108 lines
4.3 KiB
Python
108 lines
4.3 KiB
Python
"""Pinned Go bootstrap contracts for isolated Hermes execution workers."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
|
|
ROOT = Path(__file__).parents[2]
|
|
HERMES = ROOT / "services/hermes"
|
|
INSTALLER = HERMES / "scripts/install_worker_go.sh"
|
|
|
|
|
|
def _write_executable(path: Path, text: str) -> None:
|
|
path.write_text(text)
|
|
path.chmod(0o755)
|
|
|
|
|
|
def _run_installer(tmp_path: Path, architecture: str, download_arch: str) -> Path:
|
|
"""Run the installer against fake verified archive tools without network access."""
|
|
tools, mock = tmp_path / "tools", tmp_path / "mock"
|
|
mock.mkdir()
|
|
curl_log = tmp_path / "curl.log"
|
|
_write_executable(mock / "uname", '#!/bin/sh\nprintf "%s\\n" "$TEST_ARCH"\n')
|
|
_write_executable(
|
|
mock / "curl",
|
|
"""#!/bin/sh
|
|
last=""
|
|
destination=""
|
|
previous=""
|
|
for argument in "$@"; do
|
|
if [ "$previous" = "-o" ]; then destination=$argument; fi
|
|
previous=$argument
|
|
last=$argument
|
|
done
|
|
printf "%s" "$last" > "$CURL_LOG"
|
|
printf archive > "$destination"
|
|
""",
|
|
)
|
|
_write_executable(mock / "sha256sum", '#!/bin/sh\ncat >/dev/null\n')
|
|
_write_executable(
|
|
mock / "tar",
|
|
'''#!/bin/sh
|
|
while [ "$#" -gt 0 ]; do
|
|
if [ "$1" = "-C" ]; then work=$2; shift 2; continue; fi
|
|
shift
|
|
done
|
|
mkdir -p "$work/go/bin"
|
|
printf '#!/bin/sh\\nprintf "go version go1.26.5 linux/%%s\\\\n" "$TEST_DL_ARCH"\\n' > "$work/go/bin/go"
|
|
printf '#!/bin/sh\\n[ "$1" = "-w" ] && [ -f "$2" ]\\n' > "$work/go/bin/gofmt"
|
|
chmod 0755 "$work/go/bin/go" "$work/go/bin/gofmt"
|
|
''',
|
|
)
|
|
root = tools / f"go-1.26.5-{download_arch}"
|
|
(root / "bin").mkdir(parents=True)
|
|
_write_executable(root / "bin/go", "#!/bin/sh\nexit 1\n")
|
|
environment = {
|
|
**os.environ,
|
|
"PATH": f"{mock}:/usr/bin:/bin",
|
|
"HERMES_WORKER_TOOLS_DIR": str(tools),
|
|
"TEST_ARCH": architecture,
|
|
"TEST_DL_ARCH": download_arch,
|
|
"CURL_LOG": str(curl_log),
|
|
}
|
|
subprocess.run(["/bin/sh", str(INSTALLER)], env=environment, check=True)
|
|
assert curl_log.read_text().endswith(f"go1.26.5.linux-{download_arch}.tar.gz")
|
|
assert (tools / f".worker-go-toolchain-1.26.5-{download_arch}").is_file()
|
|
assert subprocess.check_output(
|
|
[tools / "bin/go", "version"], text=True, env=environment
|
|
).strip() == f"go version go1.26.5 linux/{download_arch}"
|
|
subprocess.run([tools / "bin/gofmt", "-w", str(tmp_path / "formatted.go")], check=False)
|
|
return tools
|
|
|
|
|
|
@pytest.mark.parametrize(("architecture", "download_arch"), [("aarch64", "arm64"), ("x86_64", "amd64")])
|
|
def test_worker_go_installer_recovers_incomplete_arch_cache(tmp_path, architecture, download_arch):
|
|
"""An incomplete cached tree is replaced only with the verified native archive."""
|
|
tools = _run_installer(tmp_path, architecture, download_arch)
|
|
assert (tools / f"go-1.26.5-{download_arch}/bin/gofmt").is_file()
|
|
|
|
|
|
def test_worker_manifest_installs_only_pinned_go_on_writable_tools_claim():
|
|
"""The worker gets Go before model binaries without operator credentials or mounts."""
|
|
document = yaml.safe_load(HERMES.joinpath("execution-worker-statefulset.yaml").read_text())
|
|
init = next(item for item in document["spec"]["template"]["spec"]["initContainers"] if item["name"] == "install-worker-go")
|
|
assert init["command"] == [
|
|
"/bin/sh", "-ec", "timeout 300 /bin/sh /opt/coordinator/install_worker_go.sh"
|
|
]
|
|
assert {mount["name"] for mount in init["volumeMounts"]} == {"tools", "coordinator"}
|
|
assert not next(mount for mount in init["volumeMounts"] if mount["name"] == "tools").get("readOnly", False)
|
|
assert next(mount for mount in init["volumeMounts"] if mount["name"] == "coordinator")["readOnly"] is True
|
|
kustomization = yaml.safe_load(HERMES.joinpath("kustomization.yaml").read_text())
|
|
pool = next(
|
|
item for item in kustomization["configMapGenerator"]
|
|
if item["name"] == "hermes-execution-pool"
|
|
)
|
|
assert "install_worker_go.sh=scripts/install_worker_go.sh" in pool["files"]
|
|
script = INSTALLER.read_text()
|
|
assert "sha256sum -c -" in script and "go${version}.linux-${dl_arch}.tar.gz" in script
|
|
assert "version=1.26.5" in script
|
|
assert 'timeout 15 "${root}/bin/go" version' in script
|
|
assert 'timeout 15 "${root}/bin/gofmt" -w' in script
|
|
assert "--connect-timeout 15 --max-time 90 --retry 2 --retry-delay 2" in script
|