jakman85andClaude Opus 5
8b5e950baa
pm-worker's command is pinned by admission with no args, so everything a caller could influence arrives in the environment — and the guards at the top of that script are what stand between an injected variable and a clone from the wrong host or a push to the wrong ref. Nothing exercised them, which makes them a claim rather than a control. probe-validation.sh asserts 17 refusals, each on BOTH a non-zero exit and the specific message, so a guard that stopped firing cannot pass by failing somewhere else. It covers a redirected git host, a real and reachable WRONG one (the egress policy permits tcp/443, so that case is not hypothetical), the right host with a smuggled path, 'main' and five other bad branch shapes, a malformed owner/repo, a bad mode, a bad issue number, and each missing credential. build-image.sh runs it inside the built image too. Writing it found three things: - the PM_BRANCH != main guard is unreachable while the pattern check above it holds, so the comment claiming it as the defence was wrong about which line does the work. Kept as an assertion independent of the regex; the comment now says so. - the EXIT trap ended in a failing test, which under set -e can replace the script's real exit code with that failure. - a provenance LOG LINE read a file through a redirect that set -o pipefail would have turned into a dead worker if the file were absent. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
201 lines
10 KiB
Bash
Executable File
201 lines
10 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
###############################################################################
|
|
# infra/agent/build-image.sh — build the pinned `agent-runner` image and print its digest.
|
|
#
|
|
# ./build-image.sh # build + verify + print the digest and push command
|
|
# ./build-image.sh --no-verify # build only (skip the in-image proof)
|
|
# ENGINE=docker ./build-image.sh # build with docker instead of podman
|
|
#
|
|
# THIS SCRIPT NEVER PUSHES. Publishing is an operator action: the registry credential is not
|
|
# an agent's to hold, and the pushed digest is what a fail-closed admission policy then
|
|
# trusts. So this builds locally, proves the toolchain and both entrypoints work INSIDE the
|
|
# image as the non-root uid with the read-only root filesystem the policy forces, and prints
|
|
# the exact push line for a human.
|
|
#
|
|
# VERSIONS ARE NOT DEFINED HERE. infra/agent/versions.env holds the four pins this image
|
|
# adds (base image, node, Claude Code CLI, model) and infra/devcontainer/versions.env holds
|
|
# the platform toolchain the base already carries. Nothing in this file invents a version.
|
|
#
|
|
# THE DIGEST CAVEAT — read it before pasting a digest into anything. The digest printed here
|
|
# is the LOCAL manifest digest. It is normally identical to the registry digest, but that is
|
|
# a property of the push rather than a guarantee, so the push command below uses
|
|
# `--digestfile`: the digest the REGISTRY returns is the authoritative one, and that is the
|
|
# one that goes into platform/pm-agent/configmap.yaml.
|
|
###############################################################################
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${HERE}/../.." && pwd)"
|
|
ENGINE="${ENGINE:-podman}"
|
|
|
|
VERIFY=1
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--no-verify) VERIFY=0 ;;
|
|
-h|--help) sed -n '2,/^####/p' "${BASH_SOURCE[0]}" | sed '$d' | sed 's/^# \{0,1\}//'; exit 0 ;;
|
|
*) echo "unknown argument: $arg" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
log() { printf '\n\033[1m==> %s\033[0m\n' "$*"; }
|
|
info() { printf ' %s\n' "$*"; }
|
|
die() { printf '\033[31mERROR: %s\033[0m\n' "$*" >&2; exit 1; }
|
|
|
|
command -v "${ENGINE}" >/dev/null 2>&1 || die "'${ENGINE}' not on PATH (set ENGINE=docker to use docker)"
|
|
|
|
# --- pins: sourced, never invented -------------------------------------------
|
|
AGENT_ENV="${HERE}/versions.env"
|
|
[ -f "${AGENT_ENV}" ] || die "missing ${AGENT_ENV} — the pins live there, not here"
|
|
# shellcheck disable=SC1090
|
|
source "${AGENT_ENV}"
|
|
: "${AGENT_BASE_IMAGE:?AGENT_BASE_IMAGE not set in ${AGENT_ENV}}"
|
|
: "${NODEJS_MAJOR:?NODEJS_MAJOR not set in ${AGENT_ENV}}"
|
|
: "${CLAUDE_CODE_VERSION:?CLAUDE_CODE_VERSION not set in ${AGENT_ENV}}"
|
|
: "${CLAUDE_CODE_MIN_VERSION:?CLAUDE_CODE_MIN_VERSION not set in ${AGENT_ENV}}"
|
|
: "${AGENT_MODEL:?AGENT_MODEL not set in ${AGENT_ENV}}"
|
|
: "${AGENT_IMAGE_REPO:?AGENT_IMAGE_REPO not set in ${AGENT_ENV}}"
