feat: add reproducible imgproxy runtime release

2026-07-15 11:25:32 +08:00
parent 87b03f7848
commit 3eee44ef5b
6 changed files with 171 additions and 0 deletions
@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+
+const root = path.resolve(import.meta.dirname, '..');
+const read = (name) => fs.readFileSync(path.join(root, name), 'utf8');
+
+test('imgproxy runtime pins an arm64 image digest', () => {
+  const dockerfile = read('docker/imgproxy-runtime/Dockerfile');
+  assert.match(dockerfile, /FROM darthsim\/imgproxy@sha256:[a-f0-9]{64}/);
+});
+
+test('installer uses a read-only storage mount and both required ports', () => {
+  const installer = read('scripts/install-imgproxy-runtime-prod.sh');
+  assert.match(installer, /-p 127\.0\.0\.1:20082:8080/);
+  assert.match(installer, /\$MINDSPACE_STORAGE_ROOT:\/mnt\/images:ro/);
+  assert.match(installer, /10\.10\.0\.2/);
+  assert.match(installer, /IMGPROXY_UPSTREAM/);
+});
+
+test('release verifies checksums before loading the image and backs up launch state', () => {
+  const release = read('scripts/release-imgproxy-runtime-prod.sh');
+  assert.match(release, /shasum -a 256 -c/);
+  assert.match(release, /docker load/);
+  assert.match(release, /imgproxy-compat-\$RELEASE_ID\.plist/);
+  assert.match(release, /img\.tkmind\.cn\/health/);
+});