gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-11 14:00:29 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
8e25badea1d13b32ca659aaa9f9727ecf1c32c17
pulse/scripts/installtests/install_sh_test.go
T
courtmanr@gmail.com c3c6b96cbd test(agent): keep QNAP watchdog proof cross-platform (#1617)
2026-07-30 00:54:04 +01:00

5082 lines
168 KiB
Go
Raw Blame History

package installtests
import (
"encoding/json"
"errors"
"io"
"net"
"net/http"
"net/http/httptest"
"os"
"os/exec"
"path/filepath"
"regexp"
"strconv"
"strings"
"sync"
"syscall"
"testing"
"time"
)
func TestContainerAgentCompatibilityWrapperDefaultsToUnifiedHostAndDockerMonitoring(t *testing.T) {
wrapperBytes, err := os.ReadFile(repoFile("scripts", "install-container-agent.sh"))
if err != nil {
t.Fatalf("read container-agent compatibility wrapper: %v", err)
}
wrapper := string(wrapperBytes)
if !strings.Contains(wrapper, `forward_args+=(--enable-docker --enable-host)`) {
t.Fatal("container-agent compatibility wrapper must preserve host telemetry while enabling Docker")
}
if strings.Contains(wrapper, `forward_args+=(--enable-docker --disable-host)`) {
t.Fatal("container-agent compatibility wrapper must not silently force workload-only mode")
}
if !strings.Contains(wrapper, `--enable-host=false for an intentional`) {
t.Fatal("container-agent compatibility wrapper must document the explicit workload-only path")
}
}
func TestInstallSHAllowsMissingTokenForOptionalAuth(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`build_exec_arg_items() {`,
`RUNTIME_TOKEN_FILE=""`,
`EXEC_ARG_ITEMS+=(--token-file "$RUNTIME_TOKEN_FILE")`,
`fail "Internal installer error: runtime token file was not prepared before service rendering." "$EXIT_GENERAL"`,
`build_exec_args_without_token() {`,
`build_exec_arg_items "false"`,
`build_exec_arg_items "true"`,
`if [[ -n "$PULSE_TOKEN" && ! "$PULSE_TOKEN" =~ ^[a-fA-F0-9]+$ ]]; then`,
`if [[ -n "$PULSE_TOKEN" ]]; then`,
`log_info "No API token provided; installer will configure token-optional agent runtime."`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing optional-token handling: %s", needle)
}
}
}
func TestInstallSHPersistsAndVerifiesServerFingerprint(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`SERVER_FINGERPRINT="${PULSE_SERVER_FINGERPRINT:-}"`,
`--server-fingerprint <sha256>`,
`verify_pinned_server_certificate() {`,
`openssl s_client -connect "$target" -servername "$host"`,
`EXEC_ARG_ITEMS+=(--server-fingerprint "$SERVER_FINGERPRINT")`,
`write_connection_state_value "$conn_tmp" "PULSE_SERVER_FINGERPRINT" "$SERVER_FINGERPRINT"`,
`SERVER_FINGERPRINT=$(read_connection_state_value "$file" "PULSE_SERVER_FINGERPRINT")`,
`if [[ "$OS" == "linux" || "$OS" == "freebsd" ]]; then`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing server-fingerprint lifecycle contract: %s", needle)
}
}
}
func TestInstallSHAutoDetectProxmoxKeepsRuntimeTypeUnpinned(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`if detect_proxmox; then`,
`log_info "Proxmox detected - enabling Proxmox integration"`,
`log_info " Proxmox type: auto-detect all installed services"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing unpinned Proxmox auto-detect contract: %s", needle)
}
}
forbidden := []string{
`detect_proxmox_type() {`,
`auto_type="$(detect_proxmox_type || true)"`,
`PROXMOX_TYPE="$auto_type"`,
}
for _, needle := range forbidden {
if strings.Contains(script, needle) {
t.Fatalf("install.sh preserved stale single-type Proxmox auto-detect contract: %s", needle)
}
}
}
func TestInstallSHExplainsCommandExecutionForProxmoxLXCDockerInventory(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`--enable-commands Enable Pulse command execution (disabled by default; required for Patrol actions and Proxmox LXC Docker inventory)`,
`log_info " Pulse command execution: $ENABLE_COMMANDS"`,
`log_info " Accepts Pulse-scoped command requests on this agent."`,
`log_info " On Proxmox nodes this is required for opted-in LXC Docker inventory via pct exec."`,
`log_info " The Pulse server must also be started with PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true."`,
`log_info " Command execution is off; enable only when Patrol actions or Proxmox LXC Docker inventory are needed."`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing command-execution disclosure: %s", needle)
}
}
if strings.Contains(script, "Enable AI command execution") {
t.Fatal("install.sh must not describe --enable-commands as AI command execution")
}
}
func TestInstallSHAcceptsLegacyBooleanFlagValues(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`--enable-host=true) ENABLE_HOST="true"; HOST_EXPLICIT="true"; shift ;;`,
`--enable-host=false) ENABLE_HOST="false"; HOST_EXPLICIT="true"; shift ;;`,
`--enable-docker=true) ENABLE_DOCKER="true"; DOCKER_EXPLICIT="true"; shift ;;`,
`--enable-docker=false) ENABLE_DOCKER="false"; DOCKER_EXPLICIT="true"; shift ;;`,
`--enable-kubernetes=true) ENABLE_KUBERNETES="true"; KUBERNETES_EXPLICIT="true"; shift ;;`,
`--enable-kubernetes=false) ENABLE_KUBERNETES="false"; KUBERNETES_EXPLICIT="true"; shift ;;`,
`--enable-proxmox=true) ENABLE_PROXMOX="true"; PROXMOX_EXPLICIT="true"; shift ;;`,
`--enable-proxmox=false) ENABLE_PROXMOX="false"; PROXMOX_EXPLICIT="true"; shift ;;`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing legacy boolean flag alias: %s", needle)
}
}
}
func TestInstallSHAgentDownloadIsServerVersionAware(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`"${PULSE_URL}/api/version"`,
`SERVER_VERSION="$(printf '%s' "$server_version_json" | sed -n 's/.*"version"`,
`DOWNLOAD_QUERY="${DOWNLOAD_QUERY}&serverVersion=${SERVER_VERSION}"`,
`log_info "Pulse server version: ${SERVER_VERSION}"`,
`NEW_VERSION_NORMALIZED="${NEW_VERSION#v}"`,
`SERVER_VERSION_NORMALIZED="${SERVER_VERSION#v}"`,
`"$NEW_VERSION_NORMALIZED" != "$SERVER_VERSION_NORMALIZED"`,
`Downloaded agent version (${NEW_VERSION}) does not match Pulse server version (${SERVER_VERSION})`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing version-aware agent download behavior: %s", needle)
}
}
}
// Regression test for #1527: the agent binary reports its version as "v6.0.4"
// while the server /api/version reports "6.0.4", so the mismatch check must
// strip a leading "v" before comparing and only warn on a genuine difference.
func TestInstallSHAgentVersionMismatchIgnoresVPrefix(t *testing.T) {
harness := `
set -euo pipefail
log_warn() { echo "WARN:$*"; }
SERVER_VERSION="$1"
NEW_VERSION="$2"
NEW_VERSION_NORMALIZED="${NEW_VERSION#v}"
SERVER_VERSION_NORMALIZED="${SERVER_VERSION#v}"
if [[ -n "$SERVER_VERSION" && -n "$NEW_VERSION" && "$NEW_VERSION" != "unknown" && "$NEW_VERSION_NORMALIZED" != "$SERVER_VERSION_NORMALIZED" ]]; then
log_warn "Downloaded agent version (${NEW_VERSION}) does not match Pulse server version (${SERVER_VERSION})."
fi
echo DONE
`
run := func(server, agent string) string {
out, err := exec.Command("bash", "-c", harness, "_", server, agent).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
return string(out)
}
if got := run("6.0.4", "v6.0.4"); strings.Contains(got, "WARN:") {
t.Fatalf("equal versions differing only by a leading v warned:\n%s", got)
}
if got := run("6.0.4", "6.0.4"); strings.Contains(got, "WARN:") {
t.Fatalf("identical versions warned:\n%s", got)
}
if got := run("6.0.4", "v6.0.3"); !strings.Contains(got, "WARN:") {
t.Fatalf("genuine version mismatch did not warn:\n%s", got)
}
}
func TestInstallSHAgentServiceSecurityDefaults(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`HEALTH_ADDR="${PULSE_HEALTH_ADDR:-}"`,
`if [[ -n "${PULSE_HEALTH_ADDR+x}" ]]; then`,
`--health-addr <addr> Health/metrics listener address (default: 127.0.0.1:9191; use "" to disable)`,
`if [[ "$HEALTH_ADDR_SET" == "true" ]]; then EXEC_ARG_ITEMS+=(--health-addr "$HEALTH_ADDR"); fi`,
`--health-addr) HEALTH_ADDR="$2"; HEALTH_ADDR_SET="true"; shift 2 ;;`,
`UMask=0077`,
`local no_new_privileges="true"`,
`NoNewPrivileges=${no_new_privileges}`,
`PrivateTmp=true`,
`ProtectKernelTunables=true`,
`ProtectKernelModules=true`,
`ProtectControlGroups=true`,
`LockPersonality=true`,
`local restrict_suidsgid="true"`,
`RestrictSUIDSGID=${restrict_suidsgid}`,
`SystemCallArchitectures=native`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing agent service security default: %s", needle)
}
}
}
func TestInstallSHAllowsProxmoxCommandAgentLXCAttach(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`systemd_agent_requires_lxc_attach() {`,
`if [[ "$ENABLE_COMMANDS" != "true" || "$ENABLE_PROXMOX" != "true" ]]; then`,
`""|pve|all)`,
`no_new_privileges="false"`,
`restrict_suidsgid="false"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing Proxmox command-agent LXC attach service handling: %s", needle)
}
}
}
func TestInstallSHPreflightChecksAgentDownloadArtifact(t *testing.T) {
var requestedDownloadPath string
var requestedDownloadArch string
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
switch r.URL.Path {
case "/api/health":
w.WriteHeader(http.StatusOK)
case "/download/pulse-agent":
requestedDownloadPath = r.URL.Path
requestedDownloadArch = r.URL.Query().Get("arch")
w.Header().Set("X-Checksum-Sha256", strings.Repeat("a", 64))
w.WriteHeader(http.StatusOK)
default:
http.NotFound(w, r)
}
}))
defer server.Close()
cmd := exec.Command(
"bash",
repoFile("scripts", "install.sh"),
"--url",
server.URL,
"--preflight-only",
"--output",
"json",
"--non-interactive",
)
out, err := cmd.CombinedOutput()
if err != nil {
t.Fatalf("preflight failed: %v\n%s", err, out)
}
got := string(out)
if !strings.Contains(got, `"code":"agent_download_available"`) {
t.Fatalf("preflight did not report agent download availability:\n%s", got)
}
if requestedDownloadPath != "/download/pulse-agent" {
t.Fatalf("download path = %q, want /download/pulse-agent", requestedDownloadPath)
}
if requestedDownloadArch == "" {
t.Fatalf("download arch query was empty")
}
}
func TestInstallSHPreflightDoesNotRequireRoot(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`if [[ $EUID -ne 0 && "$PREFLIGHT_ONLY" != "true" ]]; then`,
`DOWNLOAD_CHECK_URL="${PULSE_URL}/download/${BINARY_NAME}?arch=${PF_ARCH_PARAM}"`,
`CURL_DOWNLOAD_CHECK_ARGS=(-fsSI --connect-timeout 5 --max-time 30 -D "$PREFLIGHT_HEADERS" -o /dev/null)`,
`grep -i '^X-Checksum-Sha256:' "$PREFLIGHT_HEADERS"`,
`"agent_download_available"`,
`"agent_download_unavailable"`,
`"agent_download_checksum_missing"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing non-root preflight download check: %s", needle)
}
}
}
func TestBuildPlistProgramArgumentsUsesSharedExecArgs(t *testing.T) {
script := `
` + extractInstallShellFunction(t, "build_exec_arg_items") + `
` + extractInstallShellFunction(t, "xml_escape") + `
` + extractInstallShellFunction(t, "append_plist_arg") + `
` + extractInstallShellFunction(t, "build_plist_program_arguments") + `
PULSE_URL="https://pulse.example/a&b"
PULSE_TOKEN="deadbeef"
INTERVAL="30s"
ENABLE_HOST="true"
ENABLE_DOCKER="false"
DOCKER_EXPLICIT="true"
ENABLE_KUBERNETES="true"
KUBECONFIG_PATH="/etc/kube config"
ENABLE_PROXMOX="true"
PROXMOX_TYPE="pbs"
INSECURE="true"
RUNTIME_TOKEN_FILE="/var/lib/pulse-agent/token"
ENABLE_COMMANDS="true"
HEALTH_ADDR_SET="true"
HEALTH_ADDR=""
ENROLL="true"
KUBE_INCLUDE_ALL_PODS="true"
KUBE_INCLUDE_ALL_DEPLOYMENTS="true"
AGENT_ID="agent-1"
HOSTNAME_OVERRIDE="Richard's Mac & Mini"
STATE_DIR="/var/lib/pulse-agent"
DISK_EXCLUDES=("Time Machine")
build_plist_program_arguments "/usr/local/bin/pulse-agent"
printf '%s\n' "$PLIST_ARGS"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
required := []string{
`<string>/usr/local/bin/pulse-agent</string>`,
`<string>https://pulse.example/a&amp;b</string>`,
`<string>--token-file</string>`,
`<string>/var/lib/pulse-agent/token</string>`,
`<string>--enable-docker=false</string>`,
`<string>--enable-proxmox</string>`,
`<string>--proxmox-type</string>`,
`<string>pbs</string>`,
`<string>--health-addr</string>`,
`<string>--hostname</string>`,
`<string>Richard's Mac &amp; Mini</string>`,
`<string>--state-dir</string>`,
`<string>/var/lib/pulse-agent</string>`,
`<string>--disk-exclude</string>`,
`<string>Time Machine</string>`,
}
for _, needle := range required {
if !strings.Contains(got, needle) {
t.Fatalf("plist args missing %s:\n%s", needle, got)
}
}
if strings.Contains(got, "--token</string>") || strings.Contains(got, "deadbeef") {
t.Fatalf("plist args leaked raw token:\n%s", got)
}
}
// TestConnectionEnvRecovery verifies the canonical helper logic that parses
// connection.env without using shell source (to prevent injection).
func TestConnectionEnvRecovery(t *testing.T) {
cases := []struct {
name string
content string
wantURL string
wantTok string
wantID string
wantHost string
wantInsecure string
wantCACert string
}{
{
name: "single-quoted values",
content: "PULSE_URL='http://192.168.0.98:7655'\nPULSE_TOKEN='abc123def'\nPULSE_AGENT_ID='agent-123'\nPULSE_HOSTNAME='node.local'\nPULSE_INSECURE_SKIP_VERIFY='true'\nPULSE_CACERT='/etc/pulse/ca.pem'\n",
wantURL: "http://192.168.0.98:7655",
wantTok: "abc123def",
wantID: "agent-123",
wantHost: "node.local",
wantInsecure: "true",
wantCACert: "/etc/pulse/ca.pem",
},
{
name: "unquoted values",
content: "PULSE_URL=http://10.0.0.1:7655\nPULSE_TOKEN=deadbeef\nPULSE_AGENT_ID=agent-456\nPULSE_HOSTNAME=node-two.local\nPULSE_INSECURE_SKIP_VERIFY=true\nPULSE_CACERT=/opt/pulse/ca.pem\n",
wantURL: "http://10.0.0.1:7655",
wantTok: "deadbeef",
wantID: "agent-456",
wantHost: "node-two.local",
wantInsecure: "true",
wantCACert: "/opt/pulse/ca.pem",
},
{
name: "https URL",
content: "PULSE_URL='https://pulse.example.com'\nPULSE_TOKEN='aabbccdd'\nPULSE_AGENT_ID='agent-https'\nPULSE_HOSTNAME='https-host'\nPULSE_INSECURE_SKIP_VERIFY='false'\nPULSE_CACERT='/usr/local/share/ca.pem'\n",
wantURL: "https://pulse.example.com",
wantTok: "aabbccdd",
wantID: "agent-https",
wantHost: "https-host",
wantInsecure: "false",
wantCACert: "/usr/local/share/ca.pem",
},
{
name: "extra whitespace lines",
content: "\nPULSE_URL='http://host:7655'\n\nPULSE_TOKEN='tok123'\n\nPULSE_AGENT_ID='agent-spaced'\nPULSE_HOSTNAME='spaced.local'\n\nPULSE_INSECURE_SKIP_VERIFY='true'\n\nPULSE_CACERT='/tmp/ca.pem'\n\n",
wantURL: "http://host:7655",
wantTok: "tok123",
wantID: "agent-spaced",
wantHost: "spaced.local",
wantInsecure: "true",
wantCACert: "/tmp/ca.pem",
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
dir := t.TempDir()
connFile := filepath.Join(dir, "connection.env")
if err := os.WriteFile(connFile, []byte(tc.content), 0600); err != nil {
t.Fatal(err)
}
// Run the same helper logic used by install.sh
script := `
CONN_ENV="` + connFile + `"
read_connection_state_value() {
local file="$1"
local key="$2"
awk -F= -v key="$key" '
$1 == key {
value = substr($0, index($0, "=") + 1)
sub(/^'\''/, "", value)
sub(/'\''$/, "", value)
print value
exit
}
' "$file" 2>/dev/null || true
}
PULSE_URL=$(read_connection_state_value "$CONN_ENV" "PULSE_URL")
PULSE_TOKEN=$(read_connection_state_value "$CONN_ENV" "PULSE_TOKEN")
PULSE_AGENT_ID=$(read_connection_state_value "$CONN_ENV" "PULSE_AGENT_ID")
PULSE_HOSTNAME=$(read_connection_state_value "$CONN_ENV" "PULSE_HOSTNAME")
PULSE_INSECURE_SKIP_VERIFY=$(read_connection_state_value "$CONN_ENV" "PULSE_INSECURE_SKIP_VERIFY")
PULSE_CACERT=$(read_connection_state_value "$CONN_ENV" "PULSE_CACERT")
echo "URL=${PULSE_URL}"
echo "TOKEN=${PULSE_TOKEN}"
echo "AGENT_ID=${PULSE_AGENT_ID}"
echo "HOSTNAME=${PULSE_HOSTNAME}"
echo "INSECURE=${PULSE_INSECURE_SKIP_VERIFY}"
echo "CACERT=${PULSE_CACERT}"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
lines := strings.Split(strings.TrimSpace(string(out)), "\n")
gotURL, gotTok, gotID, gotHost, gotInsecure, gotCACert := "", "", "", "", "", ""
for _, line := range lines {
if strings.HasPrefix(line, "URL=") {
gotURL = strings.TrimPrefix(line, "URL=")
}
if strings.HasPrefix(line, "TOKEN=") {
gotTok = strings.TrimPrefix(line, "TOKEN=")
}
if strings.HasPrefix(line, "AGENT_ID=") {
gotID = strings.TrimPrefix(line, "AGENT_ID=")
}
if strings.HasPrefix(line, "HOSTNAME=") {
gotHost = strings.TrimPrefix(line, "HOSTNAME=")
}
if strings.HasPrefix(line, "INSECURE=") {
gotInsecure = strings.TrimPrefix(line, "INSECURE=")
}
if strings.HasPrefix(line, "CACERT=") {
gotCACert = strings.TrimPrefix(line, "CACERT=")
}
}
if gotURL != tc.wantURL {
t.Errorf("URL = %q, want %q", gotURL, tc.wantURL)
}
if gotTok != tc.wantTok {
t.Errorf("TOKEN = %q, want %q", gotTok, tc.wantTok)
}
if gotID != tc.wantID {
t.Errorf("AGENT_ID = %q, want %q", gotID, tc.wantID)
}
if gotHost != tc.wantHost {
t.Errorf("HOSTNAME = %q, want %q", gotHost, tc.wantHost)
}
if gotInsecure != tc.wantInsecure {
t.Errorf("INSECURE = %q, want %q", gotInsecure, tc.wantInsecure)
}
if gotCACert != tc.wantCACert {
t.Errorf("CACERT = %q, want %q", gotCACert, tc.wantCACert)
}
})
}
}
// TestAgentIDFileRecovery verifies the agent-id file lookup priority:
// /var/lib/pulse-agent/agent-id > /boot/config/plugins/pulse-agent/agent-id
func TestAgentIDFileRecovery(t *testing.T) {
cases := []struct {
name string
files map[string]string // relative path -> content
wantID string
}{
{
name: "primary location",
files: map[string]string{
"var/lib/pulse-agent/agent-id": "uuid-primary",
},
wantID: "uuid-primary",
},
{
name: "secondary location (Unraid)",
files: map[string]string{
"boot/config/plugins/pulse-agent/agent-id": "uuid-unraid",
},
wantID: "uuid-unraid",
},
{
name: "primary takes precedence",
files: map[string]string{
"var/lib/pulse-agent/agent-id": "uuid-primary",
"boot/config/plugins/pulse-agent/agent-id": "uuid-unraid",
},
wantID: "uuid-primary",
},
{
name: "no file found",
files: map[string]string{},
wantID: "",
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
root := t.TempDir()
for relPath, content := range tc.files {
fullPath := filepath.Join(root, relPath)
if err := os.MkdirAll(filepath.Dir(fullPath), 0755); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(fullPath, []byte(content), 0644); err != nil {
t.Fatal(err)
}
}
// Replicate the install.sh agent-id recovery loop
script := `
AGENT_ID=""
for aid_path in "` + root + `/var/lib/pulse-agent/agent-id" "` + root + `/boot/config/plugins/pulse-agent/agent-id"; do
if [[ -f "$aid_path" ]]; then
AGENT_ID=$(cat "$aid_path")
break
fi
done
echo "$AGENT_ID"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
if got != tc.wantID {
t.Errorf("agent-id = %q, want %q", got, tc.wantID)
}
})
}
}
func TestInstallSHUsesHostnameOverrideForUninstallLookup(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`LOOKUP_HOSTNAME="$HOSTNAME_OVERRIDE"`,
`if [[ -z "$LOOKUP_HOSTNAME" ]]; then`,
`LOOKUP_HOSTNAME=$(hostname 2>/dev/null || true)`,
`LOOKUP_HOSTNAME_ESCAPED=$(url_encode "$LOOKUP_HOSTNAME")`,
`"${PULSE_URL}/api/agents/agent/lookup?hostname=${LOOKUP_HOSTNAME_ESCAPED}"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing uninstall hostname override lookup handling: %s", needle)
}
}
}
func TestInstallSHUrlEncodesHostnameLookupQuery(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`url_encode() {`,
`printf -v encoded '%%%02X' "'$c"`,
`LOOKUP_HOSTNAME_ESCAPED=$(url_encode "$LOOKUP_HOSTNAME")`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing encoded hostname lookup transport: %s", needle)
}
}
}
