feat(os): make Guanghu the language-primary boot target
This commit is contained in:
parent
8ab7f4fc28
commit
44bccdd2be
9 changed files with 490 additions and 9 deletions
|
|
@ -0,0 +1,135 @@
|
|||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
usage() {
|
||||
echo "usage: install-jd-language-primary-target.sh <guanghu-os-source> <source-commit>" >&2
|
||||
exit 64
|
||||
}
|
||||
|
||||
test "$#" = 2 || usage
|
||||
test "${EUID}" = 0 || exit 77
|
||||
|
||||
source_root="$(readlink -f "$1")"
|
||||
source_commit=$2
|
||||
expected_machine_id="caa7b1019517470f9d1368b6e79db49e"
|
||||
expected_instance_id="f3d4b730-7f02-452f-975b-7091a4800431"
|
||||
install_root="/usr/local/libexec/guanghu-os"
|
||||
state_root="/var/lib/guanghu/language-primary"
|
||||
receipt_root="${state_root}/receipts"
|
||||
backup_root="${state_root}/backups/${source_commit}"
|
||||
previous_default="$(systemctl get-default)"
|
||||
installed=0
|
||||
default_changed=0
|
||||
|
||||
[[ ${source_commit} =~ ^[0-9a-f]{40}$ ]]
|
||||
test -f "${source_root}/.guanghu-source-commit"
|
||||
test "$(cat "${source_root}/.guanghu-source-commit")" = "${source_commit}"
|
||||
test "$(cat /etc/machine-id)" = "${expected_machine_id}"
|
||||
test "$(tr '[:upper:]' '[:lower:]' </sys/class/dmi/id/product_uuid)" = \
|
||||
"${expected_instance_id}"
|
||||
test -f "${source_root}/packaging/systemd/guanghu-language-primary.target"
|
||||
test -f "${source_root}/packaging/systemd/guanghu-world-gate.service"
|
||||
test -f "${source_root}/packaging/systemd/guanghu-boot-acceptance.service"
|
||||
test -f "${source_root}/scripts/verify-jd-language-primary-world.sh"
|
||||
test -f "${source_root}/scripts/verify-jd-language-primary-acceptance.sh"
|
||||
test "${previous_default}" = graphical.target
|
||||
test ! -e "${backup_root}"
|
||||
|
||||
/guanghu/bin/ghctl authorize /guanghu/current install_world_version |
|
||||
grep -q '^GUANGHU_ACTION_AUTHORIZED$'
|
||||
|
||||
for path in \
|
||||
/etc/systemd/system/guanghu-language-primary.target \
|
||||
/etc/systemd/system/guanghu-world-gate.service \
|
||||
/etc/systemd/system/guanghu-boot-acceptance.service \
|
||||
"${install_root}/verify-jd-language-primary-world" \
|
||||
"${install_root}/verify-jd-language-primary-acceptance"; do
|
||||
test ! -e "${path}"
|
||||
done
|
||||
|
||||
rollback() {
|
||||
if test "${default_changed}" = 1; then
|
||||
systemctl set-default "${previous_default}" >/dev/null || true
|
||||
fi
|
||||
if test "${installed}" = 1; then
|
||||
systemctl stop guanghu-language-primary.target \
|
||||
guanghu-boot-acceptance.service guanghu-world-gate.service \
|
||||
>/dev/null 2>&1 || true
|
||||
rm -f \
|
||||
/etc/systemd/system/guanghu-language-primary.target \
|
||||
/etc/systemd/system/guanghu-world-gate.service \
|
||||
/etc/systemd/system/guanghu-boot-acceptance.service \
|
||||
"${install_root}/verify-jd-language-primary-world" \
|
||||
"${install_root}/verify-jd-language-primary-acceptance"
|
||||
systemctl daemon-reload || true
|
||||
fi
|
||||
}
|
||||
trap rollback ERR
|
||||
|
||||
install -d -o root -g root -m 0755 "${install_root}"
|
||||
install -d -o root -g root -m 0700 \
|
||||
"${receipt_root}" "${backup_root}"
|
