tools/offline-check.sh

#!/usr/bin/env bash
# Restriction applies only to this check's children, not the user's network.
set -euo pipefail
cd -- "$(dirname -- "$0")/.."
case "${1-}" in
  "") export SPINE_PROBE_ONLY=false ;;
  --probe-only) export SPINE_PROBE_ONLY=true ;;
  *) printf 'Usage: %s [--probe-only]\n' "$0" >&2; exit 2 ;;
esac
case "$(uname -s)" in
  Linux)
    command -v unshare >/dev/null || { printf 'Missing unshare. Linux needs user/network namespaces.\n' >&2; exit 1; }
    isolation=(unshare --user --map-root-user --net)
    ;;
  Darwin)
    command -v sandbox-exec >/dev/null || { printf 'Missing sandbox-exec.\n' >&2; exit 1; }
    isolation=(sandbox-exec -p '(version 1) (allow default) (deny network*)')
    ;;
  *) printf 'Unsupported platform: %s\n' "$(uname -s)" >&2; exit 1 ;;
esac
command -v python3 >/dev/null || { printf 'Missing python3.\n' >&2; exit 1; }
if [[ "$SPINE_PROBE_ONLY" == false ]]; then
  for tool in go node pnpm; do
    command -v "$tool" >/dev/null || { printf 'Missing %s; prepare tools while online.\n' "$tool" >&2; exit 1; }
  done
  [[ -s dist/spine.wasm ]] || { printf 'Missing dist/spine.wasm; run make guest first.\n' >&2; exit 1; }
  [[ -x site/node_modules/.bin/astro ]] || { printf 'Missing site dependencies; run cd site && pnpm install --frozen-lockfile while online.\n' >&2; exit 1; }
fi
export GOPROXY=off GOSUMDB=off GOTOOLCHAIN=local
export npm_config_offline=true ASTRO_TELEMETRY_DISABLED=1
"${isolation[@]}" bash -eu -s <<'OFFLINE'
python3 - <<'PY'
import errno
import platform
import socket

expected = errno.ENETUNREACH if platform.system() == 'Linux' else errno.EPERM
with socket.socket() as sock:
    sock.settimeout(3)
    try:
        sock.connect(('1.1.1.1', 443))
    except OSError as error:
        if error.errno != expected:
            raise SystemExit(f'Unexpected network failure: {error}; expected errno {expected}')
        print(f'Verified: child network is unreachable (errno {error.errno}: {error.strerror})')
    else:
        raise SystemExit('Network unexpectedly available')
PY
if [[ "$SPINE_PROBE_ONLY" == true ]]; then
  printf 'Offline isolation probe passed.\n'
  exit 0
fi
make check
(cd site && pnpm build)
go run ./cmd/demo -source examples/order.py -plm
go run ./cmd/demo -source examples/order.py -prefix -prepared-copy
if [[ "$(uname -s)" == Linux ]]; then
  go run ./cmd/demo -source examples/order.py -prefix -prepared-cow
fi
printf 'Offline check passed with child networking denied.\n'
OFFLINE