func TestInstallSHPersistsIdentityInConnectionEnv(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`write_connection_state_value() {`,
`read_connection_state_value() {`,
`recover_connection_state() {`,
`find_connection_state_file() {`,
`write_connection_state_value "$conn_tmp" "PULSE_STATE_DIR" "$state_dir"`,
`write_connection_state_value "$conn_tmp" "PULSE_TOKEN_FILE" "$RUNTIME_TOKEN_FILE"`,
`write_connection_state_value "$conn_tmp" "PULSE_AGENT_ID" "$AGENT_ID"`,
`write_connection_state_value "$conn_tmp" "PULSE_HOSTNAME" "$HOSTNAME_OVERRIDE"`,
`write_connection_state_value "$conn_tmp" "PULSE_INSECURE_SKIP_VERIFY" "true"`,
`write_connection_state_value "$conn_tmp" "PULSE_CACERT" "$CURL_CA_BUNDLE"`,
`recover_connection_state "$lifecycle_conn_env"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing persisted identity recovery: %s", needle)
}
}
}
func TestInstallSHRecoversSavedStateForPartialUninstallContext(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
needles := []string{
`if [[ "$UPDATE_ONLY" == "true" || "$UNINSTALL" == "true" ]]; then`,
`# An explicit state directory is authoritative.`,
`lifecycle_conn_env=$(find_connection_state_file || true)`,
`recover_connection_state "$lifecycle_conn_env"`,
}
for _, needle := range needles {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing partial uninstall saved-state recovery guard: %s", needle)
}
}
}
func TestInstallSHSupportsSavedStateUpdateMode(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`--update Update an existing agent using saved connection state`,
`UPDATE_ONLY="false"`,
`--update) UPDATE_ONLY="true"; shift ;;`,
`if [[ "$UPDATE_ONLY" == "true" || "$UNINSTALL" == "true" ]]; then`,
`lifecycle_conn_env=$(find_connection_state_file || true)`,
`recover_connection_state "$lifecycle_conn_env"`,
`recover_connection_state_from_existing_agent() {`,
`recover_connection_state_from_running_agent`,
`recover_connection_state_from_systemd_unit`,
`recover_connection_state_from_launchd_plist`,
`recover_connection_state_from_service_scripts`,
`running_agent_arg_stream() {`,
`running_agent_env_stream() {`,
`recover_connection_state_from_arg_stream`,
`recover_token_from_default_agent_token_file() {`,
`normalize_recovered_agent_arg_key() {`,
`-url|-pulse-url|-token|-token-file|-interval|-agent-id|-hostname|-report-ip|-cacert|-server-fingerprint|-observers-file|-health-addr|-state-dir|-kubeconfig|-proxmox-type|-disk-exclude)`,
`--enable-host|-enable-host|--enable-host=true|-enable-host=true)`,
`recover_connection_state_from_env_stream`,
`recovered_connection_state_ready() {`,
`update_connection_state_incomplete() {`,
`[[ "$RECOVERED_AGENT_ARG_STATE" == "true" ]] && recovered_connection_state_ready`,
`[[ "$RECOVERED_AGENT_ENV_STATE" == "true" ]] && recovered_connection_state_ready`,
`if update_connection_state_incomplete; then`,
`recover_connection_state_from_existing_agent || true`,
`if [[ "$UPDATE_ONLY" == "true" && ( -z "$PULSE_URL" || -z "$PULSE_TOKEN" ) ]]; then`,
`recover_agent_id_from_state_file() {`,
`AGENT_ID=$(recover_agent_id_from_state_file || true)`,
`No existing Pulse Agent connection state found. Use the install command instead.`,
`if [[ "$UPDATE_ONLY" == "true" && "$UPGRADE_MODE" != "true" ]]; then`,
`No existing Pulse Agent installation found to update. Use the install command instead.`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing saved-state update mode contract: %s", needle)
}
}
}
func TestInstallSHRecoversV5ProcessArgsForSavedStateUpdate(t *testing.T) {
script := `
fail() { echo "FAIL:$1"; exit 99; }
PULSE_URL=""
PULSE_TOKEN=""
INTERVAL="30s"
INTERVAL_EXPLICIT="false"
ENABLE_HOST="true"
HOST_EXPLICIT="false"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
INSECURE="false"
ENABLE_COMMANDS="false"
ENROLL="false"
HEALTH_ADDR=""
HEALTH_ADDR_SET="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="/var/lib/pulse-agent"
CURL_CA_BUNDLE=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
RUNTIME_TOKEN_FILE="/var/lib/pulse-agent/token"
` + extractInstallShellFunction(t, "strip_recovered_arg_quotes") + `
` + extractInstallShellFunction(t, "normalize_recovered_agent_arg_key") + `
` + extractInstallShellFunction(t, "apply_recovered_agent_arg_value") + `
` + extractInstallShellFunction(t, "recovered_connection_state_ready") + `
` + extractInstallShellFunction(t, "recover_token_from_default_agent_token_file") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_arg_stream") + `
` + extractInstallShellFunction(t, "build_exec_arg_items") + `
` + extractInstallShellFunction(t, "join_exec_arg_items") + `
` + extractInstallShellFunction(t, "build_exec_args") + `
recover_connection_state_from_arg_stream <<'ARGS'
/usr/local/bin/pulse-agent
--url
http://192.168.2.96:7655
--token
deadbeef
--interval
30s
--enable-host
--enable-docker
--insecure
--agent-id
agent-123
--hostname
pve-one
--disk-exclude
/dev/sda
--disk-exclude=/var/run/samba/fd
ARGS
build_exec_args
printf 'URL=%s\nTOKEN=%s\nDOCKER=%s\nDOCKER_EXPLICIT=%s\nINSECURE=%s\nAGENT_ID=%s\nHOSTNAME=%s\nEXEC_ARGS=%s\n' \
"$PULSE_URL" "$PULSE_TOKEN" "$ENABLE_DOCKER" "$DOCKER_EXPLICIT" "$INSECURE" "$AGENT_ID" "$HOSTNAME_OVERRIDE" "$EXEC_ARGS"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
required := []string{
"URL=http://192.168.2.96:7655",
"TOKEN=deadbeef",
"DOCKER=true",
"DOCKER_EXPLICIT=true",
"INSECURE=true",
"AGENT_ID=agent-123",
"HOSTNAME=pve-one",
"--token-file /var/lib/pulse-agent/token",
"--enable-docker",
"--disk-exclude /dev/sda",
"--disk-exclude /var/run/samba/fd",
}
for _, needle := range required {
if !strings.Contains(got, needle) {
t.Fatalf("recovered update state missing %q:\n%s", needle, got)
}
}
if strings.Contains(got, "--token deadbeef") {
t.Fatalf("recovered service args leaked raw token:\n%s", got)
}
}
func TestInstallSHRecoversV5ProcessArgsWithoutProcfs(t *testing.T) {
script := `
PULSE_URL=""
PULSE_TOKEN=""
INTERVAL="30s"
INTERVAL_EXPLICIT="false"
ENABLE_HOST="true"
HOST_EXPLICIT="false"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
INSECURE="false"
ENABLE_COMMANDS="false"
ENROLL="false"
HEALTH_ADDR=""
HEALTH_ADDR_SET="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="/var/lib/pulse-agent"
TRUENAS_STATE_DIR="/data/pulse-agent"
CURL_CA_BUNDLE=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
RUNTIME_TOKEN_FILE="/var/lib/pulse-agent/token"
BINARY_NAME="pulse-agent"
` + extractInstallShellFunction(t, "strip_recovered_arg_quotes") + `
` + extractInstallShellFunction(t, "normalize_recovered_agent_arg_key") + `
` + extractInstallShellFunction(t, "apply_recovered_agent_arg_value") + `
` + extractInstallShellFunction(t, "recovered_connection_state_ready") + `
` + extractInstallShellFunction(t, "recover_token_from_default_agent_token_file") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_arg_stream") + `
` + extractInstallShellFunction(t, "split_recovered_shell_words") + `
` + extractInstallShellFunction(t, "running_agent_arg_stream") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_running_agent") + `
` + extractInstallShellFunction(t, "build_exec_arg_items") + `
` + extractInstallShellFunction(t, "join_exec_arg_items") + `
` + extractInstallShellFunction(t, "build_exec_args") + `
collect_running_agent_pids() { printf '%s\n' 4242; }
running_agent_env_stream() { return 1; }
ps() {
printf '%s\n' "/usr/local/bin/pulse-agent -url http://192.168.2.96:7655 -token deadbeef -enable-host -enable-docker -insecure -agent-id firewall-1 -hostname 'edge firewall'"
}
if recover_connection_state_from_running_agent; then
echo "READY"
else
echo "NOT_READY"
fi
build_exec_args
printf 'URL=%s\nTOKEN=%s\nDOCKER=%s\nINSECURE=%s\nAGENT_ID=%s\nHOSTNAME=%s\nEXEC_ARGS=%s\n' \
"$PULSE_URL" "$PULSE_TOKEN" "$ENABLE_DOCKER" "$INSECURE" "$AGENT_ID" "$HOSTNAME_OVERRIDE" "$EXEC_ARGS"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
for _, needle := range []string{
"READY",
"URL=http://192.168.2.96:7655",
"TOKEN=deadbeef",
"DOCKER=true",
"INSECURE=true",
"AGENT_ID=firewall-1",
"HOSTNAME=edge firewall",
"--token-file /var/lib/pulse-agent/token",
} {
if !strings.Contains(got, needle) {
t.Fatalf("non-procfs process recovery missing %q:\n%s", needle, got)
}
}
if strings.Contains(got, "--token deadbeef") {
t.Fatalf("non-procfs process recovery leaked raw token into service args:\n%s", got)
}
}
func TestInstallSHRecoversV5FreeBSDRCServiceState(t *testing.T) {
rcScript := filepath.Join(t.TempDir(), "pulse-agent")
if err := os.WriteFile(rcScript, []byte(`#!/bin/sh
command="/usr/local/bin/pulse-agent"
command_args="-url http://192.168.2.96:7655 -token deadbeef -enable-host -insecure -agent-id firewall-1 -hostname 'edge firewall'"
export PULSE_CACERT='/conf/pulse-ca.pem'
`), 0600); err != nil {
t.Fatalf("write rc.d fixture: %v", err)
}
script := `
PULSE_URL=""
PULSE_TOKEN=""
INTERVAL="30s"
INTERVAL_EXPLICIT="false"
ENABLE_HOST="true"
HOST_EXPLICIT="false"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
INSECURE="false"
ENABLE_COMMANDS="false"
ENROLL="false"
HEALTH_ADDR=""
HEALTH_ADDR_SET="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="/var/lib/pulse-agent"
TRUENAS_STATE_DIR="/data/pulse-agent"
CURL_CA_BUNDLE=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
RUNTIME_TOKEN_FILE="/var/lib/pulse-agent/token"
AGENT_NAME="pulse-agent"
` + extractInstallShellFunction(t, "strip_recovered_arg_quotes") + `
` + extractInstallShellFunction(t, "normalize_recovered_agent_arg_key") + `
` + extractInstallShellFunction(t, "apply_recovered_agent_arg_value") + `
` + extractInstallShellFunction(t, "recovered_connection_state_ready") + `
` + extractInstallShellFunction(t, "recover_token_from_default_agent_token_file") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_arg_stream") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_env_stream") + `
` + extractInstallShellFunction(t, "split_recovered_shell_words") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_service_scripts") + `
` + extractInstallShellFunction(t, "build_exec_arg_items") + `
` + extractInstallShellFunction(t, "join_exec_arg_items") + `
` + extractInstallShellFunction(t, "build_exec_args") + `
if recover_connection_state_from_service_scripts "${PULSE_TEST_RC_SCRIPT:?}"; then
echo "READY"
else
echo "NOT_READY"
fi
build_exec_args
printf 'URL=%s\nTOKEN=%s\nINSECURE=%s\nAGENT_ID=%s\nHOSTNAME=%s\nCACERT=%s\nEXEC_ARGS=%s\n' \
"$PULSE_URL" "$PULSE_TOKEN" "$INSECURE" "$AGENT_ID" "$HOSTNAME_OVERRIDE" "$CURL_CA_BUNDLE" "$EXEC_ARGS"
`
cmd := exec.Command("bash", "-c", script)
cmd.Env = append(os.Environ(), "PULSE_TEST_RC_SCRIPT="+rcScript)
out, err := cmd.CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
for _, needle := range []string{
"READY",
"URL=http://192.168.2.96:7655",
"TOKEN=deadbeef",
"INSECURE=true",
"AGENT_ID=firewall-1",
"HOSTNAME=edge firewall",
"CACERT=/conf/pulse-ca.pem",
"--token-file /var/lib/pulse-agent/token",
} {
if !strings.Contains(got, needle) {
t.Fatalf("FreeBSD rc.d recovery missing %q:\n%s", needle, got)
}
}
if strings.Contains(got, "--token deadbeef") {
t.Fatalf("FreeBSD rc.d recovery leaked raw token into service args:\n%s", got)
}
}
func TestInstallSHRejectsPartialRecoveredProcessConnectionState(t *testing.T) {
script := `
PULSE_URL=""
PULSE_TOKEN=""
INTERVAL="30s"
INTERVAL_EXPLICIT="false"
ENABLE_HOST="true"
HOST_EXPLICIT="false"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
INSECURE="false"
ENABLE_COMMANDS="false"
ENROLL="false"
HEALTH_ADDR=""
HEALTH_ADDR_SET="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="/var/lib/pulse-agent"
CURL_CA_BUNDLE=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
` + extractInstallShellFunction(t, "strip_recovered_arg_quotes") + `
` + extractInstallShellFunction(t, "normalize_recovered_agent_arg_key") + `
` + extractInstallShellFunction(t, "apply_recovered_agent_arg_value") + `
` + extractInstallShellFunction(t, "recovered_connection_state_ready") + `
` + extractInstallShellFunction(t, "recover_token_from_default_agent_token_file") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_arg_stream") + `
if recover_connection_state_from_arg_stream <<'ARGS'
/usr/local/bin/pulse-agent
--url
http://192.168.2.96:7655
--enable-host
--agent-id
agent-123
ARGS
then
echo "UNEXPECTED_SUCCESS"
else
echo "EXPECTED_FAILURE"
fi
printf 'URL=%s\nTOKEN=%s\nAGENT_ID=%s\n' "$PULSE_URL" "$PULSE_TOKEN" "$AGENT_ID"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
if !strings.Contains(got, "EXPECTED_FAILURE") {
t.Fatalf("partial recovered state should fail closed:\n%s", got)
}
if strings.Contains(got, "UNEXPECTED_SUCCESS") {
t.Fatalf("partial recovered state reported success:\n%s", got)
}
if !strings.Contains(got, "URL=http://192.168.2.96:7655") || !strings.Contains(got, "AGENT_ID=agent-123") {
t.Fatalf("partial recovery should still preserve non-secret fields for later sources:\n%s", got)
}
if !strings.Contains(got, "TOKEN=") {
t.Fatalf("expected token to remain empty:\n%s", got)
}
}
func TestInstallSHRecoversLegacyDefaultTokenFileForSavedStateUpdate(t *testing.T) {
stateDir := t.TempDir()
if err := os.WriteFile(filepath.Join(stateDir, "token"), []byte("deadbeef\n"), 0600); err != nil {
t.Fatalf("write legacy token file: %v", err)
}
script := `
fail() { echo "FAIL:$1"; exit 99; }
PULSE_URL="http://192.168.2.96:7655"
PULSE_TOKEN=""
INTERVAL="30s"
INTERVAL_EXPLICIT="false"
ENABLE_HOST="true"
HOST_EXPLICIT="false"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
INSECURE="true"
ENABLE_COMMANDS="false"
ENROLL="false"
HEALTH_ADDR=""
HEALTH_ADDR_SET="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="${PULSE_TEST_STATE_DIR:?}"
TRUENAS_STATE_DIR="${PULSE_TEST_STATE_DIR:?}/truenas"
CURL_CA_BUNDLE=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
RUNTIME_TOKEN_FILE="${STATE_DIR}/token"
` + extractInstallShellFunction(t, "strip_recovered_arg_quotes") + `
` + extractInstallShellFunction(t, "normalize_recovered_agent_arg_key") + `
` + extractInstallShellFunction(t, "apply_recovered_agent_arg_value") + `
` + extractInstallShellFunction(t, "recovered_connection_state_ready") + `
` + extractInstallShellFunction(t, "recover_token_from_default_agent_token_file") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_arg_stream") + `
` + extractInstallShellFunction(t, "build_exec_arg_items") + `
` + extractInstallShellFunction(t, "join_exec_arg_items") + `
` + extractInstallShellFunction(t, "build_exec_args") + `
if recover_connection_state_from_arg_stream <<'ARGS'
/usr/local/bin/pulse-agent
-url
http://192.168.2.96:7655
-interval
30s
-enable-host
-enable-docker
-agent-id
machine-1
-hostname
docker1
ARGS
then
echo "READY"
else
echo "NOT_READY"
fi
build_exec_args
printf 'URL=%s\nTOKEN=%s\nDOCKER=%s\nAGENT_ID=%s\nHOSTNAME=%s\nEXEC_ARGS=%s\n' \
"$PULSE_URL" "$PULSE_TOKEN" "$ENABLE_DOCKER" "$AGENT_ID" "$HOSTNAME_OVERRIDE" "$EXEC_ARGS"
`
cmd := exec.Command("bash", "-c", script)
cmd.Env = append(os.Environ(), "PULSE_TEST_STATE_DIR="+stateDir)
out, err := cmd.CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
for _, needle := range []string{
"READY",
"URL=http://192.168.2.96:7655",
"TOKEN=deadbeef",
"DOCKER=true",
"AGENT_ID=machine-1",
"HOSTNAME=docker1",
"--token-file",
stateDir + "/token",
} {
if !strings.Contains(got, needle) {
t.Fatalf("legacy default token recovery missing %q:\n%s", needle, got)
}
}
if strings.Contains(got, "--token deadbeef") {
t.Fatalf("legacy default token recovery leaked raw token into service args:\n%s", got)
}
}
func TestInstallSHCombinesRecoveredProcessArgsAndEnvConnectionState(t *testing.T) {
script := `
PULSE_URL=""
PULSE_TOKEN=""
INTERVAL="30s"
INTERVAL_EXPLICIT="false"
ENABLE_HOST="true"
HOST_EXPLICIT="false"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
INSECURE="false"
ENABLE_COMMANDS="false"
ENROLL="false"
HEALTH_ADDR=""
HEALTH_ADDR_SET="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="/var/lib/pulse-agent"
CURL_CA_BUNDLE=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
` + extractInstallShellFunction(t, "strip_recovered_arg_quotes") + `
` + extractInstallShellFunction(t, "normalize_recovered_agent_arg_key") + `
` + extractInstallShellFunction(t, "apply_recovered_agent_arg_value") + `
` + extractInstallShellFunction(t, "recovered_connection_state_ready") + `
` + extractInstallShellFunction(t, "recover_token_from_default_agent_token_file") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_arg_stream") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_env_stream") + `
if recover_connection_state_from_arg_stream <<'ARGS'
/usr/local/bin/pulse-agent
--url
http://192.168.2.96:7655
ARGS
then
echo "ARGS_READY"
else
echo "ARGS_PARTIAL"
fi
if recover_connection_state_from_env_stream <<'ENV'
PULSE_TOKEN=deadbeef
ENV
then
echo "ENV_READY"
else
echo "ENV_PARTIAL"
fi
printf 'URL=%s\nTOKEN=%s\n' "$PULSE_URL" "$PULSE_TOKEN"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
for _, needle := range []string{
"ARGS_PARTIAL",
"ENV_READY",
"URL=http://192.168.2.96:7655",
"TOKEN=deadbeef",
} {
if !strings.Contains(got, needle) {
t.Fatalf("combined recovery missing %q:\n%s", needle, got)
}
}
}
func TestInstallSHUpdateModeMergesExplicitURLWithRunningV5ProcessState(t *testing.T) {
script := `
fail() { echo "FAIL:$1"; exit 99; }
log_info() { :; }
UPDATE_ONLY="true"
PULSE_URL="http://192.168.2.96:7655"
PULSE_TOKEN=""
INTERVAL="30s"
INTERVAL_EXPLICIT="false"
ENABLE_HOST="true"
HOST_EXPLICIT="false"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
INSECURE="true"
ENABLE_COMMANDS="false"
ENROLL="false"
HEALTH_ADDR=""
HEALTH_ADDR_SET="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="/var/lib/pulse-agent"
CURL_CA_BUNDLE=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
RUNTIME_TOKEN_FILE="/var/lib/pulse-agent/token"
` + extractInstallShellFunction(t, "strip_recovered_arg_quotes") + `
` + extractInstallShellFunction(t, "normalize_recovered_agent_arg_key") + `
` + extractInstallShellFunction(t, "apply_recovered_agent_arg_value") + `
` + extractInstallShellFunction(t, "recovered_connection_state_ready") + `
` + extractInstallShellFunction(t, "update_connection_state_incomplete") + `
` + extractInstallShellFunction(t, "recover_token_from_default_agent_token_file") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_arg_stream") + `
` + extractInstallShellFunction(t, "build_exec_arg_items") + `
` + extractInstallShellFunction(t, "join_exec_arg_items") + `
` + extractInstallShellFunction(t, "build_exec_args") + `
find_connection_state_file() { return 1; }
recover_agent_id_from_state_file() { return 1; }
recover_connection_state_from_existing_agent() {
recover_connection_state_from_arg_stream <<'ARGS'
/usr/local/bin/pulse-agent
-url
http://192.168.2.96:7655
-token
deadbeef
-interval
30s
-enable-host
-enable-docker
-agent-id
machine-1
-hostname
docker1
ARGS
}
if [[ "$UPDATE_ONLY" == "true" ]]; then
if update_connection_state_incomplete; then
update_conn_env=$(find_connection_state_file || true)
if [[ -n "$update_conn_env" ]]; then
recover_connection_state "$update_conn_env"
fi
if update_connection_state_incomplete; then
recover_connection_state_from_existing_agent || true
fi
if [[ -n "$PULSE_URL" && -n "$PULSE_TOKEN" ]]; then
echo "READY"
elif [[ -z "$PULSE_URL" || -z "$PULSE_TOKEN" ]]; then
fail "No existing Pulse Agent connection state found. Use the install command instead."
