From 046b252e79892887a1ae92c1d5c52d92dd719931 Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Tue, 21 Jul 2026 09:42:11 +0000 Subject: [PATCH] runtime: publish RUNTIME-RECEIVER-BLOCK-024 --- .../history/RUNTIME-RECEIVER-BLOCK-024.json | 30 +++ .../history/RUNTIME-RECEIVER-BLOCK-024.txt | 125 +++++++++++ runtime/latest.json | 14 +- runtime/latest.txt | 205 +----------------- 4 files changed, 166 insertions(+), 208 deletions(-) create mode 100644 runtime/history/RUNTIME-RECEIVER-BLOCK-024.json create mode 100644 runtime/history/RUNTIME-RECEIVER-BLOCK-024.txt diff --git a/runtime/history/RUNTIME-RECEIVER-BLOCK-024.json b/runtime/history/RUNTIME-RECEIVER-BLOCK-024.json new file mode 100644 index 0000000..929bfec --- /dev/null +++ b/runtime/history/RUNTIME-RECEIVER-BLOCK-024.json @@ -0,0 +1,30 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "RUNTIME-RECEIVER-BLOCK-024", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "read-only", + "component": "gitea-runtime", + "started_at_utc": "2026-07-21T09:42:10Z", + "finished_at_utc": "2026-07-21T09:42:10Z", + "reference_register_checked": true, + "reference_sha256": "f6f7749fda946015116cdbbd754c7e7f20356b4a6cf4df330a1b0b8fdf59cbb2", + "error_register_checked": true, + "error_register_sha256": "ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc", + "command_sha256": "03de81eb7223c7f9d0a547ee58a3bc445df4b6aaa0e96535274791c8e6a2f588", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "changes_made": false, + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "bd6112182f1e657fe1f32a60b9224edd91f45d6c4fc41b0637caaaf3686aefde", + "sanitized_output_sha256": "bd6112182f1e657fe1f32a60b9224edd91f45d6c4fc41b0637caaaf3686aefde", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "COMMIT_SHA=\"$(\n docker exec \\\n -u \"${GIT_UID}:${GIT_GID}\" \\\n -e COMMAND_ID=\"$COMMAND_ID\" \\\n -e PUBLISHED_AT=\"$PUBLISHED_AT\" \\\n -e WORK_CONTAINER=\"$WORK_CONTAINER\" \\\n gitea sh -lc '\nset -eu\n\nBARE=\"/data/git/repositories/homelab-admin/homelab-public-context.git\"\nSTAGE=\"/data/gitea/runtime-stage\"\nWORK=\"$WORK_CONTAINER\"\n\nrm -rf \"$WORK\"\n\ngit clone --quiet \"$BARE\" \"$WORK\"\n\ncd \"$WORK\"\n\ngit config user.name \"homelab-runtime-publisher\"\ngit config user.email \"homelab-runtime@localhost\"\n\nif git show-ref \\\n --verify \\\n --quiet \\\n refs/remotes/origin/assistant-runtime\nthen\n git checkout \\\n --quiet \\\n -B assistant-runtime \\\n origin/assistant-runtime\nelse\n git checkout \\\n --quiet \\\n --orphan assistant-runtime\n\n git rm -rf . >/dev/null 2>&1 || true\nfi\n\nmkdir -p runtime/history\n\ncp \"$STAGE/latest.json\" runtime/latest.json\ncp \"$STAGE/latest.txt\" runtime/latest.txt\ncp \"$STAGE/latest.json\" \"runtime/history/${COMMAND_ID}.json\"\ncp \"$STAGE/latest.txt\" \"runtime/history/${COMMAND_ID}.txt\"\ncp \"$STAGE/README.md\" README.md\n\ngit add \\\n README.md \\\n runtime/latest.json \\\n runtime/latest.txt \\\n \"runtime/history/${COMMAND_ID}.json\"\n\ngit add \"runtime/history/${COMMAND_ID}.txt\"\n\nif ! git diff --cached --quiet\nthen\n GIT_AUTHOR_DATE=\"$PUBLISHED_AT\" \\\n GIT_COMMITTER_DATE=\"$PUBLISHED_AT\" \\\n git commit \\\n --quiet \\\n -m \"runtime: publish ${COMMAND_ID}\"\nfi\n\nCOMMIT=\"$(git rev-parse HEAD)\"\n\ngit --git-dir=\"$BARE\" \\\n fetch \\\n --quiet \\\n \"$WORK\" \\\n refs/heads/assistant-runtime\n\nOLD=\"$(\n git --git-dir=\"$BARE\" \\\n rev-parse refs/heads/assistant-runtime \\\n 2>/dev/null ||\n true\n)\"\n\nif [ -n \"$OLD\" ]\nthen\n git --git-dir=\"$BARE\" \\\n update-ref \\\n refs/heads/assistant-runtime \\\n \"$COMMIT\" \\\n \"$OLD\"\nelse\n git --git-dir=\"$BARE\" \\\n update-ref \\\n refs/heads/assistant-runtime \\\n \"$COMMIT\"\nfi\n\nrm -rf \"$WORK\"\n\nprintf \"%s\\n\" \"$COMMIT\"\n'\n)\"\n\nJSON_TMP=\"$(mktemp \"${PUBLIC_DIR}/.latest.json.XXXXXX\")\"\nTXT_TMP=\"$(mktemp \"${PUBLIC_DIR}/.latest.txt.XXXXXX\")\"\n" +} diff --git a/runtime/history/RUNTIME-RECEIVER-BLOCK-024.txt b/runtime/history/RUNTIME-RECEIVER-BLOCK-024.txt new file mode 100644 index 0000000..3f092b7 --- /dev/null +++ b/runtime/history/RUNTIME-RECEIVER-BLOCK-024.txt @@ -0,0 +1,125 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=RUNTIME-RECEIVER-BLOCK-024 +STATUS=OK +RC=0 +HOST=pve01 +MODE=read-only +COMPONENT=gitea-runtime +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=f6f7749fda946015116cdbbd754c7e7f20356b4a6cf4df330a1b0b8fdf59cbb2 +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc +COMMAND_SHA256=03de81eb7223c7f9d0a547ee58a3bc445df4b6aaa0e96535274791c8e6a2f588 +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGES_MADE=false +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=bd6112182f1e657fe1f32a60b9224edd91f45d6c4fc41b0637caaaf3686aefde +SANITIZED_OUTPUT_SHA256=bd6112182f1e657fe1f32a60b9224edd91f45d6c4fc41b0637caaaf3686aefde +OUTPUT_BEGIN +COMMIT_SHA="$( + docker exec \ + -u "${GIT_UID}:${GIT_GID}" \ + -e COMMAND_ID="$COMMAND_ID" \ + -e PUBLISHED_AT="$PUBLISHED_AT" \ + -e WORK_CONTAINER="$WORK_CONTAINER" \ + gitea sh -lc ' +set -eu + +BARE="/data/git/repositories/homelab-admin/homelab-public-context.git" +STAGE="/data/gitea/runtime-stage" +WORK="$WORK_CONTAINER" + +rm -rf "$WORK" + +git clone --quiet "$BARE" "$WORK" + +cd "$WORK" + +git config user.name "homelab-runtime-publisher" +git config user.email "homelab-runtime@localhost" + +if git show-ref \ + --verify \ + --quiet \ + refs/remotes/origin/assistant-runtime +then + git checkout \ + --quiet \ + -B assistant-runtime \ + origin/assistant-runtime +else + git checkout \ + --quiet \ + --orphan assistant-runtime + + git rm -rf . >/dev/null 2>&1 || true +fi + +mkdir -p runtime/history + +cp "$STAGE/latest.json" runtime/latest.json +cp "$STAGE/latest.txt" runtime/latest.txt +cp "$STAGE/latest.json" "runtime/history/${COMMAND_ID}.json" +cp "$STAGE/latest.txt" "runtime/history/${COMMAND_ID}.txt" +cp "$STAGE/README.md" README.md + +git add \ + README.md \ + runtime/latest.json \ + runtime/latest.txt \ + "runtime/history/${COMMAND_ID}.json" + +git add "runtime/history/${COMMAND_ID}.txt" + +if ! git diff --cached --quiet +then + GIT_AUTHOR_DATE="$PUBLISHED_AT" \ + GIT_COMMITTER_DATE="$PUBLISHED_AT" \ + git commit \ + --quiet \ + -m "runtime: publish ${COMMAND_ID}" +fi + +COMMIT="$(git rev-parse HEAD)" + +git --git-dir="$BARE" \ + fetch \ + --quiet \ + "$WORK" \ + refs/heads/assistant-runtime + +OLD="$( + git --git-dir="$BARE" \ + rev-parse refs/heads/assistant-runtime \ + 2>/dev/null || + true +)" + +if [ -n "$OLD" ] +then + git --git-dir="$BARE" \ + update-ref \ + refs/heads/assistant-runtime \ + "$COMMIT" \ + "$OLD" +else + git --git-dir="$BARE" \ + update-ref \ + refs/heads/assistant-runtime \ + "$COMMIT" +fi + +rm -rf "$WORK" + +printf "%s\n" "$COMMIT" +' +)" + +JSON_TMP="$(mktemp "${PUBLIC_DIR}/.latest.json.XXXXXX")" +TXT_TMP="$(mktemp "${PUBLIC_DIR}/.latest.txt.XXXXXX")" + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index abade21..929bfec 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "RUNTIME-RECEIVER-FULL-023", + "command_id": "RUNTIME-RECEIVER-BLOCK-024", "status": "OK", "rc": 0, "host": "pve01", "mode": "read-only", "component": "gitea-runtime", - "started_at_utc": "2026-07-21T09:40:01Z", - "finished_at_utc": "2026-07-21T09:40:01Z", + "started_at_utc": "2026-07-21T09:42:10Z", + "finished_at_utc": "2026-07-21T09:42:10Z", "reference_register_checked": true, "reference_sha256": "f6f7749fda946015116cdbbd754c7e7f20356b4a6cf4df330a1b0b8fdf59cbb2", "error_register_checked": true, "error_register_sha256": "ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc", - "command_sha256": "d17752c0235202b5d9f1822d70680ea57dd4578bde6bbc906c7569c0d0463bb0", + "command_sha256": "03de81eb7223c7f9d0a547ee58a3bc445df4b6aaa0e96535274791c8e6a2f588", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -22,9 +22,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "2c183b9ced4334e5ff12c1ba35dceb1f7f6ef113298d44bf3fb80ca07305b8b3", - "sanitized_output_sha256": "cd4ccc98c3b9dff7bd1f5557b41fb60d073f889a31f3fd7d86900eecbe15dff4", + "raw_evidence_sha256": "bd6112182f1e657fe1f32a60b9224edd91f45d6c4fc41b0637caaaf3686aefde", + "sanitized_output_sha256": "bd6112182f1e657fe1f32a60b9224edd91f45d6c4fc41b0637caaaf3686aefde", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "#!/usr/bin/env bash\nset -Eeuo pipefail\numask 027\n\nHOST_DATA='/opt/stacks/gitea/data'\nBARE_CONTAINER='/data/git/repositories/homelab-admin/homelab-public-context.git'\n\nPUBLIC_DIR=\"${HOST_DATA}/gitea/public/.well-known/homelab-runtime\"\nSTAGE_DIR=\"${HOST_DATA}/gitea/runtime-stage\"\nWORK_ROOT=\"${HOST_DATA}/gitea/runtime-work\"\n\nLOCK='/run/lock/homelab-runtime-receive.lock'\n\n[ \"$#\" -eq 3 ] || {\n echo 'RESULT=FAIL'\n echo 'REASON=USAGE'\n exit 64\n}\n\nCOMMAND_ID=\"$1\"\nJSON_FILE=\"$2\"\nTXT_FILE=\"$3\"\n\ncase \"$COMMAND_ID\" in\n ''|*[!A-Za-z0-9._-]*)\n echo 'RESULT=FAIL'\n echo 'REASON=INVALID_COMMAND_ID'\n exit 65\n ;;\nesac\n\n[ -f \"$JSON_FILE\" ] || {\n echo 'RESULT=FAIL'\n echo 'REASON=JSON_FILE_MISSING'\n exit 66\n}\n\n[ -f \"$TXT_FILE\" ] || {\n echo 'RESULT=FAIL'\n echo 'REASON=TXT_FILE_MISSING'\n exit 67\n}\n\nexec 9>\"$LOCK\"\nflock -w 60 9 || {\n echo 'RESULT=FAIL'\n echo 'REASON=RECEIVER_LOCK_TIMEOUT'\n exit 68\n}\n\npython3 - \"$JSON_FILE\" \"$TXT_FILE\" \"$COMMAND_ID\" <<'PY'\nimport json\nimport re\nimport sys\nfrom pathlib import Path\n\njson_path = Path(sys.argv[1])\ntext_path = Path(sys.argv[2])\nexpected_id = sys.argv[3]\n\nif json_path.stat().st_size > 524_288:\n raise SystemExit(\"JSON_TOO_LARGE\")\n\nif text_path.stat().st_size > 1_048_576:\n raise SystemExit(\"TEXT_TOO_LARGE\")\n\njson_text = json_path.read_text(encoding=\"utf-8\")\ntext = text_path.read_text(encoding=\"utf-8\")\n\ndata = json.loads(json_text)\n\nif data.get(\"command_id\") != expected_id:\n raise SystemExit(\"COMMAND_ID_MISMATCH\")\n\nif data.get(\"sanitized\") is not True:\n raise SystemExit(\"SANITIZED_FLAG_REQUIRED\")\n\nif data.get(\"secrets_included\") is not False:\n raise SystemExit(\"SECRETS_FLAG_INVALID\")\n\nif data.get(\"private_addresses_included\") is not False:\n raise SystemExit(\"PRIVATE_ADDRESS_FLAG_INVALID\")\n\ncombined = json_text + \"\\n\" + text\n\npatterns = [\n r\"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----\",\n r\"(?i)(password|passwd|passphrase|authorization|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key)\\s*[:=]\\s*\\S+\",\n r\"(?i)/root/\\.ssh\",\n r\"(?i)[SENSITIVE_PATH]\",\n r\"(?i)rclone\\.conf\",\n r\"\\b10(?:\\.\\d{1,3}){3}\\b\",\n r\"\\b192\\.168(?:\\.\\d{1,3}){2}\\b\",\n r\"\\b172\\.(?:1[6-9]|2\\d|3[01])(?:\\.\\d{1,3}){2}\\b\",\n]\n\nfor pattern in patterns:\n if re.search(pattern, combined):\n raise SystemExit(\"FORBIDDEN_PUBLIC_CONTENT\")\n\nprint(\"PAYLOAD_VALIDATION=OK\")\nPY\n\nGIT_UID=\"$(docker exec gitea id -u git)\"\nGIT_GID=\"$(docker exec gitea id -g git)\"\n\nmkdir -p \\\n \"$PUBLIC_DIR\" \\\n \"$STAGE_DIR\" \\\n \"$WORK_ROOT\"\n\nchown \"$GIT_UID:$GIT_GID\" \\\n \"$STAGE_DIR\" \\\n \"$WORK_ROOT\"\n\ninstall \\\n -o \"$GIT_UID\" \\\n -g \"$GIT_GID\" \\\n -m 0644 \\\n \"$JSON_FILE\" \\\n \"$STAGE_DIR/latest.json\"\n\ninstall \\\n -o \"$GIT_UID\" \\\n -g \"$GIT_GID\" \\\n -m 0644 \\\n \"$TXT_FILE\" \\\n \"$STAGE_DIR/latest.txt\"\n\ncat > \"$STAGE_DIR/README.md\" <<'DOC'\n# Homelab assistant runtime\n\nSanitized command results for read-only assistant inspection.\n\nCredentials, authentication data, private keys, private IP addresses and\nunfiltered configuration files are prohibited.\nDOC\n\nchown \"$GIT_UID:$GIT_GID\" \"$STAGE_DIR/README.md\"\nchmod 0644 \"$STAGE_DIR/README.md\"\n\nPUBLISHED_AT=\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"\nWORK_CONTAINER=\"/data/gitea/runtime-work/${COMMAND_ID}.