hermes
2d57173e31
Reported as "why can't i see anything from codegit its just a black box".
NOT a codegit bug. Verified first, exhaustively, through the authenticated API:
overview 200 940 bytes
log 200 79596 bytes (full commit history)
transfer 200 1460 bytes
config 200 1174 bytes
no JS errors in the console; every DOM helper codegit calls exists.
ROOT CAUSE 1 - a generic CSS rule hardcodes a height
theme/modules/common/_panel.scss -> theme/main.min.css:
panel { ... height: 500px; ... }
That forces EVERY modal panel to a fixed 500px box. Measured live:
#dialog 404px (clamped by max-height:70vh + overflow-y:auto)
#codegit panel 500px, while its content is only 119px
toolbar ("Branch") top 620 vs dialog bottom 490 -> OUTSIDE the modal
So ~380px of the dialog was empty dead space and the Branch line rendered below the
modal, invisible. Fixed to height:auto with max-height:58vh (long content still scrolls):
before: panel 500 -> toolbar top 620, dialog bottom 490 (outside)
after: panel 136 -> toolbar top 256, dialog bottom 279 (inside)
_panel.scss updated too so the source does not contradict the shipped CSS.
ROOT CAUSE 2 - the fix was invisible because of the browser cache
Atheos serves theme/main.min.css and the generated bundles from stable URLs with no cache
headers, so browsers legitimately reuse their cached copy - which is why the first attempt
appeared to do nothing. nginx now sends Cache-Control: no-cache, must-revalidate for
*.css/*.js: caching still works (cheap 304s) but changes are always picked up.
Adds
scripts/fix-panel-layout.sh idempotent re-apply for both fixes (lost on update-atheos)
docs/known-issues.md §4, §5 both findings, with the measurements
Tests (44 passed, 1 failed - the failure is branch protection, a genuine open item)
+ panel must not be fixed at 500px
+ theme CSS must send Cache-Control: no-cache
217 lines
12 KiB
Bash
217 lines
12 KiB
Bash
#!/bin/sh
|
|
# ==============================================================================
|
|
# build-and-test.sh — captures evidence for every acceptance criterion (AC-1..AC-8)
|
|
# Run ON THE GUEST: ssh root@192.168.178.57 'sh -s' < build-and-test.sh
|
|
# ==============================================================================
|
|
W=/var/www/atheos
|
|
B=$W/workspace/blog
|
|
pass=0; fail=0
|
|
ok() { echo " PASS $1"; pass=$((pass+1)); }
|
|
bad() { echo " FAIL $1"; fail=$((fail+1)); }
|
|
chk() { if [ "$2" = "$3" ]; then ok "$1 ($2)"; else bad "$1 (got '$2', want '$3')"; fi; }
|
|
asuser() { su -s /bin/sh atheos -c "$1"; }
|
|
|
|
echo "=============================================================="
|
|
echo "AC-2 Atheos is served by nginx+PHP (not 502/404)"
|
|
echo "=============================================================="
|
|
CODE=$(wget -qO /tmp/idx.html --server-response http://127.0.0.1/ 2>&1 | sed -n 's/.*HTTP\/1\.[01] \([0-9]*\).*/\1/p' | head -1)
|
|
chk "HTTP status for /" "$CODE" "200"
|
|
if grep -qi '<title>Atheos IDE</title>' /tmp/idx.html 2>/dev/null; then ok "served page is the Atheos IDE"; else bad "served page is not Atheos"; fi
