nexo312/trading-system-docs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CP2A2: verify-recovery-gold-image PATH-NORMALIZATION-FIX (Image-Manifest app/-Präfix, Container-Pfad /app/app) + Critical-File-Pfadfix

Browse source
This commit is contained in:
root 2026-08-29 19:08:42 +00:00
parent c6046feaf2
commit 9d2bfe3ae4
1 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
red-queen-architecture/control-plane/cp2a2_2b/rq-historical
View file

@ -459,16 +459,17 @@ verify_critical_files() {
local base_dir="${1:-}" local base_dir="${1:-}"
local img_shas="" local img_shas=""
if [ -n "$base_dir" ]; then if [ -n "$base_dir" ]; then
# Recovery-Image-SHAs aus kopiertem Tree # Recovery-Image-SHAs aus kopiertem Tree. Der Tree ist prefixlos (docker cp
# von /app/app), daher wird der app/-Präfix aus CRITICAL_PATH entfernt.
for k in "${!CRITICAL_SHA[@]}"; do for k in "${!CRITICAL_SHA[@]}"; do
path="app/${CRITICAL_PATH[$k]#app/}" path="${CRITICAL_PATH[$k]#app/}"
[ -f "$base_dir/$path" ] && img_shas="$img_shas $k:$(sha256sum "$base_dir/$path" | awk '{print $1}')" || img_shas="$img_shas $k:MISSING" [ -f "$base_dir/$path" ] && img_shas="$img_shas $k:$(sha256sum "$base_dir/$path" | awk '{print $1}')" || img_shas="$img_shas $k:MISSING"
done done
fi fi
local allok=1 local allok=1
for k in "${!CRITICAL_SHA[@]}"; do for k in "${!CRITICAL_SHA[@]}"; do
path="app/${CRITICAL_PATH[$k]#app/}" # Container-Pfad: Code liegt im Container unter /app/app/<rel> (docker cp von /app/app)
csha="$(docker exec "$HISTORICAL_SERVICE" sha256sum "/$path" 2>/dev/null | awk '{print $1}')" || csha="MISSING" csha="$(docker exec "$HISTORICAL_SERVICE" sha256sum "/app/app/${CRITICAL_PATH[$k]#app/}" 2>/dev/null | awk '{print $1}')" || csha="MISSING"
gold="${CRITICAL_SHA[$k]}" gold="${CRITICAL_SHA[$k]}"
img="MISSING" img="MISSING"
if [ -n "$base_dir" ]; then if [ -n "$base_dir" ]; then
@ -557,10 +558,14 @@ verify_recovery_gold_image() {
docker create --name "$tmpc" --entrypoint /bin/true "$RECOVERY_REBUILD_TAG" >/dev/null 2>&1 || die "verify: Temp-Container Fehler (FAIL CLOSED)" docker create --name "$tmpc" --entrypoint /bin/true "$RECOVERY_REBUILD_TAG" >/dev/null 2>&1 || die "verify: Temp-Container Fehler (FAIL CLOSED)"
docker cp "$tmpc:/app/app" "$tmpdir/appapp" >/dev/null 2>&1 || { docker rm -f "$tmpc" >/dev/null 2>&1; rm -rf "$tmpdir"; die "verify: /app/app nicht lesbar (FAIL CLOSED)"; } docker cp "$tmpc:/app/app" "$tmpdir/appapp" >/dev/null 2>&1 || { docker rm -f "$tmpc" >/dev/null 2>&1; rm -rf "$tmpdir"; die "verify: /app/app nicht lesbar (FAIL CLOSED)"; }
docker rm -f "$tmpc" >/dev/null 2>&1 || true docker rm -f "$tmpc" >/dev/null 2>&1 || true
# Manifest aus kopiertem Recovery-Image-Tree gegen Gold-Manifest # Manifest aus kopiertem Recovery-Image-Tree gegen Gold-Manifest.
# KANONISCHER NAMESPACE: Image-Manifest wird mit app/-Präfix erzeugt, damit es
# dem konservierten GOLD_MANIFEST (app/...) entspricht. Der kopierte Tree liegt
# unter $tmpdir/appapp und enthaelt die Dateien prefixlos (run_backfill_year.py,
# trust/trust_gate.py) -> hier wird app/ vorangestellt. KEINE Inhaltsnormalisierung.
tmpf="$(mktemp)" tmpf="$(mktemp)"
( cd "$tmpdir/appapp" && find . -type f -name '*.py' ! -path '*/__pycache__/*' -printf '%P\n' 2>/dev/null | sort \ ( cd "$tmpdir/appapp" && find . -type f -name '*.py' ! -path '*/__pycache__/*' -printf '%P\n' 2>/dev/null | sort \
| while IFS= read -r rel; do [ -f "$rel" ] && sha256sum "$rel"; done | sed 's# ./# #' ) > "$tmpf" | while IFS= read -r rel; do [ -f "$rel" ] && sha256sum "$rel"; done | awk '{print $1" app/"$2}' ) > "$tmpf"
classify_and_report "$tmpf" classify_and_report "$tmpf"
gret="$G_RET"; rm -f "$tmpf" gret="$G_RET"; rm -f "$tmpf"
if [ "$gret" != "ok" ]; then if [ "$gret" != "ok" ]; then