From 9f78b151c12ebc3472daee1934594e315dc4961c Mon Sep 17 00:00:00 2001 From: caoqianming Date: Sat, 11 Jul 2026 10:04:23 +0800 Subject: [PATCH] =?UTF-8?q?fix(sandbox):=20round-3=20=E6=8E=A2=E9=92=88?= =?UTF-8?q?=E6=94=B9=20pinned=20=E7=89=88=E6=9C=AC=E7=9B=B4=E4=B8=8B,?= =?UTF-8?q?=E7=BB=95=E5=BC=80=E8=A2=AB=E5=A2=99=E7=9A=84=E7=89=88=E6=9C=AC?= =?UTF-8?q?=E8=A7=A3=E6=9E=90(bump=200.58.7)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @stable tag 要先访问 Google last-known-good 版本解析端点(被墙)才换到具体 版本号,--base-url 只管二进制下载不管解析 —— 这是上一轮三源全败的真因。 改从镜像内 puppeteer-core revisions.js 读 pinned chrome-headless-shell 版本 直下阿里 binary 源(且正是 mermaid-cli CI 实测版本);错误输出 grep Error 行; 加 [步骤] 参数支持只跑第 3 步(1/2 已有结论:静默 CHECK 无 FATAL、栈无符号、 CPU 无 pku/shstk/ibt)。 Co-Authored-By: Claude Fable 5 --- PROGRESS.md | 3 ++- core/__init__.py | 2 +- deploy/sandbox/probe_chromium_round3.sh | 31 +++++++++++++++++-------- 3 files changed, 24 insertions(+), 12 deletions(-) diff --git a/PROGRESS.md b/PROGRESS.md index 5b6d4d6..cb0427c 100644 --- a/PROGRESS.md +++ b/PROGRESS.md @@ -2,7 +2,7 @@ > 配合 `DESIGN.md`。本文件只记 phase 状态、决策偏差、文件量、下一步。每条 1-2 句:做了啥 + 关键判断;细节查 `git log` / `git diff` / `DESIGN §7.9`。 -最后更新:2026-07-11(round-3 探针下载源改阿里,bump 0.58.6) +最后更新:2026-07-11(round-3 探针改 pinned 版本直下,绕开被墙的版本解析端点,bump 0.58.7) --- @@ -23,6 +23,7 @@ ### 2026-07 +- **07-11 / 0.58.7**:round-3 第 3 步改从镜像内 puppeteer-core `revisions.js` 读 pinned 版本号直下(`@stable` tag 需先访问 Google 版本解析端点——被墙,上一轮三源全败的真因;`--base-url` 只管二进制不管解析),错误输出改 grep Error 行;加 `[步骤]` 参数支持只跑第 3 步。round-1/2 结论沉淀:崩溃无 FATAL 行(静默 CHECK)、gdb 栈无符号、CPU 无 pku/shstk/ibt(排除新安全特性交互)。 - **07-11 / 0.58.6**:round-3 探针下载源修正——npx 拉 `@puppeteer/browsers` 显式走阿里 npm registry,chrome-for-testing 二进制按 阿里 CDN → 阿里 registry binary → 官方 三级 fallback(服务器实测默认源下不动)。 - **07-11 / 0.58.5**:**chromium 秒崩 round-3 探针**:bisect 结果全 case FAIL(含 baseline 无 hardening、seccomp=unconfined)→ hardening 全部无罪,宿主 overcommit/ulimit 数据也干净——嫌疑收敛为 trixie chromium 150 构建 × 本宿主组合本身跑不了。新 `deploy/sandbox/probe_chromium_round3.sh`:①抓崩溃 FATAL 行(此前日志被 head 截断)+ gdb backtrace(best-effort);②实测 Google 官方 chrome-headless-shell(npmmirror 下载,puppeteer 生态对着它测试)在本宿主能否跑 + mmdc 接上出图——直接验证「镜像弃发行版 chromium 改 pinned headless shell」修法可行性,PASS 即定案动 Dockerfile。 - **07-11 / 0.58.4**:**mermaid 崩塌第二根因排查工具 `deploy/sandbox/probe_chromium_bisect.sh`**:pids-limit 1024 部署后复测(同 task 9dcae061,green 实例全新容器)仍首调秒崩——排除 pids 打满,根因在 hardening flag × chromium 150 交互。探针把线上 docker run 全款 hardening 逐 flag 开关(no-new-privileges / read-only / cap-drop / mem·cpu / seccomp=unconfined),每 case 跑 mmdc + 裸 chromium 两条,忠实复现 exec 路径(--user zcbot + HOME=/tmp),尾部带判读表;RUN.md 故障兜底条目同步。 diff --git a/core/__init__.py b/core/__init__.py index db5054f..d754516 100644 --- a/core/__init__.py +++ b/core/__init__.py @@ -1,3 +1,3 @@ # zcbot 版本号单一事实源:web/app.py 的 FastAPI version、/healthz 返回、前端展示都引这里。 # 改版本只动这一行。 -__version__ = "0.58.6" +__version__ = "0.58.7" diff --git a/deploy/sandbox/probe_chromium_round3.sh b/deploy/sandbox/probe_chromium_round3.sh index b0c21d2..0c8e4ef 100644 --- a/deploy/sandbox/probe_chromium_round3.sh +++ b/deploy/sandbox/probe_chromium_round3.sh @@ -4,10 +4,13 @@ # 1/2. 