@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/process_linux.go

@@ -0,0 +1,177 @@
+package helper
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+)
+
+func executableDigest(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return "", err
+	}
+	s, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || s.Uid != 0 || st.Mode().Perm()&0022 != 0 || !st.Mode().IsRegular() || st.Size() > 64<<20 {
+		return "", errTrust
+	}
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+func inspectSupervisor(pid int, i Inventory) (Process, error) {
+	base := fmt.Sprintf("/proc/%d/", pid)
+	b, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
+	if err != nil {
+		return Process{}, err
+	}
+	stat, err := os.ReadFile(base + "stat")
+	if err != nil {
+		return Process{}, err
+	}
+	end := strings.LastIndex(string(stat), ") ")
+	if end < 0 {
+		return Process{}, errTrust
+	}
+	fields := strings.Fields(string(stat)[end+2:])
+	if len(fields) < 20 {
+		return Process{}, errTrust
+	}
+	status, err := os.ReadFile(base + "status")
+	if err != nil {
+		return Process{}, err
+	}
+	root := false
+	for _, line := range strings.Split(string(status), "\n") {
+		if strings.HasPrefix(line, "Uid:") {
+			u := strings.Fields(line)
+			root = len(u) == 5 && u[1] == "0" && u[2] == "0" && u[3] == "0" && u[4] == "0"
+		}
+	}
+	if !root {
+		return Process{}, errTrust
+	}
+	cmd, err := os.ReadFile(base + "cmdline")
+	if err != nil {
+		return Process{}, err
+	}
+	wantExe := "/var/lib/synopkgland-" + i.Package + "/payload-" + i.PayloadDigest
+	if string(cmd) != wantExe+"\x00supervise\x00" {
+		return Process{}, errTrust
+	}
+	st, err := os.Stat(base + "exe")
+	if err != nil {
+		return Process{}, err
+	}
+	s := st.Sys().(*syscall.Stat_t)
+	digest, err := executableDigest(base + "exe")
+	if err != nil || digest != i.PayloadDigest {
+		return Process{}, errTrust
+	}
+	return Process{Inventory: i, Mode: "supervised", PID: pid, Boot: strings.TrimSpace(string(b)), Start: fields[19], Device: uint64(s.Dev), Inode: s.Ino}, nil
+}
+
+type LinuxProcesses struct {
+	Client
+	Binary string
+}
+
+func (p LinuxProcesses) Start(i Inventory) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	if i != p.Expected {
+		return errTrust
+	}
+	if err := protected(p.RunDir, 0, true); err != nil {
+		return err
+	}
+	cmd := exec.Command(p.Binary, "supervise")
+	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin"}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	go cmd.Wait()
+	if waitHealthy(ctx, func(ctx context.Context) bool {
+		state, _ := p.probe(ctx, filepath.Join(p.RunDir, "helper.sock"))
+		return state == "ready"
+	}) == nil {
+		return nil
+	}
+	return errors.New("helper start timeout; residual preserved")
+}
+
+// RunLinux runs a fixed control action or the health-only server. Its caller
+// must be the hash-verified, root-owned copy, never the SPK staging executable.
+func RunLinux(base Inventory, action string) error {
+	if os.Geteuid() != 0 {
+		return errTrust
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	digest, err := executableDigest(exe)
+	if err != nil {
+		return err
+	}
+	base.PayloadDigest = digest
+	if !base.Valid() || exe != "/var/lib/synopkgland-"+base.Package+"/payload-"+digest {
+		return errTrust
+	}
+	c := NewClient(base)
+	if err := protected(c.StateDir, 0, true); err != nil {
+		return err
+	}
+	if err := protected(c.RunDir, 0, true); err != nil {
+		return err
+	}
+	switch action {
+	case "supervise":
+		return superviseLinux(c, exe)
+	case "operation-child":
+		return operationChildLinux(c)
+	case "serve-child":
+		parent, err := strconv.Atoi(os.Getenv("SYNOPKGLAND_PARENT"))
+		if err != nil {
+			return errTrust
+		}
+		runtime.LockOSThread()
+		defer runtime.UnlockOSThread()
+		if err := armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
+			return err
+		}
+		if _, err := inspectSupervisor(parent, base); err != nil {
+			return err
+		}
+		if err := inheritLifetime(c); err != nil {
+			return err
+		}
+		return serveLinux(c)
+	}
+	return (Controller{Client: c, Processes: LinuxProcesses{Client: c, Binary: exe}, Observe: observeLinux, Boot: linuxBoot}).Control(context.Background(), action)
+}
+
+func linuxBoot() (string, error) {
+	b, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
+	return strings.TrimSpace(string(b)), err
+}

