@mriekki/project-forge 4.20.0 → 4.22.0

package/assets/generated/deployment/src/project_forge_deployment/app_runtime_remote.py

@@ -8,6 +8,7 @@ EXPECTED_SPEC_SHA="${2:-}"
 DEPLOY_USER="${3:-}"
 HELD_LOCK_FD="${4:-}"
 APP_ROOT="__APP_ROOT__"
+MATERIAL_ROOT="__MATERIAL_ROOT__"
 APP_SCHEMA_VERSION="__APP_SCHEMA_VERSION__"
 NETWORK_NAME="__NETWORK_NAME__"
 CADDY_CONTAINER="__CADDY_CONTAINER__"
@@ -26,6 +27,9 @@ D_DATA_TARGET_B64="__D_DATA_TARGET_B64__"
 D_SPEC_SHA="__D_SPEC_SHA__"
 D_ENV_KEYS=(__D_ENV_KEYS__)
 D_ENV_VALUES=(__D_ENV_VALUES__)
+D_MATERIAL_NAMES=(__D_MATERIAL_NAMES__)
+D_MATERIAL_TARGETS=(__D_MATERIAL_TARGETS__)
+D_MATERIAL_EXPECTED=(__D_MATERIAL_EXPECTED__)
 
 b64d() { printf '%s' "$1" | base64 --decode; }
 meta_value() {
@@ -53,6 +57,92 @@ network_has_container() {
         grep -Fxq "$container"
 }
 
+
+material_source() {
+    printf '%s/%s/%s/%s' "$MATERIAL_ROOT" "$D_APP" "$D_ENV" "$1"
+}
+material_identity() {
+    local source="$1" run_as="$2" uid gid dir owner mode hazards
+    uid="${run_as%%:*}"
+    gid="$uid"
+    [[ "$run_as" != *:* ]] || gid="${run_as#*:}"
+    command -v setpriv >/dev/null 2>&1 || {
+        echo "setpriv is required to verify read-only material access for runAs." >&2; return 1;
+    }
+    for dir in /srv "$MATERIAL_ROOT" "$MATERIAL_ROOT/$D_APP" "$MATERIAL_ROOT/$D_APP/$D_ENV" "$source"; do
+        [[ -d "$dir" && ! -L "$dir" ]] || {
+            echo "Read-only material directory missing or linked: $dir" >&2; return 1;
+        }
+        owner="$(stat -c '%u' "$dir")"
+        mode="$(stat -c '%a' "$dir")"
+        [[ "$owner" == 0 ]] && (( (8#$mode & 022) == 0 )) || {
+            echo "Read-only material directory ownership or mode is unsafe: $dir" >&2; return 1;
+        }
+    done
+    hazards="$(find -P "$source" -mindepth 1 \( -type l -o ! -uid 0 -o -perm /022 -o \( ! -type f -a ! -type d \) \) -print -quit)" || return 1
+    [[ -z "$hazards" ]] || {
+        echo "Read-only material tree has linked, writable, unowned or special entries." >&2; return 1;
+    }
+    setpriv --reuid "$uid" --regid "$gid" --clear-groups -- bash -c '
+        path="$1"
+        [[ -r "$path" && -x "$path" ]] || exit 1
+        invalid="$(find -P "$path" \( -type d \( ! -readable -o ! -executable \) -o -type f ! -readable \) -print -quit)" || exit 1
+        [[ -z "$invalid" ]]
+    ' -- "$source" || {
+        echo "Read-only material tree is not readable/traversable by runAs." >&2; return 1;
+    }
+    stat -c '%d:%i' "$source"
+}
+validate_material_entries() {
+    [[ "${#D_MATERIAL_NAMES[@]}" -eq "${#D_MATERIAL_TARGETS[@]}" &&
+       "${#D_MATERIAL_NAMES[@]}" -eq "${#D_MATERIAL_EXPECTED[@]}" ]] || {
+        echo "Read-only material argument count mismatch." >&2; exit 33;
+    }
+    local index name target part prior data
+    local -a segments targets=()
+    data="$D_DATA_TARGET"
+    for index in "${!D_MATERIAL_NAMES[@]}"; do
+        name="$(b64d "${D_MATERIAL_NAMES[$index]}")"
+        target="$(b64d "${D_MATERIAL_TARGETS[$index]}")"
+        valid_slug "$name" || { echo "Invalid read-only material name." >&2; exit 33; }
+        [[ "$target" == /* && "$target" != / && "$target" =~ ^/[A-Za-z0-9._~+:/-]+$ ]] || {
+            echo "Invalid read-only material target." >&2; exit 33;
+        }
+        IFS='/' read -r -a segments <<< "${target#/}"
+        for part in "${segments[@]}"; do
+            [[ -n "$part" && "$part" != . && "$part" != .. ]] || {
+                echo "Read-only material target is not normalized." >&2; exit 33;
+            }
+        done
+        case "$target/" in
+            /proc/*|/sys/*|/dev/*|/run/*|/var/run/*)
+                echo "Read-only material target overlaps a system path." >&2; exit 33;;
+        esac
+        for prior in "${targets[@]}" "$data"; do
+            [[ -z "$prior" ]] && continue
+            if [[ "$target" == "$prior" || "$target" == "$prior/"* || "$prior" == "$target/"* ]]; then
+                echo "Read-only material target overlaps another mount." >&2; exit 33
+            fi
+        done
+        targets+=("$target")
+    done
+}
+material_probe() {
+    local check_expected="$1" index name source identity expected
+    for index in "${!D_MATERIAL_NAMES[@]}"; do
+        name="$(b64d "${D_MATERIAL_NAMES[$index]}")"
+        source="$(material_source "$name")"
+        identity="$(material_identity "$source" "$D_RUN_AS")" || return 1
+        expected="${D_MATERIAL_EXPECTED[$index]}"
+        if [[ "$check_expected" == true && "$identity" != "$expected" ]]; then
+            echo "Read-only material directory changed after planning: $name" >&2; return 1
+        fi
+        if [[ "$check_expected" != true ]]; then
+            printf 'MATERIAL\t%s\t%s\n' "$name" "$identity"
+        fi
+    done
+}
+
 probe_http() {
     local container="$1" port="$2" path="$3"
     docker exec "$CADDY_CONTAINER" \
@@ -75,6 +165,47 @@ wait_ready() {
     return 1
 }
 
