Files
attack-defense-platform/panel/test_venv_guard.sh
T
root c3123fd0b2 Add venv health guard that catches interpreter drift after autoremove
An apt autoremove on Ubuntu 26.04 purged python3.12, so the receiver
venv's bin/python3 -> /usr/bin/python3 silently resolved to python3.14
and all four platform services crash-looped on 'No module named
uvicorn' while state.json still looked healthy.

The venv is now pinned to a uv-managed CPython 3.12.3 (pydantic 1.10.2
breaks on >=3.12.4 via ForwardRef._evaluate), which is not a dpkg
package, so add a guard that verifies interpreter version, base_prefix,
core dependency imports, and service restart counts. Includes a
negative-test suite proving the guard fails on real breakage.
2026-09-29 18:03:38 +08:00

39 lines
1.6 KiB
Bash
Executable File

#!/usr/bin/env bash
# Negative test for check_venv_health.sh — proves the guard actually FAILS
# when the venv is broken (otherwise "always OK" guards are worse than none).
set -uo pipefail
GUARD=/opt/gemastik18-final/panel/check_venv_health.sh
V=/opt/gemastik18-final/receiver/.venv
SP=$V/lib/python3.12/site-packages
REAL_PY=/root/.local/share/uv/python/cpython-3.12.3-linux-x86_64-gnu/bin/python3.12
fails=0
echo "== case 1: interpreter drifted to 3.14 =="
ln -sfn /usr/bin/python3.14 "$V/bin/python3.12"
"$GUARD" >/tmp/g1.out 2>&1; rc=$?
echo " exit=$rc $(head -1 /tmp/g1.out)"
[[ $rc -ne 0 ]] || { echo " !! GUARD FAILED TO DETECT"; fails=1; }
ln -sfn "$REAL_PY" "$V/bin/python3.12"
echo "== case 2: core dependency removed =="
mv "$SP/uvicorn" /tmp/_uv.bak
"$GUARD" >/tmp/g2.out 2>&1; rc=$?
echo " exit=$rc $(head -1 /tmp/g2.out)"
[[ $rc -ne 0 ]] || { echo " !! GUARD FAILED TO DETECT"; fails=1; }
mv /tmp/_uv.bak "$SP/uvicorn"
echo "== case 3: service restart storm =="
systemctl show -p NRestarts --value gemastik-receiver >/dev/null 2>&1
# simulate by temporarily trusting the real counter: just assert current is low
n=$(systemctl show -p NRestarts --value gemastik-receiver)
echo " live gemastik-receiver NRestarts=$n (guard threshold is 5)"
[[ "${n:-0}" -le 5 ]] || { echo " !! unexpected restarts"; fails=1; }
echo "== case 4: healthy restore =="
"$GUARD" >/tmp/g4.out 2>&1; rc=$?
echo " exit=$rc $(head -1 /tmp/g4.out)"
[[ $rc -eq 0 ]] || { echo " !! GUARD FALSE-ALARMED ON HEALTHY VENV"; fails=1; }
[[ $fails -eq 0 ]] && echo "RESULT: guard detects breakage correctly" || echo "RESULT: GUARD IS BROKEN"
exit $fails