From 806882a7ad3cc833a30a0bccc542c0579cc0bec7 Mon Sep 17 00:00:00 2001
From: Alex Castillo <alex.castillog33@gmail.com>
Date: Wed, 4 Nov 2026 17:16:26 -0400
Subject: [PATCH 1/2] fix(install): run SeaweedFS KEK recovery container as
 root

The recovery step reads /data/.mini_kek_passphrase through --volumes-from.
weed writes that file as root with mode 0600, and the sentry-self-hosted-local
image now runs as a non-root user, so the read fails with PermissionError when
upgrading from before 26.8.0 with a wrapped filer KEK.

Run the one-shot, read-only container with --user 0.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 _unit-test/migrate-seaweedfs-kek-test.sh | 47 ++++++++++++++++++++++++
 install/migrate-seaweedfs-kek.sh         |  1 +
 2 files changed, 48 insertions(+)
 create mode 100755 _unit-test/migrate-seaweedfs-kek-test.sh

diff --git a/_unit-test/migrate-seaweedfs-kek-test.sh b/_unit-test/migrate-seaweedfs-kek-test.sh
new file mode 100755
index 00000000000..2795a64127c
--- /dev/null
+++ b/_unit-test/migrate-seaweedfs-kek-test.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+source _unit-test/_test_setup.sh
+
+# The recovery container reads /data/.mini_kek_passphrase, which weed writes as
+# root with mode 0600. The sentry image runs as a non-root user, so the
+# container has to be started as root or the read fails with PermissionError.
+
+stub_dir="$_SANDBOX/stub"
+mkdir -p "$stub_dir"
+engine_log="$stub_dir/engine.log"
+: >"$engine_log"
+
+cat >"$stub_dir/engine" <<'STUB'
+#!/usr/bin/env bash
+echo "$*" >>"$ENGINE_LOG"
+case "$1" in
+run) printf '%s' "$(printf 'a%.0s' $(seq 1 64))" ;;
+inspect) echo true ;;
+exec)
+  case "$*" in
+  *"cat /tmp/sentry-existing-kek"*) printf '%s' "wrapped-not-hex" ;;
+  *awk*) echo 200 ;;
+  *"cat /data/.mini_sse_kek"*) exit 1 ;;
+  esac
+  ;;
+esac
+exit 0
+STUB
+chmod +x "$stub_dir/engine"
+
+export ENGINE_LOG="$engine_log"
+export CONTAINER_ENGINE="$stub_dir/engine"
+stub_dcr() { printf needed; }
+stub_dc() { "$CONTAINER_ENGINE" run "$@"; }
+dcr=stub_dcr
+dc=stub_dc
+_group=""
+_endgroup=""
+
+source install/migrate-seaweedfs-kek.sh >/dev/null
+
+recovery_run=$(grep -- '--entrypoint python3' "$engine_log")
+test -n "$recovery_run"
+[[ "$recovery_run" == *"--user 0"* ]] || [[ "$recovery_run" == *"--user root"* ]]
+
+report_success
diff --git a/install/migrate-seaweedfs-kek.sh b/install/migrate-seaweedfs-kek.sh
index c710e7e0448..c6bc24bdad9 100644
--- a/install/migrate-seaweedfs-kek.sh
+++ b/install/migrate-seaweedfs-kek.sh
@@ -77,6 +77,7 @@ elif [[ "$migration_state" == "needed" ]]; then
     else
       recovered_kek=$(
         printf '%s' "$stored_kek" | $CONTAINER_ENGINE run --rm -i \
+          --user 0 \
           --entrypoint python3 \
           -v "$(pwd)/scripts/recover_seaweedfs_kek.py:/recover_seaweedfs_kek.py:ro" \
           --volumes-from "${migration_container}:ro" \

From 5e0e15c06580036becb4dccdd7a4905558635de1 Mon Sep 17 00:00:00 2001
From: Alex Castillo <alex.castillog33@gmail.com>
Date: Thu, 5 Nov 2026 10:45:15 -0400
Subject: [PATCH 2/2] chore: remove unit test for seaweedfs KEK recovery (per
 review)

---
 _unit-test/migrate-seaweedfs-kek-test.sh | 47 ------------------------
 1 file changed, 47 deletions(-)
 delete mode 100755 _unit-test/migrate-seaweedfs-kek-test.sh

diff --git a/_unit-test/migrate-seaweedfs-kek-test.sh b/_unit-test/migrate-seaweedfs-kek-test.sh
deleted file mode 100755
index 2795a64127c..00000000000
--- a/_unit-test/migrate-seaweedfs-kek-test.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/usr/bin/env bash
-
-source _unit-test/_test_setup.sh
-
-# The recovery container reads /data/.mini_kek_passphrase, which weed writes as
-# root with mode 0600. The sentry image runs as a non-root user, so the
-# container has to be started as root or the read fails with PermissionError.
-
-stub_dir="$_SANDBOX/stub"
-mkdir -p "$stub_dir"
-engine_log="$stub_dir/engine.log"
-: >"$engine_log"
-
-cat >"$stub_dir/engine" <<'STUB'
-#!/usr/bin/env bash
-echo "$*" >>"$ENGINE_LOG"
-case "$1" in
-run) printf '%s' "$(printf 'a%.0s' $(seq 1 64))" ;;
-inspect) echo true ;;
-exec)
-  case "$*" in
-  *"cat /tmp/sentry-existing-kek"*) printf '%s' "wrapped-not-hex" ;;
-  *awk*) echo 200 ;;
-  *"cat /data/.mini_sse_kek"*) exit 1 ;;
-  esac
-  ;;
-esac
-exit 0
-STUB
-chmod +x "$stub_dir/engine"
-
-export ENGINE_LOG="$engine_log"
-export CONTAINER_ENGINE="$stub_dir/engine"
-stub_dcr() { printf needed; }
-stub_dc() { "$CONTAINER_ENGINE" run "$@"; }
-dcr=stub_dcr
-dc=stub_dc
-_group=""
-_endgroup=""
-
-source install/migrate-seaweedfs-kek.sh >/dev/null
-
-recovery_run=$(grep -- '--entrypoint python3' "$engine_log")
-test -n "$recovery_run"
-[[ "$recovery_run" == *"--user 0"* ]] || [[ "$recovery_run" == *"--user root"* ]]
-
-report_success