fix(chv-muse-r11fix): browser.sock 移进 chv-browser 自有目录（缺陷 4）+ vsock 自动启动
缺陷 4：/run/chv 是 0755 root root，chv-browser 在 bind 时 EACCES 而无限 crash loop（restart 21）。browser.sock 从 /run/chv/browser.sock 移到 /run/chv-browser/browser.sock （broker 与 browser 两端常量同改）；build.sh 建目录 + tmpfiles 登记（0755 chv-browser 所有）。不用组可写 /run/chv——那会给 chv-browser 对 broker.sock/cell.pid 的 unlink 能力。 vsock 自动启动：此前 build.sh 只拷 vsock_notify.py、不建服务， vsock 通道从未自动启动。按 vsock_notify.py 的 docstring 补 vsock-notify.service（ExecStart=/usr/local/bin/vsock-notify %H， Restart=no，After/WantedBy=multi-user.target）并 enable； printf 格式串里 %H 写 %%H。测试：干跑针 /run/chv-browser； vsock 在场时干跑含服务与 enable 语句。
This commit is contained in:
host committed
1 parent
f093558c0d
commit
4a7ca25334
4 files changed
+103
-61
No files matched your search
@@ -562,62 +562,76 @@ class BuildInfoTest(unittest.TestCase):
|
||||
|
||||
|
||||
class BuildDryRunTest(unittest.TestCase):
|
||||
def _fixture(self, tmp, with_vsock=False):
|
||||
# 隔离的临时 git 仓：工作树干净、HEAD 与 REPO_COMMIT
|
||||
# 一致、假 codex 二进制报对版本。with_vsock 时一并拷入
|
||||
# vsock_notify.py（round-11 真机修复：服务须随文件建）。
|
||||
repo = os.path.join(tmp, "repo")
|
||||
guest = os.path.join(repo, "chv-guest")
|
||||
bindir = os.path.join(tmp, "bin")
|
||||
os.makedirs(guest)
|
||||
os.makedirs(os.path.join(bindir, "codex-resources"))
|
||||
for name in ("build.sh", "buildinfo.py", "check_lockfile.py",
|
||||
"generate_lockfile.py", "chv-sync.sh",
|
||||
"chv-cell.py", "chv-broker.py", "chv-browser.py",
|
||||
"authd.py", "git-credential-chv-authd",
|
||||
"chv-authd.service", "authd_init_stub.py"):
|
||||
shutil.copy2(ROOT / "chv-guest" / name,
|
||||
os.path.join(guest, name))
|
||||
shutil.copy2(ROOT / "host.py", os.path.join(repo, "host.py"))
|
||||
# round-11：build.sh 要求 P3 云端叶子模块在仓里（fail-fast），
|
||||
# 夹具须一并拷入，否则干跑在 P3 预检就失败。
|
||||
for rel in ("cloud/chv/authd.py", "cloud/chv/sentinel.py",
|
||||
"cloud/chv/errors.py",
|
||||
"cloud/__init__.py", "cloud/chv/__init__.py"):
|
||||
dest = os.path.join(repo, rel)
|
||||
os.makedirs(os.path.dirname(dest), exist_ok=True)
|
||||
shutil.copy2(ROOT / rel, dest)
|
||||
if with_vsock:
|
||||
rel = "cloud/chv/guest/vsock_notify.py"
|
||||
dest = os.path.join(repo, rel)
|
||||
os.makedirs(os.path.dirname(dest), exist_ok=True)
|
||||
shutil.copy2(ROOT / rel, dest)
|
||||
codex = os.path.join(bindir, "codex")
|
||||
with open(codex, "w") as fh:
|
||||
fh.write("#!/bin/sh\necho 'codex-cli 0.164.0-alpha.9'\n")
|
||||
os.chmod(codex, 0o755)
|
||||
host_bin = os.path.join(bindir, "codex-code-mode-host")
|
||||
with open(host_bin, "w") as fh:
|
||||
fh.write("#!/bin/sh\nexit 0\n")
|
||||
os.chmod(host_bin, 0o755)
|
||||
subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
|
||||
subprocess.run(["git", "add", "-A"], cwd=repo, check=True)
|
||||
subprocess.run(
|
||||
["git", "-c", "user.email=t@t", "-c", "user.name=t",
|
||||
"commit", "-qm", "p2 dry-run fixture"],
|
||||
cwd=repo, check=True)
|
||||
head = subprocess.run(
|
||||
["git", "rev-parse", "--short", "HEAD"], cwd=repo,
|
||||
capture_output=True, text=True, check=True).stdout.strip()
|
||||
env = dict(os.environ)
|
||||
env.update({
|
||||
"CODEX_BIN_DIR": bindir,
|
||||
"UBUNTU_VERSION": "24.04",
|
||||
"CODEX_VERSION": "0.164.0-alpha.9",
|
||||
"REPO_COMMIT": head,
|
||||
"UBUNTU_IMAGE_SHA256": "a" * 64,
|
||||
})
|
||||
return repo, guest, env
|
||||
|
||||
def _dry_run(self, repo, guest, env):
|
||||
proc = subprocess.run(
|
||||
["bash", os.path.join(guest, "build.sh"),
|
||||
"--dry-run", "out"],
|
||||
cwd=repo, capture_output=True, text=True, env=env)
|
||||
self.assertEqual(proc.returncode, 0, proc.stderr)
|
||||
return proc.stdout + proc.stderr
|
||||
|
||||
def test_dry_run_contains_p2_steps(self):
|
||||
# 在隔离的临时 git 仓里跑 build.sh --dry-run：工作树干净、
|
||||
# HEAD 与 REPO_COMMIT 一致、假 codex 二进制报对版本。
|
||||