fi
if [[ -z "$AGENT_ID" ]]; then
AGENT_ID=$(recover_agent_id_from_state_file || true)
fi
fi
fi
build_exec_args
printf 'URL=%s\nTOKEN=%s\nDOCKER=%s\nDOCKER_EXPLICIT=%s\nAGENT_ID=%s\nHOSTNAME=%s\nEXEC_ARGS=%s\n' \
"$PULSE_URL" "$PULSE_TOKEN" "$ENABLE_DOCKER" "$DOCKER_EXPLICIT" "$AGENT_ID" "$HOSTNAME_OVERRIDE" "$EXEC_ARGS"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
required := []string{
"READY",
"URL=http://192.168.2.96:7655",
"TOKEN=deadbeef",
"DOCKER=true",
"DOCKER_EXPLICIT=true",
"AGENT_ID=machine-1",
"HOSTNAME=docker1",
"--token-file /var/lib/pulse-agent/token",
}
for _, needle := range required {
if !strings.Contains(got, needle) {
t.Fatalf("reported v5 update recovery missing %q:\n%s", needle, got)
}
}
if strings.Contains(got, "--token deadbeef") {
t.Fatalf("reported v5 update recovery leaked raw token into service args:\n%s", got)
}
}
func TestInstallSHUsesCanonicalServiceLifecycleHelpers(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`stop_existing_agent_service() {`,
`restart_systemd_agent_service() {`,
`restart_openrc_agent_service() {`,
`restart_service_command_agent() {`,
`restart_sysv_agent_service() {`,
`stop_existing_agent_service || true`,
`restart_systemd_agent_service`,
`restart_openrc_agent_service`,
`restart_service_command_agent`,
`restart_sysv_agent_service "$RCSCRIPT"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing canonical service lifecycle helper usage: %s", needle)
}
}
}
func TestInstallSHUsesCanonicalServiceTeardownHelpers(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`teardown_systemd_agent_service() {`,
`teardown_openrc_agent_service() {`,
`teardown_freebsd_agent_service() {`,
`teardown_sysv_agent_service() {`,
`teardown_systemd_agent_service`,
`teardown_freebsd_agent_service "/usr/local/etc/rc.d/${AGENT_NAME}"`,
`teardown_openrc_agent_service`,
`teardown_sysv_agent_service "/etc/init.d/${AGENT_NAME}"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing canonical service teardown helper usage: %s", needle)
}
}
}
func TestWriteTrueNASBootstrapScriptUsesCanonicalRenderer(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`write_truenas_bootstrap_script() {`,
`require_bootstrap_file() {`,
`sync_runtime_binary() {`,
`link_service_artifact() {`,
`start_agent_service() {`,
`ensure_freebsd_agent_enabled() {`,
`service_link="/etc/systemd/system/${AGENT_NAME}.service"`,
`service_link="/usr/local/etc/rc.d/${AGENT_NAME}"`,
`write_truenas_bootstrap_script "$(uname -s)"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing canonical TrueNAS bootstrap renderer content: %s", needle)
}
}
if strings.Count(script, `cat > "$TRUENAS_BOOTSTRAP_SCRIPT"`) != 1 {
t.Fatalf("expected one canonical TrueNAS bootstrap writer, found %d", strings.Count(script, `cat > "$TRUENAS_BOOTSTRAP_SCRIPT"`))
}
}
func TestInstallSHUsesCanonicalQNAPBootstrapRenderer(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`detect_qnap_data_volume() {`,
`find_qnap_state_dir() {`,
`remove_qnap_autorun_block() {`,
`write_qnap_wrapper_script() {`,
`append_qnap_autorun_block() {`,
`select_platform_state_dir "${QNAP_VOL}/.pulse-agent"`,
`write_qnap_wrapper_script "$WRAPPER_SCRIPT" "$RUNTIME_BINARY" "$QNAP_STORED_BINARY" "$QNAP_LOG_DIR" "$STATE_DIR"`,
`append_qnap_autorun_block "$AUTORUN_PATH" "$WRAPPER_SCRIPT" "$STATE_DIR"`,
`complete_installation_flow "$STATE_DIR" "Installation complete! Agent is running." "Upgrade complete! Agent is running." "tail -f ${AGENT_LOG_FILE}"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing canonical QNAP bootstrap ownership: %s", needle)
}
}
}
func TestInstallSHUsesQNAPStateForUninstallRecovery(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`qnap_state_dir=$(find_qnap_state_dir || true)`,
`aid_paths+=("$qnap_state_dir/agent-id")`,
`if [[ -n "$qnap_state_dir" ]] && [[ -f "$qnap_state_dir/connection.env" ]]; then`,
`remove_qnap_autorun_block "$AUTORUN_PATH"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing QNAP uninstall continuity handling: %s", needle)
}
}
}
func TestInstallSHAgentDiskHeadroomRejectsSharedLowSpaceFilesystem(t *testing.T) {
script := `
set -euo pipefail
log_error() { :; }
log_info() { :; }
log_warn() { :; }
INSTALL_DIR="/usr/local/bin"
AGENT_MIN_TEMP_FREE_BYTES=$((100 * 1024))
AGENT_MIN_INSTALL_FREE_BYTES=$((80 * 1024))
` + extractInstallShellFunction(t, "bytes_to_human") + `
` + extractInstallShellFunction(t, "nearest_existing_dir") + `
` + extractInstallShellFunction(t, "get_available_bytes_for_path") + `
` + extractInstallShellFunction(t, "get_filesystem_device_for_path") + `
` + extractInstallShellFunction(t, "ensure_agent_disk_headroom") + `
df() {
if [[ "$1" == "-Pk" ]]; then
printf 'Filesystem 1024-blocks Used Available Capacity Mounted on\n'
printf '/dev/shared 1000 0 150 0%% /\n'
return 0
fi
command df "$@"
}
if ensure_agent_disk_headroom /tmp /usr/local/bin; then
echo "ensure_agent_disk_headroom unexpectedly passed on a shared full filesystem" >&2
exit 1
fi
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
}
func TestInstallSHAgentDiskHeadroomAcceptsSeparateFilesystems(t *testing.T) {
script := `
set -euo pipefail
log_error() { :; }
log_info() { :; }
log_warn() { :; }
INSTALL_DIR="/usr/local/bin"
AGENT_MIN_TEMP_FREE_BYTES=$((100 * 1024))
AGENT_MIN_INSTALL_FREE_BYTES=$((80 * 1024))
` + extractInstallShellFunction(t, "bytes_to_human") + `
` + extractInstallShellFunction(t, "nearest_existing_dir") + `
` + extractInstallShellFunction(t, "get_available_bytes_for_path") + `
` + extractInstallShellFunction(t, "get_filesystem_device_for_path") + `
` + extractInstallShellFunction(t, "ensure_agent_disk_headroom") + `
df() {
if [[ "$1" == "-Pk" ]]; then
case "$2" in
/tmp)
printf 'Filesystem 1024-blocks Used Available Capacity Mounted on\n'
printf '/dev/tmp 1000 0 120 0%% /tmp\n'
return 0
;;
*)
printf 'Filesystem 1024-blocks Used Available Capacity Mounted on\n'
printf '/dev/root 1000 0 90 0%% /\n'
return 0
;;
esac
fi
command df "$@"
}
ensure_agent_disk_headroom /tmp /usr/local/bin
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
}
func TestInstallSHAgentDiskHeadroomResolvesMissingDirectories(t *testing.T) {
script := `
set -euo pipefail
log_error() { :; }
log_info() { :; }
log_warn() { :; }
INSTALL_DIR="/usr/local/bin"
AGENT_MIN_TEMP_FREE_BYTES=$((100 * 1024))
AGENT_MIN_INSTALL_FREE_BYTES=$((80 * 1024))
` + extractInstallShellFunction(t, "nearest_existing_dir") + `
resolved=$(nearest_existing_dir /definitely/not/a/real/path/anywhere)
if [[ "$resolved" != "/" ]]; then
echo "nearest_existing_dir resolved to $resolved, want /" >&2
exit 1
fi
resolved=$(nearest_existing_dir /tmp)
if [[ "$resolved" != "/tmp" ]]; then
echo "nearest_existing_dir resolved to $resolved, want /tmp" >&2
exit 1
fi
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
}
// TestInstallSHChecksDiskHeadroomBeforeDownload pins the ENOSPC preflight from
// issue #1617: the installer must verify temp and install-dir headroom before
// the agent binary download stages anything, and the --preflight-only mode must
// report the same check.
func TestInstallSHChecksDiskHeadroomBeforeDownload(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
headroomCall := `if ! ensure_agent_disk_headroom "${TMPDIR:-/tmp}" "$INSTALL_DIR"; then`
stagingCall := `TMP_BIN=$(mktemp)`
headroomPos := strings.Index(script, headroomCall)
if headroomPos < 0 {
t.Fatalf("install.sh does not gate the download on ensure_agent_disk_headroom")
}
stagingPos := strings.Index(script, stagingCall)
if stagingPos < 0 {
t.Fatalf("install.sh no longer stages the download via mktemp; update this test")
}
if headroomPos > stagingPos {
t.Fatalf("disk headroom check happens after the download staging mktemp")
}
for _, needle := range []string{
`json_event "preflight" "disk_ok" "Sufficient disk space for agent install"`,
`json_event "preflight" "disk_low"`,
} {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh preflight-only mode missing disk headroom reporting: %s", needle)
}
}
}
// TestInstallSHWatchdogPathsUseRotatingAgentLog pins the logging half of issue
// #1617: the QNAP and Unraid watchdog loops must not shell-append agent stdout
// to an unrotated file on the RAM-backed root; the agent's own rotating writer
// (--log-file) owns the agent log instead.
func TestInstallSHWatchdogPathsUseRotatingAgentLog(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`if [[ -n "${AGENT_LOG_FILE:-}" ]]; then EXEC_ARG_ITEMS+=(--log-file "$AGENT_LOG_FILE"); fi`,
`QNAP_LOG_DIR="${STATE_DIR}/logs"`,
`AGENT_LOG_FILE="${QNAP_LOG_DIR}/${AGENT_NAME}.log"`,
`UNRAID_LOG_DIR="/var/log/${AGENT_NAME}"`,
`AGENT_LOG_FILE="${UNRAID_LOG_DIR}/${AGENT_NAME}.log"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing rotating agent log wiring: %s", needle)
}
}
if got := strings.Count(script, `${EXEC_ARGS} > /dev/null 2>> "\$WATCHDOG_LOG"`); got != 2 {
t.Fatalf("expected both watchdog loops (QNAP, Unraid) to discard the stdout mirror and capture stderr in the watchdog log, found %d", got)
}
if strings.Contains(script, `${EXEC_ARGS} >> /var/log/${AGENT_NAME}.log`) {
t.Fatalf("a watchdog loop still shell-appends agent output to the unrotated /var/log/${AGENT_NAME}.log")
}
}
// TestInstallSHQNAPWatchdogIsSingleton pins the process-ownership half of issue
// #1617. QNAP can launch the persistent wrapper both from autorun.sh and from an
// install/upgrade, so the wrapper must elect one supervisor before killing or
// starting an agent and must clean up only state that it owns.
func TestInstallSHQNAPWatchdogIsSingleton(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`WATCHDOG_PIDFILE="${state_dir}/${AGENT_NAME}.watchdog.pid"`,
`AGENT_PIDFILE="${state_dir}/${AGENT_NAME}.pid"`,
`LOCK_DIR="${state_dir}/${AGENT_NAME}.watchdog.lock"`,
`while ! mkdir "\$LOCK_DIR" 2>/dev/null; do`,
`if pid_is_live "\$_owner"; then`,
`if ! acquire_watchdog_lock; then`,
`[ "\$(cat "\$WATCHDOG_PIDFILE" 2>/dev/null)" = "\$\$" ]`,
`trap cleanup_watchdog EXIT`,
`trap shutdown_watchdog INT TERM HUP`,
`CURRENT_AGENT_PID=\$!`,
`echo "\$CURRENT_AGENT_PID" > "\$AGENT_PIDFILE"`,
`wait "\$CURRENT_AGENT_PID"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing QNAP watchdog singleton contract: %s", needle)
}
}
lockPos := strings.Index(script, `if ! acquire_watchdog_lock; then`)
killPos := strings.Index(script, `pkill -x "pulse-agent" 2>/dev/null || true`)
if lockPos < 0 || killPos < 0 || lockPos > killPos {
t.Fatalf("QNAP wrapper must acquire singleton ownership before killing an existing agent")
}
}
func TestRenderedQNAPWatchdogRejectsASecondSupervisor(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
start := strings.Index(script, "write_qnap_wrapper_script() {")
if start < 0 {
t.Fatal("install.sh missing QNAP wrapper renderer")
}
endOffset := strings.Index(script[start:], "\nappend_qnap_autorun_block() {")
if endOffset < 0 {
t.Fatal("could not isolate QNAP wrapper renderer")
}
renderer := script[start : start+endOffset]
tempDir := t.TempDir()
stateDir := filepath.Join(tempDir, "state")
logDir := filepath.Join(stateDir, "logs")
wrapperPath := filepath.Join(stateDir, "start-pulse-agent.sh")
storedPath := filepath.Join(stateDir, "stored-agent")
runtimePath := filepath.Join(tempDir, "runtime", "pulse-agent")
startsPath := filepath.Join(tempDir, "agent-starts")
mockBinDir := filepath.Join(tempDir, "bin")
for _, dir := range []string{stateDir, mockBinDir} {
if err := os.MkdirAll(dir, 0o755); err != nil {
t.Fatalf("create test directory: %v", err)
}
}
agentScript := "#!/bin/sh\n" +
"echo \"$$\" >> " + strconv.Quote(startsPath) + "\n" +
"trap 'exit 0' INT TERM HUP\n" +
"while :; do sleep 1; done\n"
if err := os.WriteFile(storedPath, []byte(agentScript), 0o755); err != nil {
t.Fatalf("write fake agent: %v", err)
}
if err := os.WriteFile(filepath.Join(mockBinDir, "pkill"), []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
t.Fatalf("write fake pkill: %v", err)
}
harness := renderer + `
AGENT_NAME=pulse-agent
SHELL_EXPORT_LINES=""
EXEC_ARGS=""
write_qnap_wrapper_script "$1" "$2" "$3" "$4" "$5"
`
render := exec.Command("bash", "-c", harness, "_", wrapperPath, runtimePath, storedPath, logDir, stateDir)
if output, err := render.CombinedOutput(); err != nil {
t.Fatalf("render QNAP wrapper: %v\n%s", err, output)
}
env := []string{"PATH=" + mockBinDir + ":/usr/bin:/bin"}
first := exec.Command("sh", wrapperPath)
first.Env = env
if err := first.Start(); err != nil {
t.Fatalf("start first watchdog: %v", err)
}
t.Cleanup(func() {
if first.Process != nil {
_ = first.Process.Signal(syscall.SIGTERM)
_, _ = first.Process.Wait()
}
})
watchdogPIDFile := filepath.Join(stateDir, "pulse-agent.watchdog.pid")
agentPIDFile := filepath.Join(stateDir, "pulse-agent.pid")
waitForFile := func(path string) {
t.Helper()
deadline := time.Now().Add(5 * time.Second)
for time.Now().Before(deadline) {
if _, err := os.Stat(path); err == nil {
return
}
time.Sleep(25 * time.Millisecond)
}
t.Fatalf("timed out waiting for %s", path)
}
waitForFile(watchdogPIDFile)
waitForFile(agentPIDFile)
waitForFile(startsPath)
second := exec.Command("sh", wrapperPath)
second.Env = env
if output, err := second.CombinedOutput(); err != nil {
t.Fatalf("second watchdog should exit cleanly: %v\n%s", err, output)
}
starts, err := os.ReadFile(startsPath)
if err != nil {
t.Fatalf("read fake-agent starts: %v", err)
}
if got := len(strings.Fields(string(starts))); got != 1 {
t.Fatalf("expected one supervised agent after two watchdog launches, got %d", got)
}
agentPIDBytes, err := os.ReadFile(agentPIDFile)
if err != nil {
t.Fatalf("read agent pid: %v", err)
}
agentPID, err := strconv.Atoi(strings.TrimSpace(string(agentPIDBytes)))
if err != nil {
t.Fatalf("parse agent pid: %v", err)
}
if err := first.Process.Signal(syscall.SIGTERM); err != nil {
t.Fatalf("stop first watchdog: %v", err)
}
if err := first.Wait(); err != nil {
t.Fatalf("wait for first watchdog shutdown: %v", err)
}
first.Process = nil
if err := exec.Command("kill", "-0", strconv.Itoa(agentPID)).Run(); err == nil {
t.Fatalf("watchdog shutdown left agent pid %d alive", agentPID)
}
for _, path := range []string{watchdogPIDFile, agentPIDFile, filepath.Join(stateDir, "pulse-agent.watchdog.lock")} {
if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
t.Fatalf("watchdog shutdown left singleton state %s (stat: %v)", path, err)
}
}
}
func TestInstallSHUsesSharedServiceRenderers(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`render_systemd_agent_unit() {`,
`render_freebsd_rc_agent_script() {`,
`render_systemd_agent_unit "$UNIT" "${INSTALL_DIR}/${BINARY_NAME}" "${EXEC_ARGS}" "network.target" "" "" ""`,
`render_systemd_agent_unit "$TRUENAS_SERVICE_STORAGE" "${TRUENAS_RUNTIME_BINARY}" "${EXEC_ARGS}" "network-online.target docker.service" "network-online.target" "root" "${TRUENAS_LOG_TARGET}"`,
`render_systemd_agent_unit "$UNIT" "${INSTALL_DIR}/${BINARY_NAME}" "${EXEC_ARGS}" "network-online.target docker.service" "network-online.target" "root" ""`,
`render_freebsd_rc_agent_script "$TRUENAS_SERVICE_STORAGE" "${TRUENAS_RUNTIME_BINARY}" "${EXEC_ARGS}"`,
`render_freebsd_rc_agent_script "$RCSCRIPT" "${INSTALL_DIR}/${BINARY_NAME}" "${EXEC_ARGS}"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing shared service renderer usage: %s", needle)
}
}
}
func TestInstallSHPersistsRootlessContainerRuntimeServiceEnvironment(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`ROOTLESS_RUNTIME_SOCKET_URI=""`,
`system_docker_runtime_is_active() {`,
`discover_rootless_container_runtime() {`,
// Issue #1647: a live rootful Docker must win before any rootless
// socket discovery pins podman variables into the service environment.
`if system_docker_runtime_is_active; then`,
`discover_single_socket_match "${rootless_root}/*/docker.sock"`,
`discover_single_socket_match "${rootless_root}/*/podman/podman.sock"`,
`append_service_env "DOCKER_HOST" "$ROOTLESS_RUNTIME_SOCKET_URI"`,
`append_service_env "PULSE_DOCKER_RUNTIME" "podman"`,
`append_service_env "CONTAINER_HOST" "$ROOTLESS_RUNTIME_SOCKET_URI"`,
`append_service_env "PODMAN_HOST" "$ROOTLESS_RUNTIME_SOCKET_URI"`,
`append_service_env "XDG_RUNTIME_DIR" "$ROOTLESS_RUNTIME_XDG_DIR"`,
`env_line="$SYSTEMD_ENV_LINES"`,
`local service_env_lines="$SHELL_EXPORT_LINES"`,
`</array>${PLIST_ENV_BLOCK}`,
`respawn limit 5 10${UPSTART_ENV_LINES}`,
`sed -i "s|SSL_CERT_FILE_PLACEHOLDER|${SED_EXPORT_LINES}|g" "$INITSCRIPT"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing rootless service environment persistence contract: %s", needle)
}
}
}
func TestInstallSHServiceEnvAccumulatorRendersRootlessSocketVariables(t *testing.T) {
script := `
APPLIED_SERVICE_ENV_KEYS="|"
SYSTEMD_ENV_LINES=""
SHELL_EXPORT_LINES=""
UPSTART_ENV_LINES=""
SED_EXPORT_LINES=""
PLIST_ENV_ENTRIES=""
PLIST_ENV_BLOCK=""
` + extractInstallShellFunction(t, "xml_escape") + `
` + extractInstallShellFunction(t, "service_env_has_key") + `
` + extractInstallShellFunction(t, "shell_export_value") + `
` + extractInstallShellFunction(t, "append_service_env") + `
` + extractInstallShellFunction(t, "finalize_plist_env_block") + `
append_service_env "DOCKER_HOST" "unix:///run/user/1000/docker.sock"
append_service_env "XDG_RUNTIME_DIR" "/run/user/1000"
append_service_env "DOCKER_HOST" "unix:///run/user/2000/docker.sock"
append_service_env "PULSE_DOCKER_RUNTIME" "podman"
append_service_env "CONTAINER_HOST" "unix:///run/user/1000/podman/podman.sock"
append_service_env "PODMAN_HOST" "unix:///run/user/1000/podman/podman.sock"
finalize_plist_env_block
printf '%s\n---shell---\n%s\n---sed---\n%s\n---plist---\n%s\n' "$SYSTEMD_ENV_LINES" "$SHELL_EXPORT_LINES" "$SED_EXPORT_LINES" "$PLIST_ENV_BLOCK"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
required := []string{
`Environment="DOCKER_HOST=unix:///run/user/1000/docker.sock"`,
`Environment="XDG_RUNTIME_DIR=/run/user/1000"`,
`export DOCKER_HOST="unix:///run/user/1000/docker.sock"`,
`export XDG_RUNTIME_DIR="/run/user/1000"`,
`export DOCKER_HOST="unix:///run/user/1000/docker.sock"; export XDG_RUNTIME_DIR="/run/user/1000"`,
`<key>DOCKER_HOST</key>`,
`<string>unix:///run/user/1000/docker.sock</string>`,
`Environment="PULSE_DOCKER_RUNTIME=podman"`,
`Environment="CONTAINER_HOST=unix:///run/user/1000/podman/podman.sock"`,
`Environment="PODMAN_HOST=unix:///run/user/1000/podman/podman.sock"`,
}
for _, needle := range required {
if !strings.Contains(got, needle) {
t.Fatalf("service env output missing %s:\n%s", needle, got)
}
}
if strings.Contains(got, "unix:///run/user/2000/docker.sock") {
t.Fatalf("service env accumulator did not ignore duplicate key:\n%s", got)
}
}
// TestInstallSHIssue1647RootfulDockerOutranksRootlessPodmanSocket pins the fix
// for issue #1647: a transient rootless Podman API socket (socket-activated for
// a login session) must not win runtime discovery while a rootful Docker daemon
// is alive, or the agent service gets podman variables pinned to a socket that
// disappears when the session ends.
func TestInstallSHIssue1647RootfulDockerOutranksRootlessPodmanSocket(t *testing.T) {
tmpDir, err := os.MkdirTemp("/tmp", "pulse-1647-*")
if err != nil {
t.Fatalf("mktemp dir: %v", err)
}
defer os.RemoveAll(tmpDir)
podmanDir := filepath.Join(tmpDir, "run", "user", "1000", "podman")
if err := os.MkdirAll(podmanDir, 0o755); err != nil {
t.Fatalf("mkdir podman socket dir: %v", err)
}
socketPath := filepath.Join(podmanDir, "podman.sock")
listener, err := net.Listen("unix", socketPath)
if err != nil {
t.Fatalf("listen unix socket: %v", err)
}
defer listener.Close()
common := `
set -uo pipefail
log_warn() { :; }
log_info() { :; }
uname() { echo Linux; }
PULSE_ROOTLESS_RUNTIME_ROOT="` + filepath.Join(tmpDir, "run", "user") + `"
PULSE_SYSTEM_DOCKER_SOCKET="` + filepath.Join(tmpDir, "absent", "docker.sock") + `"
` + extractInstallShellFunction(t, "system_docker_runtime_is_active") + `
` + extractInstallShellFunction(t, "discover_single_socket_match") + `
` + extractInstallShellFunction(t, "discover_rootless_container_runtime") + `
`
liveDocker := common + `
docker() { return 0; }
if discover_rootless_container_runtime; then
echo "rootless podman socket must not outrank a live rootful docker" >&2
exit 1
fi
`
out, err := exec.Command("bash", "-c", liveDocker).CombinedOutput()
if err != nil {
t.Fatalf("live rootful docker case: %v\n%s", err, out)
}
deadDocker := common + `
docker() { return 1; }
if ! discover_rootless_container_runtime; then
echo "expected rootless podman discovery when no rootful docker answers" >&2
exit 1
fi
if [[ "$ROOTLESS_RUNTIME_KIND" != "podman" ]]; then
echo "kind=$ROOTLESS_RUNTIME_KIND, want podman" >&2
exit 1
fi
if [[ "$ROOTLESS_RUNTIME_SOCKET_URI" != "unix://` + socketPath + `" ]]; then
echo "uri=$ROOTLESS_RUNTIME_SOCKET_URI" >&2
exit 1
fi
`
out, err = exec.Command("bash", "-c", deadDocker).CombinedOutput()
if err != nil {
t.Fatalf("no rootful docker case: %v\n%s", err, out)
}
}
func TestInstallSHDiscoverSingleSocketMatch(t *testing.T) {
tmpDir, err := os.MkdirTemp("/tmp", "pulse-sock-*")
if err != nil {
t.Fatalf("mktemp socket dir: %v", err)
}
defer os.RemoveAll(tmpDir)
socketPath := filepath.Join(tmpDir, "docker.sock")
listener, err := net.Listen("unix", socketPath)
if err != nil {
t.Fatalf("listen unix socket: %v", err)
}
defer listener.Close()
script := `
` + extractInstallShellFunction(t, "discover_single_socket_match") + `
discover_single_socket_match "` + filepath.ToSlash(tmpDir) + `/*.sock"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if strings.TrimSpace(string(out)) != filepath.ToSlash(socketPath) {
t.Fatalf("socket match = %q, want %q", strings.TrimSpace(string(out)), filepath.ToSlash(socketPath))
}
}
func TestInstallSHFreeBSDRendererUsesDaemonSupervisorPidfile(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`child_pidfile="/var/run/\${name}.child.pid"`,
`pulse_agent_supervisor_pid()`,
`parent_pid=\$(ps -o ppid= -p "\${agent_pid}" 2>/dev/null | tr -d '[:space:]')`,
`daemon:*)`,
`/usr/sbin/daemon -r -P \${pidfile} -p \${child_pidfile} -f "\${command}" \${command_args}`,
`kill -KILL "\${supervisor_pid}" 2>/dev/null || true`,
`rm -f \${pidfile} \${child_pidfile}`,
`legacy child pid \${legacy_pid} supervised by pid \${legacy_supervisor}`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing FreeBSD daemon supervisor contract: %s", needle)
}
}
if strings.Contains(script, `/usr/sbin/daemon -r -p \${pidfile}`) {
t.Fatal("install.sh still writes the child pid to the service pidfile under daemon -r")
}
}
func TestInstallSHUsesCanonicalCompletionHelper(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`complete_installation_flow() {`,
`save_connection_info "$state_dir"`,
`json_event "complete" "updated" "Installation updated"`,
`json_event "complete" "installed" "Installation installed"`,
`json_event "complete" "updated_unhealthy" "Agent updated but not responding"`,
`json_event "complete" "installed_unhealthy" "Agent installed but not responding"`,
`complete_installation_flow "$STATE_DIR" "Installation complete! Agent is running." "Upgrade complete! Agent restarted with new configuration." "tail -f $LOG_FILE"`,
`complete_installation_flow "$UNRAID_STORAGE_DIR" "Installation complete! Agent is running." "Upgrade complete! Agent is running." "tail -f ${AGENT_LOG_FILE}"`,
`complete_installation_flow "$STATE_DIR" "Installation complete! Agent is running." "Upgrade complete! Agent is running." "tail -f ${AGENT_LOG_FILE}"`,
`complete_installation_flow "$TRUENAS_STATE_DIR" "Installation complete! Agent is running." "Upgrade complete! Agent is running." ""`,
`complete_installation_flow "$STATE_DIR" "Installation complete! Agent is running." "Upgrade complete! Agent restarted with new configuration." "tail -f /var/log/messages"`,
`complete_installation_flow "$STATE_DIR" "Installation complete! Agent is running." "Upgrade complete! Agent restarted with new configuration." "journalctl -u ${AGENT_NAME} --no-pager -n 20"`,
`complete_installation_flow "$STATE_DIR" "Installation complete! Agent is running." "Upgrade complete! Agent restarted with new configuration." "tail -f /var/log/${AGENT_NAME}.log"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing canonical completion helper usage: %s", needle)
}
}
}
func TestInstallSHUsesCanonicalFreeBSDAgentEnablement(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`freebsd_enable_snippet() {`,
`ensure_freebsd_agent_enabled() {`,
`service_management_functions="$(freebsd_enable_snippet)`,
`ensure_freebsd_agent_enabled`,
`apply_freebsd_agent_enablement() {`,
`eval "$(freebsd_enable_snippet)"`,
`apply_freebsd_agent_enablement`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing canonical FreeBSD enablement ownership: %s", needle)
}
}
if strings.Count(script, `grep -q "pulse_agent_enable" /etc/rc.conf`) != 1 {
t.Fatalf("expected one canonical FreeBSD enablement definition, found %d", strings.Count(script, `grep -q "pulse_agent_enable" /etc/rc.conf`))
}
}
func TestInstallSHUsesCanonicalFreeBSDAgentTeardown(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`teardown_freebsd_agent_service() {`,
`"$service_path" stop 2>/dev/null || true`,
`sysrc -x pulse_agent_enable >/dev/null 2>&1 || true`,
`rm -f /usr/local/etc/rc.d/pulse_agent.sh`,
`rm -f /var/run/pulse_agent.pid /var/run/pulse_agent.child.pid`,
`log_info "Removing FreeBSD rc.d installation..."`,
`teardown_freebsd_agent_service "/usr/local/etc/rc.d/${AGENT_NAME}"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing canonical FreeBSD teardown contract: %s", needle)
}
}
}
func TestInstallSHUsesCanonicalSysVEnablementHelper(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`enable_sysv_agent_service() {`,
`update-rc.d "${AGENT_NAME}" defaults >/dev/null 2>&1 || true`,
`chkconfig --add "${AGENT_NAME}" >/dev/null 2>&1 || true`,
`chkconfig "${AGENT_NAME}" on >/dev/null 2>&1 || true`,
`enable_sysv_agent_service "$INITSCRIPT"`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing canonical SysV enablement ownership: %s", needle)
}
}
if strings.Count(script, `update-rc.d "${AGENT_NAME}" defaults >/dev/null 2>&1 || true`) != 1 {
t.Fatalf("expected one canonical SysV update-rc.d enable path, found %d", strings.Count(script, `update-rc.d "${AGENT_NAME}" defaults >/dev/null 2>&1 || true`))
}
}
// TestUnraidGoScriptCleanup verifies the sed commands that remove pulse entries
// from /boot/config/go without disturbing other entries.
func TestUnraidGoScriptCleanup(t *testing.T) {
cases := []struct {
name string
before string
after string
}{
{
name: "pulse entry with trailing blank line",
before: `#!/bin/bash
/boot/config/pulse/telegraf/start_telegraf.sh
# Pulse Agent
bash /boot/config/plugins/pulse-agent/start-pulse-agent.sh
# Other stuff
echo hello
`,
// The comment and command lines are removed; the trailing blank line remains.
// This is harmless in /boot/config/go.
after: `#!/bin/bash
/boot/config/pulse/telegraf/start_telegraf.sh
# Other stuff
echo hello
`,
},
{
name: "pulse entry without trailing blank line",
before: `#!/bin/bash
# Pulse Agent
bash /boot/config/plugins/pulse-agent/start-pulse-agent.sh
# Other stuff
echo hello
`,
after: `#!/bin/bash
# Other stuff
echo hello
`,
},
{
name: "no pulse entries - unchanged",
before: `#!/bin/bash
echo hello
echo world
`,
after: `#!/bin/bash
echo hello
echo world
`,
},
{
name: "telegraf line containing pulse is kept",
before: `#!/bin/bash
/boot/config/pulse/telegraf/start_telegraf.sh
# Pulse Agent
bash /boot/config/plugins/pulse-agent/start-pulse-agent.sh
echo done
`,
// The telegraf line is NOT removed (no "pulse-agent" in it).
// Comment and command lines are deleted individually.
after: `#!/bin/bash
/boot/config/pulse/telegraf/start_telegraf.sh
echo done
`,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
dir := t.TempDir()
goScript := filepath.Join(dir, "go")
if err := os.WriteFile(goScript, []byte(tc.before), 0755); err != nil {
t.Fatal(err)
}
// Run the exact same sed commands from install.sh (line-by-line, not range-based)
script := `
GO_SCRIPT="` + goScript + `"
# Remove unified agent entries
sed -i '' '/^# Pulse Agent$/d' "$GO_SCRIPT" 2>/dev/null || sed -i '/^# Pulse Agent$/d' "$GO_SCRIPT" 2>/dev/null || true
sed -i '' '/pulse-agent/d' "$GO_SCRIPT" 2>/dev/null || sed -i '/pulse-agent/d' "$GO_SCRIPT" 2>/dev/null || true
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got, err := os.ReadFile(goScript)
if err != nil {
t.Fatal(err)
}
if string(got) != tc.after {
t.Errorf("go script mismatch:\n--- got ---\n%s\n--- want ---\n%s", got, tc.after)
}
})
}
}
// TestAPIDeregistrationCurl verifies the curl command sends the correct
// JSON payload and headers to the canonical uninstall endpoint.
func TestAPIDeregistrationCurl(t *testing.T) {
var (
mu sync.Mutex
gotMethod string
gotPath string
gotBody map[string]string
gotHeaders http.Header
)
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
mu.Lock()
defer mu.Unlock()
gotMethod = r.Method
gotPath = r.URL.Path
gotHeaders = r.Header.Clone()
body, _ := io.ReadAll(r.Body)
_ = json.Unmarshal(body, &gotBody)
w.WriteHeader(200)
w.Write([]byte(`{"success":true}`))
}))
defer srv.Close()
agentID := "test-uuid-1234"
token := "deadbeef0123456789"
script := `
PULSE_URL="` + srv.URL + `"
PULSE_TOKEN="` + token + `"
AGENT_ID="` + agentID + `"
CURL_ARGS=(-fsSL --connect-timeout 5 -X POST -H "Content-Type: application/json")
if [[ -n "$PULSE_TOKEN" ]]; then CURL_ARGS+=(-H "X-API-Token: ${PULSE_TOKEN}"); fi
curl "${CURL_ARGS[@]}" -d "{\"agentId\": \"${AGENT_ID}\"}" "${PULSE_URL}/api/agents/agent/uninstall" >/dev/null 2>&1 || true
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
mu.Lock()
defer mu.Unlock()
if gotMethod != "POST" {
t.Errorf("method = %q, want POST", gotMethod)
}
if gotPath != "/api/agents/agent/uninstall" {
t.Errorf("path = %q, want /api/agents/agent/uninstall", gotPath)
}
if gotBody["agentId"] != agentID {
t.Errorf("body agentId = %q, want %q", gotBody["agentId"], agentID)
}
if got := gotHeaders.Get("X-API-Token"); got != token {
t.Errorf("X-API-Token = %q, want %q", got, token)
}
if got := gotHeaders.Get("Content-Type"); got != "application/json" {
t.Errorf("Content-Type = %q, want application/json", got)
}
}
func TestAPIDeregistrationCurlWithoutToken(t *testing.T) {
var (
mu sync.Mutex
gotMethod string
gotPath string
gotBody map[string]string
gotHeaders http.Header
)
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
mu.Lock()
defer mu.Unlock()
gotMethod = r.Method
gotPath = r.URL.Path
gotHeaders = r.Header.Clone()
body, _ := io.ReadAll(r.Body)
_ = json.Unmarshal(body, &gotBody)
w.WriteHeader(200)
w.Write([]byte(`{"success":true}`))
}))
defer srv.Close()
agentID := "test-uuid-5678"
script := `
PULSE_URL="` + srv.URL + `"
PULSE_TOKEN=""
AGENT_ID="` + agentID + `"
CURL_ARGS=(-fsSL --connect-timeout 5 -X POST -H "Content-Type: application/json")
if [[ -n "$PULSE_TOKEN" ]]; then CURL_ARGS+=(-H "X-API-Token: ${PULSE_TOKEN}"); fi
curl "${CURL_ARGS[@]}" -d "{\"agentId\": \"${AGENT_ID}\"}" "${PULSE_URL}/api/agents/agent/uninstall" >/dev/null 2>&1 || true
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
mu.Lock()
defer mu.Unlock()
if gotMethod != "POST" {
t.Errorf("method = %q, want POST", gotMethod)
}
if gotPath != "/api/agents/agent/uninstall" {
t.Errorf("path = %q, want /api/agents/agent/uninstall", gotPath)
}
if gotBody["agentId"] != agentID {
t.Errorf("body agentId = %q, want %q", gotBody["agentId"], agentID)
}
if got := gotHeaders.Get("X-API-Token"); got != "" {
t.Errorf("X-API-Token = %q, want empty", got)
}
if got := gotHeaders.Get("Content-Type"); got != "application/json" {
t.Errorf("Content-Type = %q, want application/json", got)
}
}
func extractInstallShellFunction(t *testing.T, name string) string {
t.Helper()
content, err := os.ReadFile(filepath.Join("..", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
pattern := regexp.MustCompile(`(?ms)^` + regexp.QuoteMeta(name) + `\(\) \{\n.*?^\}`)
match := pattern.Find(content)
if match == nil {
t.Fatalf("could not find %s in install.sh", name)
}
return string(match)
}
func extractRootInstallShellFunction(t *testing.T, name string) string {
t.Helper()
content, err := os.ReadFile(filepath.Join("..", "..", "install.sh"))
if err != nil {
t.Fatalf("read root install.sh: %v", err)
}
pattern := regexp.MustCompile(`(?ms)^` + regexp.QuoteMeta(name) + `\(\) \{\n.*?^\}`)
match := pattern.Find(content)
if match == nil {
t.Fatalf("could not find %s in root install.sh", name)
}
return string(match)
}
func extractSelectedUpdateChannelShellFunctions(t *testing.T) string {
t.Helper()
return extractRootInstallShellFunction(t, "read_configured_update_channel") + "\n" +
extractRootInstallShellFunction(t, "selected_update_channel")
}
func extractSetupAutoUpdatesShellFunctions(t *testing.T) string {
t.Helper()
return extractSelectedUpdateChannelShellFunctions(t) + "\n" +
extractRootInstallShellFunction(t, "repo_web_url") + "\n" +
extractRootInstallShellFunction(t, "configure_auto_update_script_repo") + "\n" +
extractInstallAutoUpdateAssetsShellFunctions(t) + "\n" +
extractRootInstallShellFunction(t, "setup_auto_updates")
}
// install_auto_update_assets delegates its writability probe, its staged-helper
// sanity check and the sandbox-escape migration to sibling functions, so every
// harness that executes it has to pull those in alongside it.