package/templates/native-go/backend/internal/helper/process_other.go

@@ -0,0 +1,5 @@
+//go:build !linux
+
+package helper
+
+func RunLinux(Inventory, string) error { return errTrust }

package/templates/native-go/backend/internal/helper/publication_test.go

@@ -0,0 +1,178 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// An approval rename is visible before the publisher's directory fsync and
+// policy.lock release. Reproduce that interval with real files and flock.
+func heldCompletion(t *testing.T, c Controller, f *fakeProcesses) (<-chan error, func()) {
+	t.Helper()
+	published := make(chan error, 1)
+	var lock *os.File
+	f.stopHook = func(p Process) error {
+		var err error
+		lock, err = os.OpenFile(filepath.Join(c.StateDir, "policy.lock"), os.O_RDWR, 0)
+		if err == nil {
+			err = syscall.Flock(int(lock.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
+		}
+		if err == nil {
+			err = cleanRuntime(c.Client, true)
+		}
+		if err == nil {
+			var r Record
+			r, err = readRecord(c.StateDir, c.Owner)
+			if err == nil {
+				r.Lifecycle.Phase = "stopped"
+				err = storeCompletion(c.Client, &r, Completion{Epoch: r.Lifecycle.Epoch, Process: p})
+				if err == nil {
+					err = writeProtected(c.StateDir, "approval.json", r)
+				}
+			}
+		}
+		published <- err
+		return errTrust // owner completed before the controller socket operation
+	}
+	release := func() {
+		if lock != nil {
+			syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
+			lock.Close()
+			lock = nil
+		}
+	}
+	return published, release
+}
+
+func TestControllerWaitsForCompletionPublisherUnlock(t *testing.T) {
+	for _, action := range []string{"teardown", "disable", "recover", "enable"} {
+		t.Run(action, func(t *testing.T) {
+			c, f := controlFixture(t)
+			published, release := heldCompletion(t, c, f)
+			defer release()
+			result := make(chan error, 1)
+			go func() { result <- c.Control(context.Background(), action) }()
+			if err := <-published; err != nil {
+				t.Fatal(err)
+			}
+			select {
+			case err := <-result:
+				t.Fatalf("returned before the completion publisher unlocked: %v", err)
+			case <-time.After(100 * time.Millisecond):
+			}
+			release()
+			select {
+			case err := <-result:
+				if err != nil {
+					t.Fatal("exact owner completion refused after unlock", err)
+				}
+			case <-time.After(2 * time.Second):
+				t.Fatal("controller did not finish after publisher unlock")
+			}
+			r, _ := readRecord(c.StateDir, c.Owner)
+			starts := 0
+			if action == "enable" || action == "recover" {
+				starts = 1
+			}
+			if r.Residual || r.Enabled != (action != "disable") || f.started != starts {
+				t.Fatal("incorrect post-teardown state", r, f.started)
+			}
+		})
+	}
+}
+
+func TestControllerRevalidatesCompletionAfterPublisherUnlock(t *testing.T) {
+	for _, kind := range []string{"epoch", "inventory", "binding", "lease", "proof", "digest", "missing-commit", "missing-proof", "mode", "symlink", "runtime"} {
+		t.Run(kind, func(t *testing.T) {
+			c, f := controlFixture(t)
+			published, release := heldCompletion(t, c, f)
+			defer release()
+			result := make(chan error, 1)
+			go func() { result <- c.Control(context.Background(), "recover") }()
+			if err := <-published; err != nil {
+				t.Fatal(err)
+			}
+			select {
+			case err := <-result:
+				t.Fatalf("returned before revalidation: %v", err)
+			case <-time.After(100 * time.Millisecond):
+			}
+			r, _ := readRecord(c.StateDir, c.Owner)
+			switch kind {
+			case "epoch":
+				r.Lifecycle.Epoch = strings.Repeat("e", 64)
+			case "inventory":
+				r.Inventory.Version = "9.0.0-0001"
+			case "binding":
+				r.Lifecycle.Binding.Entered++
+			case "lease":
+				r.Lifecycle.Lease = &Lease{Device: 1, Inode: 9}
+			case "proof":
+				p := f.current
+				p.Start = "different-owned-process"
+				if err := storeCompletion(c.Client, &r, Completion{Epoch: r.Lifecycle.Epoch, Process: p}); err != nil {
+					t.Fatal(err)
+				}
+			case "digest":
+				r.Lifecycle.Completion = strings.Repeat("f", 64)
+			case "missing-commit":
+				r.Lifecycle.Completion = ""
+			case "missing-proof", "mode", "symlink":
+				path := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
+				var err error
+				if kind == "mode" {
+					err = os.Chmod(path, 0644)
+				} else {
+					err = os.Remove(path)
+					if err == nil && kind == "symlink" {
+						err = os.Symlink("approval.json", path)
+					}
+				}
+				if err != nil {
+					t.Fatal(err)
+				}
+			case "runtime":
+				if err := writeProcess(c.RunDir, f.current); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+				t.Fatal(err)
+			}
+			before, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+			release()
+			if err := <-result; err == nil || f.started != 0 {
+				t.Fatal("changed completion accepted", err, f.started)
+			}
+			after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+			if string(before) != string(after) {
+				t.Fatal("failure evidence overwritten")
+			}
+		})
+	}
+}
+
+func TestControllerCompletionPublisherWaitIsBounded(t *testing.T) {
+	c, f := controlFixture(t)
+	published, release := heldCompletion(t, c, f)
+	defer release()
+	result := make(chan error, 1)
+	go func() { result <- c.Control(context.Background(), "teardown") }()
+	if err := <-published; err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case err := <-result:
+		if !errors.Is(err, errBusy) {
+			t.Fatal("persistent publisher lock was accepted", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("unbounded publisher lock wait")
+	}
+}