$$\"\n\nCOMMIT_SHA=\"$(\n docker exec \\\n -u \"${GIT_UID}:${GIT_GID}\" \\\n -e COMMAND_ID=\"$COMMAND_ID\" \\\n -e PUBLISHED_AT=\"$PUBLISHED_AT\" \\\n -e WORK_CONTAINER=\"$WORK_CONTAINER\" \\\n gitea sh -lc '\nset -eu\n\nBARE=\"/data/git/repositories/homelab-admin/homelab-public-context.git\"\nSTAGE=\"/data/gitea/runtime-stage\"\nWORK=\"$WORK_CONTAINER\"\n\nrm -rf \"$WORK\"\n\ngit clone --quiet \"$BARE\" \"$WORK\"\n\ncd \"$WORK\"\n\ngit config user.name \"homelab-runtime-publisher\"\ngit config user.email \"homelab-runtime@localhost\"\n\nif git show-ref \\\n --verify \\\n --quiet \\\n refs/remotes/origin/assistant-runtime\nthen\n git checkout \\\n --quiet \\\n -B assistant-runtime \\\n origin/assistant-runtime\nelse\n git checkout \\\n --quiet \\\n --orphan assistant-runtime\n\n git rm -rf . >/dev/null 2>&1 || true\nfi\n\nmkdir -p runtime/history\n\ncp \"$STAGE/latest.json\" runtime/latest.json\ncp \"$STAGE/latest.txt\" runtime/latest.txt\ncp \"$STAGE/latest.json\" \"runtime/history/${COMMAND_ID}.json\"\ncp \"$STAGE/latest.txt\" \"runtime/history/${COMMAND_ID}.txt\"\ncp \"$STAGE/README.md\" README.md\n\ngit add \\\n README.md \\\n runtime/latest.json \\\n runtime/latest.txt \\\n \"runtime/history/${COMMAND_ID}.json\"\n\ngit add \"runtime/history/${COMMAND_ID}.txt\"\n\nif ! git diff --cached --quiet\nthen\n GIT_AUTHOR_DATE=\"$PUBLISHED_AT\" \\\n GIT_COMMITTER_DATE=\"$PUBLISHED_AT\" \\\n git commit \\\n --quiet \\\n -m \"runtime: publish ${COMMAND_ID}\"\nfi\n\nCOMMIT=\"$(git rev-parse HEAD)\"\n\ngit --git-dir=\"$BARE\" \\\n fetch \\\n --quiet \\\n \"$WORK\" \\\n refs/heads/assistant-runtime\n\nOLD=\"$(\n git --git-dir=\"$BARE\" \\\n rev-parse refs/heads/assistant-runtime \\\n 2>/dev/null ||\n true\n)\"\n\nif [ -n \"$OLD\" ]\nthen\n git --git-dir=\"$BARE\" \\\n update-ref \\\n refs/heads/assistant-runtime \\\n \"$COMMIT\" \\\n \"$OLD\"\nelse\n git --git-dir=\"$BARE\" \\\n update-ref \\\n refs/heads/assistant-runtime \\\n \"$COMMIT\"\nfi\n\nrm -rf \"$WORK\"\n\nprintf \"%s\\n\" \"$COMMIT\"\n'\n)\"\n\nJSON_TMP=\"$(mktemp \"${PUBLIC_DIR}/.latest.json.XXXXXX\")\"\nTXT_TMP=\"$(mktemp \"${PUBLIC_DIR}/.latest.txt.XXXXXX\")\"\nINDEX_TMP=\"$(mktemp \"${PUBLIC_DIR}/.index.json.XXXXXX\")\"\n\ninstall -m 0644 \"$JSON_FILE\" \"$JSON_TMP\"\ninstall -m 0644 \"$TXT_FILE\" \"$TXT_TMP\"\n\npython3 - \\\n \"$COMMAND_ID\" \\\n \"$PUBLISHED_AT\" \\\n \"$COMMIT_SHA\" >\"$INDEX_TMP\" <<'PY'\nimport json\nimport sys\n\ncommand_id, published_at, commit_sha = sys.argv[1:4]\n\nprint(json.dumps({\n \"schema_version\": 1,\n \"channel\": \"homelab-runtime\",\n \"branch\": \"assistant-runtime\",\n \"latest_command_id\": command_id,\n \"published_at_utc\": published_at,\n \"commit_sha\": commit_sha,\n \"latest_json_url\": (\n \"https://git.gram1.ru/.well-known/\"\n \"homelab-runtime/latest.json\"\n ),\n \"latest_text_url\": (\n \"https://git.gram1.ru/.well-known/\"\n \"homelab-runtime/latest.txt\"\n )\n}, ensure_ascii=False, indent=2))\nPY\n\nchmod 