@fased/fased 0.1.61 → 0.1.64

package/scripts/install-managed-runtime.mjs

@@ -2,6 +2,10 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import {
+  authorizePreactivatedHostedGateway,
+  beginPreactivatedHostedTransaction,
+} from "./fased-managed-updater.mjs";
 import {
   assertManagedRuntime,
   atomicSymlink,
@@ -10,12 +14,26 @@ import {
   copyExecutable,
   normalizeManagedProfile,
   readHostedRuntimeMetadata,
+  readHostedReleaseBinding,
   readManagedInstallManifest,
   readPackageVersion,
   resolveLinkTarget,
   resolveManagedRuntimePaths,
 } from "./managed-runtime-layout.mjs";
 
+const DEFAULT_HOST_TRANSACTION_TIMEOUT_MS = 2 * 60_000;
+const HOST_TRANSACTION_ID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function signerReleaseIdentitiesEqual(left, right) {
+  return (
+    left?.version === right?.version &&
+    left?.commit === right?.commit &&
+    left?.buildInputDigest === right?.buildInputDigest &&
+    left?.development === right?.development
+  );
+}
+
 function parseArgs(argv) {
   const rollback = argv[0] === "--rollback";
   const tokens = rollback ? argv.slice(1) : argv;
@@ -44,9 +62,48 @@ function parseArgs(argv) {
     stateDir: path.resolve(stateDir),
     prefix: path.resolve(prefix),
     profile: normalizeManagedProfile(values.get("--profile")),
+    hostTransactionId: values.get("--host-transaction-id")?.trim() || null,
+    hostTransactionVersion: values.get("--host-transaction-version")?.trim() || null,
   };
 }
 
+function resolveHostTransaction(params, { previousManifest, previousRoot, version }) {
+  const transactionId = String(params.hostTransactionId || "").trim();
+  const transactionVersion = String(params.hostTransactionVersion || "").trim();
+  if (Boolean(transactionId) !== Boolean(transactionVersion)) {
+    throw new Error(
+      "--host-transaction-id and --host-transaction-version must be provided together",
+    );
+  }
+  if (!transactionId) {
+    return null;
+  }
+  if (!HOST_TRANSACTION_ID_PATTERN.test(transactionId)) {
+    throw new Error("--host-transaction-id must be a UUID v4");
+  }
+  if (normalizeManagedProfile(params.profile) !== "hosting") {
+    throw new Error("A host update transaction can only activate a hosting runtime.");
+  }
+  if (transactionVersion !== version) {
+    throw new Error(
+      `Host transaction version ${transactionVersion} does not match runtime ${version}.`,
+    );
+  }
+
+  // A fresh hosting install has no application release to roll back. Its root
+  // installer owns the signer transaction and commits it after the first
+  // Gateway health check. Existing hosting installs coordinate both sides here.
+  if (!previousRoot || previousManifest?.profile !== "hosting") {
+    return null;
+  }
+  if (previousManifest.runtime?.activeVersion !== params.previousVersion) {
+    throw new Error(
+      "The active hosting manifest does not match the runtime selected for transactional repair.",
+    );
+  }
+  return { transactionId, transactionVersion };
+}
+
 async function pathExists(target) {
   try {
     await fsp.lstat(target);
@@ -56,6 +113,29 @@ async function pathExists(target) {
   }
 }
 
+async function fsyncTree(rootPath) {
+  const directories = [];
+  const pending = [rootPath];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    directories.push(current);
+    const directory = await fsp.opendir(current);
+    for await (const entry of directory) {
+      const entryPath = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        pending.push(entryPath);
+      } else if (entry.isFile()) {
+        const handle = await fsp.open(entryPath, "r");
+        await handle.sync().finally(() => handle.close());
+      }
+    }
+  }
+  for (const directoryPath of directories.toReversed()) {
+    const handle = await fsp.open(directoryPath, "r");
+    await handle.sync().finally(() => handle.close());
+  }
+}
+
 async function moveDirectory(source, destination) {
   try {
     await fsp.rename(source, destination);
@@ -95,7 +175,7 @@ async function replaceWithSymlink(target, linkPath) {
   return backupPath;
 }
 
