Repository navigation
Conversation
Signed-off-by: abrichr <[email protected]>
Signed-off-by: abrichr <[email protected]>
Signed-off-by: abrichr <[email protected]>
Signed-off-by: abrichr <[email protected]>
…1918) * on-prem: install, update and roll back the real engine offline in CI bin/build-release.sh builds a release archive from uv.lock (pinned wheels, hash-checked) plus the flow wheel, a checksum and an openssl signature. bin/test-offline-install.sh builds two signed releases, then as root inside run-egress-blocked.sh installs the first from its wheelhouse, refuses a tampered second, updates to the signed second, rolls back and runs the air-gap attestation. The new flow-onprem-offline job runs it, and runs bin/test-update.sh, which no job ran before. * on-prem: check the engine version from the release venv, not the checkout The version check ran python -c from packages/flow, so it imported the source checkout and reported 2.6.0 after the update to 2.6.0.post1. Run it isolated from /, require the module to live in the venv, and compare the module with the installed distribution and the CLI's --version. * on-prem audit: do not break a lock that a live writer just took A writer that found the audit lock owned by an exited process removed it without re-checking. If the owner released between the read and the removal and another writer took the lock, the breaker deleted the live lock and two writers could chain to the same parent. Break stale locks only under a second lock and only if the lock still names the same dead owner. Add a deterministic test that forces the handover, and print the verifier output when the concurrent-writer check fails. * on-prem locks: take ownership with an exclusive file create, not mkdir(1) Ubuntu 26.04 ships uutils mkdir, which reports success to both callers when two processes race to create one directory. The audit-log writer lock and the release update lock both treated a zero exit from mkdir as ownership, so on that image concurrent audit writers chained to the same parent (the "concurrent audit writers preserve one hash chain" CI failure) and a second update could proceed beside a live one. Ownership is now the shell's own noclobber create of the pid file inside the lock directory (O_CREAT|O_EXCL), and the stale-lock breaker lock is an exclusive file too. Tests model the uutils behavior with a mkdir shim that never reports EEXIST; on the previous code they fail.
GitHub-hosted runners ignore sudo -E. Put OPENADAPT_* and PYTHONPATH on the env argv so the netns child still installs the no-outbound hook, and stop asking sudo to preserve the whole environment.
Dropping sudo -E shifted PATH= to argv[3], so the root case's argv[4:4] -u insert landed after the assignment. GNU env then treated -u as the command (env: '-u': No such file or directory) and failed critical CI on test_real_namespace_and_invoking_identity[True].
No behavior change; retriggers PR CI for d59b6e2.
abrichr
added
the
review-needed
Member
Author
|
From: Grok Local Linux verification (Colima privileged): test_real_namespace_and_invoking_identity[False/True] PASSED on this tip. Still waiting on GitHub check suites for this PR (0 so far); workflow_dispatch Packages in_progress. |
Clears CONFLICTING merge state so pull_request CI can run. Took main's lock hardening (FIFO/hard-link create_exclusive) for audit-log.sh, lib-release.sh, and test-update.sh; kept netns env -u fix.
Member
Author
|
From: Grok Same tip as #1915 after merging origin/main @ebeaaf0c0. Checks should attach now that the PR is MERGEABLE. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #142
Part of #1915
Same fix as #1915 head 6d7c1f0. Opening a sibling PR because #1915's last two pushes created no check suites (synchronize/reopen/ready_for_review produced zero runs).
Summary
After dropping sudo -E, PATH= moved to argv[3], so the root case's argv[4:4] -u insert landed after the assignment. GNU env treated -u as the command (env: '-u': No such file or directory) and failed critical CI on test_real_namespace_and_invoking_identity[True]. Insert is now right after env.
Testing
Untested