174 lines
6.9 KiB
Rust
174 lines
6.9 KiB
Rust
//! Contracts for local HEVC client-bundle preflight and remote re-entry helpers.
|
|
//!
|
|
//! Scope: guard the passwordless scripts used while Theia is offline or just
|
|
//! recovering. Targets: `scripts/manual/run_local_hevc_bundle_audit.sh`,
|
|
//! `scripts/manual/run_hevc_remote_reentry_check.sh`, and
|
|
//! `scripts/manual/run_hevc_post_reboot_sequence.sh`. Why: these helpers should
|
|
//! make the HEVC migration repeatable without reintroducing sudo prompts,
|
|
//! split-stream probes, or undocumented artifact paths.
|
|
|
|
const LOCAL_AUDIT_SCRIPT: &str =
|
|
include_str!("../../scripts/manual/run_local_hevc_bundle_audit.sh");
|
|
const LOCAL_AUDIT_VALIDATOR: &str =
|
|
include_str!("../../scripts/manual/validate_local_hevc_bundle_audit.py");
|
|
const LOCAL_ENCODER_PREFLIGHT_SCRIPT: &str =
|
|
include_str!("../../scripts/manual/run_local_hevc_encoder_preflight.sh");
|
|
const REMOTE_REENTRY_SCRIPT: &str =
|
|
include_str!("../../scripts/manual/run_hevc_remote_reentry_check.sh");
|
|
const POST_REBOOT_SCRIPT: &str =
|
|
include_str!("../../scripts/manual/run_hevc_post_reboot_sequence.sh");
|
|
|
|
#[test]
|
|
fn local_hevc_bundle_audit_is_passwordless_and_artifact_backed() {
|
|
for expected in [
|
|
"LESAVKA_LOCAL_HEVC_BUNDLE_AUDIT_OUTPUT_DIR",
|
|
"LESAVKA_LOCAL_HEVC_BUNDLE_AUDIT_JSON",
|
|
"hevc_probe_bundle_audit_writes_manifest",
|
|
"hevc_probe_bundle_train_covers_every_supported_mode",
|
|
"hevc_probe_bundle_train_drops_stale_events_as_complete_av_units_under_jitter",
|
|
"runtime_probe_hevc_video_and_audio_can_form_one_local_bundle",
|
|
"validate_local_hevc_bundle_audit.py",
|
|
"no remote host, sudo, tunnel, or RCT capture is used",
|
|
"audit_json: ${LOCAL_AUDIT_JSON}",
|
|
] {
|
|
assert!(
|
|
LOCAL_AUDIT_SCRIPT.contains(expected),
|
|
"local HEVC audit script should contain marker {expected}"
|
|
);
|
|
}
|
|
for forbidden in ["ssh ", "sudo -n", "sudo -S", "read -s", "VAULT", "vault"] {
|
|
assert!(
|
|
!LOCAL_AUDIT_SCRIPT.contains(forbidden),
|
|
"local HEVC audit must stay local/passwordless: {forbidden}"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn local_hevc_bundle_validator_enforces_event_timing_and_identity() {
|
|
for expected in [
|
|
"lesavka.local-hevc-bundle-audit.v1",
|
|
"EXPECTED_EVENTS = 16",
|
|
"EXPECTED_AUDIO_PACKETS_PER_EVENT = 2",
|
|
"EXPECTED_VIDEO_PERIOD_US = 1_000_000",
|
|
"MAX_AUDIO_VIDEO_SKEW_US = 120_000",
|
|
"has_annex_b_start_code",
|
|
"event_code",
|
|
"event codes: 1..",
|
|
"audio_capture_pts_us",
|
|
"max_audio_video_skew_us",
|
|
"local HEVC bundle audit validation: pass",
|
|
] {
|
|
assert!(
|
|
LOCAL_AUDIT_VALIDATOR.contains(expected),
|
|
"local HEVC validator should contain marker {expected}"
|
|
);
|
|
}
|
|
for forbidden in ["ssh ", "sudo", "VAULT", "vault"] {
|
|
assert!(
|
|
!LOCAL_AUDIT_VALIDATOR.contains(forbidden),
|
|
"local HEVC validator must stay local/passwordless: {forbidden}"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn local_hevc_encoder_preflight_is_passwordless_and_mode_matrix_backed() {
|
|
for expected in [
|
|
"LESAVKA_LOCAL_HEVC_ENCODER_PREFLIGHT_OUTPUT_DIR",
|
|
"LESAVKA_LOCAL_HEVC_ENCODER_PREFLIGHT_JSON",
|
|
"LESAVKA_LOCAL_HEVC_ENCODER_PREFLIGHT_MODES",
|
|
"LESAVKA_LOCAL_HEVC_ENCODER_PREFLIGHT_SECONDS",
|
|
"LESAVKA_LOCAL_HEVC_ENCODER_PREFLIGHT_KBIT",
|
|