func extractInstallAutoUpdateAssetsShellFunctions(t *testing.T) string {
t.Helper()
return extractRootInstallShellFunction(t, "auto_update_dir_writable") + "\n" +
extractRootInstallShellFunction(t, "auto_update_helper_is_sane") + "\n" +
extractRootInstallShellFunction(t, "migrate_auto_update_assets_outside_sandbox") + "\n" +
extractRootInstallShellFunction(t, "install_auto_update_assets")
}
func prepareAutoUpdatePaths(t *testing.T, tmpDir string) (string, string, string) {
t.Helper()
autoUpdateDest := filepath.Join(tmpDir, "bin", "pulse-auto-update.sh")
servicePath := filepath.Join(tmpDir, "systemd", "pulse-update.service")
timerPath := filepath.Join(tmpDir, "systemd", "pulse-update.timer")
if err := os.MkdirAll(filepath.Dir(autoUpdateDest), 0755); err != nil {
t.Fatalf("mkdir auto-update dest dir: %v", err)
}
if err := os.MkdirAll(filepath.Dir(servicePath), 0755); err != nil {
t.Fatalf("mkdir systemd dir: %v", err)
}
return autoUpdateDest, servicePath, timerPath
}
func extractAutoUpdateFunction(t *testing.T, name string) string {
t.Helper()
content, err := os.ReadFile(filepath.Join("..", "pulse-auto-update.sh"))
if err != nil {
t.Fatalf("read pulse-auto-update.sh: %v", err)
}
pattern := regexp.MustCompile(`(?ms)^` + regexp.QuoteMeta(name) + `\(\) \{\n.*?^\}`)
match := pattern.Find(content)
if match == nil {
t.Fatalf("could not find %s in pulse-auto-update.sh", name)
}
return string(match)
}
func extractInstallShellSection(t *testing.T, startMarker string, endMarker string) string {
t.Helper()
content, err := os.ReadFile(filepath.Join("..", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
text := string(content)
start := strings.Index(text, startMarker)
if start == -1 {
t.Fatalf("could not find start marker %q in install.sh", startMarker)
}
end := strings.Index(text[start:], endMarker)
if end == -1 {
t.Fatalf("could not find end marker %q in install.sh", endMarker)
}
return text[start : start+end]
}
func TestPlainHTTPInstallAutoEnablesInsecure(t *testing.T) {
script := `
log_info() { :; }
` + extractInstallShellFunction(t, "pulse_url_uses_plain_http") + `
` + extractInstallShellFunction(t, "auto_enable_insecure_for_plain_http_url") + `
PULSE_URL="http://192.168.0.98:7655"
INSECURE="false"
auto_enable_insecure_for_plain_http_url
echo "$INSECURE"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "true" {
t.Fatalf("INSECURE = %q, want true", got)
}
}
func TestHTTPSInstallKeepsInsecureDisabledByDefault(t *testing.T) {
script := `
log_info() { :; }
` + extractInstallShellFunction(t, "pulse_url_uses_plain_http") + `
` + extractInstallShellFunction(t, "auto_enable_insecure_for_plain_http_url") + `
PULSE_URL="https://pulse.example.com"
INSECURE="false"
auto_enable_insecure_for_plain_http_url
echo "$INSECURE"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "false" {
t.Fatalf("INSECURE = %q, want false", got)
}
}
func TestBuildExecArgsArrayPersistsInsecureForPlainHTTPInstall(t *testing.T) {
script := `
log_info() { :; }
` + extractInstallShellFunction(t, "pulse_url_uses_plain_http") + `
` + extractInstallShellFunction(t, "auto_enable_insecure_for_plain_http_url") + `
` + extractInstallShellFunction(t, "build_exec_arg_items") + `
` + extractInstallShellFunction(t, "build_exec_args_array") + `
PULSE_URL="http://pulse.local:7655"
PULSE_TOKEN="deadbeef"
INTERVAL="30s"
ENABLE_HOST="true"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_TYPE=""
INSECURE="false"
RUNTIME_TOKEN_FILE="/var/lib/pulse-agent/token"
ENABLE_COMMANDS=""
ENROLL=""
KUBE_INCLUDE_ALL_PODS=""
KUBE_INCLUDE_ALL_DEPLOYMENTS=""
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR=""
DISK_EXCLUDES=()
auto_enable_insecure_for_plain_http_url
build_exec_args_array
printf '%s\n' "${EXEC_ARGS_ARRAY[*]}"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
if !strings.Contains(got, "--insecure") {
t.Fatalf("EXEC_ARGS_ARRAY missing --insecure: %s", got)
}
if !strings.Contains(got, "--token-file /var/lib/pulse-agent/token") {
t.Fatalf("EXEC_ARGS_ARRAY missing runtime token file: %s", got)
}
if strings.Contains(got, "--token deadbeef") {
t.Fatalf("EXEC_ARGS_ARRAY preserved raw token: %s", got)
}
}
func TestBuildExecArgsWithoutTokenOmitsPersistedToken(t *testing.T) {
script := `
` + extractInstallShellFunction(t, "build_exec_arg_items") + `
` + extractInstallShellFunction(t, "join_exec_arg_items") + `
` + extractInstallShellFunction(t, "build_exec_args_without_token") + `
PULSE_URL="https://pulse.example.com"
PULSE_TOKEN="deadbeef"
INTERVAL="30s"
ENABLE_HOST="true"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBECONFIG_PATH=""
ENABLE_PROXMOX="true"
PROXMOX_TYPE="pbs"
INSECURE="false"
ENABLE_COMMANDS=""
ENROLL=""
KUBE_INCLUDE_ALL_PODS=""
KUBE_INCLUDE_ALL_DEPLOYMENTS=""
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="/var/lib/pulse-agent"
DISK_EXCLUDES=("/boot pool")
build_exec_args_without_token
printf '%s\n' "$EXEC_ARGS"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
if strings.Contains(got, "--token") {
t.Fatalf("EXEC_ARGS unexpectedly preserved token: %s", got)
}
if !strings.Contains(got, "--proxmox-type pbs") {
t.Fatalf("EXEC_ARGS missing proxmox type: %s", got)
}
if !strings.Contains(got, `--disk-exclude /boot\ pool`) {
t.Fatalf("EXEC_ARGS missing quoted disk exclude: %s", got)
}
}
func TestStateDirFlagIsAcceptedByInstallerParser(t *testing.T) {
script := `
fail() { echo "FAIL:$1"; exit 99; }
PULSE_URL=""
PULSE_TOKEN=""
INTERVAL="30s"
ENABLE_HOST="true"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
UNINSTALL="false"
INSECURE="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
ENABLE_COMMANDS="false"
ENROLL="false"
KUBECONFIG_PATH=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
STATE_DIR="/var/lib/pulse-agent"
CURL_CA_BUNDLE=""
NON_INTERACTIVE="false"
TOKEN_FILE_PATH=""
OUTPUT_FORMAT="text"
PREFLIGHT_ONLY="false"
set -- --state-dir /tmp/pulse-agent-state --non-interactive --url https://pulse.example.com --token deadbeef
` + extractInstallShellSection(t, "# --- Parse Arguments ---", "# Read token from file if --token-file was provided") + `
printf 'STATE_DIR=%s\nNON_INTERACTIVE=%s\nPULSE_URL=%s\n' "$STATE_DIR" "$NON_INTERACTIVE" "$PULSE_URL"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
if !strings.Contains(got, "STATE_DIR=/tmp/pulse-agent-state") {
t.Fatalf("STATE_DIR not parsed correctly:\n%s", got)
}
if !strings.Contains(got, "NON_INTERACTIVE=true") {
t.Fatalf("NON_INTERACTIVE not parsed correctly:\n%s", got)
}
if !strings.Contains(got, "PULSE_URL=https://pulse.example.com") {
t.Fatalf("PULSE_URL not parsed correctly:\n%s", got)
}
}
func TestInstallSHCustomStateDirOwnsTokenAndEnrollmentContinuity(t *testing.T) {
stateDir := filepath.Join(t.TempDir(), "custom-state")
if err := os.MkdirAll(stateDir, 0755); err != nil {
t.Fatal(err)
}
tokenPath := filepath.Join(stateDir, "token")
runtimePath := filepath.Join(stateDir, "runtime.token")
if err := os.WriteFile(tokenPath, []byte("aaa111"), 0600); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(runtimePath, []byte("runtime-one"), 0600); err != nil {
t.Fatal(err)
}
ensureToken := extractInstallShellFunction(t, "ensure_runtime_token_file")
run := func(token string) string {
t.Helper()
script := `
set -euo pipefail
PULSE_TOKEN="` + token + `"
STATE_DIR="` + stateDir + `"
ENROLL="true"
RUNTIME_TOKEN_FILE=""
RUNTIME_TOKEN_CHANGED="false"
log_info() { :; }
` + ensureToken + `
ensure_runtime_token_file "$STATE_DIR"
printf 'changed=%s runtime=%s token_file=%s\n' \
"$RUNTIME_TOKEN_CHANGED" "$([[ -f "$STATE_DIR/runtime.token" ]] && echo present || echo missing)" "$RUNTIME_TOKEN_FILE"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
return string(out)
}
if got := run("aaa111"); !strings.Contains(got, "changed=false runtime=present") {
t.Fatalf("unchanged bootstrap token did not preserve enrollment runtime state:\n%s", got)
}
if got := run("bbb222"); !strings.Contains(got, "changed=true runtime=missing") {
t.Fatalf("changed bootstrap token did not force re-enrollment:\n%s", got)
}
for path, want := range map[string]os.FileMode{
stateDir: 0700,
tokenPath: 0600,
} {
info, err := os.Stat(path)
if err != nil {
t.Fatal(err)
}
if got := info.Mode().Perm(); got != want {
t.Fatalf("%s mode = %o, want %o", path, got, want)
}
}
}
func TestInstallSHExplicitCustomStateNeverFallsBackToDefaultInstance(t *testing.T) {
root := t.TempDir()
customState := filepath.Join(root, "custom")
defaultState := filepath.Join(root, "default")
for _, dir := range []string{customState, defaultState} {
if err := os.MkdirAll(dir, 0700); err != nil {
t.Fatal(err)
}
}
customConn := filepath.Join(customState, "connection.env")
if err := os.WriteFile(customConn, []byte("PULSE_URL='https://custom.example'\n"), 0600); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(defaultState, "connection.env"), []byte("PULSE_URL='https://default.example'\n"), 0600); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(defaultState, "agent-id"), []byte("default-agent"), 0600); err != nil {
t.Fatal(err)
}
script := `
set -euo pipefail
STATE_DIR="` + customState + `"
STATE_DIR_SOURCE="explicit"
DEFAULT_STATE_DIR="` + defaultState + `"
TRUENAS_STATE_DIR="` + filepath.Join(root, "truenas") + `"
` + extractInstallShellFunction(t, "find_connection_state_file") + `
` + extractInstallShellFunction(t, "recover_agent_id_from_state_file") + `
printf 'connection=%s\n' "$(find_connection_state_file)"
rm -f "$STATE_DIR/connection.env"
printf 'fallback_connection=%s\n' "$(find_connection_state_file || true)"
printf 'fallback_agent=%s\n' "$(recover_agent_id_from_state_file || true)"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
if !strings.Contains(got, "connection="+customConn) {
t.Fatalf("custom connection state was not preferred:\n%s", got)
}
if !strings.Contains(got, "fallback_connection=\n") || !strings.Contains(got, "fallback_agent=\n") {
t.Fatalf("explicit custom state borrowed default instance state:\n%s", got)
}
}
func TestInstallSHSavedInstallerDiscoversItsCustomStateDir(t *testing.T) {
stateDir := filepath.Join(t.TempDir(), "saved custom state")
if err := os.MkdirAll(stateDir, 0700); err != nil {
t.Fatal(err)
}
installerPath := filepath.Join(stateDir, "install.sh")
if err := os.WriteFile(installerPath, []byte("#!/usr/bin/env bash\n"), 0700); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(stateDir, "connection.env"), []byte("PULSE_URL='https://pulse.example'\n"), 0600); err != nil {
t.Fatal(err)
}
script := `
set -euo pipefail
STATE_DIR="/var/lib/pulse-agent"
STATE_DIR_SOURCE="default"
` + extractInstallShellFunction(t, "discover_state_dir_from_saved_installer") + `
discover_state_dir_from_saved_installer "` + installerPath + `"
printf 'state=%s source=%s\n' "$STATE_DIR" "$STATE_DIR_SOURCE"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
resolvedStateDir, err := filepath.EvalSymlinks(stateDir)
if err != nil {
t.Fatal(err)
}
if !strings.Contains(got, "state="+resolvedStateDir) || !strings.Contains(got, "source=recovered") {
t.Fatalf("saved installer did not discover adjacent custom state:\n%s", got)
}
}
func TestInstallSHDiscoversCustomStateDirFromGeneratedSystemdUnit(t *testing.T) {
for _, commandsEnabled := range []bool{false, true} {
t.Run(map[bool]string{false: "commands_disabled", true: "commands_enabled"}[commandsEnabled], func(t *testing.T) {
root := t.TempDir()
customState := filepath.Join(root, "custom state")
defaultState := filepath.Join(root, "default")
if err := os.MkdirAll(customState, 0700); err != nil {
t.Fatal(err)
}
if err := os.MkdirAll(defaultState, 0700); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(customState, "token"), []byte("custom123"), 0600); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(defaultState, "token"), []byte("default999"), 0600); err != nil {
t.Fatal(err)
}
commandArg := ""
if commandsEnabled {
commandArg = " --enable-commands"
}
unitPath := filepath.Join(root, "pulse-agent.service")
unit := `[Service]
ExecStart=/usr/local/bin/pulse-agent --url https://custom.example --token-file ` +
strings.ReplaceAll(filepath.Join(customState, "token"), " ", `\ `) +
` --state-dir ` + strings.ReplaceAll(customState, " ", `\ `) + commandArg + "\n"
if err := os.WriteFile(unitPath, []byte(unit), 0644); err != nil {
t.Fatal(err)
}
script := `
set -euo pipefail
AGENT_NAME="pulse-agent"
PULSE_URL=""
PULSE_TOKEN=""
INTERVAL="30s"
INTERVAL_EXPLICIT="false"
ENABLE_HOST="true"
HOST_EXPLICIT="false"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
INSECURE="false"
ENABLE_COMMANDS="false"
ENROLL="false"
HEALTH_ADDR=""
HEALTH_ADDR_SET="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="` + defaultState + `"
STATE_DIR_SOURCE="default"
DEFAULT_STATE_DIR="` + defaultState + `"
TRUENAS_STATE_DIR="` + filepath.Join(root, "truenas") + `"
CURL_CA_BUNDLE=""
SERVER_FINGERPRINT=""
OBSERVERS_FILE=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
log_warn() { :; }
systemctl() { printf '%s\n' "` + unitPath + `"; }
` + extractInstallShellFunction(t, "strip_recovered_arg_quotes") + `
` + extractInstallShellFunction(t, "normalize_recovered_agent_arg_key") + `
` + extractInstallShellFunction(t, "apply_recovered_agent_arg_value") + `
` + extractInstallShellFunction(t, "recovered_connection_state_ready") + `
` + extractInstallShellFunction(t, "recover_token_from_default_agent_token_file") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_arg_stream") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_env_stream") + `
` + extractInstallShellFunction(t, "split_recovered_shell_words") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_systemd_unit") + `
` + extractInstallShellFunction(t, "remove_agent_state_dir") + `
recover_connection_state_from_systemd_unit
printf 'state=%s source=%s url=%s token=%s commands=%s\n' \
"$STATE_DIR" "$STATE_DIR_SOURCE" "$PULSE_URL" "$PULSE_TOKEN" "$ENABLE_COMMANDS"
remove_agent_state_dir "$STATE_DIR"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
for _, want := range []string{
"state=" + customState,
"source=recovered",
"url=https://custom.example",
"token=custom123",
"commands=" + map[bool]string{false: "false", true: "true"}[commandsEnabled],
} {
if !strings.Contains(got, want) {
t.Fatalf("systemd discovery missing %q:\n%s", want, got)
}
}
if strings.Contains(got, "default999") {
t.Fatalf("systemd discovery borrowed default token:\n%s", got)
}
if _, err := os.Stat(customState); !os.IsNotExist(err) {
t.Fatalf("uninstall did not remove discovered custom state: %v", err)
}
if _, err := os.Stat(defaultState); err != nil {
t.Fatalf("uninstall removed the default instance instead of discovered custom state: %v", err)
}
})
}
}
func TestInstallSHDiscoversCustomStateDirFromGeneratedLaunchdPlist(t *testing.T) {
root := t.TempDir()
customState := filepath.Join(root, "custom & state")
if err := os.MkdirAll(customState, 0700); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(customState, "token"), []byte("launch123"), 0600); err != nil {
t.Fatal(err)
}
plistPath := filepath.Join(root, "com.pulse.agent.plist")
escapedState := strings.ReplaceAll(customState, "&", "&amp;")
plist := `<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0"><dict>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/pulse-agent</string>
<string>--url</string>
<string>https://launch.example</string>
<string>--token-file</string>
<string>` + escapedState + `/token</string>
<string>--state-dir</string>
<string>` + escapedState + `</string>
<string>--enable-commands</string>
</array>
</dict></plist>`
if err := os.WriteFile(plistPath, []byte(plist), 0644); err != nil {
t.Fatal(err)
}
script := `
set -euo pipefail
PULSE_URL=""
PULSE_TOKEN=""
INTERVAL="30s"
INTERVAL_EXPLICIT="false"
ENABLE_HOST="true"
HOST_EXPLICIT="false"
ENABLE_DOCKER=""
DOCKER_EXPLICIT="false"
ENABLE_KUBERNETES=""
KUBERNETES_EXPLICIT="false"
KUBECONFIG_PATH=""
ENABLE_PROXMOX=""
PROXMOX_EXPLICIT="false"
PROXMOX_TYPE=""
INSECURE="false"
ENABLE_COMMANDS="false"
ENROLL="false"
HEALTH_ADDR=""
HEALTH_ADDR_SET="false"
AGENT_ID=""
HOSTNAME_OVERRIDE=""
STATE_DIR="/var/lib/pulse-agent"
STATE_DIR_SOURCE="default"
DEFAULT_STATE_DIR="/var/lib/pulse-agent"
TRUENAS_STATE_DIR="/data/pulse-agent"
CURL_CA_BUNDLE=""
SERVER_FINGERPRINT=""
OBSERVERS_FILE=""
KUBE_INCLUDE_ALL_PODS="false"
KUBE_INCLUDE_ALL_DEPLOYMENTS="false"
DISK_EXCLUDES=()
` + extractInstallShellFunction(t, "strip_recovered_arg_quotes") + `
` + extractInstallShellFunction(t, "normalize_recovered_agent_arg_key") + `
` + extractInstallShellFunction(t, "apply_recovered_agent_arg_value") + `
` + extractInstallShellFunction(t, "recovered_connection_state_ready") + `
` + extractInstallShellFunction(t, "recover_token_from_default_agent_token_file") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_arg_stream") + `
` + extractInstallShellFunction(t, "launchd_agent_arg_stream") + `
` + extractInstallShellFunction(t, "recover_connection_state_from_launchd_plist") + `
recover_connection_state_from_launchd_plist "` + plistPath + `"
printf 'state=%s url=%s token=%s commands=%s\n' "$STATE_DIR" "$PULSE_URL" "$PULSE_TOKEN" "$ENABLE_COMMANDS"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
for _, want := range []string{
"state=" + customState,
"url=https://launch.example",
"token=launch123",
"commands=true",
} {
if !strings.Contains(got, want) {
t.Fatalf("launchd discovery missing %q:\n%s", want, got)
}
}
}
func TestInstallSHConnectionEnvPersistsCanonicalStateDirWithoutTokenValue(t *testing.T) {
stateDir := filepath.Join(t.TempDir(), "state")
script := `
set -euo pipefail
STATE_DIR="` + stateDir + `"
PULSE_URL="https://pulse.example.com"
PULSE_TOKEN="deadbeef"
RUNTIME_TOKEN_FILE="$STATE_DIR/token"
AGENT_ID="agent-custom"
HOSTNAME_OVERRIDE="host-custom"
REPORT_IP="192.168.1.9"
INSECURE="false"
SERVER_FINGERPRINT=""
CURL_CA_BUNDLE=""
SAVED_INSTALL_SCRIPT=""
` + extractInstallShellFunction(t, "write_connection_state_value") + `
` + extractInstallShellFunction(t, "save_connection_info") + `
curl() { return 1; }
save_connection_info "$STATE_DIR"
cat "$STATE_DIR/connection.env"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
if !strings.Contains(got, "PULSE_STATE_DIR='"+stateDir+"'") ||
!strings.Contains(got, "PULSE_TOKEN_FILE='"+filepath.Join(stateDir, "token")+"'") {
t.Fatalf("connection.env did not persist canonical state paths:\n%s", got)
}
if !strings.Contains(got, "PULSE_REPORT_IP='192.168.1.9'") {
t.Fatalf("connection.env did not persist the report IP:\n%s", got)
}
if strings.Contains(got, "PULSE_TOKEN='") || strings.Contains(got, "deadbeef") {
t.Fatalf("connection.env leaked the token value:\n%s", got)
}
info, err := os.Stat(filepath.Join(stateDir, "connection.env"))
if err != nil {
t.Fatal(err)
}
if gotMode := info.Mode().Perm(); gotMode != 0600 {
t.Fatalf("connection.env mode = %o, want 600", gotMode)
}
}
func TestInstallSHStateWritesReplaceSymlinksAtomically(t *testing.T) {
stateDir := filepath.Join(t.TempDir(), "state")
if err := os.MkdirAll(stateDir, 0700); err != nil {
t.Fatal(err)
}
victimToken := filepath.Join(t.TempDir(), "victim-token")
victimConnection := filepath.Join(t.TempDir(), "victim-connection")
if err := os.WriteFile(victimToken, []byte("victim-token-content"), 0600); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(victimConnection, []byte("victim-connection-content"), 0600); err != nil {
t.Fatal(err)
}
if err := os.Symlink(victimToken, filepath.Join(stateDir, "token")); err != nil {
t.Fatal(err)
}
if err := os.Symlink(victimConnection, filepath.Join(stateDir, "connection.env")); err != nil {
t.Fatal(err)
}
script := `
set -euo pipefail
STATE_DIR="` + stateDir + `"
PULSE_URL="https://pulse.example.com"
IFS= read -r PULSE_TOKEN
RUNTIME_TOKEN_FILE=""
RUNTIME_TOKEN_CHANGED="false"
ENROLL="false"
AGENT_ID="agent-one"
HOSTNAME_OVERRIDE="host-one"
REPORT_IP=""
INSECURE="false"
SERVER_FINGERPRINT=""
CURL_CA_BUNDLE=""
SAVED_INSTALL_SCRIPT=""
NON_INTERACTIVE="true"
TMP_FILES=()
log_info() { :; }
curl() { return 1; }
` + extractInstallShellFunction(t, "write_connection_state_value") + `
` + extractInstallShellFunction(t, "ensure_runtime_token_file") + `
` + extractInstallShellFunction(t, "save_connection_info") + `
ensure_runtime_token_file "$STATE_DIR"
save_connection_info "$STATE_DIR"