-async function installStableFiles(paths, releaseRoot) {
+async function installStableFiles(paths, releaseRoot, durable = false) {
   const scriptDir = path.join(releaseRoot, "scripts");
   await copyExecutable(path.join(scriptDir, "fased-managed-launcher.sh"), paths.launcherPath);
   await copyExecutable(path.join(scriptDir, "fased-managed-service.sh"), paths.serviceLauncherPath);
@@ -104,18 +184,55 @@ async function installStableFiles(paths, releaseRoot) {
     path.join(scriptDir, "managed-runtime-layout.mjs"),
     path.join(paths.updaterDir, "managed-runtime-layout.mjs"),
   );
+  await copyExecutable(
+    path.join(scriptDir, "hosted-release-manifest.mjs"),
+    path.join(paths.updaterDir, "hosted-release-manifest.mjs"),
+  );
   await fsp.mkdir(path.dirname(paths.prefixLauncherPath), { recursive: true });
   const launcherBackup = await replaceWithSymlink(paths.launcherPath, paths.prefixLauncherPath);
   if (launcherBackup) {
     await fsp.rm(launcherBackup, { recursive: true, force: true });
   }
+  if (!durable) {
+    return;
+  }
+  const stablePaths = [
+    paths.launcherPath,
+    paths.serviceLauncherPath,
+    paths.updaterPath,
+    path.join(paths.updaterDir, "managed-runtime-layout.mjs"),
+    path.join(paths.updaterDir, "hosted-release-manifest.mjs"),
+  ];
+  for (const stablePath of stablePaths) {
+    const handle = await fsp.open(stablePath, "r");
+    await handle.sync().finally(() => handle.close());
+  }
+  for (const directoryPath of new Set(stablePaths.map((value) => path.dirname(value)))) {
+    const handle = await fsp.open(directoryPath, "r");
+    await handle.sync().finally(() => handle.close());
+  }
 }
 
-export async function installManagedRuntime(params) {
+export async function installManagedRuntime(params, dependencyOverrides = {}) {
+  const dependencies = {
+    authorizePreactivatedHostedGateway,
+    beginPreactivatedHostedTransaction,
+    ...dependencyOverrides,
+  };
   const paths = resolveManagedRuntimePaths(params);
   const existingManifest = readManagedInstallManifest(paths.manifestPath);
   const version = await assertManagedRuntime(params.packageRoot);
   const metadata = await readHostedRuntimeMetadata(params.packageRoot);
+  const hostedRelease = await readHostedReleaseBinding(params.packageRoot, metadata, version);
+  if (
+    normalizeManagedProfile(params.profile) === "hosting" &&
+    params.hostTransactionId &&
+    !hostedRelease
+  ) {
+    throw new Error(
+      "Maintained Hosting requires an attested unified app and signer release manifest.",
+    );
+  }
   let previousRoot = await resolveLinkTarget(paths.currentLink);
   let previousVersion = previousRoot ? await readPackageVersion(previousRoot) : null;
   let releaseRoot = path.join(paths.releasesDir, version);
@@ -161,30 +278,111 @@ export async function installManagedRuntime(params) {
     }
   }
 