+
+material_inventory_state() {
+    local file="$1" app="$2" env="$3" container="$4" persistence="$5"
+    local number index name target source recorded current raw mounts run_as data_target line
+    number="$(meta_value "$file" MATERIAL_COUNT || true)"
+    MATERIAL_OK=true
+    MATERIAL_ENTRIES=""
+    [[ -n "$number" ]] || return 0
+    [[ "$number" =~ ^[1-8]$ ]] || { echo "Invalid saved material count." >&2; return 1; }
+    D_APP="$app"
+    D_ENV="$env"
+    run_as="$(meta_value "$file" RUN_AS || true)"
+    valid_run_as "$run_as" || { echo "Invalid saved material runAs." >&2; return 1; }
+    mounts="$(docker inspect --format '{{range .Mounts}}{{printf "%s@%s@%t@%s\n" .Source .Destination .RW .Type}}{{end}}' "$container" 2>/dev/null)" || {
+        MATERIAL_OK=false
+        mounts=""
+    }
+    local expected_count="$number"
+    if [[ "$persistence" == directory ]]; then
+        data_target="$(b64d "$(meta_value "$file" DATA_TARGET_B64 || true)")"
+        line="$APP_ROOT/$app/$env/data@$data_target@true@bind"
+        grep -Fxq -- "$line" <<< "$mounts" || MATERIAL_OK=false
+        expected_count="$((number + 1))"
+    fi
+    [[ "$(grep -c '.' <<< "$mounts" || true)" == "$expected_count" ]] || MATERIAL_OK=false
+    for ((index=0; index < number; index++)); do
+        name="$(b64d "$(meta_value "$file" MATERIAL_NAME_B64_"$index" || true)")"
+        target="$(b64d "$(meta_value "$file" MATERIAL_TARGET_B64_"$index" || true)")"
+        recorded="$(meta_value "$file" MATERIAL_ID_"$index" || true)"
+        valid_slug "$name" && [[ "$target" =~ ^/[A-Za-z0-9._~+:/-]+$ && "$recorded" =~ ^[0-9]+:[0-9]+$ ]] || {
+            echo "Invalid saved material mount metadata." >&2; return 1;
+        }
+        source="$(material_source "$name")"
+        current="$(material_identity "$source" "$run_as" 2>/dev/null)" || { MATERIAL_OK=false; current=""; }
+        [[ "$current" == "$recorded" ]] || MATERIAL_OK=false
+        grep -Fxq -- "$source@$target@false@bind" <<< "$mounts" || MATERIAL_OK=false
+        [[ -z "$MATERIAL_ENTRIES" ]] || MATERIAL_ENTRIES+=";"
+        MATERIAL_ENTRIES+="$name@$target@$recorded"
+    done
+}
+
 inventory() {
     local count=0 state current previous release_file
     local owner env app container image spec_sha port health persistence
@@ -114,9 +245,16 @@ inventory() {
             if [[ "$running" == true && "$connected" == true ]]; then
                 probe_http "$container" "$port" "$health" && healthy=true || true
             fi
-            printf 'APP\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
-                "$owner" "$env" "$app" "$container" "$image" "$spec_sha" "$port" "$health" "$persistence" \
-                "$current" "$previous" "$running" "$connected" "$healthy"
+            material_inventory_state "$release_file" "$app" "$env" "$container" "$persistence" || exit 31
+            if [[ -n "$MATERIAL_ENTRIES" ]]; then
+                printf 'APP\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+                    "$owner" "$env" "$app" "$container" "$image" "$spec_sha" "$port" "$health" "$persistence" \
+                    "$current" "$previous" "$running" "$connected" "$healthy" "$MATERIAL_OK" "$MATERIAL_ENTRIES"
+            else
+                printf 'APP\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+                    "$owner" "$env" "$app" "$container" "$image" "$spec_sha" "$port" "$health" "$persistence" \
+                    "$current" "$previous" "$running" "$connected" "$healthy"
+            fi
             count=$((count + 1))
         done < <(find "$APP_ROOT" -mindepth 3 -maxdepth 3 -type f -name deployment.env -print 2>/dev/null | sort)
     fi
@@ -173,6 +311,7 @@ decode_desired() {
         exit 33
     }
     valid_run_as "$D_RUN_AS" || { echo "Invalid numeric runAs value." >&2; exit 33; }
+    validate_material_entries
     [[ "$D_PERSISTENCE" == "none" || "$D_PERSISTENCE" == "directory" ]] || {
         echo "Invalid persistence mode." >&2
         exit 33
@@ -216,6 +355,14 @@ write_release_metadata() {
         printf 'PERSISTENCE_MODE=%s\n' "$D_PERSISTENCE"
         printf 'DATA_TARGET_B64=%s\n' "$D_DATA_TARGET_B64"
         printf 'SPEC_SHA256=%s\n' "$D_SPEC_SHA"
+        if (( ${#D_MATERIAL_NAMES[@]} > 0 )); then
+            printf 'MATERIAL_COUNT=%s\n' "${#D_MATERIAL_NAMES[@]}"
+            for index in "${!D_MATERIAL_NAMES[@]}"; do
+                printf 'MATERIAL_NAME_B64_%s=%s\n' "$index" "${D_MATERIAL_NAMES[$index]}"
+                printf 'MATERIAL_TARGET_B64_%s=%s\n' "$index" "${D_MATERIAL_TARGETS[$index]}"
+                printf 'MATERIAL_ID_%s=%s\n' "$index" "${D_MATERIAL_EXPECTED[$index]}"
+            done
+        fi
         printf 'ENV_COUNT=%s\n' "${#D_ENV_KEYS[@]}"
         for index in "${!D_ENV_KEYS[@]}"; do
             key_b64="${D_ENV_KEYS[$index]}"
@@ -271,6 +418,13 @@ start_desired_container() {
         value="$(b64d "${D_ENV_VALUES[$index]}")"
         docker_args+=(--env "$key=$value")
     done
+    for index in "${!D_MATERIAL_NAMES[@]}"; do
+        local source target name
+        name="$(b64d "${D_MATERIAL_NAMES[$index]}")"
+        target="$(b64d "${D_MATERIAL_TARGETS[$index]}")"
+        source="$(material_source "$name")"
+        docker_args+=(--mount "type=bind,src=$source,dst=$target,readonly")
+    done
     docker_args+=("$D_IMAGE")
     "${docker_args[@]}" >/dev/null
 }
@@ -339,6 +493,7 @@ deploy() {
     release_file="$release_dir/release.env"
 
