@synopackageland/cli 0.3.9 → 0.4.0

package/dist/templates/native-go/backend/internal/helper/status_test.go

@@ -0,0 +1,205 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func fixture(t *testing.T) Client {
+	t.Helper()
+	i := Inventory{Package: "Fixture", Version: "1.0.0-0001", Protocol: 1, PayloadDigest: strings.Repeat("a", 64), RegistryDigest: strings.Repeat("b", 64)}
+	run, err := os.MkdirTemp("/tmp", "m1a-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(run) })
+	return Client{Expected: i, StateDir: t.TempDir(), RunDir: run, Owner: uint32(os.Getuid()), Peer: func(*net.UnixConn) error { return nil }}
+}
+
+func record(t *testing.T, c Client, r Record) {
+	t.Helper()
+	b, _ := json.Marshal(r)
+	if err := os.WriteFile(filepath.Join(c.StateDir, "approval.json"), b, 0644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func live(t *testing.T, c Client, i Inventory, reply func(Request) Response) {
+	t.Helper()
+	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: filepath.Join(c.RunDir, "helper.sock"), Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { l.Close() })
+	go func() {
+		for {
+			conn, err := l.AcceptUnix()
+			if err != nil {
+				return
+			}
+			go func() {
+				defer conn.Close()
+				var req Request
+				if json.NewDecoder(conn).Decode(&req) != nil {
+					return
+				}
+				r