package/templates/native-go/backend/internal/helper/read_stream_cohort_linux_test.go

@@ -0,0 +1,156 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+)
+
+func readStreamVMCreate(t *testing.T, p LinuxProcesses) Grant {
+	t.Helper()
+	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionReadStream}})
+	if res.Code != "" || res.Intent == nil {
+		t.Fatal(res)
+	}
+	b, e := os.ReadFile(p.StateDir + "/grants.json")
+	if e != nil {
+		t.Fatal(e)
+	}
+	store, code := DecodeGrantStore(bytes.NewReader(b))
+	if code != "" {
+		t.Fatal(code)
+	}
+	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
+	if res.Code != "" || res.Grant == nil {
+		t.Fatal(res)
+	}
+	return *res.Grant
+}
+func readStreamVMWait(t *testing.T, fn func() bool) {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if err := waitHealthy(ctx, func(context.Context) bool { return fn() }); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestLinuxReadStreamRealChildProofBackpressureAndQ(t *testing.T) {
+	for _, kind := range []string{"complete", "acl", "groups", "disconnect", "epoch", "backpressure"} {
+		t.Run(kind, func(t *testing.T) {
+			p := readOnlyVMFixture(t)
+			proc := startVMHelper(t, p)
+			g := readStreamVMCreate(t, p)
+			defer func() {
+				if e := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); e != nil {
+					t.Error(e)
+				}
+			}()
+			expected := bytes.Repeat([]byte("s"), 2*MaxBoundedBytes)
+			if e := os.WriteFile("/tmp/m2-s5-operations/stream", expected, 0644); e != nil {
+				t.Fatal(e)
+			}
+			if kind == "backpressure" {
+				os.WriteFile(p.RunDir+"/fixture-readonly-block-output", nil, 0600)
+			}
+			if kind == "disconnect" {
+				os.WriteFile(p.RunDir+"/fixture-disconnect", nil, 0600)
+			}
+			r := readOnlyVMRequest(t, g, ActionReadStream, ReadArgs{Segments: []string{"stream"}, MaxBytes: MaxTransferBytes})
+			if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
+				t.Fatal(res)
+			}
+			metadata := grantVMMetadata(t, p, r)
+			if metadata.Code != "" || metadata.Bytes != uint64(len(expected)) {
+				t.Fatal(metadata)
+			}
+			chunk := r
+			chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"stream"}, MaxBytes: MaxChunkBytes})
+			lease := func() Code {
+				chunk.Nonce = readOnlyVMRef(t)
+				chunk.Ticket = readOnlyVMRef(t)
+				return grantVMCall(t, p, "operation.chunk", chunk).Code
+			}
+			if code := lease(); code != "" {
+				t.Fatal(code)
+			}
+			if kind == "backpressure" {
+				if code := lease(); code != ErrBusy {
+					t.Fatal("slow client accepted second outstanding lease", code)
+				}
+				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+				store, _ := DecodeGrantStore(bytes.NewReader(raw))
+				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+				if res.Code != "" || res.Revoke == nil || !res.Revoke.Drained {
+					t.Fatal(res)
+				}
+				raw, e := os.ReadFile(p.StateDir + "/grant-q-" + g.ID + ".json")
+				var q GrantQuiescence
+				if e != nil || json.Unmarshal(raw, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.AdmittedBytes != MaxChunkBytes {
+					t.Fatal(q, e)
+				}
+				if code := lease(); code == "" {
+					t.Fatal("lease after R/Q")
