Merge branch 'fix/v147-review-wolfi' into release/v1.47.0

src/__tests__/healthcheck-boot-storm.test.ts

@@ -80,12 +80,13 @@ function imageCheck(): Check {
 }
 
 /**
- * The probe is Node's fetch, aborted by `AbortSignal.timeout(ms)`. The
- * image carries no wget or curl, so a probe that names one would fail every
- * time and mark a healthy container unhealthy.
+ * The probe is Node's fetch, aborted by `AbortSignal.timeout(ms)`. The image
+ * carries no curl, and its `wget` is a shim kept for health checks written
+ * outside the repository (`wget-shim.test.ts`); the image's own check and the
+ * bundled compose file do not lean on it, so neither names one.
  */
 function probeTimeout(command: string): number {
-  expect(command, "the probe needs a binary the image has").not.toMatch(
+  expect(command, "the image's own probe is the Node fetch").not.toMatch(
     /\b(wget|curl)\b/,
   );
   const m =

src/__tests__/runtime-package-pins.test.ts

@@ -0,0 +1,56 @@
+/**
+ * The runtime packages the image installs from apk are pinned, and the
+ * PostgreSQL client moves with the bundled database.
+ *
+ * The runner installs Node and the PostgreSQL client from the Wolfi
+ * repository. Unpinned, a rebuild of the same commit could ship another
+ * Node or another pg_dump than the one the release was checked with. No
+ * updater reads an apk pin; the image scan is what flags a pinned package
+ * once Wolfi publishes a fix (the Dockerfile comment explains the bump), so
+ * this file only holds the pins' shape and their agreement with the rest of
+ * the repository.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, it } from "vitest";
+
+const ROOT = process.cwd();
+const DOCKERFILE = readFileSync(join(ROOT, "Dockerfile"), "utf8");
+const COMPOSE = readFileSync(join(ROOT, "docker-compose.yml"), "utf8");
+
+function runner(): string {
+  const start = DOCKERFILE.search(/^FROM .* AS runner$/m);
+  expect(start, "the Dockerfile has a runner stage").toBeGreaterThan(0);
+  return DOCKERFILE.slice(start);
+}
+
+function apkAdds(): string[] {
+  return [...runner().matchAll(/apk add --no-cache ([^&\n\\]+)/g)].flatMap(
+    (m) => m[1]!.trim().split(/\s+/),
+  );
+}
+
+describe("runtime package pins", () => {
+  it("pins nodejs-22 to one exact Node 22 package version", () => {
+    const pins = apkAdds().filter((p) => p.startsWith("nodejs"));
+    expect(pins).toHaveLength(1);
+    expect(pins[0]).toMatch(/^nodejs-22=22\.\d+\.\d+-r\d+$/);
+  });
+
+  it("pins postgresql-18-client to the bundled database's minor", () => {
+    const pins = apkAdds().filter((p) => p.startsWith("postgresql"));
+    expect(pins).toHaveLength(1);
+    const client = /^postgresql-18-client=(18\.\d+)-r\d+$/.exec(pins[0]!);
+    expect(client, `an exact pin, not ${pins[0]}`).not.toBeNull();
+    const db = /^\s*image:\s*postgres:(\d+\.\d+)-alpine$/m.exec(COMPOSE);
+    expect(db, "the compose file pins the database").not.toBeNull();
+    // One decision: a database minor bump moves the client with it.
+    expect(client![1]).toBe(db![1]);
+  });
+
+  it("leaves no other package floating except tzdata and the build-only npm", () => {
+    const unpinned = apkAdds().filter((p) => !p.includes("="));
+    expect(new Set(unpinned)).toEqual(new Set(["tzdata", "npm"]));
+  });
+});

