mirror of
https://github.com/ArchiveBox/ArchiveBox.git
synced 2026-09-12 19:50:57 +05:00
520 lines
21 KiB
Bash
Executable File
520 lines
21 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -Eeuo pipefail
|
|
|
|
IMAGE="${IMAGE:-archivebox/archivebox:dev}"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
ENTRYPOINT_PATH="${ENTRYPOINT_PATH:-$REPO_DIR/bin/docker_entrypoint.sh}"
|
|
COMPOSE_PATH="${COMPOSE_PATH:-$REPO_DIR/docker-compose.yml}"
|
|
RUN_ID="${RUN_ID:-${EPOCHSECONDS:-0}-$$}"
|
|
VALIDATION_ROOT="${VALIDATION_ROOT:-$REPO_DIR/tmp/docker-uid-gid-validation/$RUN_ID}"
|
|
KEEP_VALIDATION_ROOT="${KEEP_VALIDATION_ROOT:-0}"
|
|
|
|
REMOTE_HOST=""
|
|
LOCAL_ONLY=0
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--remote)
|
|
REMOTE_HOST="$2"
|
|
shift 2
|
|
;;
|
|
--local-only)
|
|
LOCAL_ONLY=1
|
|
shift
|
|
;;
|
|
--entrypoint)
|
|
ENTRYPOINT_PATH="$2"
|
|
shift 2
|
|
;;
|
|
--workdir)
|
|
VALIDATION_ROOT="$2"
|
|
shift 2
|
|
;;
|
|
*)
|
|
echo "Usage: $0 [--remote HOST] [--local-only] [--entrypoint PATH] [--workdir PATH]" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
done
|
|
|
|
ABXPKG_LIB_DIR="${ABXPKG_LIB_DIR:-${LIB_DIR:-$HOME/.config/archivebox/lib}}"
|
|
ABXPKG_SPEC="$(UV_LOCK_PATH="$REPO_DIR/uv.lock" uv run --no-cache --no-project python -c 'import os, tomllib; package = next(item for item in tomllib.load(open(os.environ["UV_LOCK_PATH"], "rb"))["package"] if item["name"] == "abxpkg"); wheel = package["wheels"][0]; print("abxpkg @ {}#{}".format(wheel["url"], wheel["hash"].replace(":", "=")))')"
|
|
mkdir -p "$ABXPKG_LIB_DIR/env/bin"
|
|
uv run --no-cache --no-project --with "$ABXPKG_SPEC" abxpkg env \
|
|
--install \
|
|
--lib="$ABXPKG_LIB_DIR" \
|
|
--deps-from="$REPO_DIR/.github/configs/ci-tooling.json:docker_validation_binaries" \
|
|
>/dev/null
|
|
export PATH="$ABXPKG_LIB_DIR/env/bin:$PATH"
|
|
DOCKER_BINARY="$ABXPKG_LIB_DIR/env/bin/docker"
|
|
SUDO_BINARY="$ABXPKG_LIB_DIR/env/bin/sudo"
|
|
SSH_BINARY="$ABXPKG_LIB_DIR/env/bin/ssh"
|
|
UNAME_BINARY="$ABXPKG_LIB_DIR/env/bin/uname"
|
|
test -x "$DOCKER_BINARY"
|
|
test -x "$SUDO_BINARY"
|
|
test -x "$SSH_BINARY"
|
|
test -x "$UNAME_BINARY"
|
|
|
|
if [[ -n "$REMOTE_HOST" && "$LOCAL_ONLY" != "1" ]]; then
|
|
remote_dir="/tmp/archivebox-uid-gid-validation-$RUN_ID"
|
|
entrypoint_name="${ENTRYPOINT_PATH##*/}"
|
|
script_name="${0##*/}"
|
|
"$SSH_BINARY" "$REMOTE_HOST" "mkdir -p '$remote_dir'"
|
|
"$SSH_BINARY" "$REMOTE_HOST" "cat > '$remote_dir/$script_name'" < "$0"
|
|
"$SSH_BINARY" "$REMOTE_HOST" "cat > '$remote_dir/$entrypoint_name'" < "$ENTRYPOINT_PATH"
|
|
"$SSH_BINARY" "$REMOTE_HOST" "cat > '$remote_dir/docker-compose.yml'" < "$COMPOSE_PATH"
|
|
"$SSH_BINARY" "$REMOTE_HOST" "cd '$remote_dir' && IMAGE='$IMAGE' ENTRYPOINT_PATH='$remote_dir/$entrypoint_name' COMPOSE_PATH='$remote_dir/docker-compose.yml' bash './$script_name' --local-only --entrypoint '$remote_dir/$entrypoint_name' --workdir '$remote_dir/work'"
|
|
exit $?
