From 36dabd454bf137f74ab7c3e372b060a4ded7f284 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 14 Oct 2026 15:59:48 +0500 Subject: t/i/docker: move SSH setup to git_server --- docker/Dockerfile | 4 +- docker/README.md | 2 +- test/integration/docker/docker-compose.yml | 17 +++-- test/integration/docker/git_server/Dockerfile | 20 ++---- test/integration/docker/git_server/entrypoint.sh | 64 +++++++++++++++++++ test/integration/docker/git_server/setup.sh | 68 ++++++++++++++++++++ test/integration/docker/git_server/setup_repo.sh | 30 --------- test/integration/docker/test.sh | 79 ------------------------ 8 files changed, 152 insertions(+), 132 deletions(-) create mode 100755 test/integration/docker/git_server/entrypoint.sh create mode 100755 test/integration/docker/git_server/setup.sh delete mode 100755 test/integration/docker/git_server/setup_repo.sh diff --git a/docker/Dockerfile b/docker/Dockerfile index 828b9a2..aeba7ce 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -35,9 +35,7 @@ RUN apk add -q --no-cache bash git openssh-client tini COPY --from=build ["/deps", "/deps/"] ENV PYTHONPATH="/deps:/usr/src" -ARG ssh_sock_dir=/ -ARG ssh_sock_path="$ssh_sock_dir/ssh-agent.sock" -ENV SSH_AUTH_SOCK="$ssh_sock_path" +ENV SSH_AUTH_SOCK="/ssh/agent.sock" COPY ["docker/cgitize.sh", "/"] COPY ["docker/get_output_dir.py", "/"] diff --git a/docker/README.md b/docker/README.md index 32aad34..5e09007 100644 --- a/docker/README.md +++ b/docker/README.md @@ -8,7 +8,7 @@ The `SCHEDULE` environment variable controls how often it gets run (see below). * Volumes: * `/etc/cgitize/cgitize.toml`: configuration file path. * `/mnt/cgitize`: by default, cloned repositories will be written here. - * `/ssh-agent.sock`: if you use SSH, map the agent socket here. + * `/ssh/agent.sock`: if you use SSH, map the agent socket here. * Environment variables: * `SCHEDULE`: defaults to "once", which makes the container exit after the first run. diff --git a/test/integration/docker/docker-compose.yml b/test/integration/docker/docker-compose.yml index 75391b8..8a44245 100644 --- a/test/integration/docker/docker-compose.yml +++ b/test/integration/docker/docker-compose.yml @@ -1,14 +1,22 @@ services: + git_server: + build: + context: . + dockerfile: git_server/Dockerfile + volumes: + - ssh:/ssh cgitize: build: context: ../../.. dockerfile: docker/Dockerfile + depends_on: + - git_server environment: SCHEDULE: once volumes: - ./etc:/etc/cgitize:ro - - "$SSH_AUTH_SOCK:/ssh-agent.sock" - ./output:/mnt/cgitize + - ssh:/ssh:ro frontend: build: context: ../../../docker/frontend @@ -16,7 +24,6 @@ services: - '127.0.0.1:80:80' volumes: - ./output:/mnt/cgitize:ro - git_server: - build: - context: . - dockerfile: git_server/Dockerfile + +volumes: + ssh: diff --git a/test/integration/docker/git_server/Dockerfile b/test/integration/docker/git_server/Dockerfile index 97306f9..2d0fbe4 100644 --- a/test/integration/docker/git_server/Dockerfile +++ b/test/integration/docker/git_server/Dockerfile @@ -1,24 +1,16 @@ FROM alpine:3.24 -RUN apk add -q --no-cache bash git openssh-server tini && \ +RUN apk add -q --no-cache bash git openssh-client-common openssh-server tini && \ echo 'root:root' | chpasswd && \ - git config --global user.name 'John Doe' && \ - git config --global user.email 'John.Doe@example.com' && \ - git config --global init.defaultBranch main && \ sed -ri 's/^#?PermitRootLogin\s+.