|
|
|
|
# --- the base must already exist ---------------------------------------------
|
|
# Deliberately NOT built on demand. The toolbox build is its own reviewed artefact with its
|
|
# own pins, and silently building it here would mean this script could change the toolchain
|
|
# a worker gates with as a side effect of rebuilding the agent image.
|
|
if ! "${ENGINE}" image exists "${AGENT_BASE_IMAGE}" 2>/dev/null; then
|
|
die "base image '${AGENT_BASE_IMAGE}' is not present. Build the pinned toolbox first:
|
|
${REPO_ROOT}/infra/devcontainer/dev.sh build"
|
|
fi
|
|
|
|
IMAGE_TAG="claude${CLAUDE_CODE_VERSION}-node${NODEJS_MAJOR}"
|
|
IMAGE_REF="${AGENT_IMAGE_REPO}:${IMAGE_TAG}"
|
|
|
|
log "Building ${IMAGE_REF}"
|
|
info "engine ${ENGINE} ($(${ENGINE} --version 2>/dev/null | head -1))"
|
|
info "pins from ${AGENT_ENV}"
|
|
info " base ${AGENT_BASE_IMAGE}"
|
|
info " node ${NODEJS_MAJOR}"
|
|
info " claude ${CLAUDE_CODE_VERSION} (floor ${CLAUDE_CODE_MIN_VERSION})"
|
|
info " model ${AGENT_MODEL}"
|
|
|
|
"${ENGINE}" build \
|
|
--file "${HERE}/Containerfile" \
|
|
--tag "${IMAGE_REF}" \
|
|
--build-arg "AGENT_BASE_IMAGE=${AGENT_BASE_IMAGE}" \
|
|
--build-arg "NODEJS_MAJOR=${NODEJS_MAJOR}" \
|
|
--build-arg "CLAUDE_CODE_VERSION=${CLAUDE_CODE_VERSION}" \
|
|
--build-arg "CLAUDE_CODE_MIN_VERSION=${CLAUDE_CODE_MIN_VERSION}" \
|
|
--build-arg "AGENT_MODEL=${AGENT_MODEL}" \
|
|
"${HERE}"
|
|
|
|
# --- verify: the point of the whole exercise ---------------------------------
|
|
# A build that merely succeeded is not evidence this image is usable. Prove the tools
|
|
# EXECUTE, as the NON-ROOT uid, with a READ-ONLY root filesystem and only the two volumes
|
|
# the admission policy admits — the exact shape a worker Job runs in. Anything that works
|
|
# here but not there is a 3am discovery.
|
|
if [ "${VERIFY}" -eq 1 ]; then
|
|
log "Verifying inside the image (uid 65532, read-only rootfs, workspace+tmp only)"
|
|
"${ENGINE}" run --rm \
|
|
--user 65532:65532 \
|
|
--read-only \
|
|
--tmpfs /workspace:rw,mode=1777 \
|
|
--tmpfs /tmp:rw,mode=1777 \
|
|
--network none \
|
|
--entrypoint "" \
|
|
"${IMAGE_REF}" \
|
|
/bin/bash -euo pipefail -c '
|
|
echo "--- id ---"; id
|
|
echo "--- HOME ---"; echo "HOME=${HOME} CLAUDE_CONFIG_DIR=${CLAUDE_CONFIG_DIR}"
|
|
echo "--- baked versions ---"; cat /etc/agent-runner-versions
|
|
echo "--- the gate toolchain the worker needs (CLAUDE.md §3) ---"
|
|
for t in git python3 bash yamllint check-jsonschema kyverno promtool chainsaw flux sops age kubectl jq diff; do
|
|
if command -v "$t" >/dev/null 2>&1; then printf " ok %s\n" "$t";
|
|
else printf " MISSING %s\n" "$t"; missing=1; fi
|
|
done
|
|
[ -z "${missing:-}" ] || { echo "the gate cannot run in this image"; exit 1; }
|
|
echo "--- python can import the renderer dependency ---"
|
|
python3 -c "import yaml; print(\"PyYAML\", yaml.__version__)"
|
|
echo "--- claude ---"; claude --version
|
|
echo "--- the two entrypoints refuse arguments ---"
|
|
/usr/local/bin/pm-worker --anything 2>&1 | grep -q "takes no arguments" && echo " pm-worker: rejected"
|
|
/usr/local/bin/pm-dispatch --anything 2>&1 | grep -q "takes no arguments" && echo " pm-dispatch: rejected"
|
|
echo "--- the dispatcher selftest (branch vocabulary, result envelopes, Job template, persona) ---"
|
|
PM_SELFTEST=1 /usr/local/bin/pm-dispatch
|
|
echo "--- the entrypoints are root-owned and NOT writable by the runtime uid ---"
|
|
for f in /usr/local/bin/pm-worker /usr/local/bin/pm-dispatch /etc/pm-agent/worker-job-template.yaml; do
|
|
stat -c " %n %U:%G %a" "$f"
|
|
if [ -w "$f" ]; then echo "UNEXPECTED: uid $(id -u) can write $f"; exit 1; fi
|
|
done
|
|
echo " confirmed: not writable by uid $(id -u)"
|
|
echo "--- rootfs is read-only (expected: a failure) ---"
|
|
if touch /should-fail 2>/dev/null; then echo "UNEXPECTED: rootfs is writable"; exit 1; fi
|
|
echo " confirmed: / is read-only"
|
|
echo "--- the two writable paths really are writable ---"
|
|
touch "${HOME}/.probe" /tmp/.probe && echo " confirmed: ${HOME} and /tmp are writable"
|
|
echo "--- uid is non-zero ---"
|
|
[ "$(id -u)" -ne 0 ] && echo " confirmed: uid $(id -u), not root"
|
|
echo "--- no Anthropic API key is baked into the image (it would outrank the subscription token) ---"
|
|
[ -z "${ANTHROPIC_API_KEY:-}${ANTHROPIC_AUTH_TOKEN:-}" ] && echo " confirmed: neither is set"
|
|
'
