wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(observability): verify root-owned SigNoz bundle

Browse Source
This commit is contained in:
ogt
2026-07-15 16:58:03 +08:00
parent a5ae8f9969
commit 7d6db4f2b7
5 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
scripts/ops/deploy-signoz-metadata-toolchain.sh
View File

@@ -166,7 +166,11 @@ emit ai_decision pass "candidate_additive_immutable_inactive_source_deploy"
emit risk_policy_decision pass "medium_no_active_pointer_no_secret_no_raw_sqlite"
remote_check() {
bounded_ssh "${SSH_OPTIONS[@]}" "${TARGET_HOST}" bash -s -- \
# The immutable root is deliberately 0700/root-owned. Run this bounded
# verifier as root so it can distinguish exact from absent without relaxing
# directory permissions. REMOTE_CHECK contains only stat/hash/process/API
# reads and performs no writes.
bounded_ssh "${SSH_OPTIONS[@]}" "${TARGET_HOST}" sudo -n bash -s -- \
"${REMOTE_ROOT}" "${BUNDLE_ID}" "${REMOTE_TIMEOUT_SECONDS}" \
"${KILL_AFTER_SECONDS}" "${SOURCE_HASHES[@]}" <<'REMOTE_CHECK'
set -euo pipefail

7
scripts/ops/tests/test_signoz_metadata_toolchain_deploy.py
View File

@@ -174,6 +174,13 @@ def test_shared_operation_lock_is_existing_read_only_and_fail_closed() -> None:
assert "exec 8>>/tmp/awoooi-signoz-backup-operation.lock" not in source
def test_remote_check_uses_privileged_read_only_visibility() -> None:
source = DEPLOYER.read_text(encoding="utf-8")
remote_check = source.split("remote_check() {", 1)[1].split("\n}", 1)[0]
assert '"${TARGET_HOST}" sudo -n bash -s --' in remote_check
assert "REMOTE_CHECK contains only stat/hash/process/API" in remote_check
def test_exact_five_file_supply_chain_and_modes_are_fixed() -> None:
source = DEPLOYER.read_text(encoding="utf-8")
for path in (

2
scripts/reboot-recovery/signoz-canonical-route-preflight.py
View File

@@ -865,7 +865,7 @@ def evaluate(root: Path, contract_path: Path) -> dict[str, Any]:
== len(METADATA_EXPORT_SOURCE_PATHS)
and set(declared_metadata_export_hashes) == set(METADATA_EXPORT_SOURCE_PATHS)
and declared_metadata_export_hashes == actual_metadata_export_hashes
and metadata_export_source_contract.get("test_terminal") == "20_passed"
and metadata_export_source_contract.get("test_terminal") == "21_passed"
)
offsite_backup = pending_verifiers.get("signoz_backup_offsite_dr", {})
failed_artifacts = pending_verifiers.get(

2
scripts/reboot-recovery/tests/test_signoz_canonical_route_migration.py
View File

@@ -877,7 +877,7 @@ def test_post_release_verifier_and_native_backup_close_with_remaining_gaps() ->
field: hashlib.sha256((ROOT / relative).read_bytes()).hexdigest()
for field, relative in metadata_paths.items()
}
assert source_contract["test_terminal"] == "20_passed"
assert source_contract["test_terminal"] == "21_passed"
assert source_contract["raw_sqlite_read"] is False
assert source_contract["raw_volume_read"] is False
assert source_contract["secret_value_persistence"] is False