*/PermitRootLogin yes/' /etc/ssh/sshd_config +USER root WORKDIR /root -COPY ["ssh_keys/server_key", "/etc/ssh/ssh_host_ed25519_key"] -COPY ["ssh_keys/server_key.pub", "/etc/ssh/ssh_host_ed25519_key.pub"] -COPY ["ssh_keys/client_key.pub", "./.ssh/authorized_keys"] +COPY ["git_server/setup.sh", "./"] +RUN ./setup.sh -RUN chmod 0600 -- /etc/ssh/ssh_host_ed25519_key && \ - chmod 0700 -- ./.ssh/ && \ - chmod 0600 -- ./.ssh/authorized_keys +COPY ["git_server/entrypoint.sh", "/"] +ENTRYPOINT ["/sbin/tini", "--", "/entrypoint.sh"] -COPY ["git_server/setup_repo.sh", "./"] -RUN ./setup_repo.sh - -ENTRYPOINT ["/sbin/tini", "--"] CMD ["/usr/sbin/sshd", "-D"] diff --git a/test/integration/docker/git_server/entrypoint.sh b/test/integration/docker/git_server/entrypoint.sh new file mode 100755 index 0000000..03f79e4 --- /dev/null +++ b/test/integration/docker/git_server/entrypoint.sh @@ -0,0 +1,64 @@ +#!/usr/bin/env bash + +set -o errexit -o nounset -o pipefail +shopt -s inherit_errexit lastpipe + +script_name="$( basename -- "${BASH_SOURCE[0]}" )" +readonly script_name + +dump() { + local prefix="${FUNCNAME[0]}" + [ "${#FUNCNAME[@]}" -gt 1 ] && prefix="${FUNCNAME[1]}" + + local msg + for msg; do + echo "$script_name: $prefix: $msg" + done +} + +readonly ssh_dir=/ssh +readonly ssh_client_key="$ssh_dir/client_key" +readonly ssh_client_password='password' + +spawn_ssh_agent() { + if ! command -v ssh-agent > /dev/null 2>&1; then + dump "could not find ssh-agent" >&2 + return 1 + fi + + local output + output="$( ssh-agent -s -a "$ssh_dir/agent.sock" )" + + echo "$output" + eval "$output" + + if [ -z "${SSH_AGENT_PID:+x}" ]; then + dump "could not start ssh-agent" >&2 + return 1 + fi +} + +setup_ssh_agent() { + echo + echo ---------------------------------------------------------------------- + echo Setting up ssh-agent + echo ---------------------------------------------------------------------- + + spawn_ssh_agent + + local askpass_path + askpass_path="$( mktemp )" + chmod 0700 -- "$askpass_path" + + echo "#!/usr/bin/env sh" >> "$askpass_path" + printf -- 'echo %q' "$ssh_client_password" >> "$askpass_path" + + SSH_ASKPASS="$askpass_path" SSH_ASKPASS_REQUIRE=force DISPLAY= ssh-add "$ssh_client_key" < /dev/null +} + +main() { + setup_ssh_agent + exec "$@" +} + +main "$@" diff --git a/test/integration/docker/git_server/setup.sh b/test/integration/docker/git_server/setup.sh new file mode 100755 index 0000000..f2572ff --- /dev/null +++ b/test/integration/docker/git_server/setup.sh @@ -0,0 +1,68 @@ +#!/usr/bin/env bash + +set -o errexit -o nounset -o pipefail +shopt -s inherit_errexit lastpipe + +readonly ssh_dir=/ssh +readonly ssh_client_password='password' + +configure_git() { + echo + echo ---------------------------------------------------------------------- + echo Configuring git + echo ---------------------------------------------------------------------- + + git config --global user.name 'John Doe' + git config --global user.email 'John.Doe@example.com' + git config --global init.defaultBranch main +} + +generate_ssh_keys() { + echo + echo ---------------------------------------------------------------------- + echo Generating SSH keys + echo ---------------------------------------------------------------------- + + mkdir -p -- "$ssh_dir" + + ssh-keygen -t rsa -b 4096 -f "$ssh_dir/client_key" -N "$ssh_client_password" + ssh-keygen -t rsa -b 4096 -f "$ssh_dir/server_key" -N '' + + mkdir ~/.ssh + + cp "$ssh_dir/server_key" /etc/ssh/ssh_host_ed25519_key + cp "$ssh_dir/server_key.pub" /etc/ssh/ssh_host_ed25519_key.pub + cp "$ssh_dir/client_key.pub" ~/.ssh/authorized_keys + + chmod 0600 -- /etc/ssh/ssh_host_ed25519_key + chmod 0700 -- ~/.ssh/ + chmod 0600 -- ~/.ssh/authorized_keys +} + +readonly repo_path="$HOME/test_repo" + +create_repo() { + echo + echo ---------------------------------------------------------------------- + echo Setting up upstream repository + echo ---------------------------------------------------------------------- + + mkdir -p -- "$repo_path" + pushd -- "$repo_path" > /dev/null + git init + echo '1' > 1.txt + git add . + git commit -m 'first commit' + echo '2' > 2.txt + git add . + git commit -m 'second commit' + popd > /dev/null +} + +main() { + configure_git + generate_ssh_keys + create_repo +} + +main diff --git a/test/integration/docker/git_server/setup_repo.sh b/test/integration/docker/git_server/setup_repo.sh deleted file mode 100755 index c5bb32c..0000000 --- a/test/integration/docker/git_server/setup_repo.