|
|
# The worker's input guards, exercised in the image, with the interpreter and the script
|
|
# that will actually run in the cluster. The probe is mounted read-only rather than baked
|
|
# in: it is a build-time check, not something a worker Job has any business carrying.
|
|
log "Probing pm-worker's input validation inside the image"
|
|
"${ENGINE}" run --rm \
|
|
--user 65532:65532 \
|
|
--read-only \
|
|
--tmpfs /workspace:rw,mode=1777 \
|
|
--tmpfs /tmp:rw,mode=1777 \
|
|
--network none \
|
|
--volume "${HERE}/probe-validation.sh:/probe-validation.sh:ro,Z" \
|
|
--entrypoint "" \
|
|
"${IMAGE_REF}" \
|
|
/bin/bash /probe-validation.sh
|
|
|
|
log "Image verified"
|
|
fi
|
|
|
|
# --- digest ------------------------------------------------------------------
|
|
DIGEST="$("${ENGINE}" image inspect --format '{{.Digest}}' "${IMAGE_REF}")"
|
|
SIZE="$("${ENGINE}" image inspect --format '{{.Size}}' "${IMAGE_REF}")"
|
|
|
|
log "Built ${IMAGE_REF}"
|
|
info "local manifest digest ${DIGEST}"
|
|
info "size $(( SIZE / 1024 / 1024 )) MiB"
|
|
|
|
cat <<EOF
|
|
|
|
================================================================================
|
|
NOT PUSHED. Publishing is an operator action — this script holds no registry
|
|
credential and will never acquire one.
|
|
|
|
OPERATOR: run these, then put the digest from the digestfile into
|
|
platform/pm-agent/configmap.yaml (PM_WORKER_IMAGE) via a pull request:
|
|
|
|
${ENGINE} login gitea.home.keithjackson.dev
|
|
|
|
${ENGINE} push --digestfile /tmp/agent-runner.digest ${IMAGE_REF}
|
|
|
|
cat /tmp/agent-runner.digest
|
|
# -> sha256:.... THIS is the authoritative digest, not the local one above.
|
|
|
|
# platform/pm-agent/configmap.yaml
|
|
PM_WORKER_IMAGE: "${AGENT_IMAGE_REPO}@\$(cat /tmp/agent-runner.digest)"
|
|
|
|
WHY THE DIGEST AND NOT THE TAG: platform/kyverno/admission/pm-agent-job-shape.yaml is a
|
|
fail-closed Enforce policy. It DENIES any worker Job whose image is not
|
|
${AGENT_IMAGE_REPO}@sha256:<digest> — a tag reference is denied,
|
|
and so is any other repository path. The dispatcher also refuses to start if
|
|
PM_WORKER_IMAGE carries no digest, so the failure names its own cause.
|
|
|
|
THE SAME IMAGE RUNS THE DISPATCHER. platform/pm-agent/deployment.yaml pins it too, so a
|
|
new digest is a two-line change in one pull request: the Deployment's image and
|
|
PM_WORKER_IMAGE. They must be the same digest — the dispatcher and its workers share the
|
|
committed Job template and the env-name contract, and a mismatched pair would disagree
|
|
about it.
|
|
|
|
TIGHTEN THE BOUNDARY AFTERWARDS: the policy admits the wildcard
|
|
\`${AGENT_IMAGE_REPO}@sha256:*\`, so anyone who can push to that registry path can publish
|
|
a different digest. Replacing the wildcard with the LITERAL digest closes that gap; it is a
|
|
one-line change, reviewed in a pull request, which is exactly where a change to the
|
|
security boundary belongs.
|
|
================================================================================
|
|
EOF
|