luki-net/proxmox-scripts
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

K-114: input validation in build.func + mini CI (nexus-hub card)

Browse Source 
- validation helpers: sanitize_input trims CR/edge whitespace only;
  embedded control/non-ASCII bytes FAIL validation and re-prompt with a
  hint (2026-06-11 incident: invisible byte in a pasted VLAN tag broke
  pct create mid-run) - never silently stripped
- prompt_lxc_config: every prompt validated (uint for CTID/disk/cores/
  RAM, VLAN 1-4094, hostname/token formats, IP/CIDR/gateway, DNS list);
  env-provided values are sanitized + validated too (abort, no re-prompt
  loop in non-interactive use); helpers reusable for app prompts
- tests/test_validation.sh: 34 cases incl. the 2<0x80>0 repro, re-prompt
  simulation, BASH_REMATCH clobbering regression (is_cidr), env dry-run
  of prompt_lxc_config without PVE/TTY
- tests/check_ct_source.sh: every ct/*.sh must source build.func (bug
  shipped twice); negative proof via prepared fixture in the test suite
- .gitea/workflows/ci.yml: bash -n over all scripts, source-check,
  validation tests, shellcheck if present (documented skip otherwise)
- README: contributions via PR with cross-review (binding)
This commit is contained in:
l.kirchner
2026-06-12 03:14:32 +02:00
parent cad741a97c
commit 80e2ec04ff
5 changed files with 347 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+46
View File
@@ -0,0 +1,46 @@
name: CI
# K-114 (nexus-hub): Mini-CI für proxmox-scripts — Syntax, build.func-Source-
# Pflicht und Validierungs-Unit-Tests. Läuft auf dem nexus-Runner (Host-Mode).
on:
push:
branches: [main]
pull_request:
jobs:
lint:
name: Shell-Lint (bash -n, source-check, Validierungs-Tests)
runs-on: nexus
steps:
- name: Checkout
uses: actions/checkout@v4
- name: bash -n über alle Scripts
run: |
status=0
for f in ct/*.sh install/*.sh lib/*.func tests/*.sh; do
if bash -n "$f"; then
echo "ok $f"
else
echo "SYNTAX $f" >&2
status=1
fi
done
exit "$status"
- name: build.func-Source-Check (jedes ct/*.sh)
run: bash tests/check_ct_source.sh
- name: Validierungs-Unit-Tests (lib/build.func)
run: bash tests/test_validation.sh
- name: shellcheck (falls auf dem Runner installiert)
run: |
if command -v shellcheck >/dev/null 2>&1; then
# -S warning: Style-Hinweise nicht blockierend; externe Sources
# (curl|source) kann shellcheck nicht folgen.
shellcheck -S warning -e SC1090,SC1091 ct/*.sh install/*.sh tests/*.sh
else
echo "shellcheck nicht installiert — übersprungen (dokumentiert, K-114)"
fi
README.md
+6
View File
@@ -24,6 +24,12 @@ CTID=200 HOSTNAME=devpi DISK_SIZE=30 RAM=4096 CORES=4 IPCFG=dhcp \
All defaults (`DEFAULT_HOSTNAME`, `DEFAULT_DISK`, …) are settable per-call via env vars as well. All defaults (`DEFAULT_HOSTNAME`, `DEFAULT_DISK`, …) are settable per-call via env vars as well.
## Contributing (verbindlich seit K-114)
**Alle Änderungen laufen als PR mit Cross-Review** — keine Direkt-Commits auf `main`. Hintergrund: Der „`build.func` nicht gesourct"-Bug hat es einmal bis in die Produktion geschafft (authentik-Anlage), während dieselbe Fehlerklasse im nexus-db-PR vom Review gefangen wurde. Die CI (`.gitea/workflows/ci.yml`, Runner-Label `nexus`) erzwingt zusätzlich: `bash -n` über alle Scripts, „jedes `ct/*.sh` sourct `build.func`" (`tests/check_ct_source.sh`) und die Validierungs-Unit-Tests (`tests/test_validation.sh`).
Eingaben in `prompt_lxc_config` sind validiert (Ziffern-Checks, IP/CIDR/Gateway-Format, Re-Prompt bei unsichtbaren Steuer-/Non-ASCII-Zeichen — Lesson vom 2026-06-11). Neue App-Prompts bitte über `prompt_validated`/`require_valid` aus `lib/build.func` bauen statt nacktem `read`.
