funman300
8f5f54833f
Cheap insurance, explicitly not the real check -- the semantic tests in
deployment_config.rs are what prove propagation, using two TEST-NET addresses
and bind != advertise. This grep only stops the lab subnet reappearing months
from now when the reasoning has been forgotten.
Deployment config legitimately contains real addresses and lives in gitignored
files, so it is never scanned. The frozen baseline doc is allowlisted BY PATH:
it records what a past deployment actually was, and rewriting it would falsify
the record.
Also swapped the lab IP for a TEST-NET placeholder in the usage examples and
error messages of compose/entrypoint/client_arm. Those were already correct
architecture -- every one requires the address via ${VAR:?} -- but using the
real lab IP as the example is the same 'happens to match our lab' smell, and
placeholders keep the tripwire allowlist near-empty.
Mutation-tested: adding a lab address to a source file makes it exit 1.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
44 lines
1.7 KiB
Bash
Executable File
44 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Tripwire: fail if a deployment-lab address appears in tracked source.
|
|
#
|
|
# Cheap insurance, not the real check. The semantic tests in
|
|
# `openfut-adapter-fifa17/tests/deployment_config.rs` are what actually prove
|
|
# the configuration propagates — they use two RFC 5737 TEST-NET addresses and
|
|
# deliberately set bind != advertise. This grep only stops the lab's own subnet
|
|
# from creeping back into source months from now, when the reasoning behind the
|
|
# audit has been forgotten.
|
|
#
|
|
# Deployment configuration is expected to contain real addresses; it lives in
|
|
# gitignored files (docker .env) and is therefore never scanned here.
|
|
set -uo pipefail
|
|
cd "$(dirname "$(readlink -f "$0")")/.."
|
|
|
|
# The lab subnet. Override for a different deployment.
|
|
PATTERN="${OPENFUT_LAB_SUBNET_RE:-10\.10\.0\.[0-9]+}"
|
|
|
|
# Historical records may legitimately state what a past deployment actually was;
|
|
# rewriting them would falsify the record. Allowlisted BY PATH, never by pattern.
|
|
ALLOW='^fifa17-recon/docs/BASELINE-python-2026-08-10\.md$'
|
|
|
|
hits="$(git ls-files -z | xargs -0 grep -lE "$PATTERN" 2>/dev/null | grep -vE "$ALLOW" || true)"
|
|
|
|
if [[ -z "$hits" ]]; then
|
|
echo "OK: no lab addresses in tracked source"
|
|
exit 0
|
|
fi
|
|
|
|
echo "FAIL: lab address(es) found in tracked source:" >&2
|
|
for f in $hits; do
|
|
echo " $f" >&2
|
|
grep -nE "$PATTERN" "$f" | sed 's/^/ /' >&2
|
|
done
|
|
cat >&2 <<'MSG'
|
|
|
|
Deployment addresses belong in gitignored configuration, not in source.
|
|
Use an RFC 5737 TEST-NET address in examples and tests:
|
|
192.0.2.0/24 198.51.100.0/24 203.0.113.0/24
|
|
If this is a historical record that must state a real past deployment, add its
|
|
path to ALLOW in this script and say why.
|
|
MSG
|
|
exit 1
|