84874c58a5
allow you to simulate the whole official curl | bash installer,
and subsequent hermes updates.
Run development commands in a bubblewrap filesystem and network sandbox
with a local HTTPS MITM fixture server and a fake github
git-upload-pack transport.
Package the sandbox command and expose it from the nix devShell.
Stage the local installer at its canonical fake HTTPS URL and add a
persistent installation/update test path. Route root installs through
sandbox-owned filesystem locations and snapshot dirty source worktrees
into temporary fake commits so update tests can fast-forward without
changing the real checkout.
Includes a --install-ref sandbox installer mode that fetches any commit
(--from-main is a nice shorthand for local development) outside the
sealed sandbox, installs from that snapshot, and then promotes the fake
remote to the current worktree so update flows can be exercised with FF.
Notes on non-root sandboxes:
Giving a non-root sandbox a network is tricky.
slirp4netns joins the target userns and setuids to root before configuring the
netns, so the userns must map a uid 0; bwrap's --unshare-user maps exactly ONE
uid, so --uid 1000 leaves no root to become and slirp diedswith
`setns(CLONE_NEWNET): Operation not permitted`. Stage 1 builds the user+net
namespaces with `unshare` and two one-id ranges:
inner 0 -> a subuid, unused by the payload, present only so slirp can
become root
inner 1000 -> our real host uid
Mapping the payload to the *host* uid (not a second subuid) keeps everything the
sandbox writes owned by us, so `rm -rf` on a persistent sandbox still needs no
privileges. Stage 2 execs bwrap WITHOUT --unshare-user -- it only adds mount/pid
-- sidestepping bwrap's refusal to accept --uid outside a userns it created.
Costs a /etc/subuid range for the invoking user (we error with the exact line to
add) and util-linux `unshare`; `--root` needs neither.
14 lines
671 B
Bash
14 lines
671 B
Bash
#!/usr/bin/env bash
|
|
# Stand-in for ssh inside the dev sandbox.
|
|
#
|
|
# install.sh and `hermes update` clone over ssh first (git@github.com:...), so
|
|
# the sandbox needs an `ssh` that answers. Rather than run a real sshd, this
|
|
# ignores the host, user, and command git asked for and speaks the
|
|
# upload-pack protocol directly against the sandbox's bare repo -- which is
|
|
# what makes the ssh-first code path exercisable with no keys, no known_hosts,
|
|
# and no network.
|
|
#
|
|
# GIT_UPLOAD_PACK is substituted by dev-sandbox.sh when it installs this shim,
|
|
# because the host's git-upload-pack is not necessarily on the sandbox PATH.
|
|
exec @GIT_UPLOAD_PACK@ /work/repos/hermes-agent.git
|