## Repo layout ## Repo layout
``` ```
lib/build.func
+134 -22
View File
@@ -97,55 +97,166 @@ apply_network_profile() {
return 0 return 0
} }
# ── input validation (K-114) ─────────────────────────────────────────────────
# Real incident 2026-06-11: a pasted VLAN tag carried an invisible non-UTF-8
# byte and broke `pct create` deep in the run. Policy: trim CR/edge whitespace,
# but NEVER silently strip junk inside a value — embedded control/non-ASCII
# bytes fail validation and trigger a visible re-prompt.
# Trim \r and leading/trailing whitespace (edges only).
sanitize_input() {
local s="${1-}"
s="${s//$'\r'/}"
s="${s#"${s%%[![:space:]]*}"}"
s="${s%"${s##*[![:space:]]}"}"
printf '%s' "$s"
}
# True if the value contains only printable ASCII (no control/non-ASCII
# bytes). Byte-exact via tr: delete all printable ASCII — anything left
# over is junk.
is_clean_ascii() {
local leftover
leftover="$(printf '%s' "$1" | LC_ALL=C tr -d '\40-\176')"
[[ -z "$leftover" ]]
}
is_uint() { is_clean_ascii "$1" && [[ "$1" =~ ^[0-9]+$ ]]; }
is_vlan_tag() { is_uint "$1" && (( $1 >= 1 && $1 <= 4094 )); }
is_token() { is_clean_ascii "$1" && [[ "$1" =~ ^[A-Za-z0-9._-]+$ ]]; }
is_hostname() { is_clean_ascii "$1" && [[ "$1" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$ ]]; }
is_ipv4() {
is_clean_ascii "$1" && [[ "$1" =~ ^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$ ]] || return 1
local o
for o in "${BASH_REMATCH[@]:1:4}"; do (( o <= 255 )) || return 1; done
return 0
}
is_cidr() {
[[ "$1" =~ ^([0-9.]+)/([0-9]{1,2})$ ]] || return 1
# BASH_REMATCH retten — is_ipv4 nutzt selbst =~ und überschreibt es.
local _ip="${BASH_REMATCH[1]}" _prefix="${BASH_REMATCH[2]}"
is_ipv4 "$_ip" && (( _prefix >= 1 && _prefix <= 32 ))
}
is_ipcfg() { [[ "$1" == "dhcp" ]] || is_cidr "$1"; }
# Space/comma-separated list of IPv4s (DNS prompt).
is_ipv4_list() {
local item
for item in ${1//,/ }; do is_ipv4 "$item" || return 1; done
[[ -n "$1" ]]
}
# prompt_validated VARNAME PROMPT VALIDATOR [DEFAULT] [allow_empty]
# Reads into VARNAME (nameref, no subshell), sanitizes, applies the default on
# empty input and re-prompts until the validator passes. allow_empty=yes lets
# an empty value through (e.g. "no VLAN").
prompt_validated() {
local -n _pv_ref="$1"
local _pv_prompt="$2" _pv_validator="$3" _pv_default="${4-}" _pv_allow_empty="${5:-no}"
local _pv_value
while true; do
read -rp "$_pv_prompt" _pv_value
_pv_value="$(sanitize_input "$_pv_value")"
if [[ -z "$_pv_value" && -n "$_pv_default" ]]; then
_pv_value="$_pv_default"
fi
if [[ -z "$_pv_value" ]]; then
if [[ "$_pv_allow_empty" == "yes" ]]; then _pv_ref=""; return 0; fi
msg_warn "A value is required."
continue
fi
if "$_pv_validator" "$_pv_value"; then
_pv_ref="$_pv_value"
return 0
fi
if ! is_clean_ascii "$_pv_value"; then
msg_warn "Input contains invisible/non-ASCII characters — please re-type (do not paste)."
else
msg_warn "Invalid value: '$_pv_value' — please retry."
