From 2f3775a7677431e01d512a7a8d146f507623b558 Mon Sep 17 00:00:00 2001 From: Joseph Yaksich Date: Wed, 5 Aug 2026 01:17:07 +0000 Subject: [PATCH] fix(phase4): use sudo for all service-owned Linux acceptance reads The Linux acceptance runs as the ordinary hosted runner user and elevates only for the real install. `/opt/1helm` and `/var/lib/1helm-oci-v1` are service/root owned, so direct `node require(...)` and `readlink` checks report the files as missing even after a successful install. The ERR trap pinpointed the first such failure at the previous-Stable version check. Audit and fix every service-owned read in the acceptance script at once: - read both current-version package.json files through `sudo cat` and parse their piped JSON with the ordinary runner's node; - run all three current-symlink readlink checks through sudo; - retain the already-fixed sudo reads of the root-owned OCI image store. Acceptance-script only; no product/runtime change. Co-Authored-By: Claude --- ops/platform-acceptance/linux.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ops/platform-acceptance/linux.sh b/ops/platform-acceptance/linux.sh index 0138c3a..e4c0002 100755 --- a/ops/platform-acceptance/linux.sh +++ b/ops/platform-acceptance/linux.sh @@ -70,7 +70,7 @@ tar -xzf "$OFFLINE_ARCHIVE" -C "$work" "$prefix/site/public/install.sh" sudo env HELM_RELEASE_SHA256="$OFFLINE_DIGEST" bash "$work/$prefix/site/public/install.sh" "$OFFLINE_ARCHIVE" sudo systemctl is-active --quiet 1helm.service curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/clean-health.json" -[[ "$(readlink -f /opt/1helm/current)" == "/opt/1helm/releases/$VERSION-$OFFLINE_DIGEST" ]] +[[ "$(sudo readlink -f /opt/1helm/current)" == "/opt/1helm/releases/$VERSION-$OFFLINE_DIGEST" ]] RETAINED_IMAGE="/var/lib/1helm-oci-v1/shared-images/sha256/$IMAGE_DIGEST" sudo test -d "$RETAINED_IMAGE" [[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]] @@ -110,7 +110,7 @@ PREVIOUS_DIGEST="$(sha256sum "$work/$PREVIOUS_NAME" | awk '{print $1}')" previous_prefix="$(tar -tzf "$work/$PREVIOUS_NAME" | awk -F/ '/^[^/]+\/site\/public\/install\.sh$/ && !found { print $1; found=1 }')" tar -xzf "$work/$PREVIOUS_NAME" -C "$work" "$previous_prefix/site/public/install.sh" sudo env HELM_RELEASE_SHA256="$PREVIOUS_DIGEST" bash "$work/$previous_prefix/site/public/install.sh" "$work/$PREVIOUS_NAME" -[[ "$(node -p 'require("/opt/1helm/current/package.json").version')" == "$PREVIOUS_VERSION" ]] +[[ "$(sudo cat /opt/1helm/current/package.json | node -p 'JSON.parse(require("fs").readFileSync(0,"utf8")).version')" == "$PREVIOUS_VERSION" ]] MARKER=/var/lib/1helm-oci-v1/phase4-acceptance-state openssl rand -hex 32 | sudo tee "$MARKER" >/dev/null @@ -122,13 +122,13 @@ sudo tar -xzf "$ARCHIVE" -C "$CANDIDATE_RELEASE.tmp" --strip-components=1 sudo chown -R 1helm:1helm "$CANDIDATE_RELEASE.tmp" sudo mv "$CANDIDATE_RELEASE.tmp" "$CANDIDATE_RELEASE" sudo "$CANDIDATE_RELEASE/site/public/apply-linux-release.sh" "$CANDIDATE_RELEASE" "$VERSION" -[[ "$(node -p 'require("/opt/1helm/current/package.json").version')" == "$VERSION" ]] +[[ "$(sudo cat /opt/1helm/current/package.json | node -p 'JSON.parse(require("fs").readFileSync(0,"utf8")).version')" == "$VERSION" ]] sudo systemctl is-active --quiet 1helm.service curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/update-health.json" # Exercise the candidate's real atomic host transaction with a derived local # startup-failure fixture. The fixture is never uploaded as candidate bytes. -[[ "$(readlink -f /opt/1helm/current)" == "$CANDIDATE_RELEASE" ]] +[[ "$(sudo readlink -f /opt/1helm/current)" == "$CANDIDATE_RELEASE" ]] FAILURE_RELEASE="/opt/1helm/releases/$VERSION-$DIGEST-phase4-failure" sudo cp -a "$CANDIDATE_RELEASE" "$FAILURE_RELEASE" printf '%s\n' 'throw new Error("Phase 4 controlled startup failure");' | sudo tee "$FAILURE_RELEASE/src/server/index.ts" >/dev/null @@ -136,7 +136,7 @@ if sudo "$CANDIDATE_RELEASE/site/public/apply-linux-release.sh" "$FAILURE_RELEAS echo "Controlled failure unexpectedly passed." >&2 exit 1 fi -[[ "$(readlink -f /opt/1helm/current)" == "$CANDIDATE_RELEASE" ]] +[[ "$(sudo readlink -f /opt/1helm/current)" == "$CANDIDATE_RELEASE" ]] sudo systemctl is-active --quiet 1helm.service curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/rollback-health.json" STATE_AFTER="$(sudo sha256sum "$MARKER" | awk '{print $1}')"