|
|
fi
|
|
|
|
DOCKER_PLATFORM="${DOCKER_PLATFORM:-}"
|
|
if [[ -z "$DOCKER_PLATFORM" ]]; then
|
|
case "$("$UNAME_BINARY" -m)" in
|
|
arm64|aarch64) DOCKER_PLATFORM="linux/amd64" ;;
|
|
esac
|
|
fi
|
|
|
|
docker_base=("$DOCKER_BINARY" run --rm)
|
|
if [[ -n "$DOCKER_PLATFORM" ]]; then
|
|
docker_base+=(--platform "$DOCKER_PLATFORM")
|
|
fi
|
|
|
|
mkdir -p "$VALIDATION_ROOT"
|
|
|
|
total=0
|
|
passed=0
|
|
failed=0
|
|
|
|
log() {
|
|
printf '%s\n' "$*"
|
|
}
|
|
|
|
safe_name() {
|
|
printf '%s' "$1" | tr -cs 'A-Za-z0-9_.-' '-'
|
|
}
|
|
|
|
docker_setup() {
|
|
local case_dir="$1"
|
|
local setup_script="$2"
|
|
mkdir -p "$case_dir"
|
|
"${docker_base[@]}" \
|
|
-v "$case_dir:/case" \
|
|
--entrypoint /bin/bash \
|
|
"$IMAGE" \
|
|
-lc "set -Eeuo pipefail
|
|
rm -rf /case/data /case/lib /case/browsers
|
|
mkdir -p /case/data /case/lib /case/browsers
|
|
chown 0:0 /case/data /case/lib /case/browsers
|
|
chmod 755 /case/data /case/lib /case/browsers
|
|
$setup_script"
|
|
}
|
|
|
|
# These command strings intentionally expand only inside the validation container.
|
|
# shellcheck disable=SC2016
|
|
default_cmd='printf "ABX_UID=%s\nABX_GID=%s\nABX_USER=%s\nABX_GROUPS=%s\n" "$(id -u)" "$(id -g)" "$(whoami 2>/dev/null || true)" "$(id -Gn)"; touch /data/logs/probe /data/archive/probe "$ABXPKG_LIB_DIR/probe" "$PERSONAS_DIR/Default/chrome_profile/probe"; stat -c "ABX_STAT %u:%g:%a %n" /data /data/logs /data/archive "$ABXPKG_LIB_DIR" "$PERSONAS_DIR" "$PERSONAS_DIR/Default" "$PERSONAS_DIR/Default/chrome_profile"; echo ABX_PERSONA_PROFILE_OK; echo ABX_OK'
|
|
# shellcheck disable=SC2016
|
|
runtime_dependency_cmd="$default_cmd"'; mkdir -p "$ABXPKG_LIB_DIR/chromewebstore/extensions/cookie/_metadata"; touch "$ABXPKG_LIB_DIR/chromewebstore/extensions/cookie/_metadata/rules.fbs"; echo ABX_CHROME_EXTENSION_CACHE_OK'
|
|
# shellcheck disable=SC2016
|
|
full_flow_cmd='set -Eeuo pipefail
|
|
printf "ABX_UID=%s\nABX_GID=%s\nABX_USER=%s\nABX_GROUPS=%s\n" "$(id -u)" "$(id -g)" "$(whoami 2>/dev/null || true)" "$(id -Gn)"
|
|
id -Gn | grep -qw audio
|
|
id -Gn | grep -qw video
|
|
mkdir -p "$PERSONAS_DIR/Default/chrome_profile"
|
|
touch "$PERSONAS_DIR/Default/chrome_profile/probe"
|
|
rm -f "$PERSONAS_DIR/Default/chrome_profile/probe"
|
|
archivebox init
|
|
archivebox install 2>&1 | tee /tmp/archivebox-install.log
|
|
if grep -E "(/[[:alnum:]_.-]+/)?pip install|npm install|uv pip install" /tmp/archivebox-install.log; then
|
|
echo "ABX_UNEXPECTED_RUNTIME_INSTALL"
|
|
exit 1
|
|
fi
|
|
archivebox version 2>&1 | tee /tmp/archivebox-version.log
