cesnimda
66 lines
3.5 KiB
Python
66 lines
3.5 KiB
Python
"""Bounded read-only Gitea diagnostics; credentials remain in Git's configured helper."""
|
|
import datetime
|
|
import json
|
|
from pathlib import Path
|
|
import socket
|
|
import ssl
|
|
import subprocess
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
|
|
def main():
|
|
import argparse
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument('--output', required=True, type=Path)
|
|
args = parser.parse_args()
|
|
assert not args.output.exists(), 'Preserve earlier observations'
|
|
def git(*command):
|
|
result = subprocess.run(['rtk', 'proxy', 'git', *command], text=True, capture_output=True, timeout=45)
|
|
return result
|
|
url = git('remote', 'get-url', 'origin').stdout.strip()
|
|
assert url == 'https://git.cesnimda.uk/cesnimda/jobtrackingapp.git'
|
|
record = dict(observedUtc=datetime.datetime.now(datetime.timezone.utc).isoformat(), remote=url,
|
|
localCommit=git('rev-parse', 'HEAD').stdout.strip(), tlsVerificationDisabled=False)
|
|
try:
|
|
addresses = sorted({item[4][0] for item in socket.getaddrinfo('git.cesnimda.uk', 443, type=socket.SOCK_STREAM)})
|
|
record['dns'] = dict(status='PASS', addresses=addresses)
|
|
except OSError as error:
|
|
record['dns'] = dict(status='BLOCKED', errorType=type(error).__name__)
|
|
try:
|
|
with socket.create_connection(('git.cesnimda.uk', 443), timeout=5):
|
|
record['tcp443'] = dict(status='PASS')
|
|
except OSError as error:
|
|
record['tcp443'] = dict(status='BLOCKED', errorType=type(error).__name__)
|
|
try:
|
|
with socket.create_connection(('git.cesnimda.uk', 443), timeout=5) as connection:
|
|
with ssl.create_default_context().wrap_socket(connection, server_hostname='git.cesnimda.uk') as secured:
|
|
record['tls'] = dict(status='PASS', protocol=secured.version(), certificateVerified=True)
|
|
except OSError as error:
|
|
record['tls'] = dict(status='BLOCKED', errorType=type(error).__name__, certificateVerified=False)
|
|
class NoRedirect(urllib.request.HTTPRedirectHandler):
|
|
def redirect_request(self, *unused):
|
|
return None
|
|
try:
|
|
with urllib.request.build_opener(NoRedirect()).open('https://git.cesnimda.uk/api/v1/version', timeout=6) as response:
|
|
record['https'] = dict(status='PASS', httpStatus=response.status)
|
|
except (OSError, urllib.error.URLError) as error:
|
|
record['https'] = dict(status='BLOCKED', errorType=type(error).__name__, httpStatus=getattr(error, 'code', None))
|
|
command = ['ls-remote', '--exit-code', 'origin', 'refs/heads/test/pre-phase10-ux-acceptance', 'refs/heads/planning/int-global-jobs-00']
|
|
try:
|
|
result = git(*command)
|
|
refs = dict(reversed(line.split()) for line in result.stdout.splitlines() if len(line.split()) == 2)
|
|
record['git'] = dict(argv=['git', *command], exitCode=result.returncode, refs=refs,
|
|
authentication='REACHED' if result.returncode == 0 else 'NOT_ESTABLISHED')
|
|
except subprocess.TimeoutExpired:
|
|
record['git'] = dict(argv=['git', *command], exitCode=None, refs={}, authentication='NOT_ESTABLISHED', timeoutSeconds=45)
|
|
record['publication'] = 'VERIFIED' if record['git']['refs'].get('refs/heads/test/pre-phase10-ux-acceptance') == record['localCommit'] else 'BLOCKED'
|
|
args.output.parent.mkdir(parents=True, exist_ok=True)
|
|
args.output.write_text(json.dumps(record, indent=2) + '\n', encoding='utf-8')
|
|
print(json.dumps(record))
|
|
return 0
|
|
|
|
|
|
if __name__ == '__main__':
|
|
raise SystemExit(main())
|