||||
printf '%s\n' "${previous_default}" >"${backup_root}/previous-default-target"
|
||||
|
||||
install -o root -g root -m 0644 \
|
||||
"${source_root}/packaging/systemd/guanghu-language-primary.target" \
|
||||
/etc/systemd/system/guanghu-language-primary.target
|
||||
install -o root -g root -m 0644 \
|
||||
"${source_root}/packaging/systemd/guanghu-world-gate.service" \
|
||||
/etc/systemd/system/guanghu-world-gate.service
|
||||
install -o root -g root -m 0644 \
|
||||
"${source_root}/packaging/systemd/guanghu-boot-acceptance.service" \
|
||||
/etc/systemd/system/guanghu-boot-acceptance.service
|
||||
install -o root -g root -m 0755 \
|
||||
"${source_root}/scripts/verify-jd-language-primary-world.sh" \
|
||||
"${install_root}/verify-jd-language-primary-world"
|
||||
install -o root -g root -m 0755 \
|
||||
"${source_root}/scripts/verify-jd-language-primary-acceptance.sh" \
|
||||
"${install_root}/verify-jd-language-primary-acceptance"
|
||||
installed=1
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl start guanghu-language-primary.target
|
||||
test "$(systemctl is-active guanghu-language-primary.target)" = active
|
||||
test "$(systemctl is-active guanghu-world-gate.service)" = active
|
||||
test "$(systemctl is-active guanghu-boot-acceptance.service)" = active
|
||||
|
||||
systemctl set-default guanghu-language-primary.target >/dev/null
|
||||
default_changed=1
|
||||
test "$(systemctl get-default)" = guanghu-language-primary.target
|
||||
|
||||
boot_id="$(cat /proc/sys/kernel/random/boot_id)"
|
||||
boot_receipt="${receipt_root}/JD-FD-PRIMARY-LANGUAGE-PRIMARY-BOOT-${boot_id}.json"
|
||||
test -f "${boot_receipt}"
|
||||
jq -e '.result == "PASS_100" and .boot_changed == false' \
|
||||
"${boot_receipt}" >/dev/null
|
||||
|
||||
install_receipt="${receipt_root}/JD-FD-PRIMARY-LANGUAGE-PRIMARY-INSTALL-${source_commit}.json"
|
||||
jq -n \
|
||||
--arg source_commit "${source_commit}" \
|
||||
--arg previous_default "${previous_default}" \
|
||||
--arg boot_receipt "${boot_receipt}" \
|
||||
--arg observed_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
||||
'{
|
||||
schema: "guanghu.language-primary-install-receipt/v1",
|
||||
receipt_id: ("JD-FD-PRIMARY-LANGUAGE-PRIMARY-INSTALL-" + $source_commit),
|
||||
target_node_id: "JD-FD-PRIMARY",
|
||||
source_repository: "REPO-014",
|
||||
source_commit: $source_commit,
|
||||
previous_default_target: $previous_default,
|
||||
current_default_target: "guanghu-language-primary.target",
|
||||
boot_receipt: $boot_receipt,
|
||||
control_role: "GUANGHU_OS_LANGUAGE_PRIMARY",
|
||||
linux_role: "COOPERATIVE_EXECUTION_AND_RESCUE_SUBSTRATE",
|
||||
native_candidate_preserved: true,
|
||||
disk_or_bootloader_changed: false,
|
||||
rollback: ("systemctl set-default " + $previous_default),
|
||||
observed_at: $observed_at,
|
||||
result: "PASS_100"
|
||||
}' >"${install_receipt}.tmp"
|
||||
chmod 0600 "${install_receipt}.tmp"
|
||||
mv "${install_receipt}.tmp" "${install_receipt}"
|
||||
|
||||
trap - ERR
|
||||
printf 'PASS_100 target=guanghu-language-primary.target receipt=%s\n' \
|
||||
"${install_receipt}"
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
source_root=${1:-}
|
||||
[[ -n ${source_root} ]] || {