fi
done
}
# Validate an env-provided value (non-interactive: abort instead of re-prompt).
require_valid() {
local -n _rv_ref="$1"
local _rv_validator="$2" _rv_label="$3"
_rv_ref="$(sanitize_input "$_rv_ref")"
"$_rv_validator" "$_rv_ref" || { msg_err "$_rv_label invalid: '$_rv_ref'"; exit 1; }
}
# ── prompts ────────────────────────────────────────────────────────────────── # ── prompts ──────────────────────────────────────────────────────────────────
# Each prompt is skipped if the corresponding variable is already set in env. # Each prompt is skipped if the corresponding variable is already set in env
# (env values are still validated — abort on invalid, no silent use).
# VLAN_TAG and NAMESERVER use ${VAR+x} so that explicitly setting them to "" # VLAN_TAG and NAMESERVER use ${VAR+x} so that explicitly setting them to ""
# via env skips the prompt (= "no VLAN" / "inherit DNS from host"). # via env skips the prompt (= "no VLAN" / "inherit DNS from host").
prompt_lxc_config() { prompt_lxc_config() {
if [[ -z "${CTID:-}" ]]; then if [[ -z "${CTID:-}" ]]; then
read -rp "Container ID [auto]: " CTID read -rp "Container ID [auto]: " CTID
CTID="$(sanitize_input "$CTID")"
[[ -z "${CTID:-}" ]] && CTID=$(pvesh get /cluster/nextid) [[ -z "${CTID:-}" ]] && CTID=$(pvesh get /cluster/nextid)
fi fi
require_valid CTID is_uint "Container ID"
echo " → CTID: $CTID" echo " → CTID: $CTID"
if [[ -z "${CT_HOSTNAME:-}" ]]; then if [[ -z "${CT_HOSTNAME:-}" ]]; then
read -rp "Hostname [$DEFAULT_HOSTNAME]: " CT_HOSTNAME prompt_validated CT_HOSTNAME "Hostname [$DEFAULT_HOSTNAME]: " is_hostname "$DEFAULT_HOSTNAME"
CT_HOSTNAME="${CT_HOSTNAME:-$DEFAULT_HOSTNAME}" else
require_valid CT_HOSTNAME is_hostname "Hostname"
fi fi
if [[ -z "${DISK_SIZE:-}" ]]; then if [[ -z "${DISK_SIZE:-}" ]]; then
read -rp "Disk size in GB [$DEFAULT_DISK]: " DISK_SIZE prompt_validated DISK_SIZE "Disk size in GB [$DEFAULT_DISK]: " is_uint "$DEFAULT_DISK"
DISK_SIZE="${DISK_SIZE:-$DEFAULT_DISK}" else
require_valid DISK_SIZE is_uint "Disk size"
fi fi
if [[ -z "${CORES:-}" ]]; then if [[ -z "${CORES:-}" ]]; then
read -rp "vCPU cores [$DEFAULT_CORES]: " CORES prompt_validated CORES "vCPU cores [$DEFAULT_CORES]: " is_uint "$DEFAULT_CORES"
CORES="${CORES:-$DEFAULT_CORES}" else
require_valid CORES is_uint "vCPU cores"
fi fi
if [[ -z "${RAM:-}" ]]; then if [[ -z "${RAM:-}" ]]; then
read -rp "RAM in MB [$DEFAULT_RAM]: " RAM prompt_validated RAM "RAM in MB [$DEFAULT_RAM]: " is_uint "$DEFAULT_RAM"
RAM="${RAM:-$DEFAULT_RAM}" else
require_valid RAM is_uint "RAM"
fi fi
if [[ -z "${BRIDGE:-}" ]]; then if [[ -z "${BRIDGE:-}" ]]; then
read -rp "Bridge [$DEFAULT_BRIDGE]: " BRIDGE prompt_validated BRIDGE "Bridge [$DEFAULT_BRIDGE]: " is_token "$DEFAULT_BRIDGE"
BRIDGE="${BRIDGE:-$DEFAULT_BRIDGE}" else
require_valid BRIDGE is_token "Bridge"
fi fi
if [[ -z "${VLAN_TAG+x}" ]]; then if [[ -z "${VLAN_TAG+x}" ]]; then
read -rp "VLAN tag (empty for none): " VLAN_TAG # The 2026-06-11 incident prompt: junk bytes re-prompt, empty = no VLAN.
