From 69e37c582e6d7fae563bc82737f0fbabe922b959 Mon Sep 17 00:00:00 2001 From: Augustus Otu Date: Sat, 29 Aug 2026 17:38:52 +0000 Subject: [PATCH] fix(release): validate nested hypervisor runner updates --- scripts/test-app-update-payload.sh | 51 +++++++++++++++++++++++++- scripts/validate-app-update-payload.sh | 14 ++++++- 2 files changed, 62 insertions(+), 3 deletions(-) diff --git a/scripts/test-app-update-payload.sh b/scripts/test-app-update-payload.sh index c3561862..becac778 100755 --- a/scripts/test-app-update-payload.sh +++ b/scripts/test-app-update-payload.sh @@ -9,10 +9,22 @@ trap 'rm -rf "$TMP"' EXIT APP="$TMP/Dory.app" RESOURCES="$APP/Contents/Resources" HELPERS="$APP/Contents/Helpers" +RUNNER_APP="$HELPERS/DoryHVRunner.app" +RUNNER="$RUNNER_APP/Contents/MacOS/dory-hv" NETWORK_DAEMON_DIR="$APP/Contents/Library/LaunchDaemons" NETWORK_DAEMON_PLIST="$NETWORK_DAEMON_DIR/dev.dory.network-helper.plist" -mkdir -p "$RESOURCES" "$HELPERS" "$NETWORK_DAEMON_DIR" +mkdir -p "$RESOURCES" "$HELPERS" "$RUNNER_APP/Contents/MacOS" "$NETWORK_DAEMON_DIR" cp Config/dev.dory.network-helper.plist "$NETWORK_DAEMON_PLIST" +cat > "$RUNNER_APP/Contents/Info.plist" <<'PLIST' + + + +CFBundleExecutabledory-hv +CFBundleIdentifiercom.pythonxi.Dory.HVRunner + +PLIST +printf '#!/bin/sh\nexit 0\n' > "$RUNNER" +chmod 0755 "$RUNNER" ASSETS=( dory-agent-linux-arm64 @@ -39,7 +51,7 @@ for asset in "${ASSETS[@]}"; do done HELPER_ASSETS=( - doryd dorydctl dory-vmm dory-network-helper dory-dataplane-proxy dory-hv + doryd dorydctl dory-vmm dory-network-helper dory-dataplane-proxy gvproxy docker docker-buildx docker-compose kubectl dory dory-doctor ) for helper in "${HELPER_ASSETS[@]}"; do @@ -47,6 +59,41 @@ for helper in "${HELPER_ASSETS[@]}"; do chmod 0755 "$HELPERS/$helper" done +mv "$RUNNER" "$TMP/dory-hv" +if scripts/validate-app-update-payload.sh "$APP" arm64 desktop >"$TMP/missing-runner.out" 2>&1; then + echo "app-update payload test failed: missing nested dory-hv was accepted" >&2 + exit 1 +fi +grep -F 'missing direct DoryHVRunner executable dory-hv' "$TMP/missing-runner.out" >/dev/null +mv "$TMP/dory-hv" "$RUNNER" + +ln -s "$RUNNER" "$HELPERS/dory-hv" +if scripts/validate-app-update-payload.sh "$APP" arm64 desktop >"$TMP/parallel-runner.out" 2>&1; then + echo "app-update payload test failed: obsolete parallel dory-hv was accepted" >&2 + exit 1 +fi +grep -F 'obsolete parallel executable helper dory-hv is present' "$TMP/parallel-runner.out" >/dev/null +rm "$HELPERS/dory-hv" + +mv "$RUNNER_APP" "$TMP/DoryHVRunner.app" +ln -s "$TMP/DoryHVRunner.app" "$RUNNER_APP" +if scripts/validate-app-update-payload.sh "$APP" arm64 desktop >"$TMP/indirect-runner.out" 2>&1; then + echo "app-update payload test failed: indirect DoryHVRunner.app was accepted" >&2 + exit 1 +fi +grep -F 'missing direct DoryHVRunner.app' "$TMP/indirect-runner.out" >/dev/null +rm "$RUNNER_APP" +mv "$TMP/DoryHVRunner.app" "$RUNNER_APP" + +cp "$RUNNER_APP/Contents/Info.plist" "$TMP/runner-info.plist" +/usr/libexec/PlistBuddy -c 'Set :CFBundleExecutable not-dory-hv' "$RUNNER_APP/Contents/Info.plist" +if scripts/validate-app-update-payload.sh "$APP" arm64 desktop >"$TMP/runner-metadata.out" 2>&1; then + echo "app-update payload test failed: invalid runner metadata was accepted" >&2 + exit 1 +fi +grep -F 'DoryHVRunner.app CFBundleExecutable is not dory-hv' "$TMP/runner-metadata.out" >/dev/null +cp "$TMP/runner-info.plist" "$RUNNER_APP/Contents/Info.plist" + scripts/validate-app-update-payload.sh "$APP" arm64 desktop >/dev/null for asset in "${ASSETS[@]}"; do rm "$RESOURCES/$asset" diff --git a/scripts/validate-app-update-payload.sh b/scripts/validate-app-update-payload.sh index 2b23ec50..7347fa67 100755 --- a/scripts/validate-app-update-payload.sh +++ b/scripts/validate-app-update-payload.sh @@ -14,6 +14,8 @@ APP="$(cd "$APP" && pwd -P)" || { echo "app-update payload error: input app has an indirect ancestor" >&2; exit 66; } RESOURCES="$APP/Contents/Resources" HELPERS="$APP/Contents/Helpers" +RUNNER_APP="$HELPERS/DoryHVRunner.app" +RUNNER="$RUNNER_APP/Contents/MacOS/dory-hv" NETWORK_DAEMON_PLIST="$APP/Contents/Library/LaunchDaemons/dev.dory.network-helper.plist" fail() { @@ -32,10 +34,20 @@ done [ -d "$RESOURCES" ] || fail "missing $RESOURCES" [ -d "$HELPERS" ] || fail "missing $HELPERS" for helper in \ - doryd dorydctl dory-vmm dory-network-helper dory-dataplane-proxy dory-hv \ + doryd dorydctl dory-vmm dory-network-helper dory-dataplane-proxy \ gvproxy docker docker-buildx docker-compose dory dory-doctor; do [ -x "$HELPERS/$helper" ] || fail "missing executable helper $helper" done +[ -d "$RUNNER_APP" ] && [ ! -L "$RUNNER_APP" ] \ + || fail "missing direct DoryHVRunner.app" +[ -x "$RUNNER" ] && [ -f "$RUNNER" ] && [ ! -L "$RUNNER" ] \ + || fail "missing direct DoryHVRunner executable dory-hv" +[ "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$RUNNER_APP/Contents/Info.plist" 2>/dev/null || true)" = dory-hv ] \ + || fail "DoryHVRunner.app CFBundleExecutable is not dory-hv" +[ "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$RUNNER_APP/Contents/Info.plist" 2>/dev/null || true)" = com.pythonxi.Dory.HVRunner ] \ + || fail "DoryHVRunner.app bundle identifier is invalid" +[ ! -e "$HELPERS/dory-hv" ] \ + || fail "obsolete parallel executable helper dory-hv is present" if [ "$EDITION" = core ]; then [ ! -e "$HELPERS/kubectl" ] || fail "Core update unexpectedly contains kubectl" [ "$(/usr/libexec/PlistBuddy -c 'Print :DoryBundledComponents' "$APP/Contents/Info.plist" 2>/dev/null || true)" = $'Array {\n docker-core\n}' ] \