From 8161208f1ceaa85cf47a1271a513fc707de02039 Mon Sep 17 00:00:00 2001 From: root Date: Sun, 30 Aug 2026 14:22:14 +0000 Subject: [PATCH] Phase 13.5 Archive Metadata Variable Hotfix: gen_archive_meta nach write_runtime_config/write_app_manifest + SHA-Validierung (unbound variable Fix) --- .../control-plane/cp2a2_2b/rq-historical | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/red-queen-architecture/control-plane/cp2a2_2b/rq-historical b/red-queen-architecture/control-plane/cp2a2_2b/rq-historical index 278927e..43d2f88 100755 --- a/red-queen-architecture/control-plane/cp2a2_2b/rq-historical +++ b/red-queen-architecture/control-plane/cp2a2_2b/rq-historical @@ -1965,12 +1965,21 @@ archive_image() { # $1 = role HOST_SOT_RUNNER_SHA_CUR="$(sha256sum /opt/historical-v2/app/run_backfill_year.py 2>/dev/null | awk '{print $1}')" BUILD_INPUT_SHA_CUR="$(build_context_manifest 2>/dev/null | sha256sum | awk '{print $1}')" WRAPPER_SHA_CUR="$(sha256sum /usr/local/bin/rq-historical | awk '{print $1}')" - gen_archive_meta "$role" "$base" "$id" "$asize" "$asha" + # Reihenfolge (Punkt 5): erst Manifest + Runtime erzeugen, DANN deren SHAs + # berechnen, DANN gen_archive_meta mit allen Pflicht-SHAs aufrufen. + # Der fruehere gen_archive_meta-Aufruf VOR write_runtime_config/write_app_manifest + # las APP_MANIFEST_SHA_CUR/RUNTIME_CONFIG_SHA_CUR, die zu diesem Zeitpunkt noch + # nicht gesetzt waren -> unter set -u "unbound variable" (bewiesener Root Cause). write_runtime_config "$role" "$base" write_app_manifest "$role" "$base" "$id" - # SHA erneut nach manifest/runtime (weil meta SHA referenziert) + # SHA der im aktuellen Vorgang erzeugten Metadaten (Punkt 3/4/7) APP_MANIFEST_SHA_CUR="$(sha256sum "$base/app.manifest" | awk '{print $1}')" RUNTIME_CONFIG_SHA_CUR="$(sha256sum "$base/runtime-config.txt" | awk '{print $1}')" + # Validierung: exakt 64 hex, Datei existiert, reguläre Datei, kein Symlink + [[ "$APP_MANIFEST_SHA_CUR" =~ ^[a-f0-9]{64}$ ]] || die "archive($role): APP_MANIFEST_SHA_CUR ungueltig (FAIL CLOSED)" + [[ "$RUNTIME_CONFIG_SHA_CUR" =~ ^[a-f0-9]{64}$ ]] || die "archive($role): RUNTIME_CONFIG_SHA_CUR ungueltig (FAIL CLOSED)" + [ -f "$base/app.manifest" ] && [ ! -L "$base/app.manifest" ] || die "archive($role): app.manifest fehlt/ist Symlink (FAIL CLOSED)" + [ -f "$base/runtime-config.txt" ] && [ ! -L "$base/runtime-config.txt" ] || die "archive($role): runtime-config.txt fehlt/ist Symlink (FAIL CLOSED)" gen_archive_meta "$role" "$base" "$id" "$asize" "$asha" echo "ARCHIVE($role) OK: $base/ (${asize} bytes, sha256 ${asha:0:16}...)" echo " image.tar.sha256:"