prompt_validated VLAN_TAG "VLAN tag (empty for none): " is_vlan_tag "" yes
elif [[ -n "${VLAN_TAG:-}" ]]; then
require_valid VLAN_TAG is_vlan_tag "VLAN tag"
fi fi
if [[ -z "${TEMPLATE_STORAGE:-}" ]]; then if [[ -z "${TEMPLATE_STORAGE:-}" ]]; then
read -rp "Template storage [$DEFAULT_TEMPLATE_STORAGE]: " TEMPLATE_STORAGE prompt_validated TEMPLATE_STORAGE \
TEMPLATE_STORAGE="${TEMPLATE_STORAGE:-$DEFAULT_TEMPLATE_STORAGE}" "Template storage [$DEFAULT_TEMPLATE_STORAGE]: " is_token "$DEFAULT_TEMPLATE_STORAGE"
else
require_valid TEMPLATE_STORAGE is_token "Template storage"
fi fi
if [[ -z "${ROOTFS_STORAGE:-}" ]]; then if [[ -z "${ROOTFS_STORAGE:-}" ]]; then
read -rp "Rootfs storage [$DEFAULT_ROOTFS_STORAGE]: " ROOTFS_STORAGE prompt_validated ROOTFS_STORAGE \
ROOTFS_STORAGE="${ROOTFS_STORAGE:-$DEFAULT_ROOTFS_STORAGE}" "Rootfs storage [$DEFAULT_ROOTFS_STORAGE]: " is_token "$DEFAULT_ROOTFS_STORAGE"
else
require_valid ROOTFS_STORAGE is_token "Rootfs storage"
fi fi
if [[ -z "${IPCFG:-}" ]]; then if [[ -z "${IPCFG:-}" ]]; then
read -rp "Network: IP/CIDR or 'dhcp' [dhcp]: " IPCFG prompt_validated IPCFG "Network: IP/CIDR or 'dhcp' [dhcp]: " is_ipcfg "dhcp"
IPCFG="${IPCFG:-dhcp}" else
require_valid IPCFG is_ipcfg "Network (IP/CIDR or dhcp)"
fi fi
GATEWAY="${GATEWAY:-}" GATEWAY="${GATEWAY:-}"
if [[ "$IPCFG" != "dhcp" && -z "$GATEWAY" ]]; then if [[ "$IPCFG" != "dhcp" ]]; then
read -rp "Gateway: " GATEWAY if [[ -z "$GATEWAY" ]]; then
prompt_validated GATEWAY "Gateway: " is_ipv4
else
require_valid GATEWAY is_ipv4 "Gateway"
fi
fi fi
# DNS is driven by the VLAN tag via the network profile (lib/networks.conf), # DNS is driven by the VLAN tag via the network profile (lib/networks.conf),
# so the right resolvers get set even with DHCP. Precedence: # so the right resolvers get set even with DHCP. Precedence:
@@ -161,8 +272,9 @@ prompt_lxc_config() {
msg_info "DNS for VLAN ${VLAN_TAG:-none} (${PROFILE_SUBNET:-?}): $NAMESERVER" msg_info "DNS for VLAN ${VLAN_TAG:-none} (${PROFILE_SUBNET:-?}): $NAMESERVER"
elif [[ "$IPCFG" != "dhcp" ]]; then elif [[ "$IPCFG" != "dhcp" ]]; then
local default_ns="${DEFAULT_NAMESERVER:-$GATEWAY}" local default_ns="${DEFAULT_NAMESERVER:-$GATEWAY}"
read -rp "DNS server [$default_ns] (empty = inherit from PVE host): " NAMESERVER prompt_validated NAMESERVER \
NAMESERVER="${NAMESERVER:-$default_ns}" "DNS server [$default_ns] (empty = inherit from PVE host): " \
is_ipv4_list "$default_ns" yes
else else
msg_warn "No network profile for VLAN ${VLAN_TAG:-none}; DHCP DNS will be inherited." msg_warn "No network profile for VLAN ${VLAN_TAG:-none}; DHCP DNS will be inherited."
