cdsr: initial import of deployed stack (runtime 4.133.0, pinned extensions, SSOT vault)
This commit is contained in:
Antigravity
75
scripts/install-extensions.sh
Executable file
75
scripts/install-extensions.sh
Executable file
@@ -0,0 +1,75 @@
|
||||
#!/usr/bin/env bash
|
||||
# Install the pinned Open VSX extension baseline for the cdsr code-server deployment.
|
||||
# ./scripts/install-extensions.sh # baseline only
|
||||
# ./scripts/install-extensions.sh --include-optional # baseline + optional entries
|
||||
# Lock file is the single source of truth; no unpinned marketplace installs.
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
LOCK="$ROOT/config/extensions.lock.json"
|
||||
CACHE="$ROOT/tmp/extensions"
|
||||
CODE_SERVER="${CODE_SERVER_BIN:-/usr/bin/code-server}"
|
||||
CONFIG="$ROOT/config/config.yaml"
|
||||
|
||||
INCLUDE_OPTIONAL=0
|
||||
for arg in "$@"; do
|
||||
case "$arg" in
|
||||
--include-optional) INCLUDE_OPTIONAL=1 ;;
|
||||
*) echo "unknown argument: $arg" >&2; exit 2 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
[[ -f "$LOCK" ]] || { echo "missing lock file: $LOCK" >&2; exit 1; }
|
||||
command -v python3 >/dev/null || { echo "python3 is required" >&2; exit 1; }
|
||||
mkdir -p "$CACHE"
|
||||
|
||||
# The selector must not run inside process substitution: its exit status would be lost and
|
||||
# a malformed lock file would be misreported as "no extensions selected". Write to a temp
|
||||
# file, check python's status, then read the file.
|
||||
SELECTION="$(mktemp "${TMPDIR:-/tmp}/cdsr-extension-selection.XXXXXX")"
|
||||
trap 'rm -f "$SELECTION"' EXIT
|
||||
|
||||
# one tab-separated record per selected extension: id ver platform vsix_url sha_url mode
|
||||
if ! INCLUDE_OPTIONAL="$INCLUDE_OPTIONAL" python3 - "$LOCK" >"$SELECTION" <<'PY'
|
||||
import json, os, sys
|
||||
lock = json.load(open(sys.argv[1]))
|
||||
want_optional = os.environ.get("INCLUDE_OPTIONAL") == "1"
|
||||
for e in lock["extensions"]:
|
||||
if e["mode"] == "baseline" or (want_optional and e["mode"] == "optional"):
|
||||
print("\t".join([e["id"], e["version"], e["platform"], e["vsix_url"], e["sha256_url"], e["mode"]]))
|
||||
PY
|
||||
then
|
||||
echo "could not read extension selection from $LOCK (see the python traceback above)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mapfile -t ENTRIES <"$SELECTION"
|
||||
(( ${#ENTRIES[@]} )) || { echo "no extensions selected from $LOCK" >&2; exit 1; }
|
||||
|
||||
for entry in "${ENTRIES[@]}"; do
|
||||
IFS=$'\t' read -r id version platform vsix_url sha_url mode <<<"$entry"
|
||||
|
||||
vsix="$CACHE/${id}-${version}@${platform}.vsix"
|
||||
echo "==> $id@$version ($platform, $mode)"
|
||||
|
||||
if [[ ! -s "$vsix" ]]; then
|
||||
curl -fsSL --retry 3 -o "$vsix.part" "$vsix_url"
|
||||
mv "$vsix.part" "$vsix"
|
||||
fi
|
||||
|
||||
expected=$(curl -fsSL --retry 3 "$sha_url" | tr -d '[:space:]')
|
||||
[[ -n "$expected" ]] || { echo "empty checksum for $id" >&2; exit 1; }
|
||||
actual=$(sha256sum "$vsix" | cut -d' ' -f1)
|
||||
if [[ "$expected" != "$actual" ]]; then
|
||||
echo "checksum mismatch for $id@$version" >&2
|
||||
echo " expected: $expected" >&2
|
||||
echo " actual: $actual" >&2
|
||||
rm -f "$vsix"
|
||||
exit 1
|
||||
fi
|
||||
echo " sha256 ok: $actual"
|
||||
|
||||
"$CODE_SERVER" --config "$CONFIG" --install-extension "$vsix" --force
|
||||
done
|
||||
|
||||
echo "done. audit with: $ROOT/scripts/list-extension-versions.sh"