+  const previousManifest =
+    existingManifest ||
+    (previousRoot && previousVersion
+      ? buildManagedInstallManifest({
+          paths,
+          profile: params.profile,
+          version: previousVersion,
+          previousVersion: null,
+        })
+      : null);
+  const hostTransaction = resolveHostTransaction(
+    { ...params, previousVersion },
+    { previousManifest, previousRoot, version },
+  );
+  if (params.hostTransactionId) {
+    await fsyncTree(releaseRoot);
+    const nodeModulesPath = path.join(releaseRoot, "node_modules");
+    const nodeModulesRoot = await fsp.realpath(nodeModulesPath).catch(() => null);
+    if (nodeModulesRoot && !nodeModulesRoot.startsWith(`${path.resolve(releaseRoot)}${path.sep}`)) {
+      const dependencyRoot = path.dirname(nodeModulesRoot);
+      const durabilityMarker = path.join(dependencyRoot, ".fased-durable-v1");
+      try {
+        await fsp.access(durabilityMarker);
+      } catch {
+        await fsyncTree(nodeModulesRoot);
+        await fsp.writeFile(durabilityMarker, "durable-v1\n", { mode: 0o600 });
+        const markerHandle = await fsp.open(durabilityMarker, "r");
+        await markerHandle.sync().finally(() => markerHandle.close());
+        const dependencyParent = await fsp.open(dependencyRoot, "r");
+        await dependencyParent.sync().finally(() => dependencyParent.close());
+      }
+    }
+    const releasesHandle = await fsp.open(paths.releasesDir, "r");
+    await releasesHandle.sync().finally(() => releasesHandle.close());
+  }
+
   if (previousRoot && path.resolve(previousRoot) !== path.resolve(releaseRoot)) {
     await atomicSymlink(previousRoot, paths.previousLink);
   }
-  await atomicSymlink(releaseRoot, paths.currentLink);
-
-  const compatibilityBackup = await replaceWithSymlink(
-    paths.currentLink,
-    paths.compatibilityPackageRoot,
-  );
-  await installStableFiles(paths, releaseRoot);
 
   const manifest = buildManagedInstallManifest({
     paths,
     profile: params.profile,
     version,
     dependencyHash: metadata?.dependencyHash,
+    hostedRelease,
     previousVersion: previousVersion || null,
   });
+  if (hostTransaction) {
+    await dependencies.beginPreactivatedHostedTransaction({
+      paths,
+      transactionId: hostTransaction.transactionId,
+      targetVersion: hostTransaction.transactionVersion,
+      previousVersion,
+      targetRoot: releaseRoot,
+      previousRoot,
+      nextManifest: manifest,
+      previousManifest,
+      timeoutMs: params.timeoutMs || DEFAULT_HOST_TRANSACTION_TIMEOUT_MS,
+    });
+    await fsp.chmod(paths.stateDir, 0o700).catch(() => undefined);
+    return { manifest, paths, releaseRoot, hostTransaction: true };
+  }
+
+  await atomicSymlink(releaseRoot, paths.currentLink);
+  const compatibilityBackup = await replaceWithSymlink(
+    paths.currentLink,
+    paths.compatibilityPackageRoot,
+  );
+  await installStableFiles(paths, releaseRoot, Boolean(params.hostTransactionId));
   await atomicWriteJson(paths.manifestPath, manifest, 0o600);
+  if (params.hostTransactionId) {
+    const identityManifestHandle = await fsp.open(paths.manifestPath, "r");
+    await identityManifestHandle.sync().finally(() => identityManifestHandle.close());
+    for (const directoryPath of new Set([
+      paths.stateDir,
+      paths.runtimeDir,
+      path.dirname(paths.compatibilityPackageRoot),
+    ])) {
+      const handle = await fsp.open(directoryPath, "r");
+      await handle.sync().finally(() => handle.close());
+    }
+    const authorization = await dependencies.authorizePreactivatedHostedGateway({
+      transactionId: params.hostTransactionId,
+      targetVersion: params.hostTransactionVersion,
+      timeoutMs: params.timeoutMs || DEFAULT_HOST_TRANSACTION_TIMEOUT_MS,
+    });
+    if (
+      !authorization?.release ||
+      !signerReleaseIdentitiesEqual(authorization.release, hostedRelease?.signer)
+    ) {
+      throw new Error(
+        "root signer updater did not return the exact signer identity from the unified release manifest",
+      );
+    }
+    manifest.signer = { release: authorization.release };
+    await atomicWriteJson(paths.manifestPath, manifest, 0o600);
+    const manifestHandle = await fsp.open(paths.manifestPath, "r");
+    await manifestHandle.sync().finally(() => manifestHandle.close());
+  }
   await fsp.chmod(paths.stateDir, 0o700).catch(() => undefined);
   if (compatibilityBackup) {
     await fsp.rm(compatibilityBackup, { recursive: true, force: true });
   }
-  return { manifest, paths, releaseRoot };
+  return { manifest, paths, releaseRoot, hostTransaction: false };
 }
 
