cluade-reviewer-andresmgsl
fbdce5284e
Round finding from @codex-reviewer-andresmgsl, elevated to blocking by
@grok-reviewer-andresmgsl and @kimi-reviewer-andresmgsl. Unanimous, and right.
creds.md called the registration token "short-lived" and said it was "consumed
at registration". Both are GitHub's facts, copied across the forge boundary
with the rest of the sibling's shape. Forgejo's primary source, read rather
than inferred:
models/actions/runner_token.go — ActionRunnerToken has NO expiry field. Only
IsActive, Created, Updated. NewRunnerToken flips IsActive false on prior
tokens at the same scope and only there, so a token dies when somebody mints
its replacement, never on a clock.
routers/api/actions/runner/runner.go — Register reads the token, refuses it
when !IsActive ("please use the latest one"), and returns WITHOUT setting
IsActive = false. Registration does not spend it. One token registers as many
runners as it is shown to.
So it is long-lived and reusable — the precise opposite of the adjective, and
GitHub's really does expire in about an hour, which is why runner-install.sh is
correct to use it.
This is not a wording nit because of where the wording lives. creds.md is
spliced into the ci-box's own CONTEXT.md: it is the paragraph an agent INSIDE
the box reads about its own credentials. Telling that reader the token
self-expires is telling it a leaked one stops mattering on its own, while it is
still registering runners.
Pinned, not merely fixed, per codex's ask — the phrase arrived by copying from
the GitHub sibling, so the same copy can bring it back. Four rows: absence from
both files, and presence of the true claim, so the pin cannot be satisfied by
deleting the sentence instead of correcting it. The first draft of the CIBOX
pin was a phrase match and passed against the exact text it was written to
catch — the old wording wrapped across two comment lines. It is a plain absence
check now, and the file explains the ban without spelling the word.
Mutation-checked: all four go red against the old wording, green after.
124 lines
6.2 KiB
Bash
Executable file
124 lines
6.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# ci-box — the forgejo-runner binary. Run BY THE MECHANISM as root, with
