Comment-only change to cronjobs to clarify our general error checking strategy in relation to PR382 (#383)

Comment-only change to cronjobs to clarify our general error checking
strategy and explain why we sometimes choose to deviate from it. Tries
to capture the central points from a longer internal discussion in
relation to issue #381 and the fix in PR #382.

Adds the missing fixture for the existing miglustrequota cronjob.

Author: jonasbardino

mig/install/migcheckssl-template.sh.cronjob

@@ -20,6 +20,10 @@
 # NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
 # best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
 # exit midway, so it can be a trade-off.
+# IMPORTANT: we currently opt for manual exit code checks here since we deem
+# the consequences of an early script exit worse.
+# TODO: introduce individual exit code checks and re-enable '-eE' below?
+#set -eEuo pipefail
 set -uo pipefail
 
 # Send output to another email address

mig/install/migimportdoi-template.sh.cronjob

@@ -2,9 +2,12 @@
 #
 # run importdoi as mig user
 
-# Force bash to handle uninitialized variables and errors
+# By default bash silently ignores and continues on most errors but we can set
+# options to e.g. catch uninitialized variables and errors as explained in:
 # https://vaneyckt.io/posts/safer_bash_scripts_with_set_euxo_pipefail/
-# NOTE: 'set -eE' exits on failure, which is good when we handle all errors
+# NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
+# best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
+# exit midway, so it can be a trade-off.
 set -eEuo pipefail
 
 # Add any custom domains to lookup DOIs for here and format according to

mig/install/migindexdoi-template.sh.cronjob

@@ -2,9 +2,12 @@
 #
 # run indexdoi as mig user
 
-# Force bash to handle uninitialized variables and errors
+# By default bash silently ignores and continues on most errors but we can set
+# options to e.g. catch uninitialized variables and errors as explained in:
 # https://vaneyckt.io/posts/safer_bash_scripts_with_set_euxo_pipefail/
-# NOTE: 'set -eE' exits on failure, which is good when we handle all errors
+# NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
+# best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
+# exit midway, so it can be a trade-off.
 set -eEuo pipefail
 
 

mig/install/miglustrequota-template.sh.cronjob

@@ -12,8 +12,12 @@
 # This is a limitation on the run-parts wrapper used by cron
 # (see man run-parts for the rationale behind this).
 
-# Force bash to handle uninitialized variables and errors
+# By default bash silently ignores and continues on most errors but we can set
+# options to e.g. catch uninitialized variables and errors as explained in:
 # https://vaneyckt.io/posts/safer_bash_scripts_with_set_euxo_pipefail/
+# NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
+# best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
+# exit midway, so it can be a trade-off.
 set -eEuo pipefail
 
 # Send output to another email address

mig/install/migverifyarchives-template.sh.cronjob

@@ -7,9 +7,15 @@
 # any effect. Basically the ready-finalized-YYYYMMDD.txt files in archivestaging
 # must be filled with root paths of pending archives to check.
 
-# Force bash to handle uninitialized variables and errors
+# By default bash silently ignores and continues on most errors but we can set
+# options to e.g. catch uninitialized variables and errors as explained in:
 # https://vaneyckt.io/posts/safer_bash_scripts_with_set_euxo_pipefail/
-# NOTE: 'set -eE' exits on failure, good for debug but we want to handle errors
+# NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
+# best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
+# exit midway, so it can be a trade-off.
+# IMPORTANT: we currently opt for manual exit code checks here since we deem
+# the consequences of an early script exit worse.
+# TODO: introduce individual exit code checks and re-enable '-eE' below?
 #set -eEuo pipefail
 set -uo pipefail
 

tests/fixture/confs-stdlocal/migcheckssl

@@ -20,6 +20,10 @@
 # NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
 # best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
 # exit midway, so it can be a trade-off.
+# IMPORTANT: we currently opt for manual exit code checks here since we deem
+# the consequences of an early script exit worse.
+# TODO: introduce individual exit code checks and re-enable '-eE' below?
+#set -eEuo pipefail
 set -uo pipefail
 