拿到崩溃的真实 FATAL 行 + gdb backtrace(此前日志被 head 截断,一直没见到) # 3. 实测 Google 官方 chrome-headless-shell 在本宿主能否跑 —— 直接验证 # 「镜像弃发行版 chromium、改装 puppeteer pinned headless shell」修法的可行性 -# 用法(服务器 repo 根): bash deploy/sandbox/probe_chromium_round3.sh [镜像名] +# 用法(服务器 repo 根): bash deploy/sandbox/probe_chromium_round3.sh [镜像名] [步骤] +# 步骤 = all(默认)/ 3(只跑第 3 步 headless-shell 实测) set -u IMG="${1:-zcbot-sandbox:latest}" +STEP="${2:-all}" +if [ "$STEP" = "all" ]; then echo "===== 1. 崩溃日志尾部(找 FATAL/CHECK 行) =====" docker run --rm --user zcbot -e HOME=/tmp --entrypoint bash "$IMG" -c ' /usr/lib/chromium/chromium --no-sandbox --headless --disable-gpu --disable-dev-shm-usage \ @@ -30,27 +33,35 @@ docker run --rm --entrypoint bash "$IMG" -c ' else echo "[SKIP] apt 装 gdb 失败(容器网络不通?)" fi' +fi echo echo "===== 3. Google 官方 chrome-headless-shell 实测(验证修法 A) =====" docker run --rm --user zcbot -e HOME=/tmp --entrypoint bash "$IMG" -c ' set -u cd /tmp - # npm 包源走阿里(npx 拉 @puppeteer/browsers 包本身);二进制源三级 fallback: - # 阿里 CDN -> 阿里 registry binary 路径 -> Google 官方 + # npm 包源走阿里(npx 拉 @puppeteer/browsers 包本身) export npm_config_registry="https://registry.npmmirror.com" + # 版本号从镜像内 puppeteer-core 锁定的 revisions 读 —— 不用 @stable:stable tag + # 要先访问 Google 的 last-known-good 版本解析端点(被墙,上一轮三源全败的真因, + # --base-url 只管二进制下载不管版本解析);pinned 版本还正好是 mermaid-cli CI + # 实测过的那个。 + PC=/usr/local/lib/node_modules/@mermaid-js/mermaid-cli/node_modules/puppeteer-core + VER=$(node -e "console.log(require(\"$PC/lib/cjs/puppeteer/revisions.js\").PUPPETEER_REVISIONS[\"chrome-headless-shell\"])" 2>/dev/null \ + || grep -rhoE "chrome-headless-shell.{0,4}[0-9]+\.[0-9.]+" "$PC/lib" 2>/dev/null | grep -oE "[0-9]+\.[0-9.]+" | head -1) + [ -n "$VER" ] || { echo "[FAIL] 从 $PC 读不到 pinned 版本号"; exit 1; } + echo "pinned chrome-headless-shell version: $VER" ok="" for BASE in "https://cdn.npmmirror.com/binaries/chrome-for-testing" \ - "https://registry.npmmirror.com/-/binary/chrome-for-testing" \ - ""; do - echo "[download] chrome-headless-shell@stable base-url=${BASE:-官方} ..." - if npx -y @puppeteer/browsers install chrome-headless-shell@stable \ - --path /tmp/pptr ${BASE:+--base-url "$BASE"} >/tmp/dl.log 2>&1; then + "https://registry.npmmirror.com/-/binary/chrome-for-testing"; do + echo "[download] chrome-headless-shell@$VER base-url=$BASE ..." + if npx -y @puppeteer/browsers install "chrome-headless-shell@$VER" \ + --path /tmp/pptr --base-url "$BASE" >/tmp/dl.log 2>&1; then ok=1; break fi - tail -2 /tmp/dl.log + grep -aE "Error|ENOTFOUND|ECONNRE|ETIMEDOUT|404|403" /tmp/dl.log | head -3 done - [ -n "$ok" ] || { echo "[FAIL] 三个源都下不动"; tail -5 /tmp/dl.log; exit 1; } + [ -n "$ok" ] || { echo "[FAIL] 阿里两个 binary 源都失败,完整日志尾部:"; tail -8 /tmp/dl.log; exit 1; } BIN=$(find /tmp/pptr -type f -name chrome-headless-shell | head -1) [ -n "$BIN" ] || { echo "[FAIL] 下载完成但没找到二进制"; exit 1; } echo "BIN=$BIN"