|
|
# Either state is valid: pre-install shows the installer, post-install shows the login/app.
|
|
if grep -qiE 'install|setup' /tmp/idx.html 2>/dev/null; then
|
|
ok "installer markers present (pre-install state)"
|
|
elif [ -f "$W/config.php" ] && [ -s "$W/config.php" ]; then
|
|
ok "installer already completed (config.php populated)"
|
|
else
|
|
bad "neither installer markers nor a populated config.php"
|
|
fi
|
|
SOCK=$(sed -n 's/^listen = //p' /etc/php83/php-fpm.d/www.conf | head -1)
|
|
NGX=$(sed -n 's/.*fastcgi_pass unix:\([^;]*\);.*/\1/p' /etc/nginx/http.d/atheos.conf | head -1)
|
|
echo " --- socket contract (I-1):"
|
|
echo " php-fpm listen : $SOCK"
|
|
echo " nginx fastcgi : $NGX"
|
|
chk "socket paths byte-match" "$NGX" "$SOCK"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-3 'blog' is present with files that can be opened"
|
|
echo "=============================================================="
|
|
POSTS=$(ls $B/src/content/*.md 2>/dev/null | wc -l | tr -d ' ')
|
|
if [ "$POSTS" -ge 20 ]; then ok "posts found ($POSTS, expected >= 20)"; else bad "posts found ($POSTS, expected >= 20)"; fi
|
|
if [ -d "$W/workspace/blog/.git" ]; then ok "it is a git working copy"; else bad "not a git working copy"; fi
|
|
chk "theme present" "$(ls $B/src/themes 2>/dev/null | tr -d ' ')" "cleanblog"
|
|
chk "workspace owner" "$(stat -c '%U' $W/workspace/blog)" "atheos"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-4 An edit persists to disk (as the FPM user)"
|
|
echo "=============================================================="
|
|
asuser "printf 'x\n' > $B/.ac4-probe" >/dev/null 2>&1
|
|
if [ "$(asuser "cat $B/.ac4-probe" 2>/dev/null)" = "x" ]; then ok "write+read back as 'atheos'"; else bad "cannot write as atheos"; fi
|
|
asuser "rm -f $B/.ac4-probe" >/dev/null 2>&1
|
|
for p in config.php data workspace plugins themes; do
|
|
if asuser "test -w $W/$p" 2>/dev/null; then ok "writable: $p"; else bad "NOT writable: $p"; fi
|
|
done
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-5 Remote points at Gitea; the SSH switch is documented"
|
|
echo "=============================================================="
|
|
REMOTE=$(asuser "git -C $B remote get-url origin" 2>/dev/null)
|
|
echo " remote now: $REMOTE"
|
|
case "$REMOTE" in
|
|
*aridgwayweb.com*armistace/blog*) ok "remote targets armistace/blog on Gitea (HTTPS)" ;;
|
|
gitea-blog:armistace/blog*) ok "remote targets armistace/blog via the deploy-key alias" ;;
|
|
*) bad "remote does not target the blog repo" ;;
|
|
esac
|
|
# A repo may legitimately sit on master, or on the long-lived writer branch (docs/writer-branch-workflow.md).
|
|
BR=$(asuser "git -C $B rev-parse --abbrev-ref HEAD" 2>/dev/null)
|
|
case "$BR" in
|
|
master|main) ok "branch ($BR)" ;;
|
|
atheos-writer) ok "branch ($BR - writer-branch workflow)" ;;
|
|
*) bad "branch is unexpected: $BR" ;;
|
|
esac
|
|
|
|
# Phase 2: once the SSH alias is in use, prove the transport actually authenticates
|
|
case "$REMOTE" in
|
|
gitea-blog:*)
|
|
AUTH=$(asuser 'ssh -o BatchMode=yes -o ConnectTimeout=8 -T gitea-blog 2>&1' | head -1)
|
|
case "$AUTH" in
|
|
*successfully\ authenticated*) ok "deploy key authenticates over SSH" ;;
|
|
*) bad "deploy key does NOT authenticate: $AUTH" ;;
|
|
esac
|
|
;;
|
|
esac
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-6 Survives reboot (services enabled, data intact)"
|
|
echo "=============================================================="
|
|
echo " container uptime: $(cut -d. -f1 /proc/uptime)s (reboot was issued during the test)"
|
|
for s in nginx php-fpm83 sshd; do
|
|
if rc-update show 2>/dev/null | grep -qE "^\s+$s\s+\|\s+default"; then ok "$s enabled at boot"; else bad "$s NOT enabled at boot"; fi
|
|
if rc-service "$s" status >/dev/null 2>&1; then ok "$s running"; else bad "$s not running"; fi
|
|
done
|
|
if [ -S "$SOCK" ]; then ok "fpm socket exists after reboot"; else bad "fpm socket missing"; fi
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-8 SCOPE GUARD: no build toolchain present (must be ABSENT)"
|
|
echo "=============================================================="
|
|
for t in python python3 pelican pip pip3 make; do
|
|
if command -v "$t" >/dev/null 2>&1; then bad "$t IS present - scope violated!"; else ok "$t absent (correct)"; fi
|
|
done
|
|
echo " --- also check no database engine was installed (Atheos needs none):"
|
|
for d in mysqld mariadbd postgres redis-server; do
|
|
if command -v "$d" >/dev/null 2>&1; then bad "$d present - unexpected"; else ok "$d absent (correct)"; fi
|
|
done
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "REGRESSION: panel has no hardcoded height (empty-modal bug)"
|
|
echo "=============================================================="
