Skip to content

fix: monitoring.md permissions note and arcup checksum filename validation #317

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Sertug17 wants to merge 1 commit into
base: main
Choose a base branch
from
+13 −4
Open

fix: monitoring.md permissions note and arcup checksum filename validation #317

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions arcup/arcup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -654,11 +654,13 @@ verify_checksum_file() {
local archive_path="$1"
local checksum_path="$2"
local archive_name="$3"
local expected_checksum expected_name actual_checksum
local expected_checksum expected_name actual_checksum line

if ! read -r expected_checksum expected_name < "$checksum_path"; then
line=$(tr -d '\r' < "$checksum_path" | head -n1)
if [[ -z "$line" ]]; then
error "Checksum file is empty: $checksum_path"
fi
read -r expected_checksum expected_name <<< "$line"

if [[ ! "$expected_checksum" =~ ^[0-9A-Fa-f]{64}$ ]]; then
error "Checksum file has invalid SHA-256 hash: $checksum_path"
Expand All @@ -670,6 +672,8 @@ verify_checksum_file() {
if [[ "$expected_name" != "$archive_name" ]]; then
error "Checksum file is for '$expected_name', expected '$archive_name'"
fi
elif [[ -n "$archive_name" ]]; then
error "Checksum file contains no filename field; expected '$archive_name'"
fi

actual_checksum=$(compute_sha256 "$archive_path")
Expand Down
2 changes: 2 additions & 0 deletions arcup/test_arcup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,8 @@ test_checksum_validation() {

printf '%s other-asset.tar.gz\n' "$checksum" > "$checksum_file"
expect_fail "checksum filename mismatch fails" verify_checksum_file "$archive" "$checksum_file" "$archive_name"
printf '%s\n' "$checksum" > "$checksum_file"
expect_fail "checksum file without filename field fails" verify_checksum_file "$archive" "$checksum_file" "$archive_name"
}

test_download_error_lists_assets() {
Expand Down
7 changes: 5 additions & 2 deletions docs/monitoring.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,8 +276,11 @@ Also confirm that the SSH tunnel is still running.

### Prometheus is restarting with a permissions error

If Prometheus logs include an error about `queries.active` or write permission
under `/prometheus`, fix the ownership of the local data directory:
The `compose.yaml` above runs Prometheus with `user: "0"` (root), which prevents
this error in most configurations. If you removed `user: "0"` to run Prometheus
as a non-root user, or if Prometheus logs an error about `queries.active` or write
permission under `/prometheus`, restore ownership of the data directory to match
Prometheus's default UID:

```sh
sudo chown -R 65534:65534 "$ARC_MONITORING"/prometheus-data
Expand Down