empeira 0.1.0.pre.alpha.1

data/resources/modules/Gemfile.lock

@@ -0,0 +1,105 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    base64 (0.3.0)
+    colored2 (4.0.3)
+    cri (2.15.12)
+    erubi (1.13.1)
+    faraday (2.14.4)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-follow_redirects (0.5.0)
+      faraday (>= 1, < 3)
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    fast_gettext (4.1.1)
+      prime
+      racc
+    fiddle (1.1.8)
+    forwardable (1.4.0)
+    gettext (3.5.2)
+      erubi
+      locale (>= 2.0.5)
+      prime
+      racc
+      text (>= 1.3.0)
+    gettext-setup (1.1.1)
+      fast_gettext (>= 2.1, < 5.0)
+      gettext (~> 3.4)
+      locale
+    json (3.0.2)
+    jwt (2.10.3)
+      base64
+    locale (2.1.5)
+      fiddle
+    log4r (1.1.10)
+    logger (1.7.0)
+    minitar (1.1.0)
+    multi_json (1.21.2)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    prime (0.1.4)
+      forwardable
+      singleton
+    puppet_forge (6.2.0)
+      base64 (>= 0.2.0, < 0.4.0)
+      faraday (~> 2.0)
+      faraday-follow_redirects (>= 0.3, < 0.6)
+      minitar (~> 1.0, >= 1.0.2)
+      semantic_puppet (~> 1.0)
+    r10k (5.0.3)
+      colored2 (~> 4.0)
+      cri (>= 2.15.10)
+      gettext-setup (>= 0.24, < 2.0)
+      jwt (>= 2.2.3, < 3)
+      log4r (= 1.1.10)
+      minitar (>= 0.9, < 2)
+      multi_json (~> 1.10)
+      puppet_forge (>= 6.1.0, < 7)
+    racc (1.8.1)
+    semantic_puppet (1.1.1)
+    singleton (0.3.0)
+    text (1.3.1)
+    uri (1.1.1)
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  r10k (= 5.0.3)
+
+CHECKSUMS
+  base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
+  bundler (4.0.22) sha256=d8d5ec84c8555e0af71db63ed7aee4d1a8fb839ec46d84212d61979242a5d75a
+  colored2 (4.0.3) sha256=63e1038183976287efc43034f5cca17fb180b4deef207da8ba78d051cbce2b37
+  cri (2.15.12) sha256=8abfe924ef53e772a8e4ee907e791d3bfcfca78bc62a5859e3b9899ba29956e5
+  erubi (1.13.1) sha256=a082103b0885dbc5ecf1172fede897f9ebdb745a4b97a5e8dc63953db1ee4ad9
+  faraday (2.14.4) sha256=9bb4408c44621b0dbaaaa39e5dbfc4dbe58cc6751b6eb94d16ae9e1f2f2fab6e
+  faraday-follow_redirects (0.5.0) sha256=5cde93c894b30943a5d2b93c2fe9284216a6b756f7af406a1e55f211d97d10ad
+  faraday-net_http (3.4.4) sha256=0e78af151747ed1b00f33e25973b4bc220d7f16c00c39676817c8b12331eb588
+  fast_gettext (4.1.1) sha256=e8c532f6945b0dc31efb2e91366bd56630bc3ae6a05a4126937124e40366efd8
+  fiddle (1.1.8) sha256=7fa8ee3627271497f3add5503acdbc3f40b32f610fc1cf49634f083ef3f32eee
+  forwardable (1.4.0) sha256=f1cd40cc9812937980e1c76f1aa053660990a7c9b6a98fc37d945468afcce838
+  gettext (3.5.2) sha256=ada02c59aa7e9f56bd2522faedaed16421dd2f3ddb5fe28628c0be5abcbf3c74
+  gettext-setup (1.1.1) sha256=15ce653696283c9835b0ad9f02f236b9f240cb35facd3341cc62b85d42c6b667
+  json (3.0.2) sha256=8e6d7e7b11384c21230430cef90b71f14849a34a1f4452796670f7c981bd19df
+  jwt (2.10.3) sha256=e4d9352fbc7309b1a7448c7dd713dfe4d8c47077af80759cdbed8f878ea0b484
+  locale (2.1.5) sha256=1c6803e8aa6bdb2c29e91945d095050601bf6d58474993575adf6f3b89b32ef4
+  log4r (1.1.10) sha256=9b452928c964b7c54c09aeb25ff045b5a722b387b16c9ce37cb1baec00062966
+  logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
+  minitar (1.1.0) sha256=38db0cfb6f3801017946cdcd8dc53f2cf3fd41ff752892312bf9a1639c9ea23e
+  multi_json (1.21.2) sha256=245531eaf54bdba57aba515ff08b4503505c5e09911daa89c5a561e2f85bea8e
+  net-http (0.9.1) sha256=25ba0b67c63e89df626ed8fac771d0ad24ad151a858af2cc8e6a716ca4336996
+  prime (0.1.4) sha256=4d755ebf7c2994a6f3a3fee0d072063be3fff2d4042ebff6cd5eebd4747a225e
+  puppet_forge (6.2.0) sha256=9cde4841a7a6950afeb0c4fec02449931179863918c0a6e6909cb2a6c6998a0c
+  r10k (5.0.3) sha256=a76daddd8cecdc1cf0816f3d19adb23782598d373344a9de23623f601d58a68b
+  racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
+  semantic_puppet (1.1.1) sha256=15ff5b48d7f856549eb66b927a8894d3668b211970c9d7dc07dd4db57f5c7a96
+  singleton (0.3.0) sha256=83ea1bca5f4aa34d00305ab842a7862ea5a8a11c73d362cb52379d94e9615778
+  text (1.3.1) sha256=2fbbbc82c1ce79c4195b13018a87cbb00d762bda39241bb3cdc32792759dd3f4
+  uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
+
+BUNDLED WITH
+  4.0.22