0644 \"$INDEX_TMP\"\n\nmv -f \"$JSON_TMP\" \"$PUBLIC_DIR/latest.json\"\nmv -f \"$TXT_TMP\" \"$PUBLIC_DIR/latest.txt\"\nmv -f \"$INDEX_TMP\" \"$PUBLIC_DIR/index.json\"\n\ncurl -fsS \\\n --max-time 10 \\\n http://127.0.0.1:3002/.well-known/homelab-runtime/latest.json |\ngrep -F \"$COMMAND_ID\" >/dev/null\n\ncurl -fsS \\\n --max-time 10 \\\n \"http://127.0.0.1:3002/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/latest.json\" |\ngrep -F \"$COMMAND_ID\" >/dev/null\n\necho 'RESULT=OK'\necho \"COMMAND_ID=$COMMAND_ID\"\necho \"COMMIT_SHA=$COMMIT_SHA\"\necho 'STATIC_PUBLICATION=OK'\necho 'RAW_BRANCH_PUBLICATION=OK'\n" + "output": "COMMIT_SHA=\"$(\n docker exec \\\n -u \"${GIT_UID}:${GIT_GID}\" \\\n -e COMMAND_ID=\"$COMMAND_ID\" \\\n -e PUBLISHED_AT=\"$PUBLISHED_AT\" \\\n -e WORK_CONTAINER=\"$WORK_CONTAINER\" \\\n gitea sh -lc '\nset -eu\n\nBARE=\"/data/git/repositories/homelab-admin/homelab-public-context.git\"\nSTAGE=\"/data/gitea/runtime-stage\"\nWORK=\"$WORK_CONTAINER\"\n\nrm -rf \"$WORK\"\n\ngit clone --quiet \"$BARE\" \"$WORK\"\n\ncd \"$WORK\"\n\ngit config user.name \"homelab-runtime-publisher\"\ngit config user.email \"homelab-runtime@localhost\"\n\nif git show-ref \\\n --verify \\\n --quiet \\\n refs/remotes/origin/assistant-runtime\nthen\n git checkout \\\n --quiet \\\n -B assistant-runtime \\\n origin/assistant-runtime\nelse\n git checkout \\\n --quiet \\\n --orphan assistant-runtime\n\n git rm -rf . >/dev/null 2>&1 || true\nfi\n\nmkdir -p runtime/history\n\ncp \"$STAGE/latest.json\" runtime/latest.json\ncp \"$STAGE/latest.txt\" runtime/latest.txt\ncp \"$STAGE/latest.json\" \"runtime/history/${COMMAND_ID}.json\"\ncp \"$STAGE/latest.txt\" \"runtime/history/${COMMAND_ID}.txt\"\ncp \"$STAGE/README.md\" README.md\n\ngit add \\\n README.md \\\n runtime/latest.json \\\n runtime/latest.txt \\\n \"runtime/history/${COMMAND_ID}.json\"\n\ngit add \"runtime/history/${COMMAND_ID}.txt\"\n\nif ! git diff --cached --quiet\nthen\n GIT_AUTHOR_DATE=\"$PUBLISHED_AT\" \\\n GIT_COMMITTER_DATE=\"$PUBLISHED_AT\" \\\n git commit \\\n --quiet \\\n -m \"runtime: publish ${COMMAND_ID}\"\nfi\n\nCOMMIT=\"$(git rev-parse HEAD)\"\n\ngit --git-dir=\"$BARE\" \\\n fetch \\\n --quiet \\\n \"$WORK\" \\\n refs/heads/assistant-runtime\n\nOLD=\"$(\n git --git-dir=\"$BARE\" \\\n rev-parse refs/heads/assistant-runtime \\\n 2>/dev/null ||\n true\n)\"\n\nif [ -n \"$OLD\" ]\nthen\n git --git-dir=\"$BARE\" \\\n update-ref \\\n refs/heads/assistant-runtime \\\n \"$COMMIT\" \\\n \"$OLD\"\nelse\n git --git-dir=\"$BARE\" \\\n update-ref \\\n refs/heads/assistant-runtime \\\n \"$COMMIT\"\nfi\n\nrm -rf \"$WORK\"\n\nprintf \"%s\\n\" \"$COMMIT\"\n'\n)\"\n\nJSON_TMP=\"$(mktemp \"${PUBLIC_DIR}/.latest.json.XXXXXX\")\"\nTXT_TMP=\"$(mktemp \"${PUBLIC_DIR}/.latest.txt.XXXXXX\")\"\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 7df71a8..3f092b7 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,5 +1,5 