|
|
grep -Eq "/opt/archivebox/lib/(uv/venv/bin|env/bin)/trafilatura" /tmp/archivebox-version.log
|
|
grep -Eq "/opt/archivebox/lib/(pnpm/packages/defuddle/node_modules/.bin|env/bin)/defuddle" /tmp/archivebox-version.log
|
|
grep -Eq "/opt/archivebox/lib/env/bin/sonic" /tmp/archivebox-version.log
|
|
archivebox add --depth=0 https://example.com/ 2>&1 | tee /tmp/archivebox-add.log
|
|
archivebox update --index-only 2>&1 | tee /tmp/archivebox-update.log
|
|
snapshot_dir="$(find /data/archive/users/system/snapshots -mindepth 3 -maxdepth 3 -type d | head -n 1)"
|
|
test -n "$snapshot_dir"
|
|
test -s "$snapshot_dir/index.html"
|
|
test -s "$snapshot_dir/wget/example.com/index.html"
|
|
test -s "$snapshot_dir/dom/output.html"
|
|
test -s "$snapshot_dir/screenshot/screenshot.png"
|
|
test -s "$snapshot_dir/pdf/output.pdf"
|
|
test -s "$snapshot_dir/singlefile/singlefile.html"
|
|
test -s "$snapshot_dir/headers/headers.json"
|
|
test -s "$snapshot_dir/readability/content.txt"
|
|
test -s "$snapshot_dir/trafilatura/content.txt"
|
|
test -s "$snapshot_dir/defuddle/content.txt"
|
|
test -s "$snapshot_dir/liteparse/content.txt"
|
|
test -s "$snapshot_dir/responses/index.jsonl"
|
|
test -s "$snapshot_dir/search_backend_sonic/on_Snapshot__91_index_sonic."*.sh
|
|
test -s "$snapshot_dir/search_backend_sqlite/on_Snapshot__90_index_sqlite."*.sh
|
|
grep -R "Example Domain" \
|
|
"$snapshot_dir/wget/example.com/index.html" \
|
|
"$snapshot_dir/dom/output.html" \
|
|
"$snapshot_dir/readability/content.txt" \
|
|
"$snapshot_dir/trafilatura/content.txt" \
|
|
"$snapshot_dir/defuddle/content.txt" \
|
|
"$snapshot_dir/liteparse/content.txt"
|
|
if grep -R "Permission denied\\|Operation not permitted" /tmp/archivebox-add.log /tmp/archivebox-update.log /data/logs 2>/dev/null; then
|
|
echo "ABX_PERMISSION_ERROR_IN_FULL_FLOW"
|
|
exit 1
|
|
fi
|
|
find "$snapshot_dir" -maxdepth 2 -type f | sort | sed "s#^#ABX_OUTPUT #"
|
|
echo ABX_OK'
|
|
|
|
run_case() {
|
|
local name="$1"
|
|
local setup_script="$2"
|
|
local env_string="$3"
|
|
local user_spec="$4"
|
|
local expected_status="$5"
|
|
local expected_uid="$6"
|
|
local expected_gid="$7"
|
|
local command="${8:-$default_cmd}"
|
|
local post_assert="${9:-}"
|
|
|
|
total=$((total + 1))
|
|
local slug case_dir log_file status
|
|
slug="$(safe_name "$name")"
|
|
case_dir="$VALIDATION_ROOT/$slug"
|
|
log_file="$case_dir/output.log"
|
|
|
|
docker_setup "$case_dir" "$setup_script"
|
|
|
|
local run_args=("${docker_base[@]}")
|
|
if [[ "$user_spec" != "-" ]]; then
|