data/resources/modules/worker.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+
+# Runs only inside the disposable installer, never in the CLI process.
+require 'bundler/setup'
+require 'r10k/module_loader/puppetfile'
+require 'r10k/git/cache'
+require 'json'
+require 'fileutils'
+
+module EmpeiraModules
+  class Invalid < StandardError; end
+
+  # rubocop:disable-next Metrics/ClassLength -- Keep the small controlled r10k worker in one packaged file.
+  class Worker
+    def initialize(directory)
+      @directory = File.expand_path(directory)
+      @request = JSON.parse(File.read(File.join(@directory, 'request.json')))
+      R10K::Logging.disable_default_stderr = true
+      R10K::Git::Cache.settings[:cache_root] = @request.fetch('cache')
+    end
+
+    # rubocop:disable-next Metrics/AbcSize -- Evaluate once and describe both Forge and host-acquired Git modules.
+    def plan
+      sources = modules.grep(R10K::Module::Git).map { |mod| { 'name' => mod.name, 'remote' => mod.remote } }
+      report('TOTAL', modules.size)
+      descriptors = modules.map { |mod| descriptor(mod) }
+      File.write(File.join(@directory, 'install-plan.json'),
+                 JSON.generate('forge' => PuppetForge.host, 'modules' => descriptors))
+      File.write(File.join(@directory, 'git-sources.json'),
+                 JSON.generate('git' => sources, 'names' => modules.map(&:name).sort))
+    end
+
+    def run
+      selected = prepared_modules
+      selected.each { |mod| validate(mod) }
+      FileUtils.mkdir_p(File.join(@directory, 'modules'))
+      selected.each { |mod| install(mod) }
+      @request.fetch('overrides').each { |name| FileUtils.mkdir_p(File.join(@directory, 'modules', name)) }
+    end
+
+    private
+
+    def modules
+      @modules ||= load_modules.each { |mod| validate(mod) }
+    end
+
+    def descriptor(mod)
+      report('START', mod.name)
+      git = mod.is_a?(R10K::Module::Git)
+      version = git ? mod.desired_ref || mod.default_ref || 'HEAD' : mod.expected_version
+      { 'title' => mod.title, 'name' => mod.name, 'type' => git ? 'git' : 'forge', 'version' => version }
+    rescue StandardError => e
+      raise Invalid, "Module #{mod.name}: cannot resolve Forge module/version; " \
+                     'check module/version and your normal host/container network access',
+            cause: e
+    end
+
+    def prepared_modules
+      data = JSON.parse(File.read(File.join(@directory, 'install-plan.json')))
+      PuppetForge.host = data.fetch('forge')
+      data.fetch('modules').map { |entry| prepared_module(entry) }
+    end
+
+    def prepared_module(entry)
+      options = { version: entry.fetch('version'), type: entry.fetch('type'), exclude_spec: false }
+      options[:source] = acquired_git(entry.fetch('name')) if entry['type'] == 'git'
+      R10K::Module.new(entry.fetch('title'), File.join(@directory, 'modules'), options)
+    end
+
+    def load_modules
+      overrides = @request.fetch('overrides')
+      excluded = /\A(?:#{overrides.map { |name| Regexp.escape(name) }.join('|')})\z/ unless overrides.empty?
+      loader = R10K::ModuleLoader::Puppetfile.new(
+        basedir: @directory, puppetfile: File.join(@directory, 'Puppetfile'),
+        module_exclude_regex: excluded,
+        overrides: { modules: { exclude_spec: false }, forge: { allow_puppetfile_override: true } }
+      )
+      loader.load!.fetch(:modules)
+    rescue StandardError, ScriptError => e
+      raise Invalid, 'Invalid Puppetfile: check Ruby syntax, module declarations and duplicate normalized names',
+            cause: e
+    end
+
+    # rubocop:disable-next Metrics/AbcSize -- Check supported source and destination before modifying an existing module.
+    def validate(mod)
+      raise Invalid, 'Invalid Puppetfile: module names must be lowercase Puppet identifiers' unless
+        mod.name.match?(/\A[a-z][a-z0-9_]*\z/)
+
+      unless mod.dirname == File.join(@directory, 'modules')
+        raise Invalid, 'Puppetfile moduledir/install_path must use the normal environment modules directory'
+      end
+      if File.symlink?(mod.full_path) || File.symlink?(File.join(mod.full_path, '.git'))
+        raise Invalid, "Module #{mod.name}: refusing a symlinked module directory or Git metadata"
+      end
+
+      case mod
+      when R10K::Module::Git then validate_git(mod)
+      when R10K::Module::Forge then nil
+      else raise Invalid, "Module #{mod.name}: only Git and Forge entries are supported"
+      end
+    end
+
+    def validate_git(mod)
+      return unless mod.desired_ref == :control_branch
+
+      raise Invalid, "Module #{mod.name}: replace :control_branch with an explicit ref"
+    end
+
+    def acquired_git(name)
+      raise Invalid, 'Invalid Puppetfile: module name in installer plan' unless name.match?(/\A[a-z][a-z0-9_]*\z/)
+
+      acquired = JSON.parse(File.read(File.join(@directory, 'acquired.json')))
+      mirror = acquired.fetch(name)
+      unless File.dirname(mirror) == @request.fetch('sources') &&
+             File.basename(mirror).match?(/\A[0-9a-f]{64}\.git\z/) && File.directory?(mirror)
+        raise Invalid, "Module #{name}: host Git source is missing"
+      end
+
+      mirror
+    end
+
+    def install(mod)
+      report('START', mod.name)
+      mod.sync
+      report('DONE', mod.name)
+    rescue StandardError => e
+      source = mod.is_a?(R10K::Module::Git) ? 'Git repository/ref' : 'Forge module/version'
+      raise Invalid, "Module #{mod.name}: cannot synchronize #{source}; " \
+                     'check availability, ref/version and your normal host/container network access',
+            cause: e
+    end
+
+    def report(kind, value)
+      $stdout.puts "EMPEIRA_MODULE_#{kind}:#{value}"
+      $stdout.flush
+    end
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  begin
+    worker = EmpeiraModules::Worker.new(ARGV.fetch(0))
+    ARGV[1] == 'plan' ? worker.plan : worker.run
+  rescue EmpeiraModules::Invalid => e
+    # rubocop:disable-next Style/StderrPuts -- r10k sets $VERBOSE=nil; failure diagnostics must remain visible.
+    $stderr.puts e.message
+    # Buffered by the central runner; only filtered diagnostics reach the user's terminal.
+    cause = e.cause
+    3.times do
+      break unless cause
+
+      $stderr.puts cause.message # rubocop:disable Style/StderrPuts
+      cause = cause.cause
+    end
+    exit 1
+  rescue StandardError, ScriptError
+    # rubocop:disable-next Style/StderrPuts -- r10k sets $VERBOSE=nil; failure diagnostics must remain visible.
+    $stderr.puts 'Puppetfile synchronization failed: installer input/output is unavailable or inconsistent'
+    exit 1
+  end
+end

data/resources/network/adapter/Containerfile

@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+ARG EMPEIRA_BASE_BUILDER=@BUILDER@
+FROM ${EMPEIRA_BASE_BUILDER} AS build
+WORKDIR /source
+COPY *.go go.mod ./
+ENV CGO_ENABLED=0 GOTOOLCHAIN=local GOPROXY=off
+RUN go test ./... && go build -trimpath -buildvcs=false -ldflags='-s -w' -o /adapter .
+FROM scratch
+COPY --from=build /adapter /adapter
+COPY --from=build /usr/local/go/LICENSE /licenses/go-LICENSE
+COPY LICENSE /licenses/empeira-LICENSE
+ENTRYPOINT ["/adapter"]
+CMD ["hold"]

data/resources/network/adapter/bridge_linux.go

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+package main
+
+import (
+	"encoding/binary"
+	"fmt"
+	"net"
+	"syscall"
+)
+
+// Docker's outer bridge can reflect broadcasts via its hairpin-enabled veth.
+// Never relearn guest source MACs on this uplink: they belong to local TAP ports.
+// Container destinations still work through unknown-unicast flooding on the uplink.
+func disableUplinkLearning(name string) error {
+	nic, err := net.InterfaceByName(name)
+	if err != nil {
+		return err
+	}
+	fd, err := syscall.Socket(syscall.AF_NETLINK, syscall.SOCK_RAW, syscall.NETLINK_ROUTE)
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(fd)
+	message := make([]byte, 44)
+	binary.NativeEndian.PutUint32(message[0:4], uint32(len(message)))
+	binary.NativeEndian.PutUint16(message[4:6], syscall.RTM_SETLINK)
+	binary.NativeEndian.PutUint16(message[6:8], syscall.NLM_F_REQUEST|syscall.NLM_F_ACK)
+	binary.NativeEndian.PutUint32(message[8:12], 1)
+	message[16] = syscall.AF_BRIDGE
+	binary.NativeEndian.PutUint32(message[20:24], uint32(nic.Index))
+	binary.NativeEndian.PutUint16(message[32:34], 12)
+	binary.NativeEndian.PutUint16(message[34:36], syscall.IFLA_PROTINFO|0x8000)
+	binary.NativeEndian.PutUint16(message[36:38], 5)
+	binary.NativeEndian.PutUint16(message[38:40], 8) // IFLA_BRPORT_LEARNING, value 0
+	if err = syscall.Sendto(fd, message, 0, &syscall.SockaddrNetlink{Family: syscall.AF_NETLINK}); err != nil {
+		return err
+	}
+	response := make([]byte, 4096)
+	n, _, err := syscall.Recvfrom(fd, response, 0)
+	if err != nil {
+		return err
+	}
+	if n < 20 || binary.NativeEndian.Uint16(response[4:6]) != syscall.NLMSG_ERROR {
+		return fmt.Errorf("missing bridge netlink acknowledgement")
+	}
+	code := int32(binary.NativeEndian.Uint32(response[16:20]))
+	if code != 0 {
+		return syscall.Errno(-code)
+	}
+	return nil
+}

data/resources/network/adapter/framing.go

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+package main
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+)
+
+// QEMU stream netdev: a big-endian uint32 length followed by one Ethernet frame.
+// No application port or protocol is interpreted here.
+const maxFrame = 65535
+
+func readFrame(r io.Reader) ([]byte, error) {
+	var size uint32
+	if err := binary.Read(r, binary.BigEndian, &size); err != nil {
+		return nil, err
+	}
+	if size < 14 || size > maxFrame {
+		return nil, fmt.Errorf("invalid Ethernet frame length %d", size)
+	}
+	frame := make([]byte, size)
+	_, err := io.ReadFull(r, frame)
+	return frame, err
+}
+
+func writeFrame(w io.Writer, frame []byte) error {
+	if len(frame) < 14 || len(frame) > maxFrame {
+		return fmt.Errorf("invalid Ethernet frame length %d", len(frame))
+	}
+	packet := make([]byte, 4+len(frame))
+	binary.BigEndian.PutUint32(packet, uint32(len(frame)))
+	copy(packet[4:], frame)
+	for len(packet) > 0 {
+		n, err := w.Write(packet)
+		if err != nil {
+			return err
+		}
+		if n == 0 {
+			return io.ErrShortWrite
+		}
+		packet = packet[n:]
+	}
+	return nil
+}

data/resources/network/adapter/framing_test.go

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+package main
+
+import (
+	"bytes"
+	"encoding/binary"
+	"io"
+	"testing"
+)
+
+type shortWriter struct{ bytes.Buffer }
+
+func (w *shortWriter) Write(b []byte) (int, error) {
+	if len(b) > 3 {
+		b = b[:3]
+	}
+	return w.Buffer.Write(b)
+}
+
+func TestFrameRoundTrip(t *testing.T) {
+	var stream shortWriter
+	want := bytes.Repeat([]byte{0, 255, 42}, 500)
+	for i := 0; i < 2; i++ {
+		if err := writeFrame(&stream, want); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for i := 0; i < 2; i++ {
+		got, err := readFrame(&stream)
+		if err != nil || !bytes.Equal(got, want) {
+			t.Fatalf("frame mismatch: %v", err)
+		}
+	}
+	if _, err := readFrame(&stream); err != io.EOF {
+		t.Fatalf("wanted EOF: %v", err)
+	}
+}
+
+func TestInvalidLengths(t *testing.T) {
+	for _, n := range []uint32{0, 13, 65536, 0xffffffff} {
+		var stream bytes.Buffer
+		binary.Write(&stream, binary.BigEndian, n)
+		if _, err := readFrame(&stream); err == nil {
+			t.Fatalf("accepted %d", n)
+		}
+	}
+	var truncated bytes.Buffer
+	binary.Write(&truncated, binary.BigEndian, uint32(100))
+	truncated.Write(make([]byte, 14))
+	if _, err := readFrame(&truncated); err != io.ErrUnexpectedEOF {
+		t.Fatal(err)
+	}
+}

data/resources/network/adapter/go.mod

@@ -0,0 +1,3 @@
+module empeira.networkproof.transport
+
+go 1.23