|
|
# panel { height:500px } forced every modal panel to a fixed box: short content left a large
|
|
# empty black region and anything after the panel (codegit's Branch toolbar) was pushed outside
|
|
# the modal. docs/known-issues.md §4. Fails loudly if lost to an update.
|
|
PNL=$(grep -oE '(^|[;}])panel\{[^}]*\}' /var/www/atheos/theme/main.min.css 2>/dev/null | head -1)
|
|
if [ -z "$PNL" ]; then
|
|
bad "could not read the panel rule from theme/main.min.css"
|
|
elif echo "$PNL" | grep -q 'height:500px'; then
|
|
bad "panel is fixed at 500px - re-run scripts/fix-panel-layout.sh"
|
|
else
|
|
ok "panel is content-sized ($(echo "$PNL" | grep -oE 'height:[^;]*' | head -1))"
|
|
fi
|
|
# and the CSS/JS cache header must be present, or fixes stay invisible
|
|
if wget -qO /dev/null --server-response --header='Host: 127.0.0.1' http://127.0.0.1/theme/main.min.css 2>&1 | grep -qi 'Cache-Control.*no-cache'; then
|
|
ok "theme CSS sends Cache-Control: no-cache (changes are picked up)"
|
|
else
|
|
bad "theme CSS has no Cache-Control - a CSS fix can stay hidden behind the browser cache"
|
|
fi
|
|
echo
|
|
echo "=============================================================="
|
|
echo "REGRESSION: rDelete works (GLOB_BRACE is glibc-only; musl lacks it)"
|
|
echo "=============================================================="
|
|
# That broke deleting ANY file/folder in the editor AND removing a market plugin (the UI
|
|
# would spin forever because the fatal killed the response before Common::send()).
|
|
# docs/known-issues.md §1. This test fails loudly if the patch is lost (e.g. by an update).
|
|
rm -rf /tmp/rdel_guard 2>/dev/null
|
|
if mkdir -p /tmp/rdel_guard/a/b/c /tmp/rdel_guard/.hd 2>/dev/null \
|
|
&& touch /tmp/rdel_guard/f.txt /tmp/rdel_guard/.dot /tmp/rdel_guard/a/b/c/deep.txt; then
|
|
ROUT=$(php83 -r 'require_once("/var/www/atheos/common.php"); echo Common::rDelete("/tmp/rdel_guard/") ? "ok" : "fail";' 2>&1 | grep -viE 'deprecat|warning|notice' | tail -1)
|
|
if [ "$ROUT" = "ok" ] && [ ! -e /tmp/rdel_guard ]; then
|
|
ok "rDelete removed a nested tree incl. dotfiles (delete works)"
|
|
else
|
|
if echo "$ROUT" | grep -q 'GLOB_BRACE'; then
|
|
bad "rDelete FATALS on GLOB_BRACE - re-apply patches/helpers-rDelete-GLOB_BRACE.diff"
|
|
else
|
|
bad "rDelete failed (got: $ROUT)"
|
|
fi
|
|
fi
|
|
else
|
|
bad "could not build the rDelete test tree"
|
|
fi
|
|
rm -rf /tmp/rdel_guard 2>/dev/null
|
|
echo "=============================================================="
|
|
# The whole branch-based workflow assumes the deploy key CANNOT push master. That is a
|
|
# repo-side setting we cannot verify from here by inspection - so test it the way an
|
|
# attacker would: attempt a direct push to master and require it to be REJECTED.
|
|
if [ "${SKIP_MASTER_PUSH_TEST:-0}" = "1" ]; then
|
|
echo " SKIPPED (SKIP_MASTER_PUSH_TEST=1)"
|
|
else
|
|
PUSH_OUT=$(asuser "git -C $B push origin HEAD:master --dry-run" 2>&1)
|
|
if echo "$PUSH_OUT" | grep -qiE 'protected|not allowed|denied|forbidden|remote rejected'; then
|
|
ok "master is protected - the deploy key CANNOT push it"
|
|
else
|
|
bad "master is NOT protected - the deploy key could push master directly!"