|
run_args+=(--user "$user_spec")
|
|
fi
|
|
run_args+=(
|
|
-e DATA_DIR=/data
|
|
-e ABXPKG_LIB_DIR=/libdir
|
|
-e PLAYWRIGHT_BROWSERS_PATH=/browsers
|
|
)
|
|
|
|
if [[ -n "$env_string" && "$env_string" != "-" ]]; then
|
|
local env_parts=()
|
|
read -r -a env_parts <<< "$env_string"
|
|
local env_pair
|
|
for env_pair in "${env_parts[@]}"; do
|
|
run_args+=(-e "$env_pair")
|
|
done
|
|
fi
|
|
|
|
run_args+=(
|
|
-v "$ENTRYPOINT_PATH:/app/bin/docker_entrypoint.sh:ro"
|
|
-v "$case_dir/data:/data"
|
|
-v "$case_dir/lib:/libdir"
|
|
-v "$case_dir/browsers:/browsers"
|
|
--entrypoint /app/bin/docker_entrypoint.sh
|
|
"$IMAGE"
|
|
sh -c "$command"
|
|
)
|
|
|
|
set +e
|
|
"${run_args[@]}" >"$log_file" 2>&1
|
|
status=$?
|
|
set -e
|
|
|
|
local ok=1
|
|
if [[ "$expected_status" == "pass" && "$status" != "0" ]]; then
|
|
ok=0
|
|
elif [[ "$expected_status" == "fail" && "$status" == "0" ]]; then
|
|
ok=0
|
|
fi
|
|
|
|
if [[ "$expected_status" == "pass" ]]; then
|
|
if [[ -n "$expected_uid" ]] && ! grep -q "^ABX_UID=$expected_uid$" "$log_file"; then
|
|
ok=0
|
|
fi
|
|
if [[ -n "$expected_gid" ]] && ! grep -q "^ABX_GID=$expected_gid$" "$log_file"; then
|
|
ok=0
|
|
fi
|
|
if ! grep -q '^ABX_OK$' "$log_file"; then
|
|
ok=0
|
|
fi
|
|
if [[ "$user_spec" == "-" ]]; then
|
|
grep '^ABX_GROUPS=' "$log_file" | grep -qw audio || ok=0
|
|
grep '^ABX_GROUPS=' "$log_file" | grep -qw video || ok=0
|
|
grep -q '^ABX_PERSONA_PROFILE_OK$' "$log_file" || ok=0
|
|
fi
|
|
fi
|
|
|
|
if [[ "$post_assert" == "nested-root-stays" ]]; then
|
|
local nested_stat
|
|
nested_stat="$("${docker_base[@]}" -v "$case_dir/data:/data" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /data/archive/existing/file" 2>/dev/null || true)"
|
|
[[ "$nested_stat" == "0:0" ]] || ok=0
|
|
elif [[ "$post_assert" == runtime-nested-root-stays ]]; then
|
|
local lib_stat browsers_stat chrome_rules_stat chrome_metadata_stat
|
|
lib_stat="$("${docker_base[@]}" -v "$case_dir/lib:/libdir" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /libdir/existing/file" 2>/dev/null || true)"
|
|
browsers_stat="$("${docker_base[@]}" -v "$case_dir/browsers:/browsers" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /browsers/existing/file" 2>/dev/null || true)"
|
|
chrome_rules_stat="$("${docker_base[@]}" -v "$case_dir/lib:/libdir" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /libdir/chromewebstore/extensions/cookie/rules.json" 2>/dev/null || true)"
|
|
chrome_metadata_stat="$("${docker_base[@]}" -v "$case_dir/lib:/libdir" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /libdir/chromewebstore/extensions/cookie/_metadata/rules.fbs" 2>/dev/null || true)"
