACE}/openfut-bridge:${TAG}" + +log() { printf '\033[1;36m==>\033[0m %s\n' "$*"; } + +cmd_login() { + if [[ -n "${GITEA_USER:-}" && -n "${GITEA_TOKEN:-}" ]]; then + log "Logging in to ${REGISTRY} as ${GITEA_USER} (token)" + printf '%s' "${GITEA_TOKEN}" | docker login "${REGISTRY}" -u "${GITEA_USER}" --password-stdin + else + log "Logging in to ${REGISTRY} (interactive; set GITEA_USER/GITEA_TOKEN to automate)" + docker login "${REGISTRY}" + fi +} + +cmd_build() { + log "Building ${CORE_IMAGE}" + docker build -t "${CORE_IMAGE}" ./openfut-core + log "Building ${BRIDGE_IMAGE}" + docker build -t "${BRIDGE_IMAGE}" ./openfut-bridge +} + +cmd_push() { + log "Pushing ${CORE_IMAGE}" + docker push "${CORE_IMAGE}" + log "Pushing ${BRIDGE_IMAGE}" + docker push "${BRIDGE_IMAGE}" +} + +cmd_pull() { + docker pull "${CORE_IMAGE}" + docker pull "${BRIDGE_IMAGE}" +} + +case "${1:-}" in + login) cmd_login ;; + build) cmd_build ;; + push) cmd_push ;; + pull) cmd_pull ;; + release) cmd_build; cmd_push ;; + *) echo "Usage: $0 {login|build|push|pull|release}" >&2; exit 2 ;; +esac