|
|
# TENANT_USER/TENANT_HOME/TENANT_GROUP/ROLE exported.
|
|
#
|
|
# This lands the BINARY ONLY. Registration is deliberately not here: it needs a
|
|
# registration token from the Forgejo instance, and a tenant install is
|
|
# creds-free by contract — box auto-runs it at mint, holding nothing. The
|
|
# operator registers afterwards, out loud:
|
|
#
|
|
# Deliberately NOT described the way the GitHub sibling describes its own
|
|
# registration token, which really does expire in about an hour. That adjective
|
|
# must not cross this forge boundary — a test pins its absence from this file
|
|
# and from creds.md, so do not reintroduce it by copying from `rig runner`.
|
|
# Forgejo's ActionRunnerToken carries no expiry field at all;
|
|
# NewRunnerToken invalidates prior tokens only when a replacement is minted at
|
|
# the same scope, and Register leaves the one it was handed active. It is
|
|
# reusable until replaced, so a leak stays live. See creds.md, which is the
|
|
# copy an agent inside the box actually reads.
|
|
#
|
|
# box shell ci-box
|
|
# sudo rig forgejo-runner install --instance https://forgejo.example.com
|
|
#
|
|
# Same split as staging-box's tailnet join, for the same reason.
|
|
#
|
|
# Root-owned under /usr/local/bin rather than the tenant's home: unlike an
|
|
# agent CLI, this binary is run by a systemd unit as the tenant user, and a
|
|
# tenant-writable binary that root's unit executes is a trivial path to root
|
|
# inside the box.
|
|
set -euo pipefail
|
|
|
|
# fetch_and_verify_sha256 <asset-url> <file> <sumfile> <label>
|
|
#
|
|
# The whole checksum POLICY, in one place: fetch the published .sha256 beside
|
|
# an asset and prove the download matches it. Prints the reason on stderr and
|
|
# returns 1 on any failure; the caller supplies the refusal in its own voice.
|
|
#
|
|
# BYTE-IDENTICAL to the copy in commands/forgejo-runner-install.sh, diffed by
|
|
# test/cli.sh — the valid_version / templates_archive_urls precedent. The two
|
|
# downloaders cannot share a lib: that one sources commands/lib/, and this one
|
|
# is a REGISTRY DEFINITION that runs standalone inside a mint from a fetched
|
|
# tarball, with rig's tree nowhere in reach. So the pin is the only mechanism
|
|
# that keeps one policy from becoming two.
|
|
#
|
|
# Review !110 is the evidence for why that matters: a fail-open branch lived in
|
|
# BOTH copies while a grep for "checksum mismatch" passed against both, because
|
|
# the string it looked for sat right beside the branch it could not see. The
|
|
# next checksum-policy change must not be able to land in one file only.
|
|
#
|
|
# AN UNFETCHABLE CHECKSUM REFUSES — it is a gate, not a courtesy. The earlier
|
|
# reasoning ("do not let an upstream layout change break installs") reasons
|
|
# about the wrong failure: a layout change moves the BINARY url too, so the
|
|
# download would already have died. "Binary yes, checksum no" is not what a
|
|
# layout change looks like — it is what an interfered fetch looks like, which
|
|
# is precisely what a checksum exists to catch. Failing open would hand an
|
|
# unverified root install to anyone able to block a single URL. There is
|
|
# deliberately no bypass flag: if upstream really does move its assets, that is
|
|
# a rig PR editing the URL, not an operator improvising past a security gate.
|
|
fetch_and_verify_sha256() {
|
|
local url="$1" file="$2" sumfile="$3" label="$4" want got
|
|
if ! curl -fsSL "${url}.sha256" -o "$sumfile" 2>/dev/null; then
|
|
printf 'no published .sha256 for %s at %s.sha256 — the binary itself downloaded, so this is not an upstream layout change; check what is intercepting the fetch\n' "$label" "$url" >&2
|
|
return 1
|
|
fi
|
|
# The published .sha256 names the asset, not our temp path. Compare the
|
|
# digest itself rather than rewriting the file into sha256sum -c's format:
|
|
# one comparison, no parsing of a file we did not write.
|
|
want="$(tr -d '\r' < "$sumfile" 2>/dev/null | awk '{print $1}' | head -n1)"
|
|
got="$(sha256sum "$file" | awk '{print $1}')"
|
|
if [ -z "$want" ]; then
|
|
printf 'the published checksum for %s is unreadable — a fetch that succeeds but returns nothing usable is not a verified download\n' "$label" >&2
|
|
return 1
|
|
fi
|
|
if [ "$want" != "$got" ]; then
|
|
printf 'checksum mismatch for %s: published %s, downloaded %s\n' "$label" "$want" "$got" >&2
|
|
return 1
|
|
fi
|
|
printf 'checksum verified (%s)\n' "$got"
|
|
}
|
|
|
|
BIN=/usr/local/bin/forgejo-runner
|
|
|
|
if [ -x "$BIN" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
case "$(uname -m)" in
|
|
x86_64) ARCH="amd64" ;;
|
|
aarch64) ARCH="arm64" ;;
|
|
*) echo "ci-box install: unsupported arch: $(uname -m)" >&2; exit 1 ;;
|
|
esac
|
|
|
|
# The latest release, resolved by following the releases/latest redirect — no
|
|
# API call, no token, no JSON to parse on a dependency-free guest. A pinned
|
|
# version belongs to `rig forgejo-runner install --version`, which is where an
|
|
# operator who needs a deterministic install already is; a pin baked into the
|
|
# registry would go stale in a repo nobody watches.
|
|
LATEST_URL="$(curl -fsSLI -o /dev/null -w '%{url_effective}' \
|
|
https://code.forgejo.org/forgejo/runner/releases/latest)" \
|
|
|| { echo "ci-box install: could not resolve the latest forgejo-runner release" >&2; exit 1; }
|
|
VERSION="${LATEST_URL##*/}"
|
|
VERSION="${VERSION#v}"
|
|
case "$VERSION" in
|
|
""|*[!0-9.]*) echo "ci-box install: could not parse a version from ${LATEST_URL}" >&2; exit 1 ;;
|
|
esac
|
|
|
|
ASSET="forgejo-runner-${VERSION}-linux-${ARCH}"
|
|
URL="https://code.forgejo.org/forgejo/runner/releases/download/v${VERSION}/${ASSET}"
|
|
|
|
WORKDIR="$(mktemp -d)"
|
|
cleanup() { rm -rf "$WORKDIR"; }
|
|
trap cleanup EXIT
|
|
|
|
echo "ci-box install: downloading forgejo-runner ${VERSION} (${ARCH})"
|
|
curl -fsSL "$URL" -o "$WORKDIR/forgejo-runner" \
|
|
|| { echo "ci-box install: could not download ${URL}" >&2; exit 1; }
|
|
|
|
# Forgejo publishes a .sha256 beside each binary. Verifying it costs one
|
|
# request and makes the install auditable; this file executes as root inside
|
|
# every future mint, so an unverified download is the last thing it should do.
|
|
fetch_and_verify_sha256 "$URL" "$WORKDIR/forgejo-runner" "$WORKDIR/forgejo-runner.sha256" "$ASSET" \
|
|
|| { echo "ci-box install: refusing to install an unverified ${ASSET} — it lands as root inside every mint. See the checksum failure above." >&2; exit 1; }
|
|
|
|
install -m 0755 -o root -g root "$WORKDIR/forgejo-runner" "$BIN"
|
|
echo "ci-box install: installed ${BIN}"
|