|
|
[[ "$lib_stat" == "0:0" \
|
|
&& "$browsers_stat" == "0:0" \
|
|
&& "$chrome_rules_stat" == "$expected_uid:$expected_gid" \
|
|
&& "$chrome_metadata_stat" == "$expected_uid:$expected_gid" ]] || ok=0
|
|
elif [[ "$post_assert" == users-dir-repaired ]]; then
|
|
local users_stat
|
|
users_stat="$("${docker_base[@]}" -v "$case_dir/data:/data" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /data/users" 2>/dev/null || true)"
|
|
[[ "$users_stat" == "$expected_uid:$expected_gid" ]] || ok=0
|
|
elif [[ "$post_assert" == config-files-repaired ]]; then
|
|
local config_stat index_stat
|
|
config_stat="$("${docker_base[@]}" -v "$case_dir/data:/data" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /data/ArchiveBox.conf" 2>/dev/null || true)"
|
|
index_stat="$("${docker_base[@]}" -v "$case_dir/data:/data" --entrypoint /bin/bash "$IMAGE" -lc "stat -c '%u:%g' /data/index.sqlite3" 2>/dev/null || true)"
|
|
[[ "$config_stat" == "$expected_uid:$expected_gid" && "$index_stat" == "$expected_uid:$expected_gid" ]] || ok=0
|
|
fi
|
|
|
|
if [[ "$ok" == "1" ]]; then
|
|
passed=$((passed + 1))
|
|
log "PASS $name"
|
|
else
|
|
failed=$((failed + 1))
|
|
log "FAIL $name (status=$status expected=$expected_status log=$log_file)"
|
|
sed -n '1,160p' "$log_file"
|
|
fi
|
|
}
|
|
|
|
run_readonly_case() {
|
|
local name="$1"
|
|
local setup_script="$2"
|
|
local env_string="$3"
|
|
local user_spec="$4"
|
|
|
|
total=$((total + 1))
|
|
local slug case_dir log_file status ok
|
|
slug="$(safe_name "$name")"
|
|
case_dir="$VALIDATION_ROOT/$slug"
|
|
log_file="$case_dir/output.log"
|
|
docker_setup "$case_dir" "$setup_script"
|
|
|
|
local run_args=("${docker_base[@]}")
|
|
if [[ "$user_spec" != "-" ]]; then
|
|
run_args+=(--user "$user_spec")
|
|
fi
|
|
run_args+=(
|
|
-e DATA_DIR=/data
|
|
-e ABXPKG_LIB_DIR=/libdir
|
|
-e PLAYWRIGHT_BROWSERS_PATH=/browsers
|
|
)
|
|
if [[ -n "$env_string" && "$env_string" != "-" ]]; then
|
|
local env_parts=()
|
|
read -r -a env_parts <<< "$env_string"
|
|
local env_pair
|
|
for env_pair in "${env_parts[@]}"; do
|
|
run_args+=(-e "$env_pair")
|
|
done
|
|
fi
|
|
run_args+=(
|
|
-v "$ENTRYPOINT_PATH:/app/bin/docker_entrypoint.sh:ro"
|
|
-v "$case_dir/data:/data:ro"
|
|
-v "$case_dir/lib:/libdir:ro"
|
|
-v "$case_dir/browsers:/browsers:ro"
|
|
--entrypoint /app/bin/docker_entrypoint.sh
|
|
"$IMAGE"
|
|
sh -c "$default_cmd"
|
|
)
|
|
|
|
set +e
|
|
"${run_args[@]}" >"$log_file" 2>&1
|
|
status=$?