`
cmd := exec.Command("bash", "-c", script)
cmd.Stdin = strings.NewReader("new-token-content\n")
out, err := cmd.CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
for path, want := range map[string]string{
victimToken: "victim-token-content",
victimConnection: "victim-connection-content",
} {
got, err := os.ReadFile(path)
if err != nil {
t.Fatal(err)
}
if string(got) != want {
t.Fatalf("state write followed symlink and modified %s: %q", path, got)
}
}
for _, path := range []string{filepath.Join(stateDir, "token"), filepath.Join(stateDir, "connection.env")} {
info, err := os.Lstat(path)
if err != nil {
t.Fatal(err)
}
if info.Mode()&os.ModeSymlink != 0 {
t.Fatalf("%s remained a symlink after atomic replacement", path)
}
}
}
func TestInstallSHCurlTokenTransportKeepsSecretOutOfArgv(t *testing.T) {
recordDir := t.TempDir()
argsPath := filepath.Join(recordDir, "args")
configPath := filepath.Join(recordDir, "config")
script := `
set -euo pipefail
PULSE_TOKEN="feedface"
curl() {
printf '%s\n' "$@" > "` + argsPath + `"
while [[ $# -gt 0 ]]; do
if [[ "$1" == "--config" ]]; then
cp "$2" "` + configPath + `"
shift 2
continue
fi
shift
done
}
` + extractInstallShellFunction(t, "curl_with_pulse_token") + `
curl_with_pulse_token -sS https://pulse.example.com/api/agents/agent/lookup
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
args, err := os.ReadFile(argsPath)
if err != nil {
t.Fatal(err)
}
if strings.Contains(string(args), "feedface") || strings.Contains(string(args), "X-API-Token") {
t.Fatalf("curl argv leaked token material:\n%s", args)
}
config, err := os.ReadFile(configPath)
if err != nil {
t.Fatal(err)
}
if !strings.Contains(string(config), "X-API-Token: feedface") {
t.Fatalf("private curl config did not carry auth header:\n%s", config)
}
}
func TestSetupUpdateCommandHonorsRCChannelAndCustomPaths(t *testing.T) {
tmpDir := t.TempDir()
updatePath := filepath.Join(tmpDir, "update")
profilePath := filepath.Join(tmpDir, "profile")
bashrcPath := filepath.Join(tmpDir, "bashrc")
configDir := filepath.Join(tmpDir, "pulse-config")
if err := os.MkdirAll(configDir, 0755); err != nil {
t.Fatalf("mkdir config dir: %v", err)
}
if err := os.WriteFile(filepath.Join(configDir, "system.json"), []byte(`{"updateChannel":"rc"}`), 0644); err != nil {
t.Fatalf("write system.json: %v", err)
}
if err := os.WriteFile(bashrcPath, []byte(""), 0644); err != nil {
t.Fatalf("write bashrc: %v", err)
}
script := `
PULSE_UPDATE_HELPER_PATH="` + updatePath + `"
PULSE_PROFILE_PATH="` + profilePath + `"
PULSE_BASHRC_PATH="` + bashrcPath + `"
GITHUB_REPO="example/pulse-fork"
` + extractRootInstallShellFunction(t, "setup_update_command") + `
setup_update_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
content, err := os.ReadFile(updatePath)
if err != nil {
t.Fatalf("read update helper: %v", err)
}
got := string(content)
if !strings.Contains(got, `CONFIG_DIR=/etc/pulse`) {
t.Fatalf("update helper missing config dir logic:\n%s", got)
}
if !strings.Contains(got, `helper_args=()`) || !strings.Contains(got, `helper_args=("$@")`) {
t.Fatalf("update helper missing passthrough helper args:\n%s", got)
}
if !strings.Contains(got, `-h|--help|--uninstall|--version|--rc|--pre|--stable|--source|--from-source|--branch|--archive|--archive=*|--skip-upgrade-preflight)`) {
t.Fatalf("update helper missing auto-selector guard for explicit flags:\n%s", got)
}
if !strings.Contains(got, `extra_args+=("${helper_args[@]}")`) {
t.Fatalf("update helper missing forwarded helper args:\n%s", got)
}
if !strings.Contains(got, `extra_args+=(--rc)`) {
t.Fatalf("update helper missing rc channel forwarding:\n%s", got)
}
if !strings.Contains(got, `INSTALLER_URL="https://github.com/example/pulse-fork/releases/latest/download/install.sh"`) {
t.Fatalf("update helper missing configured repo installer url:\n%s", got)
}
if !strings.Contains(got, `INSTALLER_SIG_URL="${INSTALLER_URL}.sshsig"`) {
t.Fatalf("update helper missing installer signature url:\n%s", got)
}
if !strings.Contains(got, `verify_release_signature "$tmp_installer" "$tmp_signature" "downloaded Pulse installer"`) {
t.Fatalf("update helper missing signed installer verification:\n%s", got)
}
if strings.Contains(got, `curl -fsSL "$INSTALLER_URL" |`) {
t.Fatalf("update helper still pipes installer directly to bash:\n%s", got)
}
profileContent, err := os.ReadFile(profilePath)
if err != nil {
t.Fatalf("read profile: %v", err)
}
if !strings.Contains(string(profileContent), `/usr/local/bin`) {
t.Fatalf("profile not updated with /usr/local/bin path:\n%s", profileContent)
}
}
func TestSetupUpdateCommandUsesConfiguredInstallerRepo(t *testing.T) {
tmpDir := t.TempDir()
updatePath := filepath.Join(tmpDir, "update")
profilePath := filepath.Join(tmpDir, "profile")
bashrcPath := filepath.Join(tmpDir, "bashrc")
if err := os.WriteFile(bashrcPath, []byte(""), 0644); err != nil {
t.Fatalf("write bashrc: %v", err)
}
script := `
PULSE_UPDATE_HELPER_PATH="` + updatePath + `"
PULSE_PROFILE_PATH="` + profilePath + `"
PULSE_BASHRC_PATH="` + bashrcPath + `"
GITHUB_REPO="example/pulse-fork"
` + extractRootInstallShellFunction(t, "setup_update_command") + `
setup_update_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
content, err := os.ReadFile(updatePath)
if err != nil {
t.Fatalf("read update helper: %v", err)
}
got := string(content)
if strings.Contains(got, "https://github.com/rcourtman/Pulse/releases/latest/download/install.sh") {
t.Fatalf("update helper still hardcodes upstream repo:\n%s", got)
}
if !strings.Contains(got, `INSTALLER_URL="https://github.com/example/pulse-fork/releases/latest/download/install.sh"`) {
t.Fatalf("update helper missing configured installer repo:\n%s", got)
}
if !strings.Contains(got, `INSTALLER_SIG_URL="${INSTALLER_URL}.sshsig"`) {
t.Fatalf("update helper missing signature sidecar url:\n%s", got)
}
}
func TestSetupUpdateCommandFailsWhenInstallerDownloadFails(t *testing.T) {
tmpDir := t.TempDir()
updatePath := filepath.Join(tmpDir, "update")
profilePath := filepath.Join(tmpDir, "profile")
bashrcPath := filepath.Join(tmpDir, "bashrc")
curlPath := filepath.Join(tmpDir, "curl")
fakeBashPath := filepath.Join(tmpDir, "bash")
if err := os.WriteFile(bashrcPath, []byte(""), 0644); err != nil {
t.Fatalf("write bashrc: %v", err)
}
if err := os.WriteFile(curlPath, []byte("#!/usr/bin/env bash\nexit 22\n"), 0755); err != nil {
t.Fatalf("write curl stub: %v", err)
}
if err := os.WriteFile(fakeBashPath, []byte("#!/usr/bin/env bash\ncat >/dev/null\nexit 0\n"), 0755); err != nil {
t.Fatalf("write bash stub: %v", err)
}
script := `
PULSE_UPDATE_HELPER_PATH="` + updatePath + `"
PULSE_PROFILE_PATH="` + profilePath + `"
PULSE_BASHRC_PATH="` + bashrcPath + `"
` + extractRootInstallShellFunction(t, "setup_update_command") + `
setup_update_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
cmd := exec.Command("bash", updatePath)
cmd.Env = append(os.Environ(), "PATH="+tmpDir+string(os.PathListSeparator)+os.Getenv("PATH"))
out, err = cmd.CombinedOutput()
if err == nil {
t.Fatalf("expected generated update helper to fail when curl fails:\n%s", out)
}
if !strings.Contains(string(out), "Updating Pulse...") {
t.Fatalf("expected helper output before failure, got:\n%s", out)
}
}
func TestResolveInstallScriptDownloadURLUsesForcedVersion(t *testing.T) {
script := `
GITHUB_REPO="rcourtman/Pulse"
FORCE_VERSION="v1.2.3"
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
` + extractRootInstallShellFunction(t, "resolve_install_script_download_url") + `
resolve_install_script_download_url
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "https://github.com/rcourtman/Pulse/releases/download/v1.2.3/install.sh"
if got != want {
t.Fatalf("download url = %q, want %q", got, want)
}
}
func TestRootInstallStableReleaseTagRejectsPrereleaseShapes(t *testing.T) {
script := `
` + extractRootInstallShellFunction(t, "is_stable_release_tag") + `
if ! is_stable_release_tag v5.1.29; then
echo "rejected v-prefixed stable tag" >&2
exit 1
fi
if ! is_stable_release_tag 5.1.29; then
echo "rejected bare stable tag" >&2
exit 1
fi
if is_stable_release_tag v6.0.0-rc.2; then
echo "accepted rc tag" >&2
exit 1
fi
if is_stable_release_tag v6.0.0-beta.1; then
echo "accepted beta tag" >&2
exit 1
fi
if is_stable_release_tag latest; then
echo "accepted floating tag" >&2
exit 1
fi
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
}
func TestResolveLatestReleaseTagForStableChannelSkipsPrereleaseShapedTags(t *testing.T) {
tmpDir := t.TempDir()
timeoutPath := filepath.Join(tmpDir, "timeout")
curlPath := filepath.Join(tmpDir, "curl")
if err := os.WriteFile(timeoutPath, []byte("#!/usr/bin/env bash\nshift\nexec \"$@\"\n"), 0755); err != nil {
t.Fatalf("write timeout stub: %v", err)
}
curlStub := `#!/usr/bin/env bash
for arg in "$@"; do
if [[ "$arg" == "https://api.github.com/repos/rcourtman/Pulse/releases" ]]; then
printf '%s\n' '[{"draft":false,"prerelease":false,"tag_name":"v6.0.0-rc.2"},{"draft":false,"prerelease":false,"tag_name":"v5.1.29"}]'
exit 0
fi
done
echo "unexpected curl invocation: $*" >&2
exit 1
`
if err := os.WriteFile(curlPath, []byte(curlStub), 0755); err != nil {
t.Fatalf("write curl stub: %v", err)
}
script := `
PATH="` + tmpDir + `:$PATH"
GITHUB_REPO="rcourtman/Pulse"
get_latest_release_from_redirect() {
printf '%s\n' v6.0.0-rc.2
}
` + extractRootInstallShellFunction(t, "is_stable_release_tag") + `
` + extractRootInstallShellFunction(t, "latest_stable_release_tag_from_json") + `
` + extractRootInstallShellFunction(t, "resolve_latest_release_tag_for_channel") + `
resolve_latest_release_tag_for_channel stable
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "v5.1.29" {
t.Fatalf("stable release = %q, want v5.1.29", got)
}
}
func TestResolveLatestReleaseTagForStableChannelRejectsPrereleaseRedirect(t *testing.T) {
script := `
GITHUB_REPO="rcourtman/Pulse"
curl() { return 1; }
timeout() { shift; "$@"; }
get_latest_release_from_redirect() {
printf '%s\n' v6.0.0-rc.2
}
` + extractRootInstallShellFunction(t, "is_stable_release_tag") + `
` + extractRootInstallShellFunction(t, "latest_stable_release_tag_from_json") + `
` + extractRootInstallShellFunction(t, "resolve_latest_release_tag_for_channel") + `
if resolve_latest_release_tag_for_channel stable; then
echo "stable channel accepted prerelease redirect" >&2
exit 1
fi
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
}
func TestResolveInstallScriptDownloadURLUsesStableReleaseTag(t *testing.T) {
tmpDir := t.TempDir()
timeoutPath := filepath.Join(tmpDir, "timeout")
curlPath := filepath.Join(tmpDir, "curl")
if err := os.WriteFile(timeoutPath, []byte("#!/usr/bin/env bash\nshift\nexec \"$@\"\n"), 0755); err != nil {
t.Fatalf("write timeout stub: %v", err)
}
curlStub := `#!/usr/bin/env bash
for arg in "$@"; do
if [[ "$arg" == "https://api.github.com/repos/rcourtman/Pulse/releases" ]]; then
printf '%s\n' '[{"draft":false,"prerelease":true,"tag_name":"v6.0.0-rc.2"},{"draft":false,"prerelease":false,"tag_name":"v5.1.29"}]'
exit 0
fi
done
echo "unexpected curl invocation: $*" >&2
exit 1
`
if err := os.WriteFile(curlPath, []byte(curlStub), 0755); err != nil {
t.Fatalf("write curl stub: %v", err)
}
script := `
PATH="` + tmpDir + `:$PATH"
GITHUB_REPO="rcourtman/Pulse"
FORCE_VERSION=""
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
get_latest_release_from_redirect() {
printf '%s\n' v6.0.0-rc.2
}
` + extractRootInstallShellFunction(t, "is_stable_release_tag") + `
` + extractRootInstallShellFunction(t, "latest_stable_release_tag_from_json") + `
` + extractRootInstallShellFunction(t, "resolve_latest_release_tag_for_channel") + `
` + extractRootInstallShellFunction(t, "resolve_install_script_download_url") + `
resolve_install_script_download_url
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "https://github.com/rcourtman/Pulse/releases/download/v5.1.29/install.sh"
if got != want {
t.Fatalf("download url = %q, want %q", got, want)
}
}
func TestResolveInstallScriptDownloadURLUsesRCReleaseTag(t *testing.T) {
tmpDir := t.TempDir()
timeoutPath := filepath.Join(tmpDir, "timeout")
curlPath := filepath.Join(tmpDir, "curl")
if err := os.WriteFile(timeoutPath, []byte("#!/usr/bin/env bash\nshift\nexec \"$@\"\n"), 0755); err != nil {
t.Fatalf("write timeout stub: %v", err)
}
curlStub := `#!/usr/bin/env bash
for arg in "$@"; do
if [[ "$arg" == "https://api.github.com/repos/rcourtman/Pulse/releases" ]]; then
printf '%s\n' '[{"draft":false,"tag_name":"v6.0.0-rc.2"},{"draft":false,"prerelease":false,"tag_name":"v5.9.0"}]'
exit 0
fi
done
echo "unexpected curl invocation: $*" >&2
exit 1
`
if err := os.WriteFile(curlPath, []byte(curlStub), 0755); err != nil {
t.Fatalf("write curl stub: %v", err)
}
script := `
PATH="` + tmpDir + `:$PATH"
GITHUB_REPO="rcourtman/Pulse"
FORCE_VERSION=""
FORCE_CHANNEL="rc"
UPDATE_CHANNEL=""
` + extractRootInstallShellFunction(t, "resolve_latest_release_tag_for_channel") + `
` + extractRootInstallShellFunction(t, "resolve_install_script_download_url") + `
resolve_install_script_download_url
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "https://github.com/rcourtman/Pulse/releases/download/v6.0.0-rc.2/install.sh"
if got != want {
t.Fatalf("download url = %q, want %q", got, want)
}
}
func TestInstallAdditionalAgentBinariesCopiesLocalExtrasWithoutNetwork(t *testing.T) {
tmpDir := t.TempDir()
sourceDir := filepath.Join(tmpDir, "source")
installDir := filepath.Join(tmpDir, "opt", "pulse")
if err := os.MkdirAll(filepath.Join(sourceDir, "bin"), 0755); err != nil {
t.Fatalf("mkdir source bin: %v", err)
}
if err := os.MkdirAll(filepath.Join(installDir, "bin"), 0755); err != nil {
t.Fatalf("mkdir install bin: %v", err)
}
agentPath := filepath.Join(sourceDir, "bin", "pulse-agent-linux-arm64")
if err := os.WriteFile(agentPath, []byte("unified-agent\n"), 0755); err != nil {
t.Fatalf("write agent: %v", err)
}
script := `
INSTALL_DIR="` + installDir + `"
GITHUB_REPO="rcourtman/Pulse"
curl_calls=0
wget_calls=0
chown() { :; }
print_info() { :; }
print_warn() { :; }
print_success() { :; }
curl() { curl_calls=$((curl_calls + 1)); return 99; }
wget() { wget_calls=$((wget_calls + 1)); return 99; }
` + extractRootInstallShellFunction(t, "copy_unified_agent_binaries_from_dir") + `
` + extractRootInstallShellFunction(t, "install_additional_agent_binaries") + `
install_additional_agent_binaries "v6.0.0-rc.3" "` + sourceDir + `"
printf 'curl=%s wget=%s\n' "$curl_calls" "$wget_calls"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "curl=0 wget=0" {
t.Fatalf("expected no network fallback calls, got %q", got)
}
if _, err := os.Stat(filepath.Join(installDir, "bin", "pulse-agent-linux-arm64")); err != nil {
t.Fatalf("expected local unified agent binary to be copied: %v", err)
}
}
func TestInstallAdditionalAgentBinariesSkipsNetworkWhenLocalExtrasAreMissing(t *testing.T) {
tmpDir := t.TempDir()
sourceDir := filepath.Join(tmpDir, "source")
installDir := filepath.Join(tmpDir, "opt", "pulse")
if err := os.MkdirAll(filepath.Join(sourceDir, "bin"), 0755); err != nil {
t.Fatalf("mkdir source bin: %v", err)
}
if err := os.MkdirAll(filepath.Join(installDir, "bin"), 0755); err != nil {
t.Fatalf("mkdir install bin: %v", err)
}
script := `
INSTALL_DIR="` + installDir + `"
GITHUB_REPO="rcourtman/Pulse"
curl_calls=0
wget_calls=0
chown() { :; }
print_info() { :; }
print_warn() { :; }
print_success() { :; }
curl() { curl_calls=$((curl_calls + 1)); return 99; }
wget() { wget_calls=$((wget_calls + 1)); return 99; }
` + extractRootInstallShellFunction(t, "copy_unified_agent_binaries_from_dir") + `
` + extractRootInstallShellFunction(t, "install_additional_agent_binaries") + `
install_additional_agent_binaries "v6.0.0-rc.3" "` + sourceDir + `"
printf 'curl=%s wget=%s\n' "$curl_calls" "$wget_calls"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "curl=0 wget=0" {
t.Fatalf("expected missing local extras to skip network fallback, got %q", got)
}
}
func TestInstallSHRequiresPinnedSignatureVerificationForReleaseDownloads(t *testing.T) {
content, err := os.ReadFile(repoFile("scripts", "install.sh"))
if err != nil {
t.Fatalf("read install.sh: %v", err)
}
script := string(content)
required := []string{
`PINNED_INSTALLER_SSH_PUBLIC_KEY="__PULSE_INSTALLER_SSH_PUBLIC_KEY__"`,
`has_pinned_installer_signature_key() {`,
`grep -i '^X-Signature-SSHSIG:' "$TMP_HEADERS"`,
`Server did not provide checksum header; refusing install.`,
`Server did not provide SSH signature header; refusing signed install.`,
`ssh-keygen -Y verify`,
`Binary signature verified`,
}
for _, needle := range required {
if !strings.Contains(script, needle) {
t.Fatalf("install.sh missing signed-download verification contract: %s", needle)
}
}
}
func TestBuildContainerInstallCommandPreservesForcedVersion(t *testing.T) {
script := `
FORCE_VERSION="v1.2.3"
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
auto_updates_flag="--enable-auto-updates"
BUILD_FROM_SOURCE="false"
SOURCE_BRANCH="main"
frontend_port="7655"
CONFIG_DIR="` + t.TempDir() + `"
` + extractSelectedUpdateChannelShellFunctions(t) + `
` + extractRootInstallShellFunction(t, "build_container_install_command") + `
build_container_install_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "bash /tmp/install.sh --in-container --version 'v1.2.3' --enable-auto-updates"
if got != want {
t.Fatalf("install cmd = %q, want %q", got, want)
}
}
func TestBuildContainerInstallCommandPreservesExplicitAutoUpdateDisable(t *testing.T) {
script := `
FORCE_VERSION="v1.2.3"
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
auto_updates_flag="--disable-auto-updates"
BUILD_FROM_SOURCE="false"
SOURCE_BRANCH="main"
frontend_port="7655"
CONFIG_DIR="` + t.TempDir() + `"
` + extractSelectedUpdateChannelShellFunctions(t) + `
` + extractRootInstallShellFunction(t, "build_container_install_command") + `
build_container_install_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "bash /tmp/install.sh --in-container --version 'v1.2.3' --disable-auto-updates"
if got != want {
t.Fatalf("install cmd = %q, want %q", got, want)
}
}
func TestBuildContainerInstallCommandPassesArchiveToContainer(t *testing.T) {
script := `
FORCE_VERSION=""
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
auto_updates_flag=""
BUILD_FROM_SOURCE="false"
SOURCE_BRANCH="main"
frontend_port="7655"
container_archive_dest="/tmp/pulse-v6.0.0-rc.1-linux-amd64.tar.gz"
CONFIG_DIR="` + t.TempDir() + `"
` + extractSelectedUpdateChannelShellFunctions(t) + `
` + extractRootInstallShellFunction(t, "build_container_install_command") + `
build_container_install_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "bash /tmp/install.sh --in-container --archive /tmp/pulse-v6.0.0-rc.1-linux-amd64.tar.gz"
if got != want {
t.Fatalf("install cmd = %q, want %q", got, want)
}
}
func TestBuildContainerInstallCommandQuotesArchivePath(t *testing.T) {
script := `
FORCE_VERSION=""
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
auto_updates_flag=""
BUILD_FROM_SOURCE="false"
SOURCE_BRANCH="main"
frontend_port="7655"
container_archive_dest="/tmp/pulse archive-linux-amd64.tar.gz"
CONFIG_DIR="` + t.TempDir() + `"
` + extractSelectedUpdateChannelShellFunctions(t) + `
` + extractRootInstallShellFunction(t, "build_container_install_command") + `
build_container_install_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := `bash /tmp/install.sh --in-container --archive /tmp/pulse\ archive-linux-amd64.tar.gz`
if got != want {
t.Fatalf("install cmd = %q, want %q", got, want)
}
}
func TestBuildContainerInstallCommandPreservesRCChannel(t *testing.T) {
script := `
FORCE_VERSION=""
FORCE_CHANNEL="rc"
UPDATE_CHANNEL=""
auto_updates_flag=""
BUILD_FROM_SOURCE="false"
SOURCE_BRANCH="main"
frontend_port="7766"
CONFIG_DIR="` + t.TempDir() + `"
` + extractSelectedUpdateChannelShellFunctions(t) + `
` + extractRootInstallShellFunction(t, "build_container_install_command") + `
build_container_install_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "FRONTEND_PORT=7766 bash /tmp/install.sh --in-container --rc"
if got != want {
t.Fatalf("install cmd = %q, want %q", got, want)
}
}
func TestBuildContainerInstallCommandIgnoresHostConfiguredRCChannelForFreshLXCInstall(t *testing.T) {
configDir := t.TempDir()
