31 lines
1.6 KiB
JavaScript
31 lines
1.6 KiB
JavaScript
import { readFileSync } from 'node:fs';
|
|
import { resolve } from 'node:path';
|
|
|
|
const root = resolve(import.meta.dirname, '..', '..');
|
|
const read = (relativePath) => readFileSync(resolve(root, relativePath), 'utf8');
|
|
const installer = read('tools/security/install-security-agent.sh');
|
|
const service = read('deploy/security/cmpp-security-agent.service');
|
|
const action = read('deploy/security/cmpp-report-only.conf');
|
|
const placeholder = '@CMPP_SECURITY_AGENT_BIN@';
|
|
|
|
for (const [label, source] of [['systemd service', service], ['Fail2ban action', action]]) {
|
|
if (!source.includes(placeholder)) throw new Error(`${label} is missing the security-agent executable placeholder`);
|
|
if (source.includes('/opt/cmpp-platform/current/bin/cmpp-security-agent')) {
|
|
throw new Error(`${label} still references the removed current/bin deployment layout`);
|
|
}
|
|
}
|
|
|
|
if (!installer.includes('agent_binary="$APP_DIR/dist/cmpp-security-agent"')) {
|
|
throw new Error('installer does not bind the security agent to the built dist executable');
|
|
}
|
|
for (const target of ['cmpp-security-agent.service', 'cmpp-report-only.conf']) {
|
|
if (!installer.includes(`sed "s#${placeholder}#$agent_binary#g"`) || !installer.includes(target)) {
|
|
throw new Error(`installer does not render ${target} with the built security-agent executable`);
|
|
}
|
|
}
|
|
if (!installer.includes("grep -Rqs '@CMPP_SECURITY_AGENT_BIN@'")) {
|
|
throw new Error('installer does not fail closed when an executable placeholder remains');
|
|
}
|
|
|
|
console.log('Security deployment verified: systemd and Fail2ban use the built dist security-agent executable.');
|