|
|
set -e
|
|
|
|
ok=0
|
|
if [[ "$status" != "0" ]] && grep -q "cannot write to /data" "$log_file"; then
|
|
ok=1
|
|
fi
|
|
if [[ "$ok" == "1" ]]; then
|
|
passed=$((passed + 1))
|
|
log "PASS $name"
|
|
else
|
|
failed=$((failed + 1))
|
|
log "FAIL $name (status=$status expected=readonly failure log=$log_file)"
|
|
sed -n '1,160p' "$log_file"
|
|
fi
|
|
}
|
|
|
|
run_full_flow_case() {
|
|
local name="$1"
|
|
local setup_script="$2"
|
|
local env_string="$3"
|
|
local user_spec="$4"
|
|
local expected_uid="$5"
|
|
local expected_gid="$6"
|
|
|
|
total=$((total + 1))
|
|
local slug case_dir log_file status ok
|
|
slug="$(safe_name "$name")"
|
|
case_dir="$VALIDATION_ROOT/$slug"
|
|
log_file="$case_dir/output.log"
|
|
docker_setup "$case_dir" "$setup_script"
|
|
|
|
local run_args=("${docker_base[@]}")
|
|
if [[ "$user_spec" != "-" ]]; then
|
|
run_args+=(--user "$user_spec")
|
|
fi
|
|
run_args+=(
|
|
-e DATA_DIR=/data
|
|
)
|
|
if [[ -n "$env_string" && "$env_string" != "-" ]]; then
|
|
local env_parts=()
|
|
read -r -a env_parts <<< "$env_string"
|
|
local env_pair
|
|
for env_pair in "${env_parts[@]}"; do
|
|
run_args+=(-e "$env_pair")
|
|
done
|
|
fi
|
|
run_args+=(
|
|
-v "$ENTRYPOINT_PATH:/app/bin/docker_entrypoint.sh:ro"
|
|
-v "$case_dir/data:/data"
|
|
--entrypoint /app/bin/docker_entrypoint.sh
|
|
"$IMAGE"
|
|
bash -lc "$full_flow_cmd"
|
|
)
|
|
|
|
set +e
|
|
"${run_args[@]}" >"$log_file" 2>&1
|
|
status=$?
|
|
set -e
|
|
|
|
ok=1
|
|
[[ "$status" == "0" ]] || ok=0
|
|
grep -q "^ABX_UID=$expected_uid$" "$log_file" || ok=0
|
|
grep -q "^ABX_GID=$expected_gid$" "$log_file" || ok=0
|
|
grep '^ABX_GROUPS=' "$log_file" | grep -qw audio || ok=0
|
|
grep '^ABX_GROUPS=' "$log_file" | grep -qw video || ok=0
|
|
grep -q '^ABX_OK$' "$log_file" || ok=0
|
|
grep -q 'total urls snapshotted: 1' "$log_file" || ok=0
|
|
grep -q 'Search Reindex Complete' "$log_file" || ok=0
|
|
grep -q 'ABX_OUTPUT .*/wget/example.com/index.html' "$log_file" || ok=0
|
|
grep -q 'ABX_OUTPUT .*/screenshot/screenshot.png' "$log_file" || ok=0
|
|
grep -q 'ABX_OUTPUT .*/trafilatura/content.txt' "$log_file" || ok=0
|
|
|
|
if [[ "$ok" == "1" ]]; then
|
|
passed=$((passed + 1))
|
|
log "PASS $name"
|
|
else
|
|
failed=$((failed + 1))
|
|
log "FAIL $name (status=$status expected=full-flow success log=$log_file)"
|
|
sed -n '1,220p' "$log_file"
|
|
fi
|
|
}
|
|
|
|
run_mount_case() {
|
|
local fs_name="$1"
|
|
local mount_dir="$2"
|
|
|
|
[[ -n "$mount_dir" ]] || { log "FAIL $fs_name mount case: mount dir not provided"; exit 1; }
|
|
[[ -d "$mount_dir" ]] || { log "FAIL $fs_name mount case: $mount_dir does not exist"; exit 1; }
|
|
