chick
3473816167
agent 从 simadmin-relay 拆出来，作为公开仓库：安装命令要由节点执行，而节点没有凭据，所以 二进制必须放在匿名可读的地方，而 relay 源码与 IPA 继续私有。 拆出来之后有一处必须改，不是搬文件：`contracts/agent-policy.json` 原先由 relay 仓库拥有、 agent 侧是 vendored 副本（Makefile 从 `../contracts/` 拷、policy_test.go 断言两份相等）。 现在反过来——**agent 拥有策略**，因为 agent 是执行它的那一方，让它去拷贝一份住在别处的文件 本来就是别扭的。relay 保留 vendored 副本（它的限额从同一组数字推导），而两侧的一致性不再 靠构建期比较（跨仓库的构建期比较谁也做不了），改由运行时保证：agent 在握手时上报策略摘要， relay 拿自己那份比对，在 `/v1/status` 里逐节点给出 `policyMatches`。这比原来的测试更强， 因为它比的是**实际部署的那两份**，而不是两个 checkout 里的文件。 `contracts/test-vectors.json` 同理：Go 实现生成它（`make vectors`），relay 的 Node 参考实现 与 app 的 Swift 测试从 vendored 副本重算。实测重新生成的结果与 relay 那份逐字节相同。 systemd 单元的 `Documentation=` 指向本仓库。`VERSION` 提到 1.0.0。 20 个提交的历史完整保留（filter-branch 按子目录抽取）。
65 lines
2.8 KiB
Makefile
65 lines
2.8 KiB
Makefile
# This repository owns the authorisation surface: the agent is what enforces it, so it is not a copy of
|
|
# a file that lives somewhere else. `contracts/agent-policy.json` is embedded in the binary and is the
|
|
# source of truth; the relay vendors a copy and the two are compared at runtime, by the policy digest the
|
|
# agent reports in its handshake.
|
|
POLICY_SRC := contracts/agent-policy.json
|
|
POLICY_DST := internal/policy/agent-policy.json
|
|
# The systemd unit is embedded in the binary so that `msa-agent install` needs no route to anything but
|
|
# the relay, and so the unit a node runs is the one its agent was built with. Vendored mechanically: an
|
|
# operator editing the copy under internal/ would be editing a file the build overwrites, and
|
|
# TestVendoredUnitMatchesSystemd makes that loud.
|
|
UNIT_SRC := systemd/msa-agent.service
|
|
UNIT_DST := internal/install/msa-agent.service
|
|
# The version stamped into the binary, and the tag scripts/release.sh publishes under. It is the
|
|
# agent's own version rather than the app's: the two are released together but a node can be running an
|
|
# older agent than the phone, and the handshake's `agentBuild` field is what makes that visible.
|
|
VERSION ?= 1.0.0
|
|
LDFLAGS := -s -w -X main.version=$(VERSION)
|
|
|
|
.PHONY: all vendor test vet fmt vectors build build-arm64 build-armv7 clean
|
|
|
|
all: vet test build
|
|
|
|
# Regenerates contracts/test-vectors.json. It is the Go implementation that generates them, and the
|
|
# relay's Node reference implementation and the app's Swift tests recompute them from the result — three
|
|
# implementations with no shared code, so agreement is evidence rather than a tautology.
|
|
vectors:
|
|
@go run ./cmd/msa-vectors contracts/test-vectors.json
|
|
|
|
# The policy is embedded, so the vendored copy is part of the binary. Keep the copy mechanical:
|
|
# an operator editing internal/policy/agent-policy.json by hand would be editing a file the build
|
|
# overwrites, and the drift test makes that mistake loud rather than quiet.
|
|
vendor: $(POLICY_DST) $(UNIT_DST)
|
|
|
|
$(POLICY_DST): $(POLICY_SRC)
|
|
@cp $(POLICY_SRC) $(POLICY_DST)
|
|
|
|
$(UNIT_DST): $(UNIT_SRC)
|
|
@cp $(UNIT_SRC) $(UNIT_DST)
|
|
|
|
test: vendor
|
|
@go test ./...
|
|
|
|
vet: vendor
|
|
@go vet ./...
|
|
|
|
fmt:
|
|
@gofmt -l -w .
|
|
|
|
build: vendor
|
|
@mkdir -p dist
|
|
@go build -trimpath -ldflags '$(LDFLAGS)' -o dist/msa-agent ./cmd/msa-agent
|
|
|
|
# Nodes are ARM Debian boxes that also run SimAdmin, so the static binary is copied in rather than
|
|
# installed through a package manager: no runtime deps, no apt state, trivially removable.
|
|
build-arm64: vendor
|
|
@mkdir -p dist
|
|
@CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags '$(LDFLAGS)' -o dist/msa-agent-linux-arm64 ./cmd/msa-agent
|
|
|
|
build-armv7: vendor
|
|
@mkdir -p dist
|
|
@CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -trimpath -ldflags '$(LDFLAGS)' -o dist/msa-agent-linux-armv7 ./cmd/msa-agent
|
|
|
|
clean:
|
|
@rm -rf dist
|