+				}
+				return
+			}
+			readStreamVMWait(t, func() bool {
+				b, _ := os.ReadFile(p.RunDir + "/fixture-progress")
+				n, _ := strconv.Atoi(string(b))
+				return n == MaxChunkBytes
+			})
+			switch kind {
+			case "acl":
+				os.WriteFile("/tmp/m2-s5-operations/deny-acl", nil, 0644)
+			case "groups":
+				os.WriteFile("/tmp/m2-s5-operations/group-change", nil, 0644)
+			case "epoch":
+				chunk.Epoch = grantRef('f')
+			}
+			if kind == "complete" {
+				for sent := MaxChunkBytes; sent < len(expected); {
+					code := lease()
+					if code == ErrBusy {
+						time.Sleep(time.Millisecond)
+						continue
+					}
+					if code != "" {
+						t.Fatal(sent, code)
+					}
+					sent += MaxChunkBytes
+				}
+			} else if kind != "disconnect" {
+				code := lease()
+				if kind != "acl" && code == "" {
+					t.Fatal("changed binding admitted", kind)
+				}
+			}
+			if kind == "epoch" {
+				raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+				store, _ := DecodeGrantStore(bytes.NewReader(raw))
+				res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+				if res.Code != "" || !res.Revoke.Drained {
+					t.Fatal(res)
+				}
+			}
+			readStreamVMWait(t, func() bool {
+				_, e := os.Stat(p.RunDir + "/fixture-readonly-bytes")
+				return e == nil && len(processChildren(proc.PID)) == 1
+			})
+			b, e := os.ReadFile(p.RunDir + "/fixture-readonly-bytes")
+			if e != nil {
+				t.Fatal(e)
+			}
+			want := MaxChunkBytes
+			if kind == "complete" {
+				want = len(expected)
+			}
+			if len(b) != want || !bytes.Equal(b, expected[:want]) {
+				t.Fatal(kind, "unproved or truncated bytes", len(b), want)
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/read_transfer.go

@@ -0,0 +1,40 @@
+package helper
+
+import (
+	"context"
+	"time"
+)
+
+// Stream is a staged fixed read action. It has no public socket/generator/CGI
+// enablement until DSM FD ACL and end-to-end CGI proof pass.
+const MaxStreamReplayEntries = MaxPackageOperations * (MaxTransferBytes/MaxChunkBytes + MaxReplayEntries)
+
+func readDataCeiling(a Action) uint64 {
+	if a == ActionReadStream {
+		return MaxTransferBytes
+	}
+	return MaxBoundedBytes
+}
+func (op *cohortOperation) expired(now time.Time) bool {
+	if op.admittedAt.IsZero() {
+		return false
+	}
+	stream := op.work != nil && op.work.Action == ActionReadStream || op.writeWork != nil && op.writeWork.Action == ActionWriteStream
+	if !stream {
+		return now.Sub(op.admittedAt) >= BoundedTimeout
+	}
+	last := op.lastActivity
+	if last.IsZero() {
+		last = op.admittedAt
+	}
+	return now.Before(op.admittedAt) || now.Before(last) || now.Sub(op.admittedAt) >= StreamTotalTimeout || now.Sub(last) >= StreamIdleTimeout
+}
+
+// Internal child stream interface. Only a fixed actor-opened FD implementation
+// is constructed by bootstrap. Caller transport supplies leases, never a source.
+// A successful chunk includes fresh child FD ACL/object checks. Root separately
+// binds subject/session/ticket/grant/revision/epoch under the S3 admission lock.
+type readStreamSource interface {
+	ReadChunk(context.Context, uint32) ([]byte, Code)
+	Close()
+}