|
|
echo " Enable it: armistace/blog -> Settings -> Branches -> add rule for 'master',"
|
|
echo " Enable push = OFF, merge whitelist = armistace. See docs/writer-branch-workflow.md"
|
|
fi
|
|
fi
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "IDENTITY: git identity is SET by the operator (FR-11 superseded by explicit request)"
|
|
echo "=============================================================="
|
|
# FR-11 originally required the agent to leave the identity EMPTY so it could not impersonate
|
|
# the operator. The operator has since explicitly asked for it to be set, so the requirement is
|
|
# superseded - and the guard is inverted: the identity must now be present and must be the
|
|
# OPERATOR's, not an agent-invented one. Guarding the old expectation would assert the opposite
|
|
# of the current design and fail forever (which is what it did).
|
|
NAME=$(asuser 'git config --get user.name' 2>/dev/null)
|
|
MAIL=$(asuser 'git config --get user.email' 2>/dev/null)
|
|
if [ -n "$NAME" ]; then ok "git user.name set ($NAME)"; else bad "git user.name is empty - macro 2 will refuse to commit"; fi
|
|
if [ -n "$MAIL" ]; then ok "git user.email set ($MAIL)"; else bad "git user.email is empty"; fi
|
|
case "$MAIL" in
|
|
*hermes*|*bot*|*noreply@anthropic*|*agent*) bad "identity looks agent-generated: $MAIL" ;;
|
|
"") ;;
|
|
*) ok "identity is an operator address, not an agent-invented one" ;;
|
|
esac
|
|
if [ -f /home/atheos/.ssh/id_ed25519_blog ]; then ok "deploy key present"; else bad "deploy key missing"; fi
|
|
chk "deploy key mode" "$(stat -c '%a' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "600"
|
|
chk "deploy key owner" "$(stat -c '%U' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "atheos"
|
|
chk "ssh config mode" "$(stat -c '%a' /home/atheos/.ssh/config 2>/dev/null)" "600"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "RESOURCES"
|
|
echo "=============================================================="
|
|
echo " rootfs: $(df -hP / | tail -1 | awk '{print $2" total, "$3" used, "$4" avail ("$5")"}')"
|
|
# NOTE: on Alpine, `free`/`uptime` are BUSYBOX applets that use the sysinfo() syscall, which
|
|
# lxcfs cannot intercept - so they report the PVE HOST, not this container. procps-ng (installed
|
|
# by provision.sh) replaces them with binaries that read the lxcfs-virtualised /proc files.
|
|
# Detect via apk, which is the reliable signal (the binaries are plain files either way).
|
|
if apk info -e procps-ng >/dev/null 2>&1; then
|
|
echo " memory: $(/usr/bin/free -m 2>/dev/null | awk 'NR==2{print $3"MB used of "$2"MB"}')"
|
|
echo " uptime: $(/usr/bin/uptime 2>/dev/null | sed 's/.*up /up /;s/,.*//') (container-accurate)"
|
|
else
|
|
echo " memory: (procps-ng NOT installed - busybox free/uptime would report the HOST)"
|
|
fi
|
|
echo " lxcfs virtualises /proc: meminfo=$(grep MemTotal /proc/meminfo | awk '{print $2"kB"}') uptime=$(cut -d. -f1 /proc/uptime)s"
|
|
echo " listening ports: $(netstat -tln 2>/dev/null | awk '/LISTEN/{split($4,a,":"); print a[length(a)]}' | sort -u | tr '\n' ' ')"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
printf 'RESULT: %d passed, %d failed\n' "$pass" "$fail"
|
|
echo "=============================================================="
|
|
[ "$fail" -eq 0 ] || exit 1
|