Skip to content

Commit a85bcab

Browse files
jinja2Copilot
jinja2
and
Copilot
authored
[chore] update installer scripts (#7197)
* [chore] update installer scripts * fix shellcheck and windows test * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent dca1f75 commit a85bcab

File tree

4 files changed

+186
-14
lines changed

4 files changed

+186
-14
lines changed

‎.github/workflows/installer-token-verification-test.yml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
name: installer-token-verification-test
2+
3+
# Regression test for the v2/event API token validation.
4+
# Verifies that install.sh and install.ps1 check the HTTP status code (200)
5+
# rather than the response body.
6+
7+
on:
8+
push:
9+
branches:
10+
- main
11+
pull_request:
12+
paths:
13+
- '.github/workflows/installer-token-verification-test.yml'
14+
- 'packaging/installer/install.sh'
15+
- 'packaging/installer/install.ps1'
16+
- '.github/workflows/scripts/mock-http-server.py'
17+
18+
concurrency:
19+
group: installer-token-verification-test-${{ github.event.pull_request.number || github.ref }}
20+
cancel-in-progress: true
21+
22+
env:
23+
MOCK_SERVER: .github/workflows/scripts/mock-http-server.py
24+
25+
jobs:
26+
linux-curl:
27+
runs-on: ubuntu-24.04
28+
steps:
29+
- uses: actions/checkout@v5
30+
31+
- name: Start mock servers
32+
run: |
33+
python3 "$MOCK_SERVER" 200 8199 &
34+
python3 "$MOCK_SERVER" 401 8200 &
35+
sleep 1
36+
37+
- name: "curl: 200 with non-OK body passes"
38+
run: |
39+
eval "$(sed -n '/^verify_access_token()/,/^}/p' packaging/installer/install.sh)"
40+
verify_access_token "test-token" "http://127.0.0.1:8199" "false"
41+
42+
- name: "curl: 401 fails validation"
43+
run: |
44+
eval "$(sed -n '/^verify_access_token()/,/^}/p' packaging/installer/install.sh)"
45+
if verify_access_token "bad-token" "http://127.0.0.1:8200" "false"; then
46+
echo "FAIL: should have rejected 401" >&2; exit 1
47+
fi
48+
49+
linux-wget:
50+
runs-on: ubuntu-24.04
51+
steps:
52+
- uses: actions/checkout@v5
53+
54+
- name: Remove curl to force wget code path
55+
run: |
56+
sudo apt-get remove -y curl
57+
if command -v curl; then
58+
echo "curl still installed" >&2
59+
exit 1
60+
fi
61+
command -v wget
62+
63+
- name: Start mock servers
64+
run: |
65+
python3 "$MOCK_SERVER" 200 8199 &
66+
python3 "$MOCK_SERVER" 401 8200 &
67+
sleep 1
68+
69+
- name: "wget: 200 with non-OK body passes"
70+
run: |
71+
eval "$(sed -n '/^verify_access_token()/,/^}/p' packaging/installer/install.sh)"
72+
verify_access_token "test-token" "http://127.0.0.1:8199" "false"
73+
74+
- name: "wget: 401 fails validation"
75+
run: |
76+
eval "$(sed -n '/^verify_access_token()/,/^}/p' packaging/installer/install.sh)"
77+
if verify_access_token "bad-token" "http://127.0.0.1:8200" "false"; then
78+
echo "FAIL: should have rejected 401" >&2; exit 1
79+
fi
80+
81+
windows:
82+
runs-on: windows-2022
83+
steps:
84+
- uses: actions/checkout@v5
85+
86+
- name: "PowerShell: test verify_access_token"
87+
shell: pwsh
88+
run: |
89+
# Start mock servers (must be in same step — Start-Job doesn't survive across steps)
90+
$mockServer = "$env:MOCK_SERVER"
91+
$job200 = Start-Job -ScriptBlock { python3 $using:mockServer 200 8199 }
92+
$job401 = Start-Job -ScriptBlock { python3 $using:mockServer 401 8200 }
93+
Start-Sleep -Seconds 2
94+
95+
# Extract verify_access_token function from install.ps1
96+
$scriptContent = Get-Content -Raw .\packaging\installer\install.ps1
97+
if ($scriptContent -match '(?s)(function verify_access_token\(.+?\n\})') {
98+
Invoke-Expression $matches[1]
99+
} else {
100+
throw "Could not extract verify_access_token function from install.ps1"
101+
}
102+
103+
# Test 1: 200 with non-OK body should pass
104+
$result = verify_access_token -access_token "test-token" -ingest_url "http://127.0.0.1:8199" -insecure $false
105+
if (-not $result) {
106+
throw "FAIL: should have accepted 200 with non-OK body"
107+
}
108+
echo "PASS: 200 with non-OK body accepted"
109+
110+
# Test 2: 401 should fail
111+
$failed = $false
112+
try {
113+
$result = verify_access_token -access_token "bad-token" -ingest_url "http://127.0.0.1:8200" -insecure $false
114+
if (-not $result) { $failed = $true }
115+
} catch {
116+
$failed = $true
117+
}
118+
if (-not $failed) {
119+
throw "FAIL: should have rejected 401"
120+
}
121+
echo "PASS: 401 correctly rejected"
122+
123+
Stop-Job $job200, $job401
124+
Remove-Job $job200, $job401