package/templates/native-go/backend/internal/helper/read_transfer_linux.go

@@ -0,0 +1,109 @@
+package helper
+
+import (
+	"context"
+	"golang.org/x/sys/unix"
+	"io"
+)
+
+// Child-only FD source. Bounded reads retain S5's eager validation/buffer;
+// streams retain the captured object and allocate at most one leased chunk.
+// No caller path, range, URL, executable, or root-opened readable FD is accepted.
+type actorReadTransfer struct {
+	ctx               context.Context
+	object            *readOnlyObject
+	work              readOnlyWork
+	acl               readOnlyACL
+	buffer            []byte
+	remaining, offset uint64
+}
+
+func openActorReadTransfer(ctx context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork, acl readOnlyACL) (*actorReadTransfer, readOnlyResult) {
+	fail := func(c Code) (*actorReadTransfer, readOnlyResult) { return nil, readOnlyResult{Code: c} }
+	if code := w.validate(); code != "" {
+		return fail(code)
+	}
+	if w.Action != ActionRead && w.Action != ActionReadStream {
+		return fail(ErrUnsupported)
+	}
+	if acl == nil {
+		return fail(ErrUnsupported)
+	}
+	o, code := resolveReadOnly(ctx, pin, w)
+	if code != "" {
+		return fail(code)
+	}
+	ok := false
+	defer func() {
+		if !ok {
+			o.Close()
+		}
+	}()
+	if code := authorizeReadOnly(ctx, o, w, acl); code != "" {
+		return fail(code)
+	}
+	if o.before.Mode&unix.S_IFMT != unix.S_IFREG {
+		return fail(ErrDenied)
+	}
+	if o.before.Size < 0 || uint64(o.before.Size) > w.MaxBytes {
+		return fail(ErrLimit)
+	}
+	src := &actorReadTransfer{ctx: ctx, object: o, work: w, acl: acl, remaining: uint64(o.before.Size)}
+	if w.Action == ActionRead {
+		b, err := io.ReadAll(io.LimitReader(o.data, int64(w.MaxBytes)+1))
+		if err != nil {
+			return fail(readOnlyError(err))
+		}
+		if uint64(len(b)) > w.MaxBytes {
+			return fail(ErrLimit)
+		}
+		if uint64(len(b)) != src.remaining {
+			return fail(ErrStale)
+		}
+		src.buffer = b
+	}
+	if code := src.check(); code != "" {
+		return fail(code)
+	}
+	ok = true
+	return src, readOnlyResult{Bytes: src.remaining}
+}
+func (s *actorReadTransfer) check() Code {
+	if code := authorizeReadOnly(s.ctx, s.object, s.work, s.acl); code != "" {
+		return code
+	}
+	return readOnlyUnchanged(int(s.object.data.Fd()), s.object.before)
+}
+func (s *actorReadTransfer) Next(n uint32) ([]byte, Code) {
+	if n == 0 || n > MaxChunkBytes || uint64(n) > s.remaining {
+		return nil, ErrLimit
+	}
+	if code := s.check(); code != "" {
+		return nil, code
+	}
+	var b []byte
+	if s.work.Action == ActionRead {
+		b = s.buffer[s.offset : s.offset+uint64(n)]
+	} else {
+		b = make([]byte, n)
+		if _, err := io.ReadFull(s.object.data, b); err != nil {
+			return nil, ErrStale
+		}
+	}
+	if code := s.check(); code != "" {
+		return nil, code
+	}
+	s.remaining -= uint64(n)
+	s.offset += uint64(n)
+	return b, ""
+}
+func (s *actorReadTransfer) Close() { s.object.Close(); s.buffer = nil }
+
+var _ readStreamSource = (*actorReadTransfer)(nil)
+
+func (s *actorReadTransfer) ReadChunk(ctx context.Context, n uint32) ([]byte, Code) {
+	original := s.ctx
+	s.ctx = ctx
+	defer func() { s.ctx = original }()
+	return s.Next(n)
+}