ce7cb702218693d08ea6d83464d2457c9250027c

services/grafana-plugins/install.fsx

@@ -0,0 +1,42 @@
+module Install
+
+#r "/opt/fsi/packages/AWSSDK.Core.dll"
+#r "/opt/fsi/packages/AWSSDK.S3.dll"
+
+open System
+open System.IO
+open System.IO.Compression
+open System.Security.Cryptography
+open Amazon.Runtime
+open Amazon.S3
+open Amazon.S3.Model
+
+[<CLIMutable>]
+type Settings =
+    { Endpoint: string
+      Bucket: string
+      Key: string
+      Sha256: string
+      AccessKey: string }
+
+let unpack expected (input: Stream) destination =
+    use archive = new MemoryStream()
+    input.CopyTo archive
+    archive.Position <- 0L
+    let actual = SHA256.HashData archive |> Convert.ToHexString |> _.ToLowerInvariant()
+    if actual <> expected then
+        invalidOp "plugin archive checksum differs"
+    archive.Position <- 0L
+    use zip = new ZipArchive(archive, ZipArchiveMode.Read)
+    zip.ExtractToDirectory(destination, true)
+    for entry in zip.Entries do
+        if entry.Name <> "" then
+            File.SetUnixFileMode(Path.Combine(destination, entry.FullName), enum<UnixFileMode> ((entry.ExternalAttributes >>> 16) &&& 0o777))
+
+let run settings password destination =
+    let config = AmazonS3Config(ServiceURL = settings.Endpoint, AuthenticationRegion = "us-east-1", ForcePathStyle = true)
+    use client = new AmazonS3Client(BasicAWSCredentials(settings.AccessKey, password), config)
+    let request = GetObjectRequest(BucketName = settings.Bucket, Key = settings.Key)
+    use reply = client.GetObjectAsync(request).GetAwaiter().GetResult()
+    unpack settings.Sha256 reply.ResponseStream destination
+    printfn "Installed plugin archive sha256:%s" settings.Sha256

services/grafana-plugins/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+configMapGenerator:
+  - name: grafana-plugins
+    namespace: grafana
+    files:
+      - install.fsx
+      - run.fsx

services/grafana-plugins/run.fsx

@@ -0,0 +1,8 @@
+#load "install.fsx"
+
+open System.IO
+open System.Text.Json
+open Install
+
+let settings = JsonSerializer.Deserialize<Settings>(File.ReadAllText "/config/settings.json")
+run settings (File.ReadAllText("/s3/secretAccessKey").TrimEnd()) "/plugins"

services/grafana-plugins/tests.fsx

@@ -0,0 +1,43 @@
+#load "install.fsx"
+
+open System
+open System.IO
+open System.IO.Compression
+open System.Security.Cryptography
+open Install
+
+let root = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N"))
+let destination = root + "/plugins"
+let bytes =
+    use buffer = new MemoryStream()
+    use zip = new ZipArchive(buffer, ZipArchiveMode.Create, true)
+    for name, content, mode in [ "plugin.json", "synthetic manifest", 0o100644; "rcon_linux_amd64", "synthetic backend", 0o100755 ] do
+        let entry = zip.CreateEntry("quorate-rcon-app/" + name)
+        entry.ExternalAttributes <- mode <<< 16
+        use writer = new StreamWriter(entry.Open())
+        writer.Write(content: string)
+    zip.Dispose()
+    buffer.ToArray()
+let expected = SHA256.HashData bytes |> Convert.ToHexString |> _.ToLowerInvariant()
+let input () = new MemoryStream(bytes)
+let snapshot () =
+    Directory.GetFiles(destination, "*", SearchOption.AllDirectories)
+    |> Array.map (fun path -> path, File.ReadAllBytes path, File.GetUnixFileMode path)
+
+try
+    use first = input ()
+    unpack expected first destination
+    let files = snapshot ()
+    assert (File.GetUnixFileMode(destination + "/quorate-rcon-app/plugin.json") = enum<UnixFileMode> 0o644)
+    assert (File.GetUnixFileMode(destination + "/quorate-rcon-app/rcon_linux_amd64") = enum<UnixFileMode> 0o755)
+    use second = input ()
+    unpack expected second destination
+    assert (files = snapshot ())
+    let mutable rejected = false
+    use changed = input ()
+    try unpack (String.replicate 64 "0") changed destination with :? InvalidOperationException -> rejected <- true
+    assert rejected
+    assert (files = snapshot ())
+    printfn "PASS: repeat installation, executable modes and checksum rejection before writes"
+finally
+    Directory.Delete(root, true)