|
||||
echo "usage: test-jd-language-primary-target-contract.sh <guanghu-os-source>" >&2
|
||||
exit 64
|
||||
}
|
||||
|
||||
target=${source_root}/packaging/systemd/guanghu-language-primary.target
|
||||
world_gate_unit=${source_root}/packaging/systemd/guanghu-world-gate.service
|
||||
acceptance_unit=${source_root}/packaging/systemd/guanghu-boot-acceptance.service
|
||||
world_gate=${source_root}/scripts/verify-jd-language-primary-world.sh
|
||||
acceptance=${source_root}/scripts/verify-jd-language-primary-acceptance.sh
|
||||
installer=${source_root}/scripts/install-jd-language-primary-target.sh
|
||||
|
||||
for path in \
|
||||
"${target}" \
|
||||
"${world_gate_unit}" \
|
||||
"${acceptance_unit}" \
|
||||
"${world_gate}" \
|
||||
"${acceptance}" \
|
||||
"${installer}"; do
|
||||
test -f "${path}"
|
||||
done
|
||||
|
||||
grep -Fxq 'Requires=multi-user.target' "${target}"
|
||||
grep -Fq 'guanghu-world-gate.service' "${target}"
|
||||
grep -Fq 'guanghu-boot-acceptance.service' "${target}"
|
||||
grep -Fq 'bingshuo-tcs-living-controller.service' "${target}"
|
||||
grep -Fq 'guanghu-ai-discovery.service' "${target}"
|
||||
grep -Fq 'lake-lamp-authz.service' "${target}"
|
||||
grep -Fq 'lake-lamp-architecture-provision.service' "${target}"
|
||||
grep -Fq 'lake-lamp-deployment-event-worker.service' "${target}"
|
||||
grep -Fxq 'AllowIsolate=yes' "${target}"
|
||||
|
||||
grep -Fxq 'Type=oneshot' "${world_gate_unit}"
|
||||
grep -Fxq 'RemainAfterExit=yes' "${world_gate_unit}"
|
||||
grep -Fq 'Before=bingshuo-tcs-living-controller.service' "${world_gate_unit}"
|
||||
grep -Fq '/usr/local/libexec/guanghu-os/verify-jd-language-primary-world' \
|
||||
"${world_gate_unit}"
|
||||
|
||||
grep -Fxq 'Type=oneshot' "${acceptance_unit}"
|
||||
grep -Fxq 'RemainAfterExit=yes' "${acceptance_unit}"
|
||||
grep -Fq 'After=guanghu-world-gate.service' "${acceptance_unit}"
|
||||
grep -Fq '/usr/local/libexec/guanghu-os/verify-jd-language-primary-acceptance' \
|
||||
"${acceptance_unit}"
|
||||
grep -Fq 'ReadWritePaths=/var/lib/guanghu/language-primary/receipts' \
|
||||
"${acceptance_unit}"
|
||||
|
||||
grep -Fq '/guanghu/bin/ghctl wake /guanghu/current' "${world_gate}"
|
||||
grep -Fq '/guanghu/bin/ghctl authorize /guanghu/current run_tests_and_health_checks' \
|
||||
"${world_gate}"
|
||||
grep -Fq 'caa7b1019517470f9d1368b6e79db49e' "${world_gate}"
|
||||
grep -Fq 'f3d4b730-7f02-452f-975b-7091a4800431' "${world_gate}"
|
||||
|
||||
for service in \
|
||||
bingshuo-tcs-living-controller.service \
|
||||
guanghu-ai-discovery.service \
|
||||
lake-lamp-authz.service \
|
||||
lake-lamp-architecture-provision.service \
|
||||
lake-lamp-deployment-event-worker.service; do
|
||||
grep -Fq "${service}" "${acceptance}"
|
||||
done
|
||||
grep -Fq 'https://guanghulab.com/code/' "${acceptance}"
|
||||
grep -Fq 'https://guanghulab.com/api/ai/v1/anchor' "${acceptance}"
|
||||
grep -Fq '"phase" == "RUNNING_COMPANION"' "${acceptance}"
|
||||
grep -Fq '"execution_substrate.state" == "PASS_100"' "${acceptance}"
|
||||
grep -Fq 'boot_changed: false' "${acceptance}"
|
||||
|
||||
grep -Fq 'install_world_version' "${installer}"
|
||||
grep -Fq '.guanghu-source-commit' "${installer}"
|