fi fi
tests/check_ct_source.sh
Executable
+26
View File
@@ -0,0 +1,26 @@
#!/usr/bin/env bash
# K-114: Jedes ct/*.sh MUSS lib/build.func sourcen — der Bug "Helfer nicht
# gesourct, Skript stirbt erst mitten im Lauf" ist zweimal real passiert
# (nexus-db: im Review gefangen; authentik: erst in Produktion).
# Aufruf: tests/check_ct_source.sh [verzeichnis] (Default: ct/)
set -euo pipefail
DIR="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/ct}"
status=0
shopt -s nullglob
scripts=("$DIR"/*.sh)
if [[ ${#scripts[@]} -eq 0 ]]; then
echo "no scripts found in $DIR" >&2
exit 1
fi
for script in "${scripts[@]}"; do
if grep -Eq 'source[[:space:]]+<\(curl[^)]*build\.func' "$script"; then
echo "ok $script"
else
echo "FEHLT $script — sourct lib/build.func nicht" >&2
status=1
fi
done
exit "$status"
tests/test_validation.sh
Executable
+135
View File
@@ -0,0 +1,135 @@
#!/usr/bin/env bash
# K-114: Unit-Tests für die Input-Validierung in lib/build.func.
# Läuft ohne PVE (sourct nur die Helfer). Aufruf: bash tests/test_validation.sh
set -u
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=/dev/null
source "$REPO_ROOT/lib/build.func"
PASS=0
FAIL=0
ok() { PASS=$((PASS + 1)); echo "ok - $1"; }
nok() { FAIL=$((FAIL + 1)); echo "NOT OK - $1"; }
assert_true() { # assert_true "desc" cmd args...
local desc="$1"; shift
if "$@"; then ok "$desc"; else nok "$desc"; fi
}
assert_false() {
local desc="$1"; shift
if "$@"; then nok "$desc"; else ok "$desc"; fi
}
# ── Repro des Vorfalls vom 2026-06-11: VLAN-Tag mit unsichtbarem Byte ────────
JUNK_VLAN="$(printf '2\x800')" # "20" mit eingebettetem Non-UTF-8-Byte
assert_false "VLAN-Repro: '2<0x80>0' wird abgelehnt (kein silent strip)" is_vlan_tag "$JUNK_VLAN"
assert_false "is_clean_ascii erkennt eingebettetes Junk-Byte" is_clean_ascii "$JUNK_VLAN"
# Re-Prompt-Verhalten: erste Eingabe ist der Junk-Wert, zweite ist sauber —
# prompt_validated muss die zweite liefern (AC: Re-Prompt statt pct-Fehler).
reprompt_result="$(
printf '%s\n20\n' "$JUNK_VLAN" | {
VLAN=""
prompt_validated VLAN "VLAN tag (empty for none): " is_vlan_tag "" yes >/dev/null 2>&1
printf '%s' "$VLAN"
}
)"
if [[ "$reprompt_result" == "20" ]]; then
ok "prompt_validated re-promptet bei Junk und akzeptiert dann '20'"
else
nok "prompt_validated re-promptet bei Junk (got: '$reprompt_result')"
fi
# ── sanitize_input: CR + Rand-Whitespace weg, Inhalt unangetastet ─────────────
[[ "$(sanitize_input $' 42\r\n')" == "42" ]] && ok "sanitize_input trimmt CR/Whitespace" \
|| nok "sanitize_input trimmt CR/Whitespace"
[[ "$(sanitize_input "$JUNK_VLAN")" == "$JUNK_VLAN" ]] && ok "sanitize_input strippt KEIN eingebettetes Junk (Validator soll es sehen)" \
|| nok "sanitize_input lässt eingebettetes Junk unangetastet"
# ── numerische Validatoren ────────────────────────────────────────────────────
assert_true "is_uint akzeptiert 8" is_uint "8"
assert_false "is_uint lehnt '8 ' mit Junk ab" is_uint "$(printf '8\x01')"
assert_false "is_uint lehnt 'abc' ab" is_uint "abc"
assert_false "is_uint lehnt leeren Wert ab" is_uint ""
assert_true "is_vlan_tag akzeptiert 20" is_vlan_tag "20"
assert_false "is_vlan_tag lehnt 0 ab" is_vlan_tag "0"
assert_false "is_vlan_tag lehnt 5000 ab" is_vlan_tag "5000"
