funman300
5bc39e902d
openfut-observe.sh answers the one question no server log can: when a gate fails and a service logged nothing, did the client try and fail, or never try? Both look like silence. Two redirector gates were lost to that ambiguity -- "roster server logged nothing" was equally consistent with a broken roster service, a wrong roster URL, and a client that never asked. Built on iptables packet counters because this box has no tcpdump, no conntrack, and no readable kernel log. That last one is verified rather than assumed: an initial LOG-based version installed correctly and its rules matched (counters proved it), but the output went nowhere -- journalctl -k has no entries and dmesg is empty. Counters are also lower volume and record only SYNs, so no payload can be captured even in principle. Validated against the live client, not a loopback stand-in: an initial self-test using this host's own address counted almost nothing, because locally-generated packets never traverse PREROUTING. Against the real remote client it counts 8081 at ~4/min, matching the roster server's own log. Known gap, recorded rather than hidden: the catch-all TOTAL runs well above the sum of the named ports, so the client makes steady background attempts to ports not tracked here. It is present during a working session, so it is not the failure signature, and it is not chased further here. verify-build-identity.sh now rejects an argument that is not a commit hash. Passing the binary path instead of its stamp previously produced a plausible "REFUSING: binary was built from ./target/release/... but HEAD is <sha>", which reads as a real stale-build finding rather than a caller mistake -- and a safeguard that cries wolf is one people learn to route around. Usage error is now exit 2, distinct from a genuine stale build (1) and success (0).
57 lines
2.1 KiB
Bash
Executable File
57 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Is this binary trustworthy as gate evidence?
|
|
#
|
|
# verify-build-identity.sh <binary-commit>
|
|
#
|
|
# Two independent facts, both established HERE at launch rather than trusted
|
|
# from inside the binary:
|
|
#
|
|
# 1. the stamped commit equals the checkout's real HEAD
|
|
# 2. the migration crates have no uncommitted changes
|
|
#
|
|
# A compiled-in cleanliness flag cannot do this: cargo will not re-run a build
|
|
# script because another crate's source changed, so it can read "clean" for a
|
|
# binary built from edited sources. Verified on the Blaze host.
|
|
#
|
|
# REFUSES (exit non-zero) rather than warning. For a migration gate a warning on
|
|
# stderr is not a safeguard — it is something to scroll past.
|
|
set -uo pipefail
|
|
cd "$(dirname "$(readlink -f "$0")")/.."
|
|
|
|
STAMPED="${1:-}"
|
|
[[ -n "$STAMPED" ]] || { echo "usage: verify-build-identity.sh <binary-commit>" >&2; exit 2; }
|
|
|
|
# Reject anything that is not a commit BEFORE comparing. Passing the binary
|
|
# path instead of its stamp otherwise produces a perfectly plausible-looking
|
|
# REFUSING line, which reads as a real finding rather than a caller mistake —
|
|
# and a safeguard that cries wolf is one people learn to work around.
|
|
if [[ ! "$STAMPED" =~ ^[0-9a-f]{7,40}$ ]]; then
|
|
echo "usage error: expected a commit hash, got '$STAMPED'" >&2
|
|
echo " (to check a binary: verify-build-identity.sh \"\$(BIN --identity | sed -nE 's/.*commit=([0-9a-f]+).*/\\1/p')\")" >&2
|
|
exit 2
|
|
fi
|
|
|
|
CRATES=(openfut-protocol-blaze openfut-adapter-fifa17 openfut-host-config
|
|
openfut-blaze-host openfut-redirector-host)
|
|
|
|
rc=0
|
|
HEAD_NOW="$(git rev-parse --short=7 HEAD 2>/dev/null || echo unknown)"
|
|
|
|
if [[ "$STAMPED" != "$HEAD_NOW" ]]; then
|
|
echo "REFUSING: binary was built from $STAMPED but HEAD is $HEAD_NOW" >&2
|
|
echo " Rebuild before treating this run as evidence." >&2
|
|
rc=1
|
|
fi
|
|
|
|
DIRT="$(git status --porcelain --untracked-files=no -- "${CRATES[@]}" 2>/dev/null)"
|
|
if [[ -n "$DIRT" ]]; then
|
|
echo "REFUSING: migration crates have uncommitted changes:" >&2
|
|
sed 's/^/ /' <<<"$DIRT" >&2
|
|
rc=1
|
|
fi
|
|
|
|
if [[ $rc -eq 0 ]]; then
|
|
echo "build identity OK: commit $STAMPED == HEAD, migration crates clean"
|
|
fi
|
|
exit $rc
|