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=RUNTIME-RECEIVER-FULL-023 +COMMAND_ID=RUNTIME-RECEIVER-BLOCK-024 STATUS=OK RC=0 HOST=pve01 @@ -9,160 +9,16 @@ REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=f6f7749fda946015116cdbbd754c7e7f20356b4a6cf4df330a1b0b8fdf59cbb2 ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc -COMMAND_SHA256=d17752c0235202b5d9f1822d70680ea57dd4578bde6bbc906c7569c0d0463bb0 +COMMAND_SHA256=03de81eb7223c7f9d0a547ee58a3bc445df4b6aaa0e96535274791c8e6a2f588 DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGES_MADE=false SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=2c183b9ced4334e5ff12c1ba35dceb1f7f6ef113298d44bf3fb80ca07305b8b3 -SANITIZED_OUTPUT_SHA256=cd4ccc98c3b9dff7bd1f5557b41fb60d073f889a31f3fd7d86900eecbe15dff4 +RAW_EVIDENCE_SHA256=bd6112182f1e657fe1f32a60b9224edd91f45d6c4fc41b0637caaaf3686aefde +SANITIZED_OUTPUT_SHA256=bd6112182f1e657fe1f32a60b9224edd91f45d6c4fc41b0637caaaf3686aefde OUTPUT_BEGIN -#!/usr/bin/env bash -set -Eeuo pipefail -umask 027 - -HOST_DATA='/opt/stacks/gitea/data' -BARE_CONTAINER='/data/git/repositories/homelab-admin/homelab-public-context.git' - -PUBLIC_DIR="${HOST_DATA}/gitea/public/.well-known/homelab-runtime" -STAGE_DIR="${HOST_DATA}/gitea/runtime-stage" -WORK_ROOT="${HOST_DATA}/gitea/runtime-work" - -LOCK='/run/lock/homelab-runtime-receive.lock' - -[ "$#" -eq 3 ] || { - echo 'RESULT=FAIL' - echo 'REASON=USAGE' - exit 64 -} - -COMMAND_ID="$1" -JSON_FILE="$2" -TXT_FILE="$3" - -case "$COMMAND_ID" in - ''|*[!A-Za-z0-9._-]*) - echo 'RESULT=FAIL' - echo 'REASON=INVALID_COMMAND_ID' - exit 65 - ;; -esac - -[ -f "$JSON_FILE" ] || { - echo 'RESULT=FAIL' - echo 'REASON=JSON_FILE_MISSING' - exit 66 -} - -[ -f "$TXT_FILE" ] || { - echo 'RESULT=FAIL' - echo 'REASON=TXT_FILE_MISSING' - exit 67 -} - -exec 9>"$LOCK" -flock -w 60 9 || { - echo 'RESULT=FAIL' - echo 'REASON=RECEIVER_LOCK_TIMEOUT' - exit 68 -} - -python3 - "$JSON_FILE" "$TXT_FILE" "$COMMAND_ID" <<'PY' -import json -import re -import sys -from pathlib import Path - -json_path = Path(sys.argv[1]) -text_path = Path(sys.argv[2]) -expected_id = sys.argv[3] - -if json_path.stat().st_size > 524_288: - raise SystemExit("JSON_TOO_LARGE") - -if text_path.stat().st_size > 1_048_576: - raise SystemExit("TEXT_TOO_LARGE") - -json_text = json_path.read_text(encoding="utf-8") -text = text_path.read_text(encoding="utf-8") - -data = json.loads(json_text) - -if data.get("command_id") != expected_id: - raise SystemExit("COMMAND_ID_MISMATCH") - -if data.get("sanitized") is not True: - raise SystemExit("SANITIZED_FLAG_REQUIRED") - -if data.get("secrets_included") is not False: - raise SystemExit("SECRETS_FLAG_INVALID") - -if data.get("private_addresses_included") is not False: - raise SystemExit("PRIVATE_ADDRESS_FLAG_INVALID") - -combined = json_text + "\n" + text - -patterns = [ - r"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----", - r"(?i)(password|passwd|passphrase|authorization|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key)\s*[:=]\s*\S+", - r"(?i)/root/\.ssh", - r"(?i)[SENSITIVE_PATH]", - r"(?i)rclone\.conf", - r"\b10(?:\.