Ilker ManapandClaude Opus 5.5
a549f01ef5
Findings from a full review (auth/API, CA and rack channel, config generation, integrations, UI/agents/scripts), each verified in code: - rack binary endpoint read any region file via arch=../.. (CA key) - render endpoint traversal; machine-reported MACs used as file paths - delegated intermediates could mint admin/rack identities and IPs; identities now require root-issued certs, intermediates are ServerAuth-only with both name types constrained - rack certs were ServerAuth for rack-chosen SANs: now client-only; racks accept only the region's own cert; join checks the CA fingerprint; unbound join codes cannot take an existing name; job results bound to the rack that took them - rack self-update: region signs binaries with the CA key, the root unit verifies against the join-time CA in a root-owned dir - dnsmasq reads a checked, root-owned copy limited to generated options - commissioning could overwrite deployed machines; MAC takeover of PXE - injection into dnsmasq/cloud-init/PXE/udev/DNS via names and machine-reported strings; stored XSS in the UI; CSP and cross-origin protection; deploy agent shell injection and seed traversal - Redfish requests confined to the BMC's /redfish/ tree - admin_http defaults to loopback; body limits and timeouts; secrets off command lines Also: IPAM claim/reconcile race, sync stopping on one error, watchdog race, release wiping the wrong disk, SAN LUNs as auto targets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 lines
1.5 KiB
Bash
Executable File
25 lines
1.5 KiB
Bash
Executable File
#!/bin/sh
|
|
# Publish this region's commissioning image as assets of a Gitea release, so new
|
|
# installations download it (bootstrap.sh --image-url .../releases/download/TAG).
|
|
# GITEA_TOKEN=... ./publish-image.sh v0.2.0 [https://gitea.example/api/v1/repos/OWNER/REPO]
|
|
# Files are uploaded as commissioning-{vmlinuz,initrd.img,filesystem.squashfs,SHA256SUMS}.
|
|
set -eu
|
|
TAG=${1:?usage: publish-image.sh TAG [API]}
|
|
API=${2:-https://gitea.mynodes.xyz/api/v1/repos/ilker/rollcall}
|
|
IMG=${IMG:-/srv/rollcall/image}
|
|
: "${GITEA_TOKEN:?set GITEA_TOKEN (write:repository)}"
|
|
HDR=$(mktemp); trap 'rm -f "$HDR"' EXIT
|
|
printf 'Authorization: token %s\n' "$GITEA_TOKEN" > "$HDR" # not on curl's command line (ps)
|
|
cd "$IMG"
|
|
sha256sum vmlinuz initrd.img filesystem.squashfs > SHA256SUMS
|
|
id=$(curl -fsS -H "@$HDR" "$API/releases/tags/$TAG" | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])')
|
|
existing=$(curl -fsS -H "@$HDR" "$API/releases/$id/assets" | python3 -c 'import json,sys;[print(a["id"],a["name"]) for a in json.load(sys.stdin)]')
|
|
for f in vmlinuz initrd.img filesystem.squashfs SHA256SUMS; do
|
|
name=commissioning-$f
|
|
old=$(echo "$existing" | awk -v n="$name" '$2==n{print $1}')
|
|
[ -n "$old" ] && curl -fsS -X DELETE -H "@$HDR" "$API/releases/$id/assets/$old" >/dev/null
|
|
echo "uploading $name ($(du -h "$f" | cut -f1))"
|
|
curl -fsS -H "@$HDR" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" >/dev/null
|
|
done
|
|
echo "done: bootstrap.sh --image-url ${API%/api/v1/repos/*}/$(echo "$API" | sed 's#.*/repos/##')/releases/download/$TAG"
|