@consiliency/agent-board-cli 1.28.0 → 1.29.0

package/keyslot/lib.sh

@@ -732,14 +732,42 @@ keyseal_scan_mktemp() {
   printf -v "$1" '%s' "$f"
 }
 
+# The parent pid of pid $1, from /proc (the field after the state). rc 1 when $1 is gone.
+keyseal_ppid_of() {
+  local s
+  s=$(cat -- "/proc/$1/stat" 2>/dev/null) || return 1
+  s=${s##*) }
+  # shellcheck disable=SC2086
+  set -- $s
+  printf '%s' "$2"
+}
+
+# The pgid of pid $1, from /proc (the fields after the command name: state ppid pgrp).
+keyseal_pgid_of() {
+  local s
+  s=$(cat -- "/proc/$1/stat" 2>/dev/null) || return 1
+  s=${s##*) }
+  # shellcheck disable=SC2086
+  set -- $s
+  printf '%s' "$3"
+}
+
 # The scan stage: ONE child of `timeout`, run as `bash -c` so the deadline covers find, xargs,
-# grep AND the classifier (IF-552-2 "Self-bound"). Args: rc file, json file, count file, pruned
-# file, list file, uid, exempt path, roots...; the pin is in KEYSEAL_SCAN_PIN. It writes its
-# results to files; status.sh reads them only when the stage completed.
+# grep AND every slot's classifier (IF-552-2 "Self-bound"; extended by #552-ONBOARD-SL3 so N
+# slots share this ONE walk — the walk itself never depends on a pin or an exempt path). Args: rc
+# file, count file, pruned file, list file, uid, slot count n, then n groups of (json file, pin,
+# exempt path), then `--`, then the roots. It writes its results to files; status.sh reads them
+# only when the stage completed.
 keyseal_scan_stage() {
-  local rcf=$1 jsonf=$2 count=$3 pruned=$4 list=$5 uid=$6 exempt=$7 find grep i=0 h
-  shift 7
-  local -a expr greps
+  local rcf=$1 count=$2 pruned=$3 list=$4 uid=$5 n=$6 find grep i=0 h j
+  shift 6
+  local -a jsonfs=() pins=() exempts=() expr greps
+  for ((j = 0; j < n; j++)); do
+    jsonfs+=("$1"); pins+=("$2"); exempts+=("$3")
+    shift 3
+  done
+  [[ ${1-} == -- ]] || exit 3
+  shift
   find=$(seam_resolve KEYSEAL_TEST_FIND "$KEYSEAL_BIN_FIND") || exit 3
   grep=$(seam_resolve KEYSEAL_TEST_GREP "$KEYSEAL_BIN_GREP") || exit 3
   # One clause per prune entry, in report order; each writes its INDEX, never the path. The
@@ -752,36 +780,27 @@ keyseal_scan_stage() {
   for h in "${KEYSEAL_SCAN_HEADERS[@]}"; do greps+=(-e "$h" -e "$h"$'\r'); done
   "$find" -H "$@" "${expr[@]}" 2>/dev/null \
     | "$KEYSEAL_BIN_XARGS" -0 -r "$grep" -lsZ -x -F "${greps[@]}" -- >"$list"
-  local rc_find=${PIPESTATUS[0]} rc_xargs=${PIPESTATUS[1]} rc_node=-
+  local rc_find=${PIPESTATUS[0]} rc_xargs=${PIPESTATUS[1]}
+  local -a rc_nodes=()
   # find: 0, or 1 when some directory was unreadable. xargs: 0, or 123 when some grep found
-  # nothing. Anything else means the scan did not run to completion.
+  # nothing. Anything else means the scan did not run to completion, for every slot alike.
   if ((rc_find <= 1)) && ((rc_xargs == 0 || rc_xargs == 123)); then
     local delay=
     seam_active && delay=${KEYSEAL_TEST_CLASSIFY_DELAY_MS-}
-    KEYSEAL_SCAN_DELAY_MS=$delay keyseal_node classify "$list" "$uid" "$KEYSEAL_SCAN_MAX_BYTES" "$exempt" "$pruned" \
-      "${KEYSEAL_SCAN_PRUNE_NAMES[@]}" "${KEYSEAL_SCAN_PRUNE_PATHS[@]}" >"$jsonf" && rc_node=0 || rc_node=$?
+    for ((j = 0; j < n; j++)); do
+      local rc_node
+      KEYSEAL_SCAN_DELAY_MS=$delay KEYSEAL_SCAN_PIN=${pins[j]} keyseal_node classify "$list" "$uid" "$KEYSEAL_SCAN_MAX_BYTES" "${exempts[j]}" "$pruned" \
+        "${KEYSEAL_SCAN_PRUNE_NAMES[@]}" "${KEYSEAL_SCAN_PRUNE_PATHS[@]}" >"${jsonfs[j]}" && rc_node=0 || rc_node=$?
+      rc_nodes+=("$rc_node")
+    done
+  else
+    for ((j = 0; j < n; j++)); do rc_nodes+=(-); done
   fi
-  printf '%s %s %s\n' "$rc_find" "$rc_xargs" "$rc_node" >"$rcf"
-}
-
-# The parent pid of pid $1, from /proc (the field after the state). rc 1 when $1 is gone.
-keyseal_ppid_of() {
-  local s
-  s=$(cat -- "/proc/$1/stat" 2>/dev/null) || return 1
-  s=${s##*) }
-  # shellcheck disable=SC2086
-  set -- $s
-  printf '%s' "$2"
-}
-
-# The pgid of pid $1, from /proc (the fields after the command name: state ppid pgrp).
-keyseal_pgid_of() {
-  local s
-  s=$(cat -- "/proc/$1/stat" 2>/dev/null) || return 1
-  s=${s##*) }
-  # shellcheck disable=SC2086
-  set -- $s
-  printf '%s' "$3"
+  {
+    printf '%s %s' "$rc_find" "$rc_xargs"
+    for j in "${rc_nodes[@]}"; do printf ' %s' "$j"; done
+    printf '\n'
+  } >"$rcf"
 }
 
 # The stage group led by `timeout` (pid $1) is gone within the grace, else KILLed group-wide
@@ -883,14 +902,25 @@ keyseal_scan_cleanup() {
   if [[ -n $KEYSEAL_CACHE_TMP ]]; then rm -f -- "$KEYSEAL_CACHE_TMP"; fi
 }
 
-# Run the scan stage under one deadline. $1 pin, $2 exempt path, $3 deadline (s). Sets
-# KEYSEAL_SCAN_OUTCOME (ok | incomplete | timed_out), KEYSEAL_SCAN_CLASSIFIED (the classifier's
-# JSON when ok) and KEYSEAL_SCAN_FOLDERS (directories entered, from the count file's size).
+# Run the scan stage under one deadline, for every slot named in the caller's parallel arrays
+# KEYSEAL_SCAN_PINS[] / KEYSEAL_SCAN_EXEMPTS[] (at least one entry; #552-ONBOARD-SL3: N slots
+# share this ONE walk, never one walk per slot). $1 deadline (s). Sets KEYSEAL_SCAN_OUTCOME (ok |
+# incomplete | timed_out, for the whole stage: one deadline covers every slot alike),
+# KEYSEAL_SCAN_CLASSIFIED[] (index-parallel to the inputs: each slot's classifier JSON, only when
+# ok) and KEYSEAL_SCAN_FOLDERS (directories entered, from the count file's size).
 keyseal_scan_run() {
-  local pin=$1 exempt=$2 deadline=$3 list count pruned rcf jsonf trc=0 period rcs
-  KEYSEAL_SCAN_OUTCOME=incomplete KEYSEAL_SCAN_CLASSIFIED= KEYSEAL_SCAN_FOLDERS=0
+  local deadline=$1 list count pruned rcf trc=0 period rcs n i pat
+  n=${#KEYSEAL_SCAN_PINS[@]}
+  KEYSEAL_SCAN_OUTCOME=incomplete KEYSEAL_SCAN_CLASSIFIED=() KEYSEAL_SCAN_FOLDERS=0
+  ((n >= 1)) || return 0
   keyseal_scan_mktemp list && keyseal_scan_mktemp count && keyseal_scan_mktemp pruned &&
-    keyseal_scan_mktemp rcf && keyseal_scan_mktemp jsonf || return 0
+    keyseal_scan_mktemp rcf || return 0
+  local -a jsonfs=()
+  for ((i = 0; i < n; i++)); do
+    local jf
+    keyseal_scan_mktemp jf || return 0
+    jsonfs+=("$jf")
+  done
   if seam_active && [[ ${KEYSEAL_TEST_COUNT_FIFO-} == 1 ]]; then
     # SC-16's seam: a FIFO with no reader, so the REAL find blocks opening it.
     rm -f -- "$count" && "$KEYSEAL_BIN_MKFIFO" -m 0600 -- "$count" || return 0
@@ -903,9 +933,12 @@ keyseal_scan_run() {
   # GNU runner can prove what only uutils would otherwise expose (#552 review r3).
   local timeout_bin
   timeout_bin=$(seam_resolve KEYSEAL_TEST_TIMEOUT "$KEYSEAL_BIN_TIMEOUT") || return 0
-  KEYSEAL_SCAN_PIN=$pin "$timeout_bin" --kill-after="$KEYSEAL_SCAN_KILL_AFTER_S" "$deadline" \
+  local -a stage_args=("$rcf" "$count" "$pruned" "$list" "$(id -u)" "$n")
+  for ((i = 0; i < n; i++)); do stage_args+=("${jsonfs[i]}" "${KEYSEAL_SCAN_PINS[i]}" "${KEYSEAL_SCAN_EXEMPTS[i]}"); done
+  stage_args+=(--)
+  "$timeout_bin" --kill-after="$KEYSEAL_SCAN_KILL_AFTER_S" "$deadline" \
     /bin/bash -c '. "$0"; keyseal_scan_stage "$@"' "$keyseal_here/lib.sh" \
-    "$rcf" "$jsonf" "$count" "$pruned" "$list" "$(id -u)" "$exempt" "${starts[@]}" >/dev/null &
+    "${stage_args[@]}" "${starts[@]}" >/dev/null &
   KEYSEAL_SCAN_TPID=$!
   period=$(keyseal_seam_seconds KEYSEAL_TEST_SCAN_PROGRESS_S "$KEYSEAL_SCAN_PROGRESS_S")
   local watch=
@@ -926,22 +959,30 @@ keyseal_scan_run() {
   if ((trc == 124 || trc == 137)); then KEYSEAL_SCAN_OUTCOME=timed_out; return 0; fi
   ((trc == 0)) || return 0
   rcs=$(<"$rcf") || return 0
-  [[ $rcs =~ ^[01]\ (0|123)\ 0$ ]] || return 0
-  KEYSEAL_SCAN_CLASSIFIED=$(<"$jsonf") || return 0
-  [[ $KEYSEAL_SCAN_CLASSIFIED == \{* ]] || return 0
+  pat="^[01] (0|123)"
+  for ((i = 0; i < n; i++)); do pat+=" 0"; done
+  pat+='$'
+  [[ $rcs =~ $pat ]] || return 0
+  for ((i = 0; i < n; i++)); do
+    local c
+    c=$(<"${jsonfs[i]}") || return 0
+    [[ $c == \{* ]] || return 0
+    KEYSEAL_SCAN_CLASSIFIED[i]=$c
+  done
   KEYSEAL_SCAN_OUTCOME=ok
 }
 
-# The scan object's fixed part: scope, positive prune report and verdicts. This is what a cache
-# stores, WITHOUT `headers`: the cache file lives under $HOME, and the PEM header strings are never
-# written there at all. scope_sha256 covers the headers, so a hit re-adds the current ones
-# (keyseal_scan_with_headers) and a cached report is shape-identical to a fresh one.
+# The scan object's fixed part for slot index $1: scope, positive prune report and verdicts. This
+# is what a cache stores, WITHOUT `headers`: the cache file lives under $HOME, and the PEM header
+# strings are never written there at all. scope_sha256 covers the headers, so a hit re-adds the
+# current ones (keyseal_scan_with_headers) and a cached report is shape-identical to a fresh one.
 keyseal_scan_core_json() {
+  local i=$1
   printf '{"roots":%s,"roots_skipped":%s,"pruned":%s,"max_bytes":%s,"not_detected":%s,%s' \
     "$(keyseal_json_list ${KEYSEAL_ROOTS[@]+"${KEYSEAL_ROOTS[@]}"})" "$KEYSEAL_ROOTS_SKIPPED_JSON" \
     "$(keyseal_json_list "${KEYSEAL_SCAN_PRUNE_NAMES[@]}" "${KEYSEAL_SCAN_PRUNE_PATHS[@]}")" \
     "$KEYSEAL_SCAN_MAX_BYTES" \
-    "$(keyseal_json_list "${KEYSEAL_SCAN_NOT_DETECTED[@]}")" "${KEYSEAL_SCAN_CLASSIFIED#\{}"
+    "$(keyseal_json_list "${KEYSEAL_SCAN_NOT_DETECTED[@]}")" "${KEYSEAL_SCAN_CLASSIFIED[i]#\{}"
 }
 keyseal_scan_with_headers() { printf '{"headers":%s,%s' "$(keyseal_json_list "${KEYSEAL_SCAN_HEADERS[@]}")" "${1#\{}"; }