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/usr/bin/env bash - -set -o errexit -o nounset -o pipefail -shopt -s inherit_errexit lastpipe - -readonly local_repo_path="$HOME/test_repo" - -setup_local_repo() { - echo - echo ---------------------------------------------------------------------- - echo Setting up upstream repository - echo ---------------------------------------------------------------------- - - mkdir -p -- "$local_repo_path" - pushd -- "$local_repo_path" > /dev/null - git init - echo '1' > 1.txt - git add . - git commit -m 'first commit' - echo '2' > 2.txt - git add . - git commit -m 'second commit' - popd > /dev/null -} - -main() { - setup_local_repo -} - -main diff --git a/test/integration/docker/test.sh b/test/integration/docker/test.sh index ae43b71..a82f3b1 100755 --- a/test/integration/docker/test.sh +++ b/test/integration/docker/test.sh @@ -12,8 +12,6 @@ readonly script_name # This is still required with older Compose versions to use TARGETARCH: export DOCKER_BUILDKIT=1 -readonly ssh_dir="$script_dir/ssh_keys" -readonly client_key_password='password' readonly output_dir="$script_dir/output" readonly frontend_host=127.0.0.1 @@ -40,8 +38,6 @@ cleanup() { echo Cleaning up echo ---------------------------------------------------------------------- - remove_ssh_keys - kill_ssh_agent docker_cleanup rm -rf -- "$output_dir" @@ -85,74 +81,6 @@ curl_check_code() { fi } -generate_ssh_keys() { - echo - echo ---------------------------------------------------------------------- - echo Generating SSH keys - echo ---------------------------------------------------------------------- - - mkdir -p -- "$ssh_dir" - - ssh-keygen -t rsa -b 4096 -f "$ssh_dir/client_key" -N "$client_key_password" - ssh-keygen -t rsa -b 4096 -f "$ssh_dir/server_key" -N '' -} - -remove_ssh_keys() { - rm -rf -- "$ssh_dir" -} - -kill_ssh_agent() { - [ -n "${this_ssh_agent_pid:+x}" ] || return 0 - dump "killing ssh-agent with PID $this_ssh_agent_pid" - kill "$this_ssh_agent_pid" -} - -spawn_ssh_agent() { - if ! command -v ssh-agent > /dev/null 2>&1; then - dump "could not find ssh-agent" >&2 - return 1 - fi - - local output - output="$( ssh-agent -s )" - - eval "$output" - - if [ -z "${SSH_AGENT_PID:+x}" ]; then - dump "could not start ssh-agent" >&2 - return 1 - fi - - this_ssh_agent_pid="$SSH_AGENT_PID" -} - -setup_ssh_agent() { - echo - echo ---------------------------------------------------------------------- - echo Setting up ssh-agent - echo ---------------------------------------------------------------------- - - spawn_ssh_agent - - local key="$ssh_dir/client_key" - chmod 0600 -- "$key" - - local askpass_path - askpass_path="$( mktemp --tmpdir="$script_dir" )" - - local askpass_rm - askpass_rm="$( printf -- 'rm -- %q; trap - RETURN' "$askpass_path" )" - trap "$askpass_rm" RETURN - - chmod 0700 -- "$askpass_path" - - local echo_password - echo_password="$( printf -- 'echo %q' "$client_key_password" )" - echo "$echo_password" > "$askpass_path" - - SSH_ASKPASS="$askpass_path" SSH_ASKPASS_REQUIRE=force DISPLAY= ssh-add "$key" < /dev/null -} - docker_build() { echo echo ---------------------------------------------------------------------- @@ -169,8 +97,6 @@ docker_cleanup() { } setup() { - generate_ssh_keys - setup_ssh_agent docker_build } @@ -189,11 +115,6 @@ run_cgitize() { echo Running cgitize echo ---------------------------------------------------------------------- - if [ -z "${SSH_AUTH_SOCK:+x}" ]; then - dump 'SSH_AUTH_SOCK is not defined' >&2 - return 1 - fi - dump "SSH_AUTH_SOCK: $SSH_AUTH_SOCK" docker compose run --rm cgitize } -- cgit v1.3