"LESAVKA_LOCAL_HEVC_ENCODER_PREFLIGHT_MIN_REALTIME_FACTOR",
|
|
"LESAVKA_LOCAL_HEVC_ENCODER",
|
|
"1280x720@20,1280x720@30,1920x1080@20,1920x1080@30",
|
|
"lesavka.local-hevc-encoder-preflight.v1",
|
|
"gst-launch-1.0",
|
|
"h265parse config-interval=-1",
|
|
"video/x-h265,stream-format=byte-stream,alignment=au",
|
|
"local HEVC encoder preflight failed",
|
|
"no remote host, sudo, tunnel, or RCT capture is used",
|
|
] {
|
|
assert!(
|
|
LOCAL_ENCODER_PREFLIGHT_SCRIPT.contains(expected),
|
|
"local HEVC encoder preflight should contain marker {expected}"
|
|
);
|
|
}
|
|
for forbidden in ["ssh ", "sudo -n", "sudo -S", "read -s", "VAULT", "vault"] {
|
|
assert!(
|
|
!LOCAL_ENCODER_PREFLIGHT_SCRIPT.contains(forbidden),
|
|
"local HEVC encoder preflight must stay local/passwordless: {forbidden}"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn remote_reentry_helper_is_noninteractive_and_explicitly_opt_in_for_mutations() {
|
|
for expected in [
|
|
"LESAVKA_HEVC_REENTRY_HOST",
|
|
"LESAVKA_HEVC_REENTRY_REMOTE_REPO",
|
|
"LESAVKA_HEVC_REENTRY_MODE",
|
|
"LESAVKA_HEVC_REENTRY_CODEC",
|
|
"LESAVKA_HEVC_REENTRY_SYNC",
|
|
"LESAVKA_HEVC_REENTRY_BUILD",
|
|
"LESAVKA_HEVC_REENTRY_DEPLOY",
|
|
"LESAVKA_HEVC_REENTRY_RECONFIGURE",
|
|
"LESAVKA_HEVC_REENTRY_WAIT_SECONDS",
|
|
"LESAVKA_HEVC_REENTRY_WAIT_INTERVAL_SECONDS",
|
|
"sudo -n /usr/local/sbin/lesavka-dev-install status",
|
|
"sudo -n /usr/local/sbin/lesavka-dev-install deploy",
|
|
"sudo -n /usr/local/sbin/lesavka-dev-install reconfigure",
|
|
"falling back to git-file tar-over-SSH sync without remote delete",
|
|
"git ls-files -z --cached --others --exclude-standard",
|
|
"--exclude '*.profraw'",
|
|
"BatchMode=yes",
|
|
"this script will not prompt for passwords",
|
|
"remote host did not become reachable within",
|
|
] {
|
|
assert!(
|
|
REMOTE_REENTRY_SCRIPT.contains(expected),
|
|
"remote HEVC re-entry script should contain marker {expected}"
|
|
);
|
|
}
|
|
for forbidden in ["sudo -S", "read -s", "VAULT", "vault"] {
|
|
assert!(
|
|
!REMOTE_REENTRY_SCRIPT.contains(forbidden),
|
|
"remote HEVC re-entry script must not retrieve or prompt secrets: {forbidden}"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn post_reboot_sequence_chains_local_preflights_reentry_and_hevc_matrix() {
|
|
for expected in [
|
|
"LESAVKA_HEVC_POST_REBOOT_OUTPUT_DIR",
|
|
"LESAVKA_HEVC_POST_REBOOT_WAIT_SECONDS",
|
|
"LESAVKA_HEVC_POST_REBOOT_RUN_LOCAL_PREFLIGHTS",
|
|
"LESAVKA_HEVC_POST_REBOOT_RUN_REENTRY",
|
|
"LESAVKA_HEVC_POST_REBOOT_RUN_STATIC_MATRIX",
|
|
"LESAVKA_HEVC_POST_REBOOT_RUN_FINAL_SANITY",
|
|
"run_local_hevc_bundle_audit.sh",
|
|
"run_local_hevc_encoder_preflight.sh",
|
|
"run_hevc_remote_reentry_check.sh",
|
|
"run_server_to_rc_mode_matrix.sh",
|
|
"LESAVKA_SERVER_RC_PROFILE=hevc",
|
|
"LESAVKA_SERVER_RC_PROMPT_SUDO_EARLY=0",
|
|
"LESAVKA_SERVER_RC_TUNE_DELAYS=0",
|
|
"1280x720@30,1280x720@20",
|
|
"1280x720@20,1280x720@30,1920x1080@20,1920x1080@30",
|
|
"sudo is non-interactive only; no password prompt path is used",
|
|
] {
|
|
assert!(
|
|
POST_REBOOT_SCRIPT.contains(expected),
|
|
"post-reboot HEVC sequence should contain marker {expected}"
|
|
);
|
|
}
|
|
for forbidden in ["sudo -S", "read -s", "VAULT", "vault"] {
|
|
assert!(
|
|
!POST_REBOOT_SCRIPT.contains(forbidden),
|
|
"post-reboot HEVC sequence must not retrieve or prompt secrets: {forbidden}"
|
|
);
|
|
}
|
|
}
|