53f0061d31
The old package-validate.sh only checked that the unit came up and that `yams daemon status` answered with YAMS_DAEMON_SOCKET set by hand, so it passed while nobody's CLI ever reached the system daemon, the socket was world-writable and `yams add ~/file` failed. package-validate.sh stays the single entry point (same --only/--deb/ --rpm/--arch flags the workflow uses) and now drives package-validate-checks.sh inside Debian, Ubuntu, Fedora and Arch containers booted with systemd as PID 1 (private cgroup namespace; the host's cgroups are not shared). Per lane it checks: install with no manual steps; the installed file list against a runtime allowlist with no headers, static libs, pkg-config or CMake files; no world-writable, setuid or non-root files; resolvable DT_NEEDED and $ORIGIN-or-/usr/lib RPATH/RUNPATH; unit enabled and active as the yams account; socket group yams and closed to others; `systemd-analyze verify` and a `systemd-analyze security` exposure budget; root, a yams-group member and a non-member using the CLI with no YAMS_* variables (add from $HOME and /tmp, search, shared corpus, no private fallback store, clear directory error, non-member denied, `daemon stop` deferring to systemd); state after a container reboot; removal and deb purge. With --upgrade-from-<fmt> it installs an older package, stores a document, upgrades and checks the restart and the document. Every check reports PASS/FAIL, a summary table follows, and any FAIL fails the run. release.yml's existing validation steps (the gate before artifacts are uploaded for publishing) pass the latest published release's packages as the upgrade source. The unreferenced packaging/systemd/Dockerfile is removed; the lane images take a BASE_IMAGE argument and add binutils and util-linux for the checks. Signed-off-by: trvon <me@trevon.dev>
33 lines
1.3 KiB
Docker
33 lines
1.3 KiB
Docker
# Minimal Arch Linux systemd-in-Docker substrate for package validation.
|
|
#
|
|
# Used by scripts/local-ci/package-validate.sh to boot an Arch container under
|
|
# /usr/lib/systemd/systemd, install the built .pkg.tar.zst package, and
|
|
# validate the yams-daemon service end-to-end (see that script).
|
|
|
|
# archlinux/archlinux is amd64-only; aarch64 lanes pass an Arch Linux ARM
|
|
# image (ghcr.io/menci/archlinuxarm, built from the official ALARM rootfs).
|
|
ARG ARCH_BASE_IMAGE=archlinux/archlinux:latest
|
|
FROM ${ARCH_BASE_IMAGE}
|
|
|
|
ENV container=docker
|
|
|
|
RUN set -eux; \
|
|
grep -q '^DisableSandbox$' /etc/pacman.conf || sed -i '/^\[options\]/a DisableSandbox' /etc/pacman.conf; \
|
|
grep -q '^[[:space:]]*DownloadUser' /etc/pacman.conf && sed -i 's/^[[:space:]]*DownloadUser/# DownloadUser/' /etc/pacman.conf || true; \
|
|
pacman-key --init 2>/dev/null || true; \
|
|
pacman-key --populate archlinux 2>/dev/null || true; \
|
|
pacman-key --populate archlinuxarm 2>/dev/null || true; \
|
|
pacman -Syu --noconfirm --needed; \
|
|
pacman -S --noconfirm --needed \
|
|
systemd \
|
|
procps-ng \
|
|
iproute2 \
|
|
shadow \
|
|
util-linux \
|
|
binutils \
|
|
findutils \
|
|
ca-certificates; \
|
|
yes | pacman -Scc 2>/dev/null || true
|
|
|
|
STOPSIGNAL SIGRTMIN+3
|
|
CMD ["/usr/lib/systemd/systemd"]
|