co-op/ops-docs
2
0 Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

runbook: add the standing supply-chain IoC check to the gateway verify steps

Browse Source
This commit is contained in:
inference-bot committed 2026-11-06 04:11:11 +00:00
1 parent 816961fb2d
commit 0f40dcc519
1 file changed
+8
Download Patch File Download Diff File Expand all files Collapse all files
maintenance/2026-11-08-litellm-1.108.0-librechat-1.4.8.md
+8
View File
@@ -122,6 +122,14 @@ CR exec --app gateway.inference.coop -- sh -c \
grep -c "x-litellm-response-cost-input" /app/.venv/lib/python3.13/site-packages/litellm/proxy/proxy_server.py' grep -c "x-litellm-response-cost-input" /app/.venv/lib/python3.13/site-packages/litellm/proxy/proxy_server.py'
# → 1 and 1 # → 1 and 1
# 2b. supply-chain IoC check (standing policy on every LiteLLM image change):
CR exec --app gateway.inference.coop -- sh -c \
'ls /app/.venv/lib/python3.13/site-packages/litellm_init.pth 2>/dev/null; \
ls /root/.config/sysmon 2>/dev/null; \
ls /tmp/pglog 2>/dev/null; echo IOC-CLEAN'
# → must print ONLY "IOC-CLEAN" (no such files). Any hit = stop, quarantine, rotate
# the gateway env keys (master + providers live in that env).
# 3. MEMBER-SCOPE key path (master-key tests alone prove nothing — master bypasses # 3. MEMBER-SCOPE key path (master-key tests alone prove nothing — master bypasses
# exactly the tables a broken migration empties): # exactly the tables a broken migration empties):
# POST /key/generate {"alias":"upgrade-verify-temp"} (master auth) → temp key # POST /key/generate {"alias":"upgrade-verify-temp"} (master auth) → temp key