|
||||
106
scripts/list-extension-versions.sh
Executable file
106
scripts/list-extension-versions.sh
Executable file
@@ -0,0 +1,106 @@
|
||||
#!/usr/bin/env bash
|
||||
# Audit installed extensions against config/extensions.lock.json.
|
||||
# Fails if a pinned extension is missing/at another version, if an expected transitive
|
||||
# dependency is at another version, or if anything is installed that the lock does not
|
||||
# describe at all (ad-hoc marketplace installs are contract violations here).
|
||||
# ./scripts/list-extension-versions.sh # baseline audit
|
||||
# ./scripts/list-extension-versions.sh --include-optional # also require optional entries
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
LOCK="$ROOT/config/extensions.lock.json"
|
||||
CODE_SERVER="${CODE_SERVER_BIN:-/usr/bin/code-server}"
|
||||
CONFIG="$ROOT/config/config.yaml"
|
||||
|
||||
INCLUDE_OPTIONAL=0
|
||||
for arg in "$@"; do
|
||||
case "$arg" in
|
||||
--include-optional) INCLUDE_OPTIONAL=1 ;;
|
||||
*) echo "unknown argument: $arg" >&2; exit 2 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
installed=$("$CODE_SERVER" --config "$CONFIG" --list-extensions --show-versions 2>/dev/null | sed '/^$/d' | sort)
|
||||
|
||||
echo "installed:"
|
||||
printf '%s\n' "$installed" | sed 's/^/ /'
|
||||
echo
|
||||
|
||||
INSTALLED="$installed" INCLUDE_OPTIONAL="$INCLUDE_OPTIONAL" python3 - "$LOCK" <<'PY'
|
||||
import json, os, sys
|
||||
|
||||
lock = json.load(open(sys.argv[1]))
|
||||
want_optional = os.environ.get("INCLUDE_OPTIONAL") == "1"
|
||||
installed = {}
|
||||
for line in os.environ.get("INSTALLED", "").splitlines():
|
||||
line = line.strip()
|
||||
if "@" in line:
|
||||
eid, _, ver = line.rpartition("@")
|
||||
installed[eid.lower()] = ver
|
||||
|
||||
status = 0
|
||||
known = set()
|
||||
|
||||
# 1. forward check: every selected pin must be installed at the pinned version
|
||||
selected = [
|
||||
e for e in lock["extensions"]
|
||||
if e["mode"] == "baseline" or (want_optional and e["mode"] == "optional")
|
||||
]
|
||||
for e in selected:
|
||||
key = e["id"].lower()
|
||||
known.add(key)
|
||||
want = f'{e["id"]}@{e["version"]}'
|
||||
have = installed.get(key)
|
||||
if have == e["version"]:
|
||||
print(f"ok {want}")
|
||||
elif have is None:
|
||||
print(f"MISSING {want}", file=sys.stderr)
|
||||
status = 1
|
||||
else:
|
||||
print(f'MISMATCH expected {want}, found {e["id"]}@{have}', file=sys.stderr)
|
||||
status = 1
|
||||
|
||||
# 2. expected transitive dependencies: pulled in by the pins above, so their presence is
|
||||
# legitimate; absence is not a lock violation, but a version drift is reported and is
|
||||
# labelled MISMATCH-DEP so it is never confused with a baseline pin mismatch.
|
||||
for e in lock.get("expected_transitive", []):
|
||||
key = e["id"].lower()
|
||||
known.add(key)
|
||||
want = f'{e["id"]}@{e["version"]}'
|
||||
have = installed.get(key)
|
||||
if have == e["version"]:
|
||||
print(f"ok-dep {want}")
|
||||
elif have is None:
|
||||
print(f"note {want} (expected transitive dependency not installed)")
|
||||
else:
|
||||
print(
|
||||
f'MISMATCH-DEP expected transitive {want}, found {e["id"]}@{have}',
|
||||
file=sys.stderr,
|
||||
)
|
||||
status = 1
|
||||
|
||||
# 3. lock-described but not selected (e.g. optional entries in a baseline run): installed
|
||||
# copies are informational, never failures, because the lock does describe them.
|
||||
for e in lock["extensions"]:
|
||||
key = e["id"].lower()
|
||||
if key in known:
|
||||
continue
|
||||
known.add(key)
|
||||
have = installed.get(key)
|
||||
if have is None:
|
||||
continue
|
||||
suffix = "" if have == e["version"] else f' (lock pins {e["version"]})'
|
||||
print(f'note {e["id"]}@{have} installed, {e["mode"]} entry not selected{suffix}')
|
||||
|
||||
# 4. reverse check: anything installed that the lock does not describe at all
|
||||
excluded = {e["id"].lower(): e.get("reason", "") for e in lock.get("excluded", [])}
|
||||
for eid, ver in sorted(installed.items()):
|
||||
if eid in known:
|
||||
continue
|
||||
why = excluded.get(eid)
|
||||
detail = f" (explicitly excluded by lock: {why})" if why else ""
|
||||
print(f"EXTRA {eid}@{ver}{detail}", file=sys.stderr)
|
||||
status = 1
|
||||
|
||||
sys.exit(status)
|
||||
PY
|
||||
Reference in New Issue
Block a user