mirror of
https://github.com/hashicorp/vault.git
synced 2026-01-09 02:31:12 +01:00
720e942662
When verifying the Vault version, in addition to verifying the CLI version we also check that the `/sys/version-history` contains the expected version. As part of this we also fix a bug where when doing an in-place upgrade with a Debian or Redhat package we also remove the self-managed `vault.service` systemd unit to ensure that correctly start up using the new version of Vault. Signed-off-by: Ryan Cragun <me@ryan.ec>
48 lines
1.7 KiB
Bash
48 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
# Copyright (c) HashiCorp, Inc.
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
# Verify the Vault "version" includes the correct base version, build date,
|
|
# revision SHA, and edition metadata.
|
|
set -e
|
|
|
|
fail() {
|
|
echo "$1" 1>&2
|
|
exit 1
|
|
}
|
|
|
|
[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
|
|
[[ -z "$VAULT_BUILD_DATE" ]] && fail "VAULT_BUILD_DATE env variable has not been set"
|
|
[[ -z "$VAULT_EDITION" ]] && fail "VAULT_EDITION env variable has not been set"
|
|
[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
|
|
[[ -z "$VAULT_REVISION" ]] && fail "VAULT_REVISION env variable has not been set"
|
|
[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
|
|
[[ -z "$VAULT_VERSION" ]] && fail "VAULT_VERSION env variable has not been set"
|
|
|
|
binpath=${VAULT_INSTALL_DIR}/vault
|
|
edition=${VAULT_EDITION}
|
|
version=${VAULT_VERSION}
|
|
sha=${VAULT_REVISION}
|
|
build_date=${VAULT_BUILD_DATE}
|
|
|
|
test -x "$binpath" || fail "unable to locate vault binary at $binpath"
|
|
version_expected="Vault v$version ($sha), built $build_date"
|
|
|
|
case "$edition" in
|
|
*ce) ;;
|
|
*ent) ;;
|
|
*ent.hsm) version_expected="$version_expected (cgo)";;
|
|
*ent.fips1402) version_expected="$version_expected (cgo)" ;;
|
|
*ent.hsm.fips1402) version_expected="$version_expected (cgo)" ;;
|
|
*) fail "Unknown Vault edition: ($edition)" ;;
|
|
esac
|
|
|
|
version_expected_nosha=$(echo "$version_expected" | awk '!($3="")' | sed 's/ / /' | sed -e 's/[[:space:]]*$//')
|
|
version_output=$("$binpath" version)
|
|
|
|
if [[ "$version_output" == "$version_expected_nosha" ]] || [[ "$version_output" == "$version_expected" ]]; then
|
|
echo "Version verification succeeded!"
|
|
else
|
|
fail "expected Version=$version_expected or $version_expected_nosha, got: $version_output"
|
|
fi
|