 export async function rollbackManagedRuntime(params) {
@@ -201,6 +399,7 @@ export async function rollbackManagedRuntime(params) {
   const previousVersion = await assertManagedRuntime(previousRoot);
   const currentVersion = await readPackageVersion(currentRoot);
   const metadata = await readHostedRuntimeMetadata(previousRoot);
+  const hostedRelease = await readHostedReleaseBinding(previousRoot, metadata, previousVersion);
 
   await atomicSymlink(currentRoot, paths.previousLink);
   await atomicSymlink(previousRoot, paths.currentLink);
@@ -211,6 +410,7 @@ export async function rollbackManagedRuntime(params) {
     profile: manifest.profile,
     version: previousVersion,
     dependencyHash: metadata?.dependencyHash,
+    hostedRelease,
     previousVersion: currentVersion,
   });
   await atomicWriteJson(paths.manifestPath, previousManifest, 0o600);
@@ -233,6 +433,8 @@ if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.ar
 }
 
 export const __testing = {
+  parseArgs,
+  resolveHostTransaction,
   installStableFiles,
   moveDirectory,
   replaceWithSymlink,

package/scripts/managed-runtime-layout.mjs

@@ -2,8 +2,9 @@ import fs from "node:fs";
 import fsp from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { readHostedReleaseManifestV2 } from "./hosted-release-manifest.mjs";
 
-export const MANAGED_INSTALL_SCHEMA_VERSION = 1;
+export const MANAGED_INSTALL_SCHEMA_VERSION = 2;
 
 export function resolveManagedStateDir(env = process.env, homedir = os.homedir) {
   return path.resolve(
@@ -51,7 +52,7 @@ export function normalizeManagedProfile(value) {
 export function readManagedInstallManifest(manifestPath) {
   try {
     const parsed = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-    if (parsed?.schemaVersion !== MANAGED_INSTALL_SCHEMA_VERSION) {
+    if (parsed?.schemaVersion !== 1 && parsed?.schemaVersion !== MANAGED_INSTALL_SCHEMA_VERSION) {
       return null;
     }
     if (!parsed.runtime || typeof parsed.runtime.activeVersion !== "string") {
@@ -79,7 +80,13 @@ export async function readHostedRuntimeMetadata(packageRoot) {
     const parsed = JSON.parse(
       await fsp.readFile(path.join(packageRoot, ".fased-hosted-runtime.json"), "utf8"),
     );
-    if (parsed?.schemaVersion !== 1 || !/^[a-f0-9]{64}$/.test(parsed.dependencyHash || "")) {
+    if (
+      !new Set([1, 2]).has(parsed?.schemaVersion) ||
+      !/^[a-f0-9]{64}$/.test(parsed.dependencyHash || "") ||
+      (parsed.schemaVersion === 2 &&
+        (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(parsed.version || "") ||
+          !/^[a-f0-9]{40}$/.test(parsed.commit || "")))
+    ) {
       return null;
     }
     return parsed;
@@ -88,6 +95,45 @@ export async function readHostedRuntimeMetadata(packageRoot) {
   }
 }
 