     acquire_deployment_lock "$lock_file"
+    material_probe true || { echo "Read-only material preflight failed." >&2; exit 40; }
 
     for path in "$root" "$releases" "$state" "$root/data" "$root/deployment-evidence.jsonl"; do
         [[ ! -L "$path" ]] || { echo "Managed application path must not be a symbolic link: $path" >&2; exit 35; }
@@ -397,11 +552,22 @@ deploy() {
             echo "Release directory collision with different runtime metadata." >&2
             exit 35
         }
+        if (( ${#D_MATERIAL_NAMES[@]} > 0 )); then
+            [[ "$(release_value "$release_file" MATERIAL_COUNT || true)" == "${#D_MATERIAL_NAMES[@]}" ]] || {
+                echo "Existing release material metadata mismatch." >&2; exit 35;
+            }
+            for index in "${!D_MATERIAL_NAMES[@]}"; do
+                [[ "$(release_value "$release_file" MATERIAL_ID_"$index" || true)" == "${D_MATERIAL_EXPECTED[$index]}" ]] || {
+                    echo "Existing release material directory identity changed." >&2; exit 35;
+                }
+            done
+        fi
     else
         write_release_metadata "$release_file"
     fi
 
     docker pull "$D_IMAGE" >/dev/null
+    material_probe true || { echo "Read-only material source changed before runtime replacement." >&2; exit 40; }
 
     if [[ -n "$current_container" ]]; then
         docker rm -f "$current_container" >/dev/null
@@ -442,6 +608,10 @@ case "$ACTION" in
     deploy)
         deploy
         ;;
+    material-inspect)
+        decode_desired
+        material_probe false || exit 40
+        ;;
     *)
         echo "Unsupported application-runtime action: $ACTION" >&2
         exit 2