 # Send output to another email address

tests/fixture/confs-stdlocal/migimportdoi

@@ -2,9 +2,12 @@
 #
 # run importdoi as mig user
 
-# Force bash to handle uninitialized variables and errors
+# By default bash silently ignores and continues on most errors but we can set
+# options to e.g. catch uninitialized variables and errors as explained in:
 # https://vaneyckt.io/posts/safer_bash_scripts_with_set_euxo_pipefail/
-# NOTE: 'set -eE' exits on failure, which is good when we handle all errors
+# NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
+# best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
+# exit midway, so it can be a trade-off.
 set -eEuo pipefail
 
 # Add any custom domains to lookup DOIs for here and format according to

tests/fixture/confs-stdlocal/migindexdoi

@@ -2,9 +2,12 @@
 #
 # run indexdoi as mig user
 
-# Force bash to handle uninitialized variables and errors
+# By default bash silently ignores and continues on most errors but we can set
+# options to e.g. catch uninitialized variables and errors as explained in:
 # https://vaneyckt.io/posts/safer_bash_scripts_with_set_euxo_pipefail/
-# NOTE: 'set -eE' exits on failure, which is good when we handle all errors
+# NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
+# best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
+# exit midway, so it can be a trade-off.
 set -eEuo pipefail
 
 

tests/fixture/confs-stdlocal/miglustrequota

@@ -0,0 +1,62 @@
+#!/bin/bash
+#
+# Run lustre quota for MiG servers
+#
+# The script depends on a miglustrequota setup
+# (please refer to mig/src/pylustrequota/README).
+#
+# IMPORTANT: if placed in /etc/cron.X the script filename must be
+# something consisting entirely of upper and lower case letters, digits,
+# underscores, and hyphens. I.e. if the script name contains e.g. a period,
+# '.', it will be silently ignored!
+# This is a limitation on the run-parts wrapper used by cron
+# (see man run-parts for the rationale behind this).
+
+# By default bash silently ignores and continues on most errors but we can set
+# options to e.g. catch uninitialized variables and errors as explained in:
+# https://vaneyckt.io/posts/safer_bash_scripts_with_set_euxo_pipefail/
+# NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
+# best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
+# exit midway, so it can be a trade-off.
+set -eEuo pipefail
+
+# Send output to another email address
+#MAILTO="root"
+
+MIG_CONF=/home/mig/mig/server/MiGserver.conf
+
+# Specify if migrid runs natively or inside containers with lustre at host.
+# Value is the container manager (docker, podman, or empty string for none)
+container_manager=""
+container="migrid-lustre-quota"
+
+# Look in miglustrequota install dir first
+export PATH="/usr/local/bin:${PATH}"
+
+if [[ $(id -u) -ne 0 ]]; then
+    echo "Please run $0 as root"
+    exit 1
+fi
+
+if [ -z "${container_manager}" ]; then
+    miglustrequota=$(which "miglustrequota.py" 2>/dev/null)
+    if [ ! -x "${miglustrequota}" ]; then
+        echo "ERROR: Missing miglustrequota.py"
+        exit 1
+    fi
+    quota_cmd="${miglustrequota} -c ${MIG_CONF}" 
+else
+    check_cmd="${container_manager} container ls -a | grep -q '${container}'"
+    eval "$check_cmd"
+    ret=$?
+    if [ "$ret" -ne 0 ]; then
+        echo "ERROR: Missing ${container} container"
+        exit 1
+    fi
+    quota_cmd="${container_manager} start -a ${container}"
+fi
+
+eval "$quota_cmd"
+ret=$?
+
+exit $ret

tests/fixture/confs-stdlocal/migverifyarchives

@@ -7,9 +7,15 @@
 # any effect. Basically the ready-finalized-YYYYMMDD.txt files in archivestaging
 # must be filled with root paths of pending archives to check.
 
-# Force bash to handle uninitialized variables and errors
+# By default bash silently ignores and continues on most errors but we can set
+# options to e.g. catch uninitialized variables and errors as explained in:
 # https://vaneyckt.io/posts/safer_bash_scripts_with_set_euxo_pipefail/
-# NOTE: 'set -eE' exits on failure, good for debug but we want to handle errors
+# NOTE: 'set -eE' exits on non-zero exit codes to add safety and as recommended
+# best-practice (CWE-252, CWE-248, ...), yet, in some cases it hurts more to
+# exit midway, so it can be a trade-off.
+# IMPORTANT: we currently opt for manual exit code checks here since we deem
+# the consequences of an early script exit worse.
+# TODO: introduce individual exit code checks and re-enable '-eE' below?
 #set -eEuo pipefail
 set -uo pipefail