+export async function readHostedReleaseBinding(packageRoot, metadata, expectedVersion) {
+  const releasePath = path.join(packageRoot, ".fased-hosted-release-v2.json");
+  let release;
+  try {
+    release = await readHostedReleaseManifestV2(releasePath, { version: expectedVersion });
+  } catch (error) {
+    if (error?.code === "ENOENT" && metadata?.schemaVersion !== 2) {
+      return null;
+    }
+    throw error;
+  }
+  const architecture = process.arch === "x64" ? "x64" : process.arch === "arm64" ? "arm64" : null;
+  if (!architecture) {
+    throw new Error(`Managed Hosting release has no Linux artifact for ${process.arch}.`);
+  }
+  const app = release.manifest.application.linux[architecture];
+  if (
+    metadata?.schemaVersion !== 2 ||
+    metadata.version !== expectedVersion ||
+    metadata.commit !== release.manifest.release.commit ||
+    metadata.dependencyHash !== app.dependencies.dependencyHash
+  ) {
+    throw new Error("Managed Hosting app metadata does not match its attested release manifest.");
+  }
+  return Object.freeze({
+    manifestDigest: release.digest,
+    version: release.manifest.release.version,
+    commit: release.manifest.release.commit,
+    appArtifact: app.artifact.asset,
+    appArtifactDigest: `sha256:${app.artifact.sha256}`,
+    dependencyArtifact: app.dependencies.asset,
+    dependencyArtifactDigest: `sha256:${app.dependencies.sha256}`,
+    dependencyHash: app.dependencies.dependencyHash,
+    signer: release.manifest.signer.release,
+    capabilities: release.manifest.signer.capabilities,
+    capabilitiesDigest: release.manifest.signer.capabilitiesDigest,
+  });
+}
+
 export async function assertManagedRuntime(packageRoot, expectedVersion) {
   const version = await readPackageVersion(packageRoot);
   if (!version || (expectedVersion && version !== expectedVersion)) {
@@ -152,6 +198,7 @@ export function buildManagedInstallManifest({
   profile,
   version,
   dependencyHash,
+  hostedRelease,
   previousVersion,
   source = "managed-artifact",
 }) {
@@ -169,6 +216,10 @@ export function buildManagedInstallManifest({
       previousLink: paths.previousLink,
       releasesDir: paths.releasesDir,
       dependencyHash: dependencyHash || null,
+      releaseManifestDigest: hostedRelease?.manifestDigest || null,
+      appCommit: hostedRelease?.commit || null,
+      appArtifact: hostedRelease?.appArtifact || null,
+      appArtifactDigest: hostedRelease?.appArtifactDigest || null,
     },
     package: {
       prefix: paths.prefix,
@@ -183,6 +234,27 @@ export function buildManagedInstallManifest({
       version,
       path: paths.updaterPath,
     },
+    release: hostedRelease
+      ? {
+          version: hostedRelease.version,
+          commit: hostedRelease.commit,
+          manifestDigest: hostedRelease.manifestDigest,
+          application: {
+            artifact: hostedRelease.appArtifact,
+            digest: hostedRelease.appArtifactDigest,
+            dependencies: {
+              artifact: hostedRelease.dependencyArtifact,
+              digest: hostedRelease.dependencyArtifactDigest,
+              dependencyHash: hostedRelease.dependencyHash,
+            },
+          },
+          signer: {
+            release: hostedRelease.signer,
+            capabilities: hostedRelease.capabilities,
+            capabilitiesDigest: hostedRelease.capabilitiesDigest,
+          },
+        }
+      : null,
     updatedAt: new Date().toISOString(),
   };
 }

package/scripts/migrate-hosted-signer-v2.mjs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const SIGNER_BINARY = "/opt/fased/signer/fased-signerd";
+const FIXED_ARGS = [
+  "admin",
+  "migration",
+  "hosted-v1",
+  "--control-socket",
+  "/run/fased-signerd/control.sock",
+  "--policy-file",
+  "/etc/fased/signer-migration-policies.json",
+  "--app-home",
+  "/home/app",
+  "--legacy-signer-home",
+  "/home/fased-signer",
+  "--state-dir",
+  "/var/lib/fased-signerd",
+  "--marker-file",
+  "/var/lib/fased-host-updater/signer-v1-migration.pending",
+];
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function resolvePhase(argv = process.argv) {
+  if (argv.length !== 3 || !new Set(["prepare", "commit"]).has(argv[2])) {
+    fail("usage: migrate-hosted-signer-v2.mjs {prepare|commit}");
+  }
+  return argv[2];
+}
+
+function run(phase) {
+  const child = spawnSync(SIGNER_BINARY, [...FIXED_ARGS, "--phase", phase], {
+    env: {
+      HOME: "/var/lib/fased-host-updater",
+      LANG: "C",
+      LC_ALL: "C",
+      PATH: "/usr/sbin:/usr/bin:/sbin:/bin",
+    },
+    stdio: "inherit",
+  });
+  if (child.error) {
+    fail("the verified native signer migration command could not be started");
+  }
+  if (child.status !== 0) {
+    process.exitCode = child.status ?? 1;
+  }
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  run(resolvePhase());
+}
+
+export const __testing = { FIXED_ARGS, SIGNER_BINARY, resolvePhase };