[[ -w "$mount_dir" ]] || { log "FAIL $fs_name mount case: $mount_dir is not writable by host user"; exit 1; }
|
|
|
|
local previous_root case_root
|
|
previous_root="$VALIDATION_ROOT"
|
|
case_root="$mount_dir/archivebox-uidgid-validation-$RUN_ID"
|
|
mkdir -p "$case_root"
|
|
VALIDATION_ROOT="$case_root"
|
|
run_case "$fs_name writable forced-owner style mount" ":" "-" "-" pass 911 911 "$default_cmd" ""
|
|
VALIDATION_ROOT="$previous_root"
|
|
}
|
|
|
|
run_compose_personas_case() {
|
|
total=$((total + 1))
|
|
local case_dir="$VALIDATION_ROOT/compose-personas-persist"
|
|
local log_file="$case_dir/output.log"
|
|
local status
|
|
mkdir -p "$case_dir/data"
|
|
|
|
set +e
|
|
# shellcheck disable=SC2016
|
|
ARCHIVEBOX_IMAGE="$IMAGE" "$DOCKER_BINARY" compose \
|
|
--project-directory "$case_dir" \
|
|
-f "$COMPOSE_PATH" \
|
|
run --rm -T archivebox sh -c \
|
|
'printf "ABX_UID=%s\nABX_GID=%s\n" "$(id -u)" "$(id -g)"; archivebox init; printf persisted > "$PERSONAS_DIR/Default/chrome_profile/persisted"; echo ABX_OK' \
|
|
>"$log_file" 2>&1
|
|
status=$?
|
|
"$DOCKER_BINARY" compose --project-directory "$case_dir" -f "$COMPOSE_PATH" down --volumes --remove-orphans >/dev/null 2>&1
|
|
set -e
|
|
|
|
if [[ "$status" == "0" ]] \
|
|
&& grep -q '^ABX_OK$' "$log_file" \
|
|
&& [[ -f "$case_dir/data/personas/Default/chrome_profile/persisted" ]] \
|
|
&& [[ "$(< "$case_dir/data/personas/Default/chrome_profile/persisted")" == persisted ]]; then
|
|
passed=$((passed + 1))
|
|
log "PASS compose persists persona data outside the inherited anonymous volume"
|
|
else
|
|
failed=$((failed + 1))
|
|
log "FAIL compose persists persona data outside the inherited anonymous volume (status=$status log=$log_file)"
|
|
sed -n '1,160p' "$log_file"
|
|
fi
|
|
}
|
|
|
|
log "Running UID/GID validation on ${HOSTNAME:-unknown-host} using image=$IMAGE entrypoint=$ENTRYPOINT_PATH root=$VALIDATION_ROOT platform=${DOCKER_PLATFORM:-native}"
|
|
|
|
run_case "root-owned empty data auto-detect default" \
|
|
"chown 0:0 /case/data && chmod 755 /case/data" \
|
|
"-" "-" pass 911 911
|
|
|
|
run_case "501-owned data auto-detected" \
|
|
"chown 501:20 /case/data && chmod 755 /case/data" \
|
|
"-" "-" pass 501 20
|
|
|
|
run_case "non-root data with root-owned config files repaired" \
|
|
"chown 501:20 /case/data && chmod 755 /case/data && touch /case/data/index.sqlite3 /case/data/ArchiveBox.conf && mkdir -p /case/data/archive/users && chown 0:0 /case/data/index.sqlite3 /case/data/ArchiveBox.conf /case/data/archive/users" \
|
|
"-" "-" pass 501 20 "$default_cmd" config-files-repaired
|
|
|
|
run_case "911-owned data auto-detected" \
|
|