‎.github/workflows/scripts/mock-http-server.py‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/usr/bin/env python3
2+
"""Minimal HTTP server that responds with a fixed status code and empty JSON body.
3+
4+
Usage: python3 mock-http-server.py <status_code> <port>
5+
"""
6+
import http.server
7+
import sys
8+
9+
if len(sys.argv) != 3:
10+
print(f"Usage: {sys.argv[0]} <status_code> <port>", file=sys.stderr)
11+
sys.exit(1)
12+
13+
try:
14+
status = int(sys.argv[1])
15+
port = int(sys.argv[2])
16+
except (ValueError, TypeError):
17+
print("Error: <status_code> and <port> must be integers.", file=sys.stderr)
18+
sys.exit(1)
19+
class Handler(http.server.BaseHTTPRequestHandler):
20+
def do_POST(self):
21+
self.send_response(status)
22+
self.send_header("Content-Type", "application/json")
23+
self.end_headers()
24+
self.wfile.write(b"{}")
25+
26+
def log_message(self, *a):
27+
pass
28+
29+
http.server.HTTPServer(("127.0.0.1", port), Handler).serve_forever()

‎packaging/installer/install.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -559,7 +559,7 @@ if ($force_skip_verify_access_token) {
559559
# verify access token
560560
echo 'Verifying Access Token...'
561561
if (!(verify_access_token -access_token $access_token -ingest_url $ingest_url -insecure $insecure)) {
562-
throw "Access token authentication failed. Verify that your access token is correct."
562+
throw "Access token authentication failed. Verify that your access token is correct. If your access token is valid, you can skip validation by rerunning with -force_skip_verify_access_token `$true or setting the VERIFY_ACCESS_TOKEN=false environment variable."
563563
}
564564
else {
565565
echo '- Verified Access Token'

‎packaging/installer/install.sh‎

Lines changed: 32 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -141,38 +141,56 @@ verify_access_token() {
141141
local access_token="$1"
142142
local ingest_url="$2"
143143
local insecure="$3"
144+
local http_code
144145

145146
if command -v curl > /dev/null; then
146-
api_output=$(curl \
147+
http_code=$(curl \
147148
-d '[]' \
148149
-H "X-Sf-Token: $access_token" \
149150
-H "Content-Type:application/json" \
150151
-X POST \
152+
-w "%{http_code}" \
153+
-o /dev/null \
154+
-s \
151155
$([ "$insecure" = "true" ] && echo -n "--insecure") \
152-
"$ingest_url"/v2/event 2>/dev/null)
156+
"$ingest_url"/v2/event)
157+
if [ $? -ne 0 ]; then
158+
echo "Failed to verify access token: curl request failed" >&2
159+
return 1
160+
fi
153161
elif command -v wget > /dev/null; then
154-
api_output=$(wget \
162+
# --server-response prints HTTP headers to stderr
163+
local wget_output
164+
wget_output=$(wget \
155165
--header="Content-Type: application/json" \
156166
--header="X-Sf-Token: $access_token" \
157167
--post-data='[]' \
158168
$([ "$insecure" = "true" ] && echo -n "--no-check-certificate") \
159-
-O - \
160-
-o /dev/null \
161-
"$ingest_url"/v2/event)
162-
if [ $? -eq 5 ]; then
169+
--server-response \
170+
-O /dev/null \
171+
"$ingest_url"/v2/event 2>&1)
172+
local wget_exit=$?
173+
if [ $wget_exit -eq 5 ]; then
163174
echo "TLS cert for Splunk ingest could not be verified, does your system have TLS certs installed?" >&2
164-
exit 1
175+
return 1
176+
fi
177+
# Extract HTTP status code from response headers (format: " HTTP/1.1 200 OK")
178+
http_code=$(echo "$wget_output" | grep -i "^[[:space:]]*HTTP/" | tail -1 | awk '{print $2}')
179+
if [ -z "$http_code" ]; then
180+
echo "Failed to verify access token: wget request failed" >&2
181+
return 1
165182
fi
166183
else
167184
echo "Either curl or wget is required to verify the access token" >&2
168-
exit 1
185+
return 1
169186
fi
170187

171-
if [ "$api_output" = "\"OK\"" ]; then
172-
true
188+
# Check if status code is 200
189+
if [ "$http_code" -eq 200 ]; then
190+
return 0
173191
else
174-
echo "$api_output"
175-
false
192+
echo "Access token verification failed with HTTP status code: $http_code" >&2
193+
return 1
176194
fi
177195
}
178196

@@ -1405,6 +1423,7 @@ parse_args_and_install() {
14051423

14061424
if [ "${VERIFY_ACCESS_TOKEN:-true}" = "true" ] && ! verify_access_token "$access_token" "$ingest_url" "$insecure"; then
14071425
echo "Your access token could not be verified. This may be due to a network connectivity issue or an invalid access token." >&2
1426+
echo "If your access token is valid, you can skip validation by setting VERIFY_ACCESS_TOKEN=false and rerunning the installer." >&2
14081427
exit 1
14091428
fi
14101429

0 commit comments

Comments
 (0)