admin343/run
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Keep run logs opaque and streamline transfers

Browse Source
This commit is contained in:
npc0-hue
2026-09-03 16:40:05 +08:00
parent 48dd540253
commit 330b1c0130
27 changed files with 429 additions and 673 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/package_config.go
+9 -36
View File
@@ -11,8 +11,7 @@ import (
)
const (
PackageComponentRun = "run"
PackageComponentClientManager = "client-manager"
PackageComponentRun = "run"
PackageConfigEnv = "RUN_PACKAGE_CONFIG"
)
@@ -94,7 +93,7 @@ func LoadPackageConfigBesideExecutable() (PackageConfig, bool, error) {
func ValidatePackageConfig(cfg PackageConfig) error {
var violations []string
if cfg.Kind != PackageComponentRun && cfg.Kind != PackageComponentClientManager {
if cfg.Kind != PackageComponentRun {
violations = append(violations, "kind is invalid")
}
if !safeIdentifier(cfg.ServerInstanceID) {
@@ -109,13 +108,10 @@ func ValidatePackageConfig(cfg PackageConfig) error {
if cfg.ProfileKey != "" && !safeLogicalKey(cfg.ProfileKey) {
violations = append(violations, "profileKey is invalid")
}
if cfg.Kind == PackageComponentClientManager && cfg.ProfileKey == "" {
violations = append(violations, "profileKey is required for client-manager packages")
}
if !safeRuntimeTarget(cfg.TargetOS, cfg.TargetArch) {
violations = append(violations, "target platform is invalid")
}
if !strings.HasPrefix(cfg.SecretRef, "secret://runtime-keys/") || containsUnsafeDiagnosticText(cfg.SecretRef) {
if !strings.HasPrefix(cfg.SecretRef, "secret://runtime-keys/") || strings.ContainsAny(cfg.SecretRef, " \t\r\n") {
violations = append(violations, "secretRef is invalid")
}
if cfg.KeyGeneration <= 0 {
@@ -124,9 +120,6 @@ func ValidatePackageConfig(cfg PackageConfig) error {
if strings.TrimSpace(cfg.AuthKey) == "" {
violations = append(violations, "authKey is required")
}
if containsUnsafeDiagnosticText(cfg.AuthKey) {
violations = append(violations, "authKey contains unsafe content")
}
if len(violations) > 0 {
return fmt.Errorf("invalid run package config: %s", strings.Join(violations, "; "))
}
@@ -165,7 +158,7 @@ func (cfg PackageConfig) Identity() PackageIdentity {
}
}
func (cfg PackageConfig) RedactedDiagnostics() map[string]string {
func (cfg PackageConfig) IdentityDiagnostics() map[string]string {
identity := cfg.Identity()
return map[string]string{
"kind": identity.Kind,
@@ -188,7 +181,7 @@ func AuthenticatePackageGeneration(pkg PackageConfig, auth ComponentAuthResult)
return fmt.Errorf("component authentication scope does not match package")
}
if !auth.Allowed {
return fmt.Errorf("component authentication rejected: %s", redactedReason(auth.Reason))
return fmt.Errorf("component authentication rejected: %s", auth.Reason)
}
if auth.KeyGeneration != pkg.KeyGeneration {
return fmt.Errorf("component key generation is no longer current")
@@ -196,11 +189,8 @@ func AuthenticatePackageGeneration(pkg PackageConfig, auth ComponentAuthResult)
return nil
}
func packageComponentKey(pkg PackageConfig) string {
if pkg.Kind == PackageComponentRun {
return ""
}
return strings.TrimSpace(pkg.ProfileKey)
func packageComponentKey(PackageConfig) string {
return ""
}
func fingerprint(value string) string {
@@ -210,7 +200,7 @@ func fingerprint(value string) string {
func safeIdentifier(value string) bool {
value = strings.TrimSpace(value)
if value == "" || len(value) > 120 || containsUnsafeDiagnosticText(value) {
if value == "" || len(value) > 120 {
return false
}
for _, char := range value {
@@ -228,7 +218,7 @@ func safePluginID(value string) bool {
func safeLogicalKey(value string) bool {
value = strings.TrimSpace(value)
if value == "" || len(value) > 120 || strings.HasPrefix(value, "/") || strings.Contains(value, "..") || strings.Contains(value, `\`) || containsUnsafeDiagnosticText(value) {
if value == "" || len(value) > 120 || strings.HasPrefix(value, "/") || strings.Contains(value, "..") || strings.Contains(value, `\`) {
return false
}
for _, char := range value {
@@ -253,20 +243,3 @@ func safeRuntimeTarget(osName string, arch string) bool {
return false
}
}
func containsUnsafeDiagnosticText(value string) bool {
normalized := strings.ToLower(value)
for _, marker := range []string{"/users/", "/.ssh/", "password=", "apikey", "api_key", "bearer ", "sk-", "unix://", "tcp://", "mysql://", "sqlite://"} {
if strings.Contains(normalized, marker) {
return true
}
}
return false
}
func redactedReason(value string) string {
if containsUnsafeDiagnosticText(value) {
return "[redacted]"
}
return value
}