src/__tests__/wget-shim.test.ts

@@ -0,0 +1,186 @@
+/**
+ * The image's `wget` answers the health checks written outside this
+ * repository the way wget would.
+ *
+ * The runtime base carries no wget. A compose file copied from this
+ * repository up to v1.46.6 checks health with
+ * `wget --no-verbose --tries=1 --spider http://127.0.0.1:3000/api/health`,
+ * and the TrueNAS catalog app renders `wget --quiet --spider <url>`; either
+ * replaces the image's own HEALTHCHECK. Without a `wget` such a container is
+ * unhealthy forever and a proxy that routes on health drops its traffic. So
+ * the image installs `scripts/wget-shim.mjs` as `/usr/local/bin/wget`, and
+ * this file runs that script as the health check would: exit 0 on a healthy
+ * answer, 1 on a 503, a refused connection or a timeout, and no file
+ * written anywhere.
+ */
+import { spawn } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+const ROOT = process.cwd();
+const SHIM = join(ROOT, "scripts", "wget-shim.mjs");
+
+let server: Server;
+let base = "";
+
+beforeAll(async () => {
+  server = createServer((req, res) => {
+    if (req.url === "/ok") {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end('{"status":"ok"}');
+    } else if (req.url === "/down") {
+      res.writeHead(503, { "content-type": "application/json" });
+      res.end('{"status":"degraded"}');
+    } else if (req.url === "/moved") {
+      res.writeHead(302, { location: "http://192.0.2.1/elsewhere" });
+      res.end();
+    } else if (req.url === "/slow") {
+      // Never answers; the shim's timeout has to end the request.
+    } else {
+      res.writeHead(404);
+      res.end();
+    }
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+});
+
+afterAll(async () => {
+  server.closeAllConnections();
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+});
+
+function wget(
+  args: string[],
+  cwd = ROOT,
+): Promise<{
+  code: number | null;
+  stdout: string;
+  stderr: string;
+  ms: number;
+}> {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    const child = spawn(process.execPath, [SHIM, ...args], { cwd });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d: Buffer) => (stdout += d.toString()));
+    child.stderr.on("data", (d: Buffer) => (stderr += d.toString()));
+    child.on("close", (code) =>
+      resolve({ code, stdout, stderr, ms: Date.now() - started }),
+    );
+  });
+}
+
+/** A port nothing listens on: bind one, note it, close it again. */
+async function closedPort(): Promise<number> {
+  const probe = createServer();
+  await new Promise<void>((resolve) => probe.listen(0, "127.0.0.1", resolve));
+  const { port } = probe.address() as AddressInfo;
+  await new Promise<void>((resolve) => probe.close(() => resolve()));
+  return port;
+}
+
+// The two command lines found in the wild, with the URL left to the case.
+const LINES: Array<[string, (url: string) => string[]]> = [
+  [
+    "compose up to v1.46.6",
+    (url) => ["--no-verbose", "--tries=1", "--timeout=4", "--spider", url],
+  ],
+  [
+    "compose without a timeout",
+    (url) => ["--no-verbose", "--tries=1", "--spider", url],
+  ],
+  ["TrueNAS catalog app", (url) => ["--quiet", "--spider", url]],
+];
+
+describe.each(LINES)("the %s health check", (_name, line) => {
+  it("passes on a healthy server", async () => {
+    expect((await wget(line(`${base}/ok`))).code).toBe(0);
+  });
+
+  it("fails on a 503", async () => {
+    expect((await wget(line(`${base}/down`))).code).toBe(1);
+  });
+
+  it("fails on a refused connection", async () => {
+    const port = await closedPort();
+    expect((await wget(line(`http://127.0.0.1:${port}/api/health`))).code).toBe(
+      1,
+    );
+  });
+});
+
+describe("wget shim", () => {
+  it("gives up at its timeout instead of hanging", async () => {
+    const result = await wget(["-q", "-T", "1", "--spider", `${base}/slow`]);
+    expect(result.code).toBe(1);
+    expect(result.ms).toBeLessThan(5_000);
+  });
+
+  it("counts a redirect as an answer and does not follow it", async () => {
+    expect((await wget(["-q", "--spider", `${base}/moved`])).code).toBe(0);
+  });
+
+  it("prints the body for -O - and stays quiet with -q", async () => {
+    const result = await wget(["-qO-", `${base}/ok`]);
+    expect(result.code).toBe(0);
+    expect(result.stdout).toBe('{"status":"ok"}');
+    expect(result.stderr).toBe("");
+  });
+
+  it("accepts -O /dev/null and -S", async () => {
+    const result = await wget(["-S", "-O", "/dev/null", `${base}/ok`]);
+    expect(result.code).toBe(0);
+    expect(result.stderr).toMatch(/HTTP\/1\.1 200/);
+  });
+
+  it("ignores flags it does not know", async () => {
+    const result = await wget([
+      "--no-check-certificate",
+      "--header",
+      "X-Probe: 1",
+      "-c",
+      "--spider",
+      `${base}/ok`,
+    ]);
+    expect(result.code).toBe(0);
+  });
+
+  it("is not a download tool: it refuses any other output file and writes none", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "wget-shim-"));
+    try {
+      const target = join(dir, "health.json");
+      const refused = await wget(["-O", target, `${base}/ok`], dir);
+      expect(refused.code).toBe(2);
+      expect(existsSync(target)).toBe(false);
+      // Without -O real wget saves `index.html`; the shim discards the body.
+      const bare = await wget([`${base}/ok`], dir);
+      expect(bare.code).toBe(0);
+      expect(existsSync(join(dir, "ok"))).toBe(false);
+      expect(existsSync(join(dir, "index.html"))).toBe(false);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("refuses a command line without a URL", async () => {
+    expect((await wget(["--spider"])).code).toBe(2);
+  });
+
+  it("is what the image installs as wget", () => {
+    const dockerfile = readFileSync(join(ROOT, "Dockerfile"), "utf8");
+    const runner = dockerfile.slice(dockerfile.search(/^FROM .* AS runner$/m));
+    expect(runner).toContain(
+      "COPY --from=builder /app/scripts/wget-shim.mjs /usr/local/lib/healthlog/wget-shim.mjs",
+    );
+    expect(runner).toContain(
+      `exec node /usr/local/lib/healthlog/wget-shim.mjs "$@"\\n' > /usr/local/bin/wget`,
+    );
+  });
+});