45 lines
2.2 KiB
Bash
45 lines
2.2 KiB
Bash
#!/bin/sh
|
|
set -u
|
|
ARTIFACTAPI_LOGIN_NOEXEC=1 . "$(dirname "$0")/../artifactapi-login.sh"
|
|
|
|
SA_TOKEN_FILE=$(mktemp)
|
|
echo sa-jwt > "$SA_TOKEN_FILE"
|
|
REG=artifactapi.k8s.syd1.au.unkin.net
|
|
OK_LOGIN='{"registry":"'$REG'","username":"woodpecker","password":"oidc-jwt"}'
|
|
VAULT_FAIL=
|
|
|
|
no_secret_argv() { case "$*" in *sa-jwt*|*s.client*|*oidc-jwt*) echo "secret in argv: $*" >&2; return 99 ;; esac; }
|
|
jq() { no_secret_argv "$@" && command jq "$@"; }
|
|
|
|
curl() {
|
|
[ -z "$VAULT_FAIL" ] || return 22
|
|
no_secret_argv "$@" || return
|
|
case "$*" in
|
|
*auth/k8s/au/syd1/login*) grep -q '"role":"woodpecker_artifactapi_writer","jwt":"sa-jwt"' && echo '{"auth":{"client_token":"s.client"}}' ;;
|
|
*"-H @-"*identity/oidc/token/artifactapi-writer) grep -qx 'X-Vault-Token: s.client' && echo '{"data":{"token":"oidc-jwt"}}' ;;
|
|
*) return 22 ;;
|
|
esac
|
|
}
|
|
|
|
fail=0
|
|
check() {
|
|
name=$1 want=$2; shift 2
|
|
got=$(unset PLUGIN_REGISTRY PLUGIN_REPO PLUGIN_USERNAME PLUGIN_PASSWORD PLUGIN_LOGINS PLUGIN_DRY_RUN
|
|
for kv in "$@"; do export "$kv"; done
|
|
artifactapi_login 2>/dev/null; printf %s "${PLUGIN_LOGINS:-}")
|
|
if [ "$got" = "$want" ]; then echo "ok $name"; else echo "FAIL $name: got [$got] want [$want]"; fail=1; fi
|
|
}
|
|
|
|
check "registry setting logs in" "[$OK_LOGIN]" PLUGIN_REGISTRY=$REG
|
|
check "repo on artifactapi logs in" "[$OK_LOGIN]" PLUGIN_REPO=$REG/docker-internal/x
|
|
check "existing logins kept" '[{"registry":"r","username":"u","password":"p"},'"$OK_LOGIN]" PLUGIN_REGISTRY=$REG 'PLUGIN_LOGINS=[{"registry":"r","username":"u","password":"p"}]'
|
|
check "other registry skipped" "" PLUGIN_REPO=git.unkin.net/unkin/x
|
|
check "dry run skipped" "" PLUGIN_REGISTRY=$REG PLUGIN_DRY_RUN=true
|
|
check "explicit creds skipped" "" PLUGIN_REGISTRY=$REG PLUGIN_USERNAME=u PLUGIN_PASSWORD=p
|
|
check "creds for another registry still log in" "[$OK_LOGIN]" PLUGIN_REGISTRY=git.unkin.net PLUGIN_REPO=$REG/docker-internal/x PLUGIN_USERNAME=u PLUGIN_PASSWORD=p
|
|
check "explicit login skipped" '[{"registry":"'$REG'"}]' PLUGIN_REGISTRY=$REG 'PLUGIN_LOGINS=[{"registry":"'$REG'"}]'
|
|
check "missing sa token is anonymous" "" PLUGIN_REGISTRY=$REG SA_TOKEN_FILE=/nonexistent
|
|
check "vault failure is anonymous" "" PLUGIN_REGISTRY=$REG VAULT_FAIL=1
|
|
check "bad role is anonymous" "" PLUGIN_REGISTRY=$REG PLUGIN_VAULT_ROLE=other
|
|
exit $fail
|