if err := os.WriteFile(filepath.Join(configDir, "system.json"), []byte(`{"updateChannel":"rc"}`), 0644); err != nil {
t.Fatalf("write system.json: %v", err)
}
script := `
FORCE_VERSION=""
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
IGNORE_CONFIGURED_UPDATE_CHANNEL="true"
auto_updates_flag=""
BUILD_FROM_SOURCE="false"
SOURCE_BRANCH="main"
frontend_port="7655"
CONFIG_DIR="` + configDir + `"
` + extractSelectedUpdateChannelShellFunctions(t) + `
` + extractRootInstallShellFunction(t, "build_container_install_command") + `
build_container_install_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "bash /tmp/install.sh --in-container"
if got != want {
t.Fatalf("install cmd = %q, want %q", got, want)
}
}
func TestPrintContainerRecoveryCommandPreservesForcedVersion(t *testing.T) {
script := `
FORCE_VERSION="v1.2.3"
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
auto_updates_flag="--enable-auto-updates"
BUILD_FROM_SOURCE="false"
SOURCE_BRANCH="main"
frontend_port="7655"
CONFIG_DIR="` + t.TempDir() + `"
print_info() { printf '%s\n' "$1"; }
` + extractSelectedUpdateChannelShellFunctions(t) + `
` + extractRootInstallShellFunction(t, "build_container_install_command") + `
` + extractRootInstallShellFunction(t, "print_container_recovery_command") + `
print_container_recovery_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "bash /tmp/install.sh --in-container --version 'v1.2.3' --enable-auto-updates"
if got != want {
t.Fatalf("recovery command = %q, want %q", got, want)
}
}
func TestPrintContainerRecoveryCommandPreservesExplicitAutoUpdateDisable(t *testing.T) {
script := `
FORCE_VERSION="v1.2.3"
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
auto_updates_flag="--disable-auto-updates"
BUILD_FROM_SOURCE="false"
SOURCE_BRANCH="main"
frontend_port="7655"
CONFIG_DIR="` + t.TempDir() + `"
print_info() { printf '%s\n' "$1"; }
` + extractSelectedUpdateChannelShellFunctions(t) + `
` + extractRootInstallShellFunction(t, "build_container_install_command") + `
` + extractRootInstallShellFunction(t, "print_container_recovery_command") + `
print_container_recovery_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "bash /tmp/install.sh --in-container --version 'v1.2.3' --disable-auto-updates"
if got != want {
t.Fatalf("recovery command = %q, want %q", got, want)
}
}
func TestPrintContainerRecoveryCommandPreservesRCChannel(t *testing.T) {
script := `
FORCE_VERSION=""
FORCE_CHANNEL="rc"
UPDATE_CHANNEL=""
auto_updates_flag=""
BUILD_FROM_SOURCE="false"
SOURCE_BRANCH="main"
frontend_port="7766"
CONFIG_DIR="` + t.TempDir() + `"
print_info() { printf '%s\n' "$1"; }
` + extractSelectedUpdateChannelShellFunctions(t) + `
` + extractRootInstallShellFunction(t, "build_container_install_command") + `
` + extractRootInstallShellFunction(t, "print_container_recovery_command") + `
print_container_recovery_command
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "FRONTEND_PORT=7766 bash /tmp/install.sh --in-container --rc"
if got != want {
t.Fatalf("recovery command = %q, want %q", got, want)
}
}
func TestResolveReleaseAssetBaseURLUsesLatestRelease(t *testing.T) {
script := `
GITHUB_REPO="rcourtman/Pulse"
LATEST_RELEASE="v1.2.3"
` + extractRootInstallShellFunction(t, "resolve_release_asset_base_url") + `
resolve_release_asset_base_url
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := strings.TrimSpace(string(out))
want := "https://github.com/rcourtman/Pulse/releases/download/v1.2.3"
if got != want {
t.Fatalf("asset base url = %q, want %q", got, want)
}
}
func TestDownloadAutoUpdateScriptUsesSelectedReleaseAssets(t *testing.T) {
tmpDir := t.TempDir()
curlPath := filepath.Join(tmpDir, "curl")
sshKeygenPath := filepath.Join(tmpDir, "ssh-keygen")
destPath := filepath.Join(tmpDir, "pulse-auto-update.sh")
logPath := filepath.Join(tmpDir, "curl.log")
curlStub := `#!/usr/bin/env bash
set -e
out=""
url=""
while [[ $# -gt 0 ]]; do
case "$1" in
-o)
out="$2"
shift 2
;;
--connect-timeout|--max-time)
shift 2
;;
-fsSL|-fsS|-fsSL)
shift
;;
*)
url="$1"
shift
;;
esac
done
printf '%s\n' "$url" >> "` + logPath + `"
case "$url" in
"https://github.com/rcourtman/Pulse/releases/download/v9.9.9/pulse-auto-update.sh")
printf '#!/usr/bin/env bash\nexit 0\n' > "$out"
;;
"https://github.com/rcourtman/Pulse/releases/download/v9.9.9/pulse-auto-update.sh.sshsig")
printf 'signed-payload\n' > "$out"
;;
*)
echo "unexpected url: $url" >&2
exit 1
;;
esac
`
if err := os.WriteFile(curlPath, []byte(curlStub), 0755); err != nil {
t.Fatalf("write curl stub: %v", err)
}
sshKeygenStub := `#!/usr/bin/env bash
exit 0
`
if err := os.WriteFile(sshKeygenPath, []byte(sshKeygenStub), 0755); err != nil {
t.Fatalf("write ssh-keygen stub: %v", err)
}
script := `
PATH="` + tmpDir + `:$PATH"
GITHUB_REPO="rcourtman/Pulse"
LATEST_RELEASE="v9.9.9"
PULSE_AUTO_UPDATE_DEST="` + destPath + `"
print_warn() { :; }
print_info() { :; }
INSTALL_SIGNATURE_IDENTITY="pulse-installer"
INSTALL_SIGNATURE_NAMESPACE="pulse-install"
PINNED_RELEASE_SSH_PUBLIC_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZd/DaH+BldzOkq1A8KVTcFk73nAyrE8aJOyf7i00jm pulse-installer"
` + extractRootInstallShellFunction(t, "release_signature_key_available") + `
` + extractRootInstallShellFunction(t, "require_release_signature_verifier") + `
` + extractRootInstallShellFunction(t, "verify_release_signature") + `
` + extractRootInstallShellFunction(t, "resolve_release_asset_base_url") + `
` + extractRootInstallShellFunction(t, "download_auto_update_script") + `
download_auto_update_script
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
logContent, err := os.ReadFile(logPath)
if err != nil {
t.Fatalf("read curl log: %v", err)
}
got := string(logContent)
if !strings.Contains(got, "https://github.com/rcourtman/Pulse/releases/download/v9.9.9/pulse-auto-update.sh") {
t.Fatalf("missing versioned helper download:\n%s", got)
}
if !strings.Contains(got, "https://github.com/rcourtman/Pulse/releases/download/v9.9.9/pulse-auto-update.sh.sshsig") {
t.Fatalf("missing versioned signature download:\n%s", got)
}
}
func TestPulseAutoUpdatePerformUpdateUsesVersionedInstallerURL(t *testing.T) {
tmpDir := t.TempDir()
curlPath := filepath.Join(tmpDir, "curl")
sshKeygenPath := filepath.Join(tmpDir, "ssh-keygen")
logPath := filepath.Join(tmpDir, "curl.log")
installDir := filepath.Join(tmpDir, "install")
if err := os.MkdirAll(filepath.Join(installDir, "bin"), 0755); err != nil {
t.Fatalf("mkdir install bin: %v", err)
}
if err := os.WriteFile(filepath.Join(installDir, "bin", "pulse"), []byte("old"), 0755); err != nil {
t.Fatalf("write fake pulse binary: %v", err)
}
if err := os.WriteFile(filepath.Join(installDir, "VERSION"), []byte("v1.0.0\n"), 0644); err != nil {
t.Fatalf("write VERSION: %v", err)
}
curlStub := `#!/usr/bin/env bash
set -e
printf '%s\n' "$*" >> "` + logPath + `"
out=""
url=""
while [[ $# -gt 0 ]]; do
case "$1" in
-o)
out="$2"
shift 2
;;
-fsSL)
shift
;;
*)
url="$1"
shift
;;
esac
done
case "$url" in
"https://github.com/rcourtman/Pulse/releases/download/v9.9.9/install.sh")
printf '#!/usr/bin/env bash\nexit 0\n' > "$out"
;;
"https://github.com/rcourtman/Pulse/releases/download/v9.9.9/install.sh.sshsig")
printf 'signed-payload\n' > "$out"
;;
esac
`
if err := os.WriteFile(curlPath, []byte(curlStub), 0755); err != nil {
t.Fatalf("write curl stub: %v", err)
}
if err := os.WriteFile(sshKeygenPath, []byte("#!/usr/bin/env bash\nexit 0\n"), 0755); err != nil {
t.Fatalf("write ssh-keygen stub: %v", err)
}
script := `
PATH="` + tmpDir + `:$PATH"
GITHUB_REPO="rcourtman/Pulse"
INSTALL_DIR="` + installDir + `"
log() { :; }
detect_service_name() { echo pulse; }
get_current_version() { echo v9.9.9; }
systemctl() { return 0; }
INSTALL_SIGNATURE_IDENTITY="pulse-installer"
INSTALL_SIGNATURE_NAMESPACE="pulse-install"
PINNED_RELEASE_SSH_PUBLIC_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZd/DaH+BldzOkq1A8KVTcFk73nAyrE8aJOyf7i00jm pulse-installer"
` + extractAutoUpdateFunction(t, "release_signature_key_available") + `
` + extractAutoUpdateFunction(t, "require_release_signature_verifier") + `
` + extractAutoUpdateFunction(t, "verify_release_signature") + `
` + extractAutoUpdateFunction(t, "resolve_install_script_url") + `
` + extractAutoUpdateFunction(t, "is_prerelease_tag") + `
wait_for_service_active() { return 0; }
` + extractAutoUpdateFunction(t, "perform_update") + `
perform_update v9.9.9
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
logContent, err := os.ReadFile(logPath)
if err != nil {
t.Fatalf("read curl log: %v", err)
}
got := string(logContent)
if !strings.Contains(got, "https://github.com/rcourtman/Pulse/releases/download/v9.9.9/install.sh") {
t.Fatalf("perform_update did not use versioned installer url:\n%s", got)
}
if !strings.Contains(got, "https://github.com/rcourtman/Pulse/releases/download/v9.9.9/install.sh.sshsig") {
t.Fatalf("perform_update did not use versioned installer signature url:\n%s", got)
}
if strings.Contains(got, "releases/latest/download/install.sh") {
t.Fatalf("perform_update still used latest installer url:\n%s", got)
}
}
func TestPulseAutoUpdateResolveInstallScriptURLUsesConfiguredRepo(t *testing.T) {
script := `
GITHUB_REPO="example/pulse-fork"
` + extractAutoUpdateFunction(t, "resolve_install_script_url") + `
resolve_install_script_url v9.9.9
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "https://github.com/example/pulse-fork/releases/download/v9.9.9/install.sh" {
t.Fatalf("resolve_install_script_url = %q", got)
}
}
func TestRepoDockerDocsURLUsesConfiguredRepo(t *testing.T) {
script := `
GITHUB_REPO="example/pulse-fork"
LATEST_RELEASE="v9.9.9"
` + extractRootInstallShellFunction(t, "repo_web_url") + `
` + extractRootInstallShellFunction(t, "resolve_latest_release_tag_for_channel") + `
` + extractRootInstallShellFunction(t, "repo_release_docs_ref") + `
` + extractRootInstallShellFunction(t, "repo_docs_url_for_path") + `
` + extractRootInstallShellFunction(t, "repo_docker_docs_url") + `
repo_docker_docs_url
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "https://github.com/example/pulse-fork/blob/v9.9.9/docs/DOCKER.md" {
t.Fatalf("repo_docker_docs_url = %q", got)
}
}
func TestRepoDockerDocsURLFallsBackToReleaseLandingPageWhenVersionUnknown(t *testing.T) {
script := `
GITHUB_REPO="example/pulse-fork"
get_latest_release_from_redirect() { return 1; }
curl() { return 1; }
timeout() { return 1; }
` + extractRootInstallShellFunction(t, "repo_web_url") + `
` + extractRootInstallShellFunction(t, "is_stable_release_tag") + `
` + extractRootInstallShellFunction(t, "latest_stable_release_tag_from_json") + `
` + extractRootInstallShellFunction(t, "resolve_latest_release_tag_for_channel") + `
` + extractRootInstallShellFunction(t, "repo_release_docs_ref") + `
` + extractRootInstallShellFunction(t, "repo_docs_url_for_path") + `
` + extractRootInstallShellFunction(t, "repo_docker_docs_url") + `
repo_docker_docs_url
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "https://github.com/example/pulse-fork/releases/latest" {
t.Fatalf("repo_docker_docs_url fallback = %q", got)
}
}
func TestRepoDockerImageRefUsesConfiguredImageRepo(t *testing.T) {
script := `
DOCKER_IMAGE_REPO="example/pulse-enterprise"
` + extractRootInstallShellFunction(t, "repo_docker_image_ref") + `
repo_docker_image_ref latest
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "example/pulse-enterprise:latest" {
t.Fatalf("repo_docker_image_ref = %q", got)
}
}
func TestCheckDockerEnvironmentUsesConfiguredImageAndDocs(t *testing.T) {
script := `
GITHUB_REPO="example/pulse-fork"
LATEST_RELEASE="v9.9.9"
DOCKER_IMAGE_REPO="example/pulse-enterprise"
print_error() { printf 'ERR:%s\n' "$1"; }
grep() { return 1; }
` + extractRootInstallShellFunction(t, "repo_web_url") + `
` + extractRootInstallShellFunction(t, "resolve_latest_release_tag_for_channel") + `
` + extractRootInstallShellFunction(t, "repo_release_docs_ref") + `
` + extractRootInstallShellFunction(t, "repo_docs_url_for_path") + `
` + extractRootInstallShellFunction(t, "repo_docker_docs_url") + `
` + extractRootInstallShellFunction(t, "repo_docker_image_ref") + `
` + extractRootInstallShellFunction(t, "check_docker_environment") + `
container="docker"
check_docker_environment
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err == nil {
t.Fatalf("expected docker environment check to exit non-zero:\n%s", out)
}
got := string(out)
if !strings.Contains(got, "docker run -d -p 7655:7655 example/pulse-enterprise:latest") {
t.Fatalf("docker guidance missing configured image repo:\n%s", got)
}
if !strings.Contains(got, "https://github.com/example/pulse-fork/blob/v9.9.9/docs/DOCKER.md") {
t.Fatalf("docker guidance missing configured docs url:\n%s", got)
}
}
func TestBuildPrintedManagementCommandPreservesRCChannel(t *testing.T) {
script := `
GITHUB_REPO="rcourtman/Pulse"
FORCE_VERSION=""
FORCE_CHANNEL="rc"
UPDATE_CHANNEL=""
` + extractRootInstallShellFunction(t, "build_printed_management_command") + `
build_printed_management_command update
build_printed_management_command reset
build_printed_management_command uninstall
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
lines := strings.Split(strings.TrimSpace(string(out)), "\n")
if len(lines) != 3 {
t.Fatalf("expected 3 commands, got %d:\n%s", len(lines), out)
}
if got := lines[0]; got != "/bin/update --rc" {
t.Fatalf("update command missing rc flag: %s", lines[0])
}
if got := lines[1]; got != "/bin/update --rc --reset" {
t.Fatalf("reset command missing rc flag: %s", lines[1])
}
if strings.Contains(lines[2], "--rc") {
t.Fatalf("uninstall command should not include channel flags: %s", lines[2])
}
}
func TestRootPrintCompletionRevealsBootstrapTokenThroughCLI(t *testing.T) {
tmpDir := t.TempDir()
configDir := filepath.Join(tmpDir, "config")
installDir := filepath.Join(tmpDir, "install")
pulseBin := filepath.Join(tmpDir, "bin", "pulse")
if err := os.MkdirAll(configDir, 0755); err != nil {
t.Fatalf("mkdir config dir: %v", err)
}
if err := os.MkdirAll(filepath.Dir(pulseBin), 0755); err != nil {
t.Fatalf("mkdir pulse bin dir: %v", err)
}
if err := os.WriteFile(filepath.Join(configDir, ".bootstrap_token"), []byte(`{"version":2,"token_ciphertext":"encrypted-token","token_hash":"hash"}`), 0600); err != nil {
t.Fatalf("write encrypted bootstrap token marker: %v", err)
}
if err := os.WriteFile(pulseBin, []byte(`#!/usr/bin/env bash
if [[ "$1" != "bootstrap-token" ]]; then
exit 2
fi
printf 'Token: raw-bootstrap-token\n'
printf 'Data: %s\n' "$PULSE_DATA_DIR"
`), 0755); err != nil {
t.Fatalf("write fake pulse binary: %v", err)
}
script := `
RED=''
GREEN=''
YELLOW=''
BLUE=''
NC=''
CONFIG_DIR="$TEST_CONFIG_DIR"
INSTALL_DIR="$TEST_INSTALL_DIR"
BINARY_LINK_PATH="$TEST_PULSE_BIN"
UPDATE_HELPER_PATH="/bin/update"
SERVICE_NAME="pulse"
UPDATE_TIMER_UNIT="pulse-update.timer"
hostname() { if [[ "${1:-}" == "-I" ]]; then printf '127.0.0.1\n'; else command hostname "$@"; fi; }
current_frontend_port() { printf '7655\n'; }
print_header() { :; }
print_success() { printf '%s\n' "$1"; }
print_warn() { printf 'WARN: %s\n' "$1"; }
print_info() { printf 'INFO: %s\n' "$1"; }
update_timer_exists() { return 1; }
update_timer_enabled() { return 1; }
build_printed_management_command() { printf '/bin/update\n'; }
` + extractRootInstallShellFunction(t, "print_completion") + `
print_completion
`
cmd := exec.Command("bash", "-c", script)
cmd.Env = append(os.Environ(),
"TEST_CONFIG_DIR="+configDir,
"TEST_INSTALL_DIR="+installDir,
"TEST_PULSE_BIN="+pulseBin,
)
out, err := cmd.CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
got := string(out)
if !strings.Contains(got, "raw-bootstrap-token") {
t.Fatalf("completion output did not include revealed token:\n%s", got)
}
if !strings.Contains(got, "Data: "+configDir) {
t.Fatalf("completion output did not pass PULSE_DATA_DIR to bootstrap-token:\n%s", got)
}
if strings.Contains(got, "encrypted-token") || strings.Contains(got, "token_ciphertext") {
t.Fatalf("completion output leaked encrypted bootstrap file contents:\n%s", got)
}
}
func TestBuildPrintedManagementCommandPreservesForcedVersion(t *testing.T) {
script := `
GITHUB_REPO="rcourtman/Pulse"
FORCE_VERSION="v1.2.3"
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
` + extractRootInstallShellFunction(t, "build_printed_management_command") + `
build_printed_management_command update
build_printed_management_command reset
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
lines := strings.Split(strings.TrimSpace(string(out)), "\n")
if len(lines) != 2 {
t.Fatalf("expected 2 commands, got %d:\n%s", len(lines), out)
}
if got := lines[0]; got != "/bin/update --version v1.2.3" {
t.Fatalf("update command missing version pin: %s", lines[0])
}
if got := lines[1]; got != "/bin/update --version v1.2.3 --reset" {
t.Fatalf("reset command missing version pin: %s", lines[1])
}
}
func TestBuildPrintedManagementCommandUsesConfiguredHelperPath(t *testing.T) {
script := `
GITHUB_REPO="rcourtman/Pulse"
FORCE_VERSION=""
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
UPDATE_HELPER_PATH="/usr/local/bin/update-pulse-preview"
` + extractRootInstallShellFunction(t, "build_printed_management_command") + `
build_printed_management_command update
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "/usr/local/bin/update-pulse-preview" {
t.Fatalf("printed command = %q, want configured helper path", got)
}
}
func TestSelectedUpdateChannelTreatsPrereleaseVersionAsRC(t *testing.T) {
script := `
FORCE_CHANNEL=""
FORCE_VERSION="v1.2.3-rc.4"
UPDATE_CHANNEL=""
CONFIG_DIR="` + t.TempDir() + `"
` + extractSelectedUpdateChannelShellFunctions(t) + `
selected_update_channel
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "rc" {
t.Fatalf("selected_update_channel = %q, want rc", got)
}
}
func TestResolveTargetReleaseIgnoresHostConfiguredRCChannelForFreshLXCInstall(t *testing.T) {
tmpDir := t.TempDir()
configDir := filepath.Join(tmpDir, "config")
if err := os.MkdirAll(configDir, 0755); err != nil {
t.Fatalf("mkdir config dir: %v", err)
}
if err := os.WriteFile(filepath.Join(configDir, "system.json"), []byte(`{"updateChannel":"rc"}`), 0644); err != nil {
t.Fatalf("write system.json: %v", err)
}
timeoutPath := filepath.Join(tmpDir, "timeout")
curlPath := filepath.Join(tmpDir, "curl")
if err := os.WriteFile(timeoutPath, []byte("#!/usr/bin/env bash\nshift\nexec \"$@\"\n"), 0755); err != nil {
t.Fatalf("write timeout stub: %v", err)
}
curlStub := `#!/usr/bin/env bash
for arg in "$@"; do
if [[ "$arg" == "https://api.github.com/repos/rcourtman/Pulse/releases" ]]; then
printf '%s\n' '[{"draft":false,"prerelease":false,"tag_name":"v6.0.0-rc.1"},{"draft":false,"prerelease":false,"tag_name":"v5.1.28"}]'
exit 0
fi
done
echo "unexpected curl invocation: $*" >&2
exit 1
`
if err := os.WriteFile(curlPath, []byte(curlStub), 0755); err != nil {
t.Fatalf("write curl stub: %v", err)
}
script := `
PATH="` + tmpDir + `:$PATH"
GITHUB_REPO="rcourtman/Pulse"
FORCE_VERSION=""
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
IGNORE_CONFIGURED_UPDATE_CHANNEL="true"
CONFIG_DIR="` + configDir + `"
print_info() { :; }
print_warn() { :; }
get_latest_release_from_redirect() { return 1; }
` + extractRootInstallShellFunction(t, "read_configured_update_channel") + `
` + extractRootInstallShellFunction(t, "is_stable_release_tag") + `
` + extractRootInstallShellFunction(t, "latest_stable_release_tag_from_json") + `
` + extractRootInstallShellFunction(t, "resolve_target_release") + `
resolve_target_release
printf '%s\n' "$LATEST_RELEASE"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if got := strings.TrimSpace(string(out)); got != "v5.1.28" {
t.Fatalf("LATEST_RELEASE = %q, want v5.1.28", got)
}
}
func TestSetupAutoUpdatesCreatesSystemJSONWithSelectedChannel(t *testing.T) {
tmpDir := t.TempDir()
configDir := filepath.Join(tmpDir, "config")
installDir := filepath.Join(tmpDir, "install")
autoUpdateSrc := filepath.Join(installDir, "scripts", "pulse-auto-update.sh")
autoUpdateDest, servicePath, timerPath := prepareAutoUpdatePaths(t, tmpDir)
if err := os.MkdirAll(configDir, 0755); err != nil {
t.Fatalf("mkdir config dir: %v", err)
}
if err := os.MkdirAll(filepath.Dir(autoUpdateSrc), 0755); err != nil {
t.Fatalf("mkdir auto-update src dir: %v", err)
}