||||
grep -Fq 'systemctl start guanghu-language-primary.target' "${installer}"
|
||||
grep -Fq 'systemctl set-default guanghu-language-primary.target' "${installer}"
|
||||
grep -Fq 'systemctl set-default "${previous_default}"' "${installer}"
|
||||
grep -Fq 'rollback' "${installer}"
|
||||
|
||||
if grep -Eiq 'eval|sh -c|bash -c|rm -rf /|systemctl reboot|grub-reboot' \
|
||||
"${world_gate}" "${acceptance}" "${installer}"; then
|
||||
echo "language-primary path contains a forbidden unbounded execution primitive" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for script in "${world_gate}" "${acceptance}" "${installer}"; do
|
||||
bash -n "${script}"
|
||||
done
|
||||
|
||||
echo "JD_LANGUAGE_PRIMARY_TARGET_CONTRACT_PASS_100"
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
expected_machine_id="caa7b1019517470f9d1368b6e79db49e"
|
||||
receipt_root="/var/lib/guanghu/language-primary/receipts"
|
||||
services=(
|
||||
"bingshuo-tcs-living-controller.service"
|
||||
"guanghu-ai-discovery.service"
|
||||
"lake-lamp-authz.service"
|
||||
"lake-lamp-architecture-provision.service"
|
||||
"lake-lamp-deployment-event-worker.service"
|
||||
)
|
||||
|
||||
test "$(cat /etc/machine-id)" = "${expected_machine_id}"
|
||||
install -d -o root -g root -m 0700 "${receipt_root}"
|
||||
|
||||
ready=0
|
||||
controller_json=""
|
||||
authz_json=""
|
||||
public_code_http="000"
|
||||
public_anchor_http="000"
|
||||
for _attempt in $(seq 1 30); do
|
||||
services_ready=1
|
||||
for service in "${services[@]}"; do
|
||||
if test "$(systemctl is-active "${service}")" != active; then
|
||||
services_ready=0
|
||||
fi
|
||||
done
|
||||
|
||||
controller_json="$(
|
||||
curl -fsS --max-time 3 http://127.0.0.1:3930/health 2>/dev/null || true
|
||||
)"
|
||||
authz_json="$(
|
||||
curl -fsS --max-time 3 http://127.0.0.1:3921/health 2>/dev/null || true
|
||||
)"
|
||||
public_code_http="$(
|
||||
curl -LfsS -o /dev/null -w '%{http_code}' --max-time 5 \
|
||||
https://guanghulab.com/code/ 2>/dev/null || printf '000'
|
||||
)"
|
||||
public_anchor_http="$(
|
||||
curl -LfsS -o /dev/null -w '%{http_code}' --max-time 5 \
|
||||
https://guanghulab.com/api/ai/v1/anchor 2>/dev/null || printf '000'
|
||||
)"
|
||||
|
||||
if test "${services_ready}" = 1 &&
|
||||
jq -e '
|
||||
."phase" == "RUNNING_COMPANION"
|
||||
and ."execution_substrate.state" == "PASS_100"
|
||||
and ."execution_substrate.linux_role" == "COOPERATIVE_EXECUTION_SUBSTRATE"
|
||||
and ."execution_substrate.arbitrary_shell" == false
|
||||
' <<<"${controller_json}" >/dev/null 2>&1 &&
|
||||
jq -e '
|
||||
.ok == true
|
||||
and .merge_deployment_gate.configured == true
|
||||
and .merge_deployment_gate.mode == "human-merged-pull-request-only"
|
||||
' <<<"${authz_json}" >/dev/null 2>&1 &&
|
||||
test "${public_code_http}" = 200 &&
|
||||
test "${public_anchor_http}" = 200; then
|
||||
ready=1
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
test "${ready}" = 1
|
||||
|
||||
boot_id="$(cat /proc/sys/kernel/random/boot_id)"
|
||||
observed_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
receipt="${receipt_root}/JD-FD-PRIMARY-LANGUAGE-PRIMARY-BOOT-${boot_id}.json"
|
||||
world_target="$(readlink -f /guanghu/current)"