\d{1,3}){3}\b", - r"\b192\.168(?:\.\d{1,3}){2}\b", - r"\b172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}\b", -] - -for pattern in patterns: - if re.search(pattern, combined): - raise SystemExit("FORBIDDEN_PUBLIC_CONTENT") - -print("PAYLOAD_VALIDATION=OK") -PY - -GIT_UID="$(docker exec gitea id -u git)" -GIT_GID="$(docker exec gitea id -g git)" - -mkdir -p \ - "$PUBLIC_DIR" \ - "$STAGE_DIR" \ - "$WORK_ROOT" - -chown "$GIT_UID:$GIT_GID" \ - "$STAGE_DIR" \ - "$WORK_ROOT" - -install \ - -o "$GIT_UID" \ - -g "$GIT_GID" \ - -m 0644 \ - "$JSON_FILE" \ - "$STAGE_DIR/latest.json" - -install \ - -o "$GIT_UID" \ - -g "$GIT_GID" \ - -m 0644 \ - "$TXT_FILE" \ - "$STAGE_DIR/latest.txt" - -cat > "$STAGE_DIR/README.md" <<'DOC' -# Homelab assistant runtime - -Sanitized command results for read-only assistant inspection. - -Credentials, authentication data, private keys, private IP addresses and -unfiltered configuration files are prohibited. -DOC - -chown "$GIT_UID:$GIT_GID" "$STAGE_DIR/README.md" -chmod 0644 "$STAGE_DIR/README.md" - -PUBLISHED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)" -WORK_CONTAINER="/data/gitea/runtime-work/${COMMAND_ID}.$$" - COMMIT_SHA="$( docker exec \ -u "${GIT_UID}:${GIT_GID}" \ @@ -264,59 +120,6 @@ printf "%s\n" "$COMMIT" JSON_TMP="$(mktemp "${PUBLIC_DIR}/.latest.json.XXXXXX")" TXT_TMP="$(mktemp "${PUBLIC_DIR}/.latest.txt.XXXXXX")" -INDEX_TMP="$(mktemp "${PUBLIC_DIR}/.index.json.XXXXXX")" - -install -m 0644 "$JSON_FILE" "$JSON_TMP" -install -m 0644 "$TXT_FILE" "$TXT_TMP" - -python3 - \ - "$COMMAND_ID" \ - "$PUBLISHED_AT" \ - "$COMMIT_SHA" >"$INDEX_TMP" <<'PY' -import json -import sys - -command_id, published_at, commit_sha = sys.argv[1:4] - -print(json.dumps({ - "schema_version": 1, - "channel": "homelab-runtime", - "branch": "assistant-runtime", - "latest_command_id": command_id, - "published_at_utc": published_at, - "commit_sha": commit_sha, - "latest_json_url": ( - "https://git.gram1.ru/.well-known/" - "homelab-runtime/latest.json" - ), - "latest_text_url": ( - "https://git.gram1.ru/.well-known/" - "homelab-runtime/latest.txt" - ) -}, ensure_ascii=False, indent=2)) -PY - -chmod 0644 "$INDEX_TMP" - -mv -f "$JSON_TMP" "$PUBLIC_DIR/latest.json" -mv -f "$TXT_TMP" "$PUBLIC_DIR/latest.txt" -mv -f "$INDEX_TMP" "$PUBLIC_DIR/index.json" - -curl -fsS \ - --max-time 10 \ - http://127.0.0.1:3002/.well-known/homelab-runtime/latest.json | -grep -F "$COMMAND_ID" >/dev/null - -curl -fsS \ - --max-time 10 \ - "http://127.0.0.1:3002/homelab-admin/homelab-public-context/raw/branch/assistant-runtime/runtime/latest.json" | -grep -F "$COMMAND_ID" >/dev/null - -echo 'RESULT=OK' -echo "COMMAND_ID=$COMMAND_ID" -echo "COMMIT_SHA=$COMMIT_SHA" -echo 'STATIC_PUBLICATION=OK' -echo 'RAW_BRANCH_PUBLICATION=OK' OUTPUT_END CHAT_OUTPUT_END