# ── Netz-Validatoren ──────────────────────────────────────────────────────────
assert_true "is_ipv4 akzeptiert 10.11.20.66" is_ipv4 "10.11.20.66"
assert_false "is_ipv4 lehnt 10.11.20.666 ab" is_ipv4 "10.11.20.666"
assert_false "is_ipv4 lehnt 10.11.20 ab" is_ipv4 "10.11.20"
assert_true "is_cidr akzeptiert 10.11.20.5/24" is_cidr "10.11.20.5/24"
assert_false "is_cidr lehnt 10.11.20.5/33 ab" is_cidr "10.11.20.5/33"
assert_false "is_cidr lehnt 10.11.20.5 ohne Maske" is_cidr "10.11.20.5"
assert_true "is_ipcfg akzeptiert dhcp" is_ipcfg "dhcp"
assert_true "is_ipcfg akzeptiert CIDR" is_ipcfg "192.168.0.7/24"
assert_false "is_ipcfg lehnt 'static' ab" is_ipcfg "static"
assert_true "is_ipv4_list akzeptiert Liste" is_ipv4_list "1.1.1.1, 8.8.8.8"
assert_false "is_ipv4_list lehnt Hostnamen ab" is_ipv4_list "dns.local"
# ── Namen/Token ───────────────────────────────────────────────────────────────
assert_true "is_hostname akzeptiert nexus-db" is_hostname "nexus-db"
assert_false "is_hostname lehnt '-bad' ab" is_hostname "-bad"
assert_false "is_hostname lehnt 'a b' ab" is_hostname "a b"
assert_true "is_token akzeptiert local-lvm" is_token "local-lvm"
assert_false "is_token lehnt 'a;b' ab" is_token "a;b"
# ── require_valid: env-Werte werden sanitisiert + geprüft ────────────────────
CHECKVAL=$' 7\r'
require_valid CHECKVAL is_uint "Testwert" && [[ "$CHECKVAL" == "7" ]] \
&& ok "require_valid sanitisiert env-Wert (CR weg)" \
|| nok "require_valid sanitisiert env-Wert"
( CHECKBAD="$JUNK_VLAN"; require_valid CHECKBAD is_uint "Testwert" ) >/dev/null 2>&1 \
&& nok "require_valid bricht bei Junk-env-Wert ab" \
|| ok "require_valid bricht bei Junk-env-Wert ab (exit != 0)"
# ── Negativ-Beweis: build.func-Source-Check schlägt bei Präparat an ──────────
TMPDIR_CT="$(mktemp -d)"
cat >"$TMPDIR_CT/broken.sh" <<'EOF'
#!/usr/bin/env bash
# absichtlich ohne source build.func (Repro des zweimal aufgetretenen Bugs)
APP="broken"
prompt_lxc_config
EOF
if bash "$REPO_ROOT/tests/check_ct_source.sh" "$TMPDIR_CT" >/dev/null 2>&1; then
nok "check_ct_source.sh erkennt fehlendes 'source build.func'"
else
ok "check_ct_source.sh erkennt fehlendes 'source build.func'"
fi
rm -rf "$TMPDIR_CT"
# Positiv: das echte ct/-Verzeichnis ist sauber.
if bash "$REPO_ROOT/tests/check_ct_source.sh" "$REPO_ROOT/ct" >/dev/null 2>&1; then
ok "alle ct/*.sh sourcen build.func"
else
nok "alle ct/*.sh sourcen build.func"
fi
# ── Dry-Run: prompt_lxc_config komplett aus env, ohne PVE/TTY ────────────────
smoke_out="$(
env CTID=999 CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm \
IPCFG=10.11.20.99/24 GATEWAY=10.11.20.1 NAMESERVER="" \
NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK"
)" || true
[[ "$smoke_out" == *SMOKE-OK* ]] \
&& ok "prompt_lxc_config Dry-Run mit validen env-Werten läuft durch" \
|| nok "prompt_lxc_config Dry-Run (got: '$smoke_out')"
smoke_bad="$(
env CTID="$(printf '9\x809')" CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm IPCFG=dhcp NAMESERVER="" \
NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK" 2>/dev/null
)" || true
[[ "$smoke_bad" == *SMOKE-OK* ]] \
&& nok "prompt_lxc_config bricht bei Junk-CTID aus env ab" \
|| ok "prompt_lxc_config bricht bei Junk-CTID aus env ab"
echo
echo "passed=$PASS failed=$FAIL"
[[ "$FAIL" -eq 0 ]]