From 0fd47f7ebf5da8588d62b9f81b336b5267e3430d Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 09:16:32 +0100 Subject: [PATCH] Keep PBS guidance checks credential-safe and TLS-bounded Completed PR 2362 CI still required the retired credential-bearing PBS bootstrap command, and CodeQL reported an implicit TLS protocol floor in its local fixture. Assert the accepted read-only and private-file guidance instead, forbid the unsafe forms, and explicitly require TLS 1.2 or later in the fixture. No product or permission changes. Contract-Neutral: Documentation regression assertions and local TLS test fixture only; runtime and public contracts unchanged. Change-source: pulse-maintainer --- internal/repoctl/setup_bootstrap_docs_test.go | 18 +++++++++++++++--- scripts/tests/test_pbs_docs.py | 1 + 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/internal/repoctl/setup_bootstrap_docs_test.go b/internal/repoctl/setup_bootstrap_docs_test.go index 0fd5e04b63..2bba957374 100644 --- a/internal/repoctl/setup_bootstrap_docs_test.go +++ b/internal/repoctl/setup_bootstrap_docs_test.go @@ -17,10 +17,22 @@ func TestSetupBootstrapDocsStayOnCanonicalArtifactContract(t *testing.T) { pbsRel := "docs/PBS.md" pbsDoc := readRepoFile(t, pbsRel) assertContainsAll(t, pbsRel, pbsDoc, []string{ - `curl -fsSL "http://:7655/api/setup-script?type=pbs&host=https://:8007&pulse_url=http://:7655" | { if [ "$(id -u)" -eq 0 ]; then PULSE_SETUP_TOKEN="" bash; elif command -v sudo >/dev/null 2>&1; then sudo env PULSE_SETUP_TOKEN="" bash; else echo "Root privileges required. Run as root (su -) and retry." >&2; exit 1; fi; }`, - "Pulse generates that full command for you from **Settings → Infrastructure**", + "### Method 1: API-Only Connection (Recommended)", + "proxmox-backup-manager acl update / Audit --auth-id pulse-monitor@pbs", + "proxmox-backup-manager acl update / Audit --auth-id 'pulse-monitor@pbs!pulse-token'", + `chmod 600 "$HOME/.config/pulse/pbs-agent-token"`, + `--output "$HOME/.config/pulse/pbs-agent-install.sh"`, + "https://pulse.example.com/install.sh", + `--token-file "$HOME/.config/pulse/pbs-agent-token"`, + "Stop if the download fails", + "Do not bypass certificate checks", }) assertContainsNone(t, pbsRel, pbsDoc, []string{ - `curl -sSL "http://:7655/api/setup-script?type=pbs&host=https://:8007&pulse_url=http://:7655" | bash`, + "PULSE_SETUP_TOKEN=", + "sudo env PULSE_SETUP_TOKEN=", + "curl -k", + "--insecure", + `--token "`, + "| bash", }) } diff --git a/scripts/tests/test_pbs_docs.py b/scripts/tests/test_pbs_docs.py index fc19a7c2fd..d84be0c363 100644 --- a/scripts/tests/test_pbs_docs.py +++ b/scripts/tests/test_pbs_docs.py @@ -79,6 +79,7 @@ def server(cert, key, status=200, installer=None, installer_path="/install.sh"): http = HTTPServer(("127.0.0.1", 0), Handler) context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) + context.minimum_version = ssl.TLSVersion.TLSv1_2 context.load_cert_chain(str(cert), str(key)) http.socket = context.wrap_socket(http.socket, server_side=True) thread = threading.Thread(target=http.serve_forever, daemon=True)