Skip to content

Copy scripts from tools to bin/ directory in assembly and make scripts agnostic to directory#6023

Open
cwperks wants to merge 7 commits intoopensearch-project:mainfrom
cwperks:move-tools-to-bin
Open

Copy scripts from tools to bin/ directory in assembly and make scripts agnostic to directory#6023
cwperks wants to merge 7 commits intoopensearch-project:mainfrom
cwperks:move-tools-to-bin

Conversation

@cwperks
Copy link
Member

@cwperks cwperks commented Mar 19, 2026

Description

This PR fixes the packaging of the OpenSearch Security tools scripts so they retain executable permissions after plugin installation.

Today, scripts under <OPENSEARCH_HOME>/plugins/opensearch-security/tools can lose their execute bit during plugin installation. As a result, cluster administrators must manually update file permissions before they can run them.

i.e.

> ./install_demo_configuration.sh
zsh: permission denied: ./install_demo_configuration.sh
> sudo chmod 755 *
> ./install_demo_configuration.sh

### OpenSearch Security Demo Installer
### ** Warning: Do not use on production or public reachable systems **
...

With the changes in this PR we are going to copy the tools into another directory called bin/ on assembly which OpenSearch core nows how to handle on plugin install to copy these to <OPENSEARCH_HOME>/bin/opensearch-security/ and keep the file's permissions as they are (755).

In order to do this, I also have to make the scripts agnostic to directory since they are now one level less deep so there's logic introduced to identify OPENSEARCH_HOME directory by looking for the lib directory and OpenSearch jar.

Yes this means there will be copies of each script (left intentionally until all places around the ecosystem are updated like Docker entrypoint).

  • Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)
  • Why these changes are required?
  • What is the old behavior before changes and new behavior after changes?

Issues Resolved

Enhancement

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

…s agnostic to directory

Signed-off-by: Craig Perkins <cwperx@amazon.com>
cwperks added 5 commits March 19, 2026 12:22
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
@codecov
Copy link

codecov bot commented Mar 19, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.82%. Comparing base (3661e7b) to head (add6ad8).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #6023      +/-   ##
==========================================
- Coverage   73.82%   73.82%   -0.01%     
==========================================
  Files         439      440       +1     
  Lines       27122    27229     +107     
  Branches     4025     4044      +19     
==========================================
+ Hits        20024    20101      +77     
- Misses       5192     5218      +26     
- Partials     1906     1910       +4     
Files with missing lines Coverage Δ
...pensearch/security/tools/democonfig/Installer.java 74.01% <100.00%> (+1.12%) ⬆️

... and 10 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Craig Perkins <cwperx@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant