From ff3d05be49a3b067637107f83298066745dc5a1e Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 09:09:01 +0100 Subject: [PATCH 1/3] Set an explicit TLS floor for the synthetic PBS guide server CodeQL on PRs 2361 and 2362 flags the fixture's implicit protocol floor. Require TLS 1.2 explicitly and test that same context; retain trusted, untrusted and wrong-host certificate controls without changing product TLS or documentation. Contract-Neutral: Synthetic TLS test fixture only; no runtime or subsystem contract delta. Change-source: pulse-maintainer --- scripts/tests/test_pbs_docs.py | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/scripts/tests/test_pbs_docs.py b/scripts/tests/test_pbs_docs.py index fc19a7c2fd..d13c26dab5 100644 --- a/scripts/tests/test_pbs_docs.py +++ b/scripts/tests/test_pbs_docs.py @@ -62,6 +62,13 @@ def certificate(directory, name): return certificate, key +def server_context(cert, key): + context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) + context.minimum_version = ssl.TLSVersion.TLSv1_2 + context.load_cert_chain(str(cert), str(key)) + return context + + @contextmanager def server(cert, key, status=200, installer=None, installer_path="/install.sh"): requests = [] @@ -78,8 +85,7 @@ def server(cert, key, status=200, installer=None, installer_path="/install.sh"): pass http = HTTPServer(("127.0.0.1", 0), Handler) - context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) - context.load_cert_chain(str(cert), str(key)) + context = server_context(cert, key) http.socket = context.wrap_socket(http.socket, server_side=True) thread = threading.Thread(target=http.serve_forever, daemon=True) thread.start() @@ -102,6 +108,10 @@ class PBSDocsTest(unittest.TestCase): def tearDownClass(cls): cls.temporary.cleanup() + def test_tls_fixture_explicitly_rejects_legacy_protocols(self): + self.assertEqual(server_context(self.cert, self.key).minimum_version, + ssl.TLSVersion.TLSv1_2) + def test_shipped_copy_and_safe_scope(self): self.assertEqual(DOC.read_bytes(), (ROOT / "frontend-modern/public/docs/PBS.md").read_bytes()) text = DOC.read_text() From 2a8134035846a3bb3e0097a921a0f068edee1394 Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 09:35:38 +0100 Subject: [PATCH 2/3] Bind PBS bootstrap checks to the credential-safe guide PR2361 run 36829483740 requires the retired inline-token HTTP pipe, rejecting the already reviewed guide. Require private directories/token files, inspected HTTPS downloads, the agent profile and TLS checks instead; explicitly forbid inline setup tokens and insecure transport. Existing API bootstrap contract checks remain intact. Contract-Neutral: Documentation regression assertions only; no installer, API or runtime contract change. Change-source: pulse-maintainer --- internal/repoctl/setup_bootstrap_docs_test.go | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/internal/repoctl/setup_bootstrap_docs_test.go b/internal/repoctl/setup_bootstrap_docs_test.go index 0fd5e04b63..78e458f941 100644 --- a/internal/repoctl/setup_bootstrap_docs_test.go +++ b/internal/repoctl/setup_bootstrap_docs_test.go @@ -17,10 +17,24 @@ func TestSetupBootstrapDocsStayOnCanonicalArtifactContract(t *testing.T) { pbsRel := "docs/PBS.md" pbsDoc := readRepoFile(t, pbsRel) assertContainsAll(t, pbsRel, pbsDoc, []string{ - `curl -fsSL "http://:7655/api/setup-script?type=pbs&host=https://:8007&pulse_url=http://:7655" | { if [ "$(id -u)" -eq 0 ]; then PULSE_SETUP_TOKEN="" bash; elif command -v sudo >/dev/null 2>&1; then sudo env PULSE_SETUP_TOKEN="" bash; else echo "Root privileges required. Run as root (su -) and retry." >&2; exit 1; fi; }`, - "Pulse generates that full command for you from **Settings → Infrastructure**", + "Create a separate Pulse token in **API Access**", + "enter an administrator root shell", + `chmod 700 "$HOME/.config/pulse"`, + `chmod 600 "$HOME/.config/pulse/pbs-agent-token"`, + `vi "$HOME/.config/pulse/pbs-agent-token"`, + `curl --fail --silent --show-error`, + `--output "$HOME/.config/pulse/pbs-agent-install.sh"`, + `https://pulse.example.com/install.sh`, + "successful download and inspection", + `bash "$HOME/.config/pulse/pbs-agent-install.sh"`, + `--token-file "$HOME/.config/pulse/pbs-agent-token"`, + `--enable-proxmox --proxmox-type pbs --enable-docker=false`, + "Do not bypass certificate checks", }) assertContainsNone(t, pbsRel, pbsDoc, []string{ `curl -sSL "http://:7655/api/setup-script?type=pbs&host=https://:8007&pulse_url=http://:7655" | bash`, + `PULSE_SETUP_TOKEN=`, + `sudo env PULSE_SETUP_TOKEN=`, + `--insecure`, }) } From 0955ddf9e0b48b9571771c04a27aa354db796055 Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 10:02:52 +0100 Subject: [PATCH 3/3] Check PBS shell examples without rejecting TLS safety warnings The exact-source validation found that the safety warning names the forbidden curl option. Scope the negative checks to fenced shell examples, while retaining certificate, private-token and canonical-installer assertions. Contract-Neutral: Documentation regression assertions only; no installer, API or runtime contract change. Change-source: pulse-maintainer --- internal/repoctl/setup_bootstrap_docs_test.go | 34 +++++++++++++++++-- 1 file changed, 32 insertions(+), 2 deletions(-) diff --git a/internal/repoctl/setup_bootstrap_docs_test.go b/internal/repoctl/setup_bootstrap_docs_test.go index 78e458f941..0f7ba066f5 100644 --- a/internal/repoctl/setup_bootstrap_docs_test.go +++ b/internal/repoctl/setup_bootstrap_docs_test.go @@ -1,6 +1,31 @@ package repoctl -import "testing" +import ( + "strings" + "testing" +) + +func pbsShellExamples(document string) string { + var examples []string + blocks := strings.Split(document, "```") + for i := 1; i < len(blocks); i += 2 { + language, body, _ := strings.Cut(blocks[i], "\n") + switch strings.TrimSpace(language) { + case "bash", "sh", "shell": + examples = append(examples, body) + } + } + return strings.Join(examples, "\n") +} + +func TestPBSShellExamplesKeepWarningsSeparateFromCommands(t *testing.T) { + document := "Do not use `--insecure` or `-k`.\n```bash\ncurl --fail https://pbs.example.com\n```\n" + + "```sh\ncurl --insecure https://pbs.example.com\n```\n" + examples := pbsShellExamples(document) + if examples != "curl --fail https://pbs.example.com\n\ncurl --insecure https://pbs.example.com\n" { + t.Fatalf("unexpected shell examples: %q", examples) + } +} func TestSetupBootstrapDocsStayOnCanonicalArtifactContract(t *testing.T) { apiRel := "docs/API.md" @@ -31,10 +56,15 @@ func TestSetupBootstrapDocsStayOnCanonicalArtifactContract(t *testing.T) { `--enable-proxmox --proxmox-type pbs --enable-docker=false`, "Do not bypass certificate checks", }) - assertContainsNone(t, pbsRel, pbsDoc, []string{ + shellExamples := pbsShellExamples(pbsDoc) + if shellExamples == "" { + t.Fatal("PBS guide must retain executable shell examples") + } + assertContainsNone(t, pbsRel, shellExamples, []string{ `curl -sSL "http://:7655/api/setup-script?type=pbs&host=https://:8007&pulse_url=http://:7655" | bash`, `PULSE_SETUP_TOKEN=`, `sudo env PULSE_SETUP_TOKEN=`, `--insecure`, + ` -k`, }) }