"chown 911:911 /case/data && chmod 755 /case/data" \
|
|
"-" "-" pass 911 911
|
|
|
|
run_case "root-owned data falls back to default archivebox user" \
|
|
"chown 0:0 /case/data && chmod 755 /case/data" \
|
|
"-" "-" pass 911 911
|
|
|
|
run_case "nested root-owned archive content is not recursively chowned" \
|
|
"chown 0:0 /case/data && chmod 755 /case/data && mkdir -p /case/data/archive/existing && touch /case/data/archive/existing/file && chown -R 0:0 /case/data/archive/existing" \
|
|
"-" "-" pass 911 911 "$default_cmd" nested-root-stays
|
|
|
|
run_case "only the writable Chrome extension cache is recursively repaired" \
|
|
"chown 501:20 /case/data && mkdir -p /case/lib/existing /case/lib/chromewebstore/extensions/cookie /case/browsers/existing && touch /case/lib/existing/file /case/lib/chromewebstore/extensions/cookie/rules.json /case/browsers/existing/file && chown -R 0:0 /case/lib/existing /case/lib/chromewebstore /case/browsers/existing" \
|
|
"-" "-" pass 501 20 "$runtime_dependency_cmd" runtime-nested-root-stays
|
|
|
|
run_case "root start fixes read-only top-level data when chmod works" \
|
|
"chown 0:0 /case/data && chmod 555 /case/data" \
|
|
"-" "-" pass 911 911
|
|
|
|
run_case "legacy data users dir repaired when present" \
|
|
"chown 911:911 /case/data && chmod 755 /case/data && mkdir -p /case/data/users && chown 0:0 /case/data/users" \
|
|
"-" "-" pass 911 911 "$default_cmd" users-dir-repaired
|
|
|
|
run_case "archive dir root-owned inside 911 data repaired shallowly" \
|
|
"chown 911:911 /case/data && chmod 755 /case/data && mkdir -p /case/data/archive && chown 0:0 /case/data/archive" \
|
|
"-" "-" pass 911 911
|
|
|
|
run_case "logs dir root-owned mode 000 repaired shallowly" \
|
|
"chown 911:911 /case/data && chmod 755 /case/data && mkdir -p /case/data/logs && chown 0:0 /case/data/logs && chmod 000 /case/data/logs" \
|
|
"-" "-" pass 911 911
|
|
|
|
run_case "1001-owned data auto-detected" \
|
|
"chown 1001:1001 /case/data && chmod 755 /case/data" \
|
|
"-" "-" pass 1001 1001
|
|
|
|
run_case "root-owned ArchiveBox.conf only is repaired" \
|
|
"chown 911:911 /case/data && chmod 755 /case/data && touch /case/data/ArchiveBox.conf /case/data/index.sqlite3 && chown 0:0 /case/data/ArchiveBox.conf /case/data/index.sqlite3" \
|
|
"-" "-" pass 911 911 "$default_cmd" config-files-repaired
|
|
|
|
run_compose_personas_case
|
|
|
|
run_mount_case "NFS" "${NFS_TEST_DIR:-}"
|
|
run_mount_case "SMB" "${SMB_TEST_DIR:-}"
|
|
|
|
log "SUMMARY passed=$passed failed=$failed total=$total"
|
|
|
|
if [[ "$KEEP_VALIDATION_ROOT" != "1" ]]; then
|
|
"$SUDO_BINARY" rm -rf "$VALIDATION_ROOT"
|
|
fi
|
|
|
|
[[ "$failed" == "0" ]]
|