funman300/OpenFUT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

redirector.sh: verify the RUNNING process's commit, not just the binary on disk

Browse Source 
`verify` inspects `$BIN --identity`, which is the file on disk. That is not
necessarily what is serving. Caught during gate 14 setup: the live process had
been started from 5bc39e9, then `cargo test` re-ran build.rs (the branch ref
moved when an unrelated script was committed) and restamped the on-disk binary
to fc411bb. `verify` then reported "build identity OK" about an artifact that
was not the running service.

`start` now records the stamped commit to $RUNDIR/redirector.commit, and
`verify-running` compares THAT against HEAD, refusing when they differ. The
existing on-disk check stays -- it is the right gate for "may I start this" --
but only the recorded stamp answers "is the thing currently serving the thing I
think it is", which is the question a live gate's evidence depends on.
This commit is contained in:
funman300
2026-08-11 05:03:47 +00:00
parent fc411bb6f1
commit cfb0435d96
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openfut-redirector-host/redirector.sh
+18
View File
@@ -17,6 +17,10 @@ ROOT="$(cd "$HERE/.." && pwd)"
RUNDIR="${OPENFUT_REDIRECTOR_RUNDIR:-${TMPDIR:-/tmp}/openfut-redirector}"
PIDFILE="$RUNDIR/redirector.pid"
PORTFILE="$RUNDIR/redirector.port"
# Commit the RUNNING process was started from. `verify` alone inspects the
# on-disk binary, which a rebuild (even `cargo test`, which re-runs build.rs
# when the branch ref moves) can silently advance past the live process.
STAMPFILE="$RUNDIR/redirector.commit"
LOGFILE="${OPENFUT_REDIRECTOR_LOG:-$RUNDIR/redirector.log}"
BIN="$ROOT/target/debug/openfut-redirector-host"
[[ -x "$BIN" ]] || BIN="$ROOT/target/release/openfut-redirector-host"
@@ -56,6 +60,7 @@ cmd_start() {
cmd_verify || die "build identity check failed — refusing to start"
mkdir -p "$RUNDIR"; echo "$OPENFUT_REDIRECTOR_HOST_PORT" > "$PORTFILE"
stamped_commit > "$STAMPFILE"
"$BIN" >"$LOGFILE" 2>&1 &
local pid=$!; echo "$pid" > "$PIDFILE"
local w=0
@@ -102,10 +107,23 @@ cmd_status() {
return 0
}
cmd_verify_running() {
[[ -f "$STAMPFILE" ]] || die "no running-process stamp — was it started by this script?"
local running head
running="$(cat "$STAMPFILE")"; head="$(git -C "$ROOT" rev-parse --short=7 HEAD 2>/dev/null)"
if [[ "$running" != "$head" ]]; then
echo "REFUSING: the RUNNING process was started from $running but HEAD is $head" >&2
echo " Restart before treating this run as evidence." >&2
return 1
fi
echo "running-process identity OK: started from $running == HEAD"
}
case "${1:-}" in
start) cmd_start ;;
stop) cmd_stop ;;
status) cmd_status ;;
verify) cmd_verify ;;
verify-running) cmd_verify_running ;;
*) sed -n '2,6p' "$0" | sed 's/^# \?//'; exit 2 ;;
esac