From 59f1c687594a9c5007b766deb6ee7220cd4bdb3d Mon Sep 17 00:00:00 2001 From: houseme Date: Sat, 12 Sep 2026 17:03:48 +0800 Subject: [PATCH] fix(scanner): require ABBA collector credentials (#7700) Co-authored-by: zhi22915 --- scripts/scanner_abba.py | 2 ++ scripts/test_scanner_abba.py | 22 +++++++++++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/scripts/scanner_abba.py b/scripts/scanner_abba.py index 5ae72c874..cb2539a1d 100644 --- a/scripts/scanner_abba.py +++ b/scripts/scanner_abba.py @@ -650,6 +650,8 @@ def collect_live(prepared, request, request_path, adapter): connection = prepared["collector"] require(set(connection) == {"alias", "endpoint", "metrics_endpoints"}, "invalid collector connection") require(all(isinstance(value, str) and value for value in connection.values()), "missing collector endpoint") + require(os.environ.get("RUSTFS_ACCESS_KEY"), "collector requires RUSTFS_ACCESS_KEY") + require(os.environ.get("RUSTFS_SECRET_KEY"), "collector requires RUSTFS_SECRET_KEY") expected_metrics_endpoints = None if request.get("evidence") == "measured": expected_metrics_endpoints = request["release_evidence"]["distributed"]["metrics_endpoints"] diff --git a/scripts/test_scanner_abba.py b/scripts/test_scanner_abba.py index 5f26f68e1..0253d3eec 100755 --- a/scripts/test_scanner_abba.py +++ b/scripts/test_scanner_abba.py @@ -278,7 +278,8 @@ class ScannerAbbaTest(unittest.TestCase): try: with patch.dict(os.environ, {"SCANNER_ABBA_TEST_FAULT": "stubborn-child"}), \ patch.object(harness, "__file__", str(self.root / "scanner_abba.py")), \ - patch.object(harness, "invoke", side_effect=failed_measure): + patch.object(harness, "invoke", side_effect=failed_measure), \ + patch.dict(os.environ, {"RUSTFS_ACCESS_KEY": "test", "RUSTFS_SECRET_KEY": "test"}): with self.assertRaisesRegex(ValueError, "injected measurement failure"): harness.collect_live({"collector": {"alias": "fixture", "endpoint": "fixture", "metrics_endpoints": "fixture"}}, {"duration_seconds": 900}, request, self.adapter) @@ -537,7 +538,8 @@ class ScannerAbbaTest(unittest.TestCase): process = Mock(pid=123, wait=Mock(return_value=1 if name == "collector-exit" else 0)) with patch.object(harness, "OwnedCommand", return_value=process), \ patch.object(harness, "invoke", return_value={"sample_count": 10}), \ - patch.object(harness.time, "monotonic", side_effect=(0, 900)): + patch.object(harness.time, "monotonic", side_effect=(0, 900)), \ + patch.dict(os.environ, {"RUSTFS_ACCESS_KEY": "test", "RUSTFS_SECRET_KEY": "test"}): if error: with self.assertRaisesRegex(ValueError, error): harness.collect_live(prepared, {"duration_seconds": 900}, self.root / "request.json", self.adapter) @@ -547,6 +549,19 @@ class ScannerAbbaTest(unittest.TestCase): process.finish.assert_called_once_with(terminate=True) + def test_live_collector_requires_credentials_before_measurement(self): + request = self.root / "request.json" + harness.write_json(request, {}) + prepared = {"collector": {"alias": "test", "endpoint": "http://node-a:9000", + "metrics_endpoints": "http://node-a:9000"}} + with patch.object(harness, "OwnedCommand") as command, \ + patch.object(harness, "invoke") as invoke, \ + patch.dict(os.environ, {}, clear=True): + with self.assertRaisesRegex(ValueError, "collector requires RUSTFS_ACCESS_KEY"): + harness.collect_live(prepared, {"duration_seconds": 900}, request, self.adapter) + command.assert_not_called() + invoke.assert_not_called() + def test_live_collector_binds_release_evidence_metrics_endpoints(self): telemetry = self.root / "telemetry" for name in ("status", "heal", "metrics"): @@ -570,7 +585,8 @@ class ScannerAbbaTest(unittest.TestCase): process = Mock(pid=123, wait=Mock(return_value=0)) with patch.object(harness, "OwnedCommand", return_value=process), \ patch.object(harness, "invoke", return_value={"sample_count": 10}), \ - patch.object(harness.time, "monotonic", side_effect=(0, 900)): + patch.object(harness.time, "monotonic", side_effect=(0, 900)), \ + patch.dict(os.environ, {"RUSTFS_ACCESS_KEY": "test", "RUSTFS_SECRET_KEY": "test"}): with self.assertRaisesRegex(ValueError, "collector metrics endpoints"): harness.collect_live(prepared, request, self.root / "request.json", self.adapter) process.finish.assert_called_once_with(terminate=True)