Harden VM-lifecycle + storage: false-success on cancel/failure paths (v1.121.14)#82
Merged
Merged
Conversation
…(v1.121.14) Fixes from an adversarial audit of the VM export/import, offline-VHD, VHD convert, batch S2D, and Hyper-V Replica modules. Recurring class: false success on a cancel/failure path (data-loss risk). 53-VMExportImport.ps1: - A cancelled/timed-out VM export (operator stops watching or declines the 4h cap while vmms.exe is still exporting) is no longer reported 'Export complete!' and logged as a successful export. That false success could lead an operator to decommission the source VM against a truncated, unbootable export. 43-OfflineVHD.ps1: - Offline customization returns $false (not success) when the SYSTEM hive didn't load, so the computer-name / offline settings that were silently skipped aren't reported as applied (the VM would otherwise boot with the sysprep-default name). 41-VHDManagement.ps1: - dynamic->fixed conversion gates success on the Move actually succeeding, not on $finalPath still existing (which is the un-converted DYNAMIC copy) -- it no longer returns/reports the dynamic VHD as 'Fixed' and orphans the fixed file. 62-HyperVReplica.ps1: - A replica-side planned failover now confirms the primary was prepared (-Prepare) and shut down before Complete-VMFailover (avoids silent data loss / split-brain). - Certificate-based replica resolves + passes -CertificateThumbprint (the option never worked before). Dry-Run replica undos use -EA Stop (no silent open receiver). 50-EntryPoint.ps1: - Batch S2D carries the AllowS2DDataLoss consent flag to the gate (was dropped, making batch S2D enable permanently unreachable). Tests: Section 201 (10 asserts). Structural 5357/5357; Pester 312/312; PSSA 0. Version stamps -> 1.121.14.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes from an adversarial audit of the VM export/import, offline-VHD, VHD conversion, batch S2D, and Hyper-V Replica modules. Recurring class: false success on a cancel/failure path (data-loss risk). 2 finder findings were refuted.
VM export false-success → source-VM data loss (
53, HIGH)If the operator stopped watching an export (ESC) or declined the 4-hour cap while
vmms.exewas still exporting, the tool printedExport complete!and wrote a successful "Exported VM …" audit record — but Hyper-V was still writing a truncated, unbootable copy. Trusting the recorded success, an operator could decommission the source VM and lose it. It now checks$cancelRequestedand reports the export as not confirmed.Offline-VHD silent no-op (
43, MED)If the VHD's registry hive couldn't load (e.g. a leftover
HKLM\OFFLINE_*mount from a prior crash), all offline settings were skipped yet it returned success — the VM booted with the sysprep-default name. It now returns$falsewhen the SYSTEM hive didn't load (the computer name has no first-boot fallback) or when neither hive loaded.VHD convert returns the wrong disk (
41, MED)If the final rename failed,
Test-Path $finalPathwas true (it's the un-converted dynamic copy), so the code reported that dynamic disk as "Fixed VHD" and orphaned the real fixed file. Success is now gated on the Move actually succeeding.Hyper-V Replica (
62)Complete-VMFailoveris only lossless if the primary ran-Prepareand shut down first; without it you get silent data loss (unsynced delta) or split-brain. It now requires explicit confirmation.-CertificateThumbprint(the option always threw before). Dry-Run undos use-EA Stopso a failed rollback isn't a silent open-receiver no-op.Batch S2D consent (
50, LOW)The
AllowS2DDataLossflag was dropped before the consent gate, making batch S2D enable permanently unreachable. It's now carried through.Verification