# 在隔离的临时 git 仓里跑 build.sh --dry-run。
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
repo = os.path.join(tmp, "repo")
|
||||
guest = os.path.join(repo, "chv-guest")
|
||||
bindir = os.path.join(tmp, "bin")
|
||||
os.makedirs(guest)
|
||||
os.makedirs(os.path.join(bindir, "codex-resources"))
|
||||
for name in ("build.sh", "buildinfo.py", "check_lockfile.py",
|
||||
"generate_lockfile.py", "chv-sync.sh",
|
||||
"chv-cell.py", "chv-broker.py", "chv-browser.py",
|
||||
"authd.py", "git-credential-chv-authd",
|
||||
"chv-authd.service", "authd_init_stub.py"):
|
||||
shutil.copy2(ROOT / "chv-guest" / name,
|
||||
os.path.join(guest, name))
|
||||
shutil.copy2(ROOT / "host.py", os.path.join(repo, "host.py"))
|
||||
# round-11：build.sh 要求 P3 云端叶子模块在仓里（fail-fast），
|
||||
# 夹具须一并拷入，否则干跑在 P3 预检就失败。
|
||||
for rel in ("cloud/chv/authd.py", "cloud/chv/sentinel.py",
|
||||
"cloud/chv/errors.py",
|
||||
"cloud/__init__.py", "cloud/chv/__init__.py"):
|
||||
dest = os.path.join(repo, rel)
|
||||
os.makedirs(os.path.dirname(dest), exist_ok=True)
|
||||
shutil.copy2(ROOT / rel, dest)
|
||||
codex = os.path.join(bindir, "codex")
|
||||
with open(codex, "w") as fh:
|
||||
fh.write("#!/bin/sh\necho 'codex-cli 0.164.0-alpha.9'\n")
|
||||
os.chmod(codex, 0o755)
|
||||
host_bin = os.path.join(bindir, "codex-code-mode-host")
|
||||
with open(host_bin, "w") as fh:
|
||||
fh.write("#!/bin/sh\nexit 0\n")
|
||||
os.chmod(host_bin, 0o755)
|
||||
subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
|
||||
subprocess.run(["git", "add", "-A"], cwd=repo, check=True)
|
||||
subprocess.run(
|
||||
["git", "-c", "user.email=t@t", "-c", "user.name=t",
|
||||
"commit", "-qm", "p2 dry-run fixture"],
|
||||
cwd=repo, check=True)
|
||||
head = subprocess.run(
|
||||
["git", "rev-parse", "--short", "HEAD"], cwd=repo,
|
||||
capture_output=True, text=True, check=True).stdout.strip()
|
||||
env = dict(os.environ)
|
||||
env.update({
|
||||
"CODEX_BIN_DIR": bindir,
|
||||
"UBUNTU_VERSION": "24.04",
|
||||
"CODEX_VERSION": "0.164.0-alpha.9",
|
||||
"REPO_COMMIT": head,
|
||||
"UBUNTU_IMAGE_SHA256": "a" * 64,
|
||||
})
|
||||
proc = subprocess.run(
|
||||
["bash", os.path.join(guest, "build.sh"),
|
||||
"--dry-run", "out"],
|
||||
cwd=repo, capture_output=True, text=True, env=env)
|
||||
self.assertEqual(proc.returncode, 0, proc.stderr)
|
||||
out = proc.stdout + proc.stderr
|
||||
repo, guest, env = self._fixture(tmp)
|
||||
out = self._dry_run(repo, guest, env)
|
||||
for needle in ("systemd-container", "chv-cell", "chv-broker",
|
||||
"chv-browser", "chv-browser.service",
|
||||
"chv-broker.service", "useradd --system",
|
||||
@@ -625,6 +639,10 @@ class BuildDryRunTest(unittest.TestCase):
|
||||
"chv-authd", "git-credential-chv-authd",
|
||||
"systemctl enable chv-authd",
|
||||
"systemctl start chv-authd",
|
||||
# round-11 真机修复（缺陷 4）：browser.sock
|
||||
# 移进 chv-browser 自有目录，build.sh 须
|
||||
# 建目录 + tmpfiles 登记。
|
||||
"/run/chv-browser",
|
||||
# round-11 真机修复（层 1）：叶子树含
|
||||
# errors.py + stub __init__，不拷真实的
|
||||
# cloud/chv/__init__.py。
|
||||
@@ -637,6 +655,18 @@ class BuildDryRunTest(unittest.TestCase):
|
||||
self.assertNotIn("credential.helper store", out)
|
||||
self.assertIn("git config --system user.name chv", out)
|
||||
|
||||
def test_dry_run_with_vsock_creates_service(self):
|
||||
# round-11 真机修复（vsock 自动启动）：vsock_notify.py
|
||||
# 在场时建 vsock-notify.service 并 enable，不再只警告。
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
repo, guest, env = self._fixture(tmp, with_vsock=True)
|
||||
out = self._dry_run(repo, guest, env)
|
||||
self.assertNotIn("vsock_notify.py 不在仓库里", out)
|
||||
for needle in ("vsock-notify.service",
|
||||
"systemctl enable vsock-notify",
|
||||
"ExecStart=/usr/local/bin/vsock-notify"):
|
||||
self.assertIn(needle, out, needle)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
Reference in new issue
Block a user