修复跨 Docker 版本灰度镜像校验

deploy/activate-gray.sh

@@ -24,7 +24,9 @@ done < "$release/release.env"
 [[ "$CHAT_IMAGE" =~ ^baiyue-logistics-chat-gray:[a-f0-9]{12}-b[0-9]+$ ]] || exit 2
 [[ "$HOST_PORT" =~ ^[0-9]+$ ]] && ((HOST_PORT >= 1024 && HOST_PORT <= 65535)) || exit 2
 [[ -d "$CHAT_PROXY_DIR" && -r "$CHAT_TLS_CERT" && -r "$CHAT_TLS_KEY" ]] || exit 2
-[[ "$(docker image inspect --format '{{.Id}}' "$CHAT_IMAGE")" == "$CHAT_IMAGE_ID" ]] || exit 2
+loaded_id=$(awk -F= '$1 == "CHAT_IMAGE_ID" {print $2}' "$release/loaded-image-ids.env")
+[[ "$loaded_id" =~ ^sha256:[a-f0-9]{64}$ ]] || exit 2
+[[ "$(docker image inspect --format '{{.Id}}' "$CHAT_IMAGE")" == "$loaded_id" ]] || { echo 'Loaded application image changed.' >&2; exit 2; }
 [[ "$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$CHAT_IMAGE")" == "$SOURCE_COMMIT" ]] || exit 2
 openssl x509 -in "$CHAT_TLS_CERT" -checkhost "$CHAT_DOMAIN" -noout >/dev/null
 

deploy/prepare-gray-tls.sh

@@ -18,7 +18,9 @@ done < "$release/release.env"
 [[ "$CHAT_TLS_CERT" == "$root/tls/config/live/$CHAT_DOMAIN/fullchain.pem" ]] || exit 2
 [[ "$CHAT_TLS_KEY" == "$root/tls/config/live/$CHAT_DOMAIN/privkey.pem" ]] || exit 2
 [[ "$CHAT_CERTBOT_IMAGE" =~ ^baiyue-logistics-chat-certbot:[a-f0-9]{12}-b[0-9]+$ ]] || exit 2
-[[ "$(docker image inspect --format '{{.Id}}' "$CHAT_CERTBOT_IMAGE")" == "$CHAT_CERTBOT_IMAGE_ID" ]] || exit 2
+loaded_id=$(awk -F= '$1 == "CERTBOT_IMAGE_ID" {print $2}' "$release/loaded-image-ids.env")
+[[ "$loaded_id" =~ ^sha256:[a-f0-9]{64}$ ]] || exit 2
+[[ "$(docker image inspect --format '{{.Id}}' "$CHAT_CERTBOT_IMAGE")" == "$loaded_id" ]] || { echo 'Loaded certificate image changed.' >&2; exit 2; }
 [[ "$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$CHAT_CERTBOT_IMAGE")" == "$SOURCE_COMMIT" ]] || exit 2
 
 site="$CHAT_PROXY_DIR/baiyue-logistics-chat-gray.conf"

deploy/publish-gray.sh

@@ -40,7 +40,7 @@ release=$2
 [[ "$root" == /*/gray-logistics-chat && "$root" != *..* ]] || exit 2
 [[ "$release" == "$root"/releases/* ]] || exit 2
 [[ "$(id -u)" == 0 ]] || { echo 'The managed gray deployment account must have the required host permissions.' >&2; exit 2; }
-for program in docker nginx openssl curl ss systemctl; do command -v "$program" >/dev/null; done
+for program in docker nginx openssl curl ss systemctl sha256sum; do command -v "$program" >/dev/null; done
 if [[ -e "$root" && ! -f "$root/.project" ]] && [[ -n "$(find "$root" -mindepth 1 -maxdepth 1 -print -quit)" ]]; then
   echo 'Refusing to reuse an unowned deployment directory.' >&2
   exit 2
@@ -55,8 +55,38 @@ chown 10001:10001 "$root/data" "$root/logs"
 install -d -m 700 "$release"
 PREPARE
 
-# Transport only tested images built without runtime credentials.
-docker save "$CHAT_IMAGE" "$CERTBOT_IMAGE" | gzip | run_ssh "bash -o pipefail -c 'gzip -dc | docker load'"
+# Verify the exact exported archive before loading. Classic and containerd image
+# stores can report different IDs for the same archive, so retain target IDs too.
+docker save "$CHAT_IMAGE" "$CERTBOT_IMAGE" | gzip > "$temporary/images.tar.gz"
+archive_sha=$(sha256sum "$temporary/images.tar.gz" | awk '{print $1}')
+scp "${ssh_options[@]}" "$temporary/images.tar.gz" "$target:$release/images.tar.gz"
+run_ssh bash -s -- "$root" "$release" "$archive_sha" "$CHAT_IMAGE" "$CERTBOT_IMAGE" "$SOURCE_COMMIT" <<'LOAD'
+set -Eeuo pipefail
+umask 077
+root=$1
+release=$2
+checksum=$3
+app_image=$4
+certbot_image=$5
+source_commit=$6
+[[ "$root" == /*/gray-logistics-chat && "$root" != *..* ]] || exit 2
+[[ "$release" == "$root"/releases/* && "$release" != *..* ]] || exit 2
+[[ "$(cat "$root/.project")" == baiyue-logistics-chat-gray ]] || exit 2
+[[ "$checksum" =~ ^[a-f0-9]{64}$ && "$source_commit" =~ ^[a-f0-9]{40}$ ]] || exit 2
+[[ "$app_image" =~ ^baiyue-logistics-chat-gray:[a-f0-9]{12}-b[0-9]+$ ]] || exit 2
+[[ "$certbot_image" =~ ^baiyue-logistics-chat-certbot:[a-f0-9]{12}-b[0-9]+$ ]] || exit 2
+printf '%s  %s\n' "$checksum" "$release/images.tar.gz" | sha256sum --check --status
+gzip -dc "$release/images.tar.gz" | docker load
+for image in "$app_image" "$certbot_image"; do
+  [[ "$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$image")" == "$source_commit" ]] || exit 2
+done
+app_id=$(docker image inspect --format '{{.Id}}' "$app_image")
+certbot_id=$(docker image inspect --format '{{.Id}}' "$certbot_image")
+[[ "$app_id" =~ ^sha256:[a-f0-9]{64}$ && "$certbot_id" =~ ^sha256:[a-f0-9]{64}$ ]] || exit 2
+printf 'ARCHIVE_SHA256=%s\nCHAT_IMAGE_ID=%s\nCERTBOT_IMAGE_ID=%s\n' "$checksum" "$app_id" "$certbot_id" > "$release/loaded-image-ids.env"
+rm -f -- "$release/images.tar.gz"
+echo 'Image archive checksum and source labels verified; target image IDs recorded.'
+LOAD
 scp "${ssh_options[@]}" "$temporary/release/"* "$target:$release/"
 run_ssh bash "$release/prepare-tls.sh" "$root" "$release"
 run_ssh bash "$release/activate.sh" "$root" "$release"