wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(security): remove credentialed reboot SOP command
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 2s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m17s
Details
CD Pipeline / build-and-deploy (push) Successful in 13m58s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m55s
Details

Browse Source
This commit is contained in:
ogt
2026-07-15 02:15:44 +08:00
parent 74fbefc6c9
commit 3d8fa0200e
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/runbooks/REBOOT-RECOVERY-SOP.md
View File

@@ -479,7 +479,8 @@ curl -s --max-time 5 http://192.168.0.121:32334/api/v1/health 2>/dev/null | pyth
```bash ```bash
# 自動化腳本通常已處理，但若沒有自動啟動: # 自動化腳本通常已處理，但若沒有自動啟動:
ssh ollama@192.168.0.188 "sudo /usr/local/bin/awoooi-startup.sh" ssh ollama@192.168.0.188 "sudo /usr/local/bin/awoooi-startup.sh"
ssh wooo@192.168.0.110 "echo '0936223270' | sudo -S /usr/local/bin/awoooi-startup-110.sh" ssh wooo@192.168.0.110 "sudo -n /usr/local/bin/awoooi-startup-110.sh"
# 若 sudo -n 不可用，改走 Agent99 allowlisted executor 或本機 console；禁止把密碼寫入 SOP、命令列或 evidence。
``` ```
**P1 (T+5~15 分鐘): K3s 叢集** **P1 (T+5~15 分鐘): K3s 叢集**

7
scripts/reboot-recovery/tests/test_reboot_p0_operational_contract.py
View File

@@ -15,6 +15,13 @@ def read(path: str) -> str:
return (ROOT / path).read_text(encoding="utf-8") return (ROOT / path).read_text(encoding="utf-8")
def test_reboot_sop_never_embeds_passworded_sudo_startup() -> None:
sop = read("docs/runbooks/REBOOT-RECOVERY-SOP.md")
assert "sudo -n /usr/local/bin/awoooi-startup-110.sh" in sop
assert "| sudo -S /usr/local/bin/awoooi-startup-110.sh" not in sop
def load_public_maintenance_probe() -> ModuleType: def load_public_maintenance_probe() -> ModuleType:
path = ROOT / "scripts/reboot-recovery/public-maintenance-fallback-probe.py" path = ROOT / "scripts/reboot-recovery/public-maintenance-fallback-probe.py"
spec = importlib.util.spec_from_file_location( spec = importlib.util.spec_from_file_location(