mirror of
https://github.com/rustfs/rustfs.git
synced 2026-10-27 14:27:10 +00:00
Chris
4d7cd23f8e
Raise CARGO_BUILD_JOBS to 3 on every event in the workspace test lane and record the closed backlog#1601 experiment: the test-profile compile took 28m21s at 2 on a pull request and 16-23 min at 3 across three successful main runs. Merge the two Connect boundary jobs into connect-feature-boundaries. The offline enrollment gate no longer exports a fresh CARGO_TARGET_DIR, so it rebuilds only the rustfs crate on top of the restored ci-dev cache; the E2E root is isolated by the feature gate and the dedicated binary name, not by the target directory. The short-credential release guard is now `cargo rustc -p rustfs --lib --features connect-e2e-short-credentials -- -C debug-assertions=off`, which trips the same cfg(not(debug_assertions)) compile_error against cached dev-profile dependencies instead of a cold release check of the whole graph. Every assertion of both lanes is kept. Update ci_gate.py and the ci-gates.md PR matrix for the merged job.
83 lines
3.9 KiB
Bash
Executable File
83 lines
3.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
fixture_root="${repo_root}/rustfs/tests/fixtures/offline-enrollment-e2e"
|
|
root_fixture="${fixture_root}/root.json"
|
|
challenge_fixture="${fixture_root}/challenge.json"
|
|
|
|
for command in cargo python3; do
|
|
command -v "${command}" >/dev/null 2>&1 || {
|
|
echo "offline enrollment E2E gate: ${command} is required" >&2
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
read_fixture_field()
|
|
{
|
|
python3 -c 'import json, sys; value=json.load(open(sys.argv[1], encoding="utf-8"))[sys.argv[2]]; assert isinstance(value, str) and value; print(value)' "$1" "$2"
|
|
}
|
|
|
|
RUSTFS_E2E_OFFLINE_ENROLLMENT_ROOT_KEY_ID="$(read_fixture_field "${root_fixture}" keyId)"
|
|
RUSTFS_E2E_OFFLINE_ENROLLMENT_ROOT_PUBLIC_KEY="$(read_fixture_field "${root_fixture}" publicKey)"
|
|
RUSTFS_E2E_OFFLINE_ENROLLMENT_FIXTURE_TIME="$(
|
|
python3 -c 'import base64, datetime, json, sys; envelope=json.load(open(sys.argv[1], encoding="utf-8")); document=json.loads(base64.b64decode(envelope["bytes"], validate=True)); print(int(datetime.datetime.fromisoformat(document["issuedAt"].replace("Z", "+00:00")).timestamp()))' "${challenge_fixture}"
|
|
)"
|
|
export RUSTFS_E2E_OFFLINE_ENROLLMENT_ROOT_KEY_ID
|
|
export RUSTFS_E2E_OFFLINE_ENROLLMENT_ROOT_PUBLIC_KEY
|
|
export RUSTFS_E2E_OFFLINE_ENROLLMENT_FIXTURE_TIME
|
|
|
|
[[ "${RUSTFS_E2E_OFFLINE_ENROLLMENT_ROOT_KEY_ID}" =~ ^[0-9a-f]{64}$ ]] \
|
|
|| { echo 'offline enrollment E2E gate: fixture root key id is invalid' >&2; exit 1; }
|
|
[[ "${RUSTFS_E2E_OFFLINE_ENROLLMENT_ROOT_PUBLIC_KEY}" =~ ^[A-Za-z0-9_-]{87}$ ]] \
|
|
|| { echo 'offline enrollment E2E gate: fixture root public key is invalid' >&2; exit 1; }
|
|
[[ "${RUSTFS_E2E_OFFLINE_ENROLLMENT_FIXTURE_TIME}" =~ ^[0-9]+$ ]] \
|
|
|| { echo 'offline enrollment E2E gate: fixture evaluation time is invalid' >&2; exit 1; }
|
|
|
|
task_root="$(mktemp -d "${TMPDIR:-/tmp}/rustfs-offline-enrollment-e2e.XXXXXX")"
|
|
case "${task_root}" in
|
|
"${TMPDIR:-/tmp}"/rustfs-offline-enrollment-e2e.*) ;;
|
|
*) echo 'offline enrollment E2E gate: unsafe temporary path' >&2; exit 1 ;;
|
|
esac
|
|
cleanup()
|
|
{
|
|
rm -rf -- "${task_root}"
|
|
}
|
|
trap cleanup EXIT
|
|
trap 'exit 130' HUP INT TERM
|
|
|
|
# The binaries land in the workspace target directory so CI reuses its restored
|
|
# dependency cache. The E2E root is isolated by the feature gate and the
|
|
# dedicated binary name, not by where the build happens; only the challenge,
|
|
# response and key files are task-local.
|
|
target_dir="${CARGO_TARGET_DIR:-${repo_root}/target}"
|
|
feature=offline-enrollment-e2e-root
|
|
cargo build --locked -p rustfs --bin rustfs-cli-e2e --features "${feature}"
|
|
cargo build --locked -p rustfs --bin rustfs-cli --features "${feature}"
|
|
cargo test --locked -p rustfs --test connect_offline_enrollment --features "${feature}" e2e_
|
|
|
|
"${target_dir}/debug/rustfs-cli-e2e" connect offline enroll \
|
|
--challenge "${challenge_fixture}" \
|
|
--output "${task_root}/e2e-response.json" \
|
|
--key-dir "${task_root}/e2e-key" \
|
|
>"${task_root}/e2e.stdout" 2>"${task_root}/e2e.stderr"
|
|
test -s "${task_root}/e2e-response.json" \
|
|
|| { echo 'offline enrollment E2E gate: dedicated CLI produced no response' >&2; exit 1; }
|
|
|
|
if "${target_dir}/debug/rustfs-cli" connect offline enroll \
|
|
--challenge "${challenge_fixture}" \
|
|
--output "${task_root}/production-response.json" \
|
|
--key-dir "${task_root}/production-key" \
|
|
>"${task_root}/production.stdout" 2>"${task_root}/production.stderr"
|
|
then
|
|
echo 'offline enrollment E2E gate: production CLI accepted the E2E root' >&2
|
|
exit 1
|
|
fi
|
|
grep -Fq 'rustfs-cli: the trust chain is not issued by a root pinned in this build' \
|
|
"${task_root}/production.stderr" \
|
|
|| { echo 'offline enrollment E2E gate: production CLI failed for the wrong reason' >&2; exit 1; }
|
|
test ! -e "${task_root}/production-response.json" \
|
|
|| { echo 'offline enrollment E2E gate: rejected production CLI wrote a response' >&2; exit 1; }
|
|
|
|
echo 'Offline enrollment E2E root gate passed.'
|