|
||||
execution_release="$(readlink -f /opt/guanghu/execution-bridge/current)"
|
||||
controller_receipt="$(
|
||||
jq -r '.receipt_id' <<<"${controller_json}"
|
||||
)"
|
||||
|
||||
jq -n \
|
||||
--arg boot_id "${boot_id}" \
|
||||
--arg observed_at "${observed_at}" \
|
||||
--arg world_target "${world_target}" \
|
||||
--arg execution_release "${execution_release}" \
|
||||
--arg controller_receipt "${controller_receipt}" \
|
||||
'{
|
||||
schema: "guanghu.language-primary-boot-receipt/v1",
|
||||
receipt_id: ("JD-FD-PRIMARY-LANGUAGE-PRIMARY-BOOT-" + $boot_id),
|
||||
target_node_id: "JD-FD-PRIMARY",
|
||||
boot_id: $boot_id,
|
||||
control_role: "GUANGHU_OS_LANGUAGE_PRIMARY",
|
||||
linux_role: "COOPERATIVE_EXECUTION_AND_RESCUE_SUBSTRATE",
|
||||
world_target: $world_target,
|
||||
execution_release: $execution_release,
|
||||
controller_receipt: $controller_receipt,
|
||||
world_gate: "PASS_100",
|
||||
controller_gate: "PASS_100",
|
||||
execution_substrate_gate: "PASS_100",
|
||||
service_gate: "PASS_100",
|
||||
public_code_http: 200,
|
||||
public_anchor_http: 200,
|
||||
arbitrary_shell: false,
|
||||
boot_changed: false,
|
||||
bare_metal_candidate_preserved: true,
|
||||
observed_at: $observed_at,
|
||||
result: "PASS_100"
|
||||
}' >"${receipt}.tmp"
|
||||
chmod 0600 "${receipt}.tmp"
|
||||
mv "${receipt}.tmp" "${receipt}"
|
||||
|
||||
printf 'GUANGHU_LANGUAGE_PRIMARY_BOOT_PASS_100 receipt=%s\n' "${receipt}"
|
||||
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
expected_machine_id="caa7b1019517470f9d1368b6e79db49e"
|
||||
expected_instance_id="f3d4b730-7f02-452f-975b-7091a4800431"
|
||||
execution_policy="/opt/guanghu/execution-bridge/current/policy.json"
|
||||
|
||||
test "$(cat /etc/machine-id)" = "${expected_machine_id}"
|
||||
test "$(tr '[:upper:]' '[:lower:]' </sys/class/dmi/id/product_uuid)" = \
|
||||
"${expected_instance_id}"
|
||||
test -L /guanghu/current
|
||||
test -f /guanghu/current/WORLD-MANIFEST.hldp
|
||||
test -f /guanghu/current/CURRENT.hldp
|
||||
test -x /guanghu/bin/ghctl
|
||||
test -f "${execution_policy}"
|
||||
|
||||
wake_output="$(/guanghu/bin/ghctl wake /guanghu/current)"
|
||||
grep -Fxq 'GUANGHU_WORLD_OK' <<<"${wake_output}"
|
||||
grep -Fxq 'world_id=GLW-ROOT-0001' <<<"${wake_output}"
|
||||
grep -Fxq 'domains=5' <<<"${wake_output}"
|
||||
grep -Fxq 'authorization=GH-OS-AUTH-BINGSHUO-JD-FD-PRIMARY-001' \
|
||||
<<<"${wake_output}"
|
||||
|
||||
authorization_output="$(
|
||||
/guanghu/bin/ghctl authorize /guanghu/current run_tests_and_health_checks
|
||||
)"
|
||||
grep -Fxq 'GUANGHU_ACTION_AUTHORIZED' <<<"${authorization_output}"
|
||||
grep -Fxq 'target=JD-FD-PRIMARY' <<<"${authorization_output}"
|
||||
|
||||
jq -e '
|
||||
.schema == "guanghu.execution-policy/v1"
|
||||
and .target_node_id == "JD-FD-PRIMARY"
|
||||
and .allow_status == true
|
||||
and .allow_restart == false
|
||||
and .mutation_grants == []
|
||||
' "${execution_policy}" >/dev/null
|
||||
|
||||
printf '%s\n' \
|
||||
'GUANGHU_LANGUAGE_PRIMARY_WORLD_PASS_100' \
|
||||
'target=JD-FD-PRIMARY' \
|
||||
'world=GLW-ROOT-0001' \
|
||||
'domains=5' \
|
||||
'linux_role=COOPERATIVE_EXECUTION_SUBSTRATE'
|
||||
Loading…
Reference in a new issue