if err := os.WriteFile(autoUpdateSrc, []byte("#!/usr/bin/env bash\n"), 0755); err != nil {
t.Fatalf("write auto-update src: %v", err)
}
script := `
CONFIG_DIR="` + configDir + `"
INSTALL_DIR="` + installDir + `"
PULSE_AUTO_UPDATE_DEST="` + autoUpdateDest + `"
PULSE_UPDATE_SERVICE_PATH="` + servicePath + `"
PULSE_UPDATE_TIMER_PATH="` + timerPath + `"
FORCE_CHANNEL="rc"
UPDATE_CHANNEL=""
GITHUB_REPO="rcourtman/Pulse"
print_info() { :; }
print_warn() { :; }
print_success() { :; }
safe_systemctl() { :; }
systemctl() { return 0; }
cp() { command cp "$@"; }
chmod() { command chmod "$@"; }
chown() { :; }
cat() { command cat "$@"; }
mkdir() { command mkdir "$@"; }
` + extractSetupAutoUpdatesShellFunctions(t) + `
setup_auto_updates
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
content, err := os.ReadFile(filepath.Join(configDir, "system.json"))
if err != nil {
t.Fatalf("read system.json: %v", err)
}
var got map[string]any
if err := json.Unmarshal(content, &got); err != nil {
t.Fatalf("parse system.json: %v\n%s", err, content)
}
if enabled, ok := got["autoUpdateEnabled"].(bool); !ok || !enabled {
t.Fatalf("system.json missing autoUpdateEnabled=true:\n%s", content)
}
if channel, ok := got["updateChannel"].(string); !ok || channel != "rc" {
t.Fatalf("system.json missing updateChannel rc:\n%s", content)
}
}
func TestSetupAutoUpdatesConfiguresInstalledAutoUpdateRepo(t *testing.T) {
tmpDir := t.TempDir()
configDir := filepath.Join(tmpDir, "config")
systemdDir := filepath.Join(tmpDir, "systemd")
installDir := filepath.Join(tmpDir, "install")
autoUpdateSrc := filepath.Join(installDir, "scripts", "pulse-auto-update.sh")
autoUpdateDest := filepath.Join(tmpDir, "bin", "pulse-auto-update.sh")
servicePath := filepath.Join(systemdDir, "pulse-update.service")
timerPath := filepath.Join(systemdDir, "pulse-update.timer")
if err := os.MkdirAll(configDir, 0755); err != nil {
t.Fatalf("mkdir config dir: %v", err)
}
if err := os.MkdirAll(systemdDir, 0755); err != nil {
t.Fatalf("mkdir systemd dir: %v", err)
}
if err := os.MkdirAll(filepath.Dir(autoUpdateSrc), 0755); err != nil {
t.Fatalf("mkdir auto-update src dir: %v", err)
}
if err := os.MkdirAll(filepath.Dir(autoUpdateDest), 0755); err != nil {
t.Fatalf("mkdir auto-update dest dir: %v", err)
}
if err := os.WriteFile(autoUpdateSrc, []byte("#!/usr/bin/env bash\nGITHUB_REPO=\"rcourtman/Pulse\"\n"), 0755); err != nil {
t.Fatalf("write auto-update src: %v", err)
}
script := `
CONFIG_DIR="` + configDir + `"
INSTALL_DIR="` + installDir + `"
PULSE_AUTO_UPDATE_DEST="` + autoUpdateDest + `"
PULSE_UPDATE_SERVICE_PATH="` + servicePath + `"
PULSE_UPDATE_TIMER_PATH="` + timerPath + `"
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
GITHUB_REPO="example/pulse-fork"
print_info() { :; }
print_warn() { :; }
print_success() { :; }
safe_systemctl() { :; }
systemctl() { return 0; }
cp() { command cp "$@"; }
chmod() { command chmod "$@"; }
chown() { :; }
cat() { command cat "$@"; }
mkdir() { command mkdir "$@"; }
mv() { command mv "$@"; }
rm() { command rm "$@"; }
awk() { command awk "$@"; }
mktemp() { command mktemp "$@"; }
` + extractSetupAutoUpdatesShellFunctions(t) + `
setup_auto_updates
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
content, err := os.ReadFile(autoUpdateDest)
if err != nil {
t.Fatalf("read configured auto-update script: %v", err)
}
got := string(content)
if strings.Contains(got, "GITHUB_REPO=\"rcourtman/Pulse\"") {
t.Fatalf("auto-update script kept upstream repo:\n%s", got)
}
if !strings.Contains(got, "GITHUB_REPO=\"example/pulse-fork\"") {
t.Fatalf("auto-update script missing configured repo:\n%s", got)
}
serviceContent, err := os.ReadFile(servicePath)
if err != nil {
t.Fatalf("read service file: %v", err)
}
if !strings.Contains(string(serviceContent), "ExecStart="+autoUpdateDest) {
t.Fatalf("service file missing configured auto-update path:\n%s", serviceContent)
}
if !strings.Contains(string(serviceContent), "Documentation=https://github.com/example/pulse-fork") {
t.Fatalf("service file missing configured documentation url:\n%s", serviceContent)
}
if _, err := os.Stat(timerPath); err != nil {
t.Fatalf("timer file missing: %v", err)
}
timerContent, err := os.ReadFile(timerPath)
if err != nil {
t.Fatalf("read timer file: %v", err)
}
if !strings.Contains(string(timerContent), "Documentation=https://github.com/example/pulse-fork") {
t.Fatalf("timer file missing configured documentation url:\n%s", timerContent)
}
}
func TestSetupAutoUpdatesTreatsPrereleaseVersionAsRCChannel(t *testing.T) {
tmpDir := t.TempDir()
configDir := filepath.Join(tmpDir, "config")
installDir := filepath.Join(tmpDir, "install")
autoUpdateSrc := filepath.Join(installDir, "scripts", "pulse-auto-update.sh")
autoUpdateDest, servicePath, timerPath := prepareAutoUpdatePaths(t, tmpDir)
if err := os.MkdirAll(configDir, 0755); err != nil {
t.Fatalf("mkdir config dir: %v", err)
}
if err := os.MkdirAll(filepath.Dir(autoUpdateSrc), 0755); err != nil {
t.Fatalf("mkdir auto-update src dir: %v", err)
}
if err := os.WriteFile(autoUpdateSrc, []byte("#!/usr/bin/env bash\n"), 0755); err != nil {
t.Fatalf("write auto-update src: %v", err)
}
script := `
CONFIG_DIR="` + configDir + `"
INSTALL_DIR="` + installDir + `"
PULSE_AUTO_UPDATE_DEST="` + autoUpdateDest + `"
PULSE_UPDATE_SERVICE_PATH="` + servicePath + `"
PULSE_UPDATE_TIMER_PATH="` + timerPath + `"
FORCE_CHANNEL=""
FORCE_VERSION="v1.2.3-rc.4"
UPDATE_CHANNEL=""
GITHUB_REPO="rcourtman/Pulse"
print_info() { :; }
print_warn() { :; }
print_success() { :; }
safe_systemctl() { :; }
systemctl() { return 0; }
chown() { :; }
` + extractSetupAutoUpdatesShellFunctions(t) + `
setup_auto_updates
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
content, err := os.ReadFile(filepath.Join(configDir, "system.json"))
if err != nil {
t.Fatalf("read system.json: %v", err)
}
var got map[string]any
if err := json.Unmarshal(content, &got); err != nil {
t.Fatalf("parse system.json: %v\n%s", err, content)
}
if channel, ok := got["updateChannel"].(string); !ok || channel != "rc" {
t.Fatalf("prerelease version did not persist rc channel:\n%s", content)
}
}
func TestSetupAutoUpdatesPreservesRCChannelWhenUpdatingExistingConfig(t *testing.T) {
tmpDir := t.TempDir()
configDir := filepath.Join(tmpDir, "config")
installDir := filepath.Join(tmpDir, "install")
autoUpdateSrc := filepath.Join(installDir, "scripts", "pulse-auto-update.sh")
autoUpdateDest, servicePath, timerPath := prepareAutoUpdatePaths(t, tmpDir)
if err := os.MkdirAll(configDir, 0755); err != nil {
t.Fatalf("mkdir config dir: %v", err)
}
if err := os.MkdirAll(filepath.Dir(autoUpdateSrc), 0755); err != nil {
t.Fatalf("mkdir auto-update src dir: %v", err)
}
if err := os.WriteFile(autoUpdateSrc, []byte("#!/usr/bin/env bash\n"), 0755); err != nil {
t.Fatalf("write auto-update src: %v", err)
}
if err := os.WriteFile(filepath.Join(configDir, "system.json"), []byte(`{"updateChannel":"rc","autoUpdateEnabled":false}`), 0644); err != nil {
t.Fatalf("write system.json: %v", err)
}
script := `
CONFIG_DIR="` + configDir + `"
INSTALL_DIR="` + installDir + `"
PULSE_AUTO_UPDATE_DEST="` + autoUpdateDest + `"
PULSE_UPDATE_SERVICE_PATH="` + servicePath + `"
PULSE_UPDATE_TIMER_PATH="` + timerPath + `"
FORCE_CHANNEL=""
UPDATE_CHANNEL=""
GITHUB_REPO="rcourtman/Pulse"
print_info() { :; }
print_warn() { :; }
print_success() { :; }
safe_systemctl() { :; }
systemctl() { return 0; }
command -v jq >/dev/null 2>&1 || true
chown() { :; }
` + extractSetupAutoUpdatesShellFunctions(t) + `
setup_auto_updates
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
content, err := os.ReadFile(filepath.Join(configDir, "system.json"))
if err != nil {
t.Fatalf("read system.json: %v", err)
}
var got map[string]any
if err := json.Unmarshal(content, &got); err != nil {
t.Fatalf("parse system.json: %v\n%s", err, content)
}
if enabled, ok := got["autoUpdateEnabled"].(bool); !ok || !enabled {
t.Fatalf("system.json missing enabled flag:\n%s", content)
}
if channel, ok := got["updateChannel"].(string); !ok || channel != "rc" {
t.Fatalf("system.json lost rc channel:\n%s", content)
}
}
// TestInstallSHVerifyAgentServerRegistrationDetectsRejectedToken verifies that
// the post-install health check tells a rejected token (401/403) apart from a
// transient "agent has not reported yet" state, so the installer can surface an
// actionable error instead of leaving a silent 401 loop behind (issue #1515).
func TestInstallSHVerifyAgentServerRegistrationDetectsRejectedToken(t *testing.T) {
urlEncode := extractInstallShellFunction(t, "url_encode")
curlWithPulseToken := extractInstallShellFunction(t, "curl_with_pulse_token")
verifyFn := extractInstallShellFunction(t, "verify_agent_server_registration")
cases := []struct {
name string
status int
body string
wantRC string
}{
{"rejected token 401", http.StatusUnauthorized, `{"error":"Authentication required"}`, "rc=2"},
{"rejected token 403", http.StatusForbidden, `{"error":"missing_scope"}`, "rc=2"},
{"registered", http.StatusOK, `{"success":true,"agent":{"id":"agent-omv"}}`, "rc=0"},
{"not reported yet", http.StatusNotFound, `{"error":"agent_not_found"}`, "rc=1"},
}
for _, tc := range cases {
tc := tc
t.Run(tc.name, func(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if !strings.HasPrefix(r.URL.Path, "/api/agents/agent/lookup") {
http.Error(w, "not found", http.StatusNotFound)
return
}
w.WriteHeader(tc.status)
_, _ = w.Write([]byte(tc.body))
}))
defer server.Close()
script := `
PULSE_URL="` + server.URL + `"
PULSE_TOKEN="stale-token"
HOSTNAME_OVERRIDE="omv"
INSECURE="false"
CURL_CA_BUNDLE=""
` + curlWithPulseToken + `
` + urlEncode + `
` + verifyFn + `
verify_agent_server_registration
echo "rc=$?"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if !strings.Contains(string(out), tc.wantRC) {
t.Fatalf("case %q: want %s, got:\n%s", tc.name, tc.wantRC, out)
}
})
}
}
// TestInstallSHRegistrationRetryWindowOutlastsFirstReportCycle verifies that
// the post-install registration check polls for a window instead of warning
// after a single lookup: /readyz flips before the agent's first report cycle
// completes, so an immediate one-shot lookup routinely misses a healthy
// registration (issue #1644). A rejected token still short-circuits because
// more polling cannot change a definitive 401/403.
func TestInstallSHRegistrationRetryWindowOutlastsFirstReportCycle(t *testing.T) {
urlEncode := extractInstallShellFunction(t, "url_encode")
curlWithPulseToken := extractInstallShellFunction(t, "curl_with_pulse_token")
verifyFn := extractInstallShellFunction(t, "verify_agent_server_registration")
retryFn := extractInstallShellFunction(t, "verify_agent_server_registration_with_retry")
verifyStarted := extractInstallShellFunction(t, "verify_agent_started")
if !strings.Contains(verifyStarted, "verify_agent_server_registration_with_retry") {
t.Fatal("verify_agent_started does not use the registration retry window")
}
cases := []struct {
name string
// statuses is consumed one per lookup; the last value repeats.
statuses []int
wantRC string
}{
{"registered after report cycle", []int{http.StatusNotFound, http.StatusNotFound, http.StatusOK}, "rc=0"},
{"rejected token short-circuits", []int{http.StatusUnauthorized}, "rc=2"},
}
for _, tc := range cases {
tc := tc
t.Run(tc.name, func(t *testing.T) {
var mu sync.Mutex
lookups := 0
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if !strings.HasPrefix(r.URL.Path, "/api/agents/agent/lookup") {
http.Error(w, "not found", http.StatusNotFound)
return
}
mu.Lock()
idx := lookups
lookups++
mu.Unlock()
if idx >= len(tc.statuses) {
idx = len(tc.statuses) - 1
}
w.WriteHeader(tc.statuses[idx])
if tc.statuses[idx] == http.StatusOK {
_, _ = w.Write([]byte(`{"success":true,"agent":{"id":"agent-1644"}}`))
} else {
_, _ = w.Write([]byte(`{"error":"agent_not_found"}`))
}
}))
defer server.Close()
script := `
PULSE_URL="` + server.URL + `"
PULSE_TOKEN="install-token"
HOSTNAME_OVERRIDE="pve-1644"
INSECURE="false"
CURL_CA_BUNDLE=""
sleep() { :; }
` + curlWithPulseToken + `
` + urlEncode + `
` + verifyFn + `
` + retryFn + `
verify_agent_server_registration_with_retry
echo "rc=$?"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
if !strings.Contains(string(out), tc.wantRC) {
t.Fatalf("case %q: want %s, got:\n%s", tc.name, tc.wantRC, out)
}
if tc.wantRC == "rc=2" {
mu.Lock()
got := lookups
mu.Unlock()
if got != 1 {
t.Fatalf("rejected token was retried %d times, want 1 lookup", got)
}
}
})
}
}
// TestInstallSHSurfacesBlockedProxmoxRegistration verifies the installer reads
// the agent's proxmox-<type>-registration-blocked marker and prints the denial
// in its own output instead of leaving it buried in the agent journal (#1644).
func TestInstallSHSurfacesBlockedProxmoxRegistration(t *testing.T) {
logInfo := extractInstallShellFunction(t, "log_info")
logWarn := extractInstallShellFunction(t, "log_warn")
logError := extractInstallShellFunction(t, "log_error")
reportFn := extractInstallShellFunction(t, "report_proxmox_registration_outcome")
completeFlow := extractInstallShellFunction(t, "complete_installation_flow")
if !strings.Contains(completeFlow, `report_proxmox_registration_outcome "$state_dir"`) {
t.Fatal("complete_installation_flow does not report the Proxmox registration outcome")
}
clearFn := extractInstallShellFunction(t, "clear_proxmox_state_if_needed")
for _, marker := range []string{"proxmox-pve-registration-blocked", "proxmox-pbs-registration-blocked", "proxmox-detected-types"} {
if !strings.Contains(clearFn, marker) {
t.Fatalf("clear_proxmox_state_if_needed does not clear %s", marker)
}
}
runReport := func(t *testing.T, stateDir string) (string, int) {
t.Helper()
script := `
NON_INTERACTIVE="false"
ENABLE_PROXMOX="true"
redact_token() { printf '%s' "$1"; }
sleep() { :; }
` + logInfo + `
` + logWarn + `
` + logError + `
` + reportFn + `
report_proxmox_registration_outcome "` + stateDir + `"
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
rc := 0
if err != nil {
var exitErr *exec.ExitError
if !errors.As(err, &exitErr) {
t.Fatalf("bash: %v\n%s", err, out)
}
rc = exitErr.ExitCode()
}
return string(out), rc
}
t.Run("blocked marker surfaces reason", func(t *testing.T) {
stateDir := t.TempDir()
reason := "Pulse at https://pulse.local has no PVE source for https://pve.local:8006 and this agent's token cannot create one."
if err := os.WriteFile(filepath.Join(stateDir, "proxmox-pve-registration-blocked"), []byte(reason+"\n"), 0o600); err != nil {
t.Fatalf("write blocked marker: %v", err)
}
out, rc := runReport(t, stateDir)
if rc == 0 {
t.Fatalf("blocked registration reported success:\n%s", out)
}
if !strings.Contains(out, "[ERROR]") || !strings.Contains(out, "registration failed") {
t.Fatalf("blocked registration not surfaced as an error:\n%s", out)
}
if !strings.Contains(out, reason) {
t.Fatalf("blocked registration output missing agent-recorded reason:\n%s", out)
}
})
t.Run("registered marker reports success", func(t *testing.T) {
stateDir := t.TempDir()
if err := os.WriteFile(filepath.Join(stateDir, "proxmox-pve-registered"), []byte("ok\n"), 0o600); err != nil {
t.Fatalf("write registered marker: %v", err)
}
out, rc := runReport(t, stateDir)
if rc != 0 {
t.Fatalf("registered marker returned rc=%d:\n%s", rc, out)
}
if !strings.Contains(out, "Proxmox pve node registered with Pulse.") {
t.Fatalf("registered marker did not report success:\n%s", out)
}
})
// A host with both PVE and PBS installed registers each product separately
// (#1644). The installer must report each outcome rather than letting the
// first marker it finds speak for the whole install.
t.Run("combined host reports both products", func(t *testing.T) {
stateDir := t.TempDir()
writeMarker(t, stateDir, "proxmox-detected-types", "pve\npbs\n")
writeMarker(t, stateDir, "proxmox-pve-registered", "ok\n")
writeMarker(t, stateDir, "proxmox-pbs-registered", "ok\n")
out, rc := runReport(t, stateDir)
if rc != 0 {
t.Fatalf("combined host returned rc=%d:\n%s", rc, out)
}
for _, want := range []string{"Proxmox pve node registered with Pulse.", "Proxmox pbs node registered with Pulse."} {
if !strings.Contains(out, want) {
t.Fatalf("combined host output missing %q:\n%s", want, out)
}
}
if strings.Contains(out, "[ERROR]") {
t.Fatalf("fully registered combined host reported an error:\n%s", out)
}
})
// The regression behind #1644: PVE registered, PBS was refused, and the
// installer printed a bare ERROR banner that read as a failed install.
// Both outcomes must now show up, each attributed to its own product.
t.Run("combined host keeps a successful product visible next to a refusal", func(t *testing.T) {
stateDir := t.TempDir()
reason := "Pulse at https://pulse.local has no PBS source for https://pbs.local:8007 and this agent's token cannot create one."
writeMarker(t, stateDir, "proxmox-detected-types", "pve\npbs\n")
writeMarker(t, stateDir, "proxmox-pve-registered", "ok\n")
writeMarker(t, stateDir, "proxmox-pbs-registration-blocked", reason+"\n")
out, rc := runReport(t, stateDir)
if rc == 0 {
t.Fatalf("refused pbs registration reported overall success:\n%s", out)
}
if !strings.Contains(out, "Proxmox pve node registered with Pulse.") {
t.Fatalf("pve success was erased by the pbs refusal:\n%s", out)
}
if !strings.Contains(out, "Proxmox pbs registration failed:") || !strings.Contains(out, reason) {
t.Fatalf("pbs refusal not surfaced with its reason:\n%s", out)
}
})
// Only the detected products are awaited. A PVE-only host must not sit out
// the full timeout waiting for a PBS outcome that will never arrive.
t.Run("detected types bound what is awaited", func(t *testing.T) {
stateDir := t.TempDir()
writeMarker(t, stateDir, "proxmox-detected-types", "pve\n")
writeMarker(t, stateDir, "proxmox-pve-registered", "ok\n")
out, rc := runReport(t, stateDir)
if rc != 0 {
t.Fatalf("pve-only host returned rc=%d:\n%s", rc, out)
}
if strings.Contains(out, "pbs") {
t.Fatalf("pve-only host reported on pbs:\n%s", out)
}
if strings.Contains(out, "not confirmed") {
t.Fatalf("pve-only host warned about an unconfirmed registration:\n%s", out)
}
})
// Agents older than the detected-types marker keep the previous timing:
// the first outcome that appears ends the wait.
t.Run("missing detected types falls back to first outcome", func(t *testing.T) {
stateDir := t.TempDir()
writeMarker(t, stateDir, "proxmox-pbs-registered", "ok\n")
out, rc := runReport(t, stateDir)
if rc != 0 {
t.Fatalf("legacy agent marker returned rc=%d:\n%s", rc, out)
}
if !strings.Contains(out, "Proxmox pbs node registered with Pulse.") {
t.Fatalf("legacy agent marker did not report success:\n%s", out)
}
if strings.Contains(out, "not confirmed") {
t.Fatalf("legacy agent marker warned about an unconfirmed registration:\n%s", out)
}
})
t.Run("no outcome warns once", func(t *testing.T) {
stateDir := t.TempDir()
out, rc := runReport(t, stateDir)
if rc != 0 {
t.Fatalf("unconfirmed registration returned rc=%d:\n%s", rc, out)
}
if !strings.Contains(out, "not confirmed") || !strings.Contains(out, "Check the agent logs") {
t.Fatalf("unconfirmed registration did not warn:\n%s", out)
}
})
}
func writeMarker(t *testing.T, stateDir, name, contents string) {
t.Helper()
if err := os.WriteFile(filepath.Join(stateDir, name), []byte(contents), 0o600); err != nil {
t.Fatalf("write %s: %v", name, err)
}
}
// TestInstallSHWarnAgentTokenRejectedIsActionable pins the actionable recovery
// copy the installer prints when the server rejects the agent's token.
func TestInstallSHWarnAgentTokenRejectedIsActionable(t *testing.T) {
logWarn := extractInstallShellFunction(t, "log_warn")
warnFn := extractInstallShellFunction(t, "warn_agent_token_rejected")
script := `
NON_INTERACTIVE="false"
redact_token() { printf '%s' "$1"; }
` + logWarn + `
` + warnFn + `
warn_agent_token_rejected
`
out, err := exec.Command("bash", "-c", script).CombinedOutput()
if err != nil {
t.Fatalf("bash: %v\n%s", err, out)
}
for _, needle := range []string{
"rejected this agent's API token",
"Re-run the full agent install command",
"mint a fresh token",
} {
if !strings.Contains(string(out), needle) {
t.Fatalf("warn_agent_token_rejected missing %q:\n%s", needle, out)
}
}
}
Reference in New Issue View Git Blame Copy Permalink