Spaces:
Sleeping
Sleeping
File size: 4,083 Bytes
39ff632 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 | #!/usr/bin/env bash
# Build the linux/amd64 Space image and verify its runtime surface.
set -euo pipefail
TAG="${1:-img2threejs:verify}"
PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
NO_SECRET_CONTAINER="i2t-no-secret-$$"
GUARD_CONTAINER="i2t-guard-$$"
VERIFY_TMP="$(mktemp -d -t img2threejs-docker-verify.XXXXXX)"
cleanup() {
docker rm -f "$NO_SECRET_CONTAINER" "$GUARD_CONTAINER" >/dev/null 2>&1 || true
rm -rf "$VERIFY_TMP"
}
trap cleanup EXIT
cd "$PROJECT_ROOT"
echo "==> docker build --platform=linux/amd64 -t $TAG ."
docker build --platform=linux/amd64 -t "$TAG" .
echo "==> image size"
docker images "$TAG" --format ' {{.Repository}}:{{.Tag}} {{.Size}}'
echo "==> runtime image allowlist"
docker run --rm --entrypoint sh "$TAG" -c '
set -eu
for path in \
/home/user/app/.git \
/home/user/app/.pytest_cache \
/home/user/app/.venv \
/home/user/app/.workflow \
/home/user/app/docs \
/home/user/app/grimoire \
/home/user/app/pytest.ini \
/home/user/app/scripts \
/home/user/app/SKILL.md \
/home/user/app/tests \
/home/user/app/upstream-src \
/home/user/app/verification \
/home/user/app/forge/tests; do
test ! -e "$path"
done
test -z "$(find /home/user/app -type d -name __pycache__ -print -quit)"
test -z "$(find /home/user/app -type f \( -name "rollout*.jsonl" -o -name "*.pyc" \) -print -quit)"
test -f /home/user/app/app/main.py
test -f /home/user/app/forge/stage3_build/generate_threejs_factory.py
test -f /home/user/app/LICENSE
echo " strict runtime source allowlist ok"
'
echo "==> no-secret container: health, UI, and honest 503"
docker run -d --name "$NO_SECRET_CONTAINER" -p 17860:7860 "$TAG" >/dev/null
curl --fail --silent --show-error \
--retry 45 --retry-all-errors --retry-connrefused --retry-delay 1 \
--connect-timeout 2 --max-time 90 \
http://127.0.0.1:17860/health >"$VERIFY_TMP/health.json"
grep -q '"status":"ok"' "$VERIFY_TMP/health.json"
grep -q '"llm_configured":false' "$VERIFY_TMP/health.json"
curl --fail --silent --show-error http://127.0.0.1:17860/ \
>"$VERIFY_TMP/index.html"
grep -q 'img2threejs' "$VERIFY_TMP/index.html"
curl --fail --silent --show-error http://127.0.0.1:17860/static/app.js \
>"$VERIFY_TMP/app.js"
grep -q 'startJob' "$VERIFY_TMP/app.js"
no_secret_code="$(curl --silent --output "$VERIFY_TMP/no-secret-job.json" \
--write-out '%{http_code}' \
-F "file=@tests/fixtures/ref.png;type=image/png" \
http://127.0.0.1:17860/api/jobs)"
if [[ "$no_secret_code" != "503" ]]; then
echo "FAIL: expected 503 without LLM secrets, got $no_secret_code" >&2
sed -n '1,20p' "$VERIFY_TMP/no-secret-job.json" >&2
exit 1
fi
grep -q 'llm_not_configured' "$VERIFY_TMP/no-secret-job.json"
if grep -qiE 'sculptRuntime|makeModel|model\.bundle' "$VERIFY_TMP/no-secret-job.json"; then
echo "FAIL: no-secret response appears to contain fabricated artifacts" >&2
exit 1
fi
echo " health/UI/honest 503 ok"
echo "==> configured guard container: invalid upload reaches image validation"
docker run -d --name "$GUARD_CONTAINER" -p 17861:7860 \
-e LLM_API_KEY=verification-dummy \
-e LLM_MODEL=verification-dummy \
-e LLM_BASE_URL=http://127.0.0.1:9 \
"$TAG" >/dev/null
curl --fail --silent --show-error \
--retry 45 --retry-all-errors --retry-connrefused --retry-delay 1 \
--connect-timeout 2 --max-time 90 \
http://127.0.0.1:17861/health >"$VERIFY_TMP/guard-health.json"
grep -q '"llm_configured":true' "$VERIFY_TMP/guard-health.json"
printf '<html><body>not an image</body></html>' >"$VERIFY_TMP/not-image.html"
guard_code="$(curl --silent --output "$VERIFY_TMP/guard-job.json" \
--write-out '%{http_code}' \
-F "file=@$VERIFY_TMP/not-image.html;type=text/html" \
http://127.0.0.1:17861/api/jobs)"
if [[ "$guard_code" != "415" ]]; then
echo "FAIL: expected 415 for a declared non-image, got $guard_code" >&2
sed -n '1,20p' "$VERIFY_TMP/guard-job.json" >&2
exit 1
fi
grep -q 'unsupported_media_type' "$VERIFY_TMP/guard-job.json"
echo " upload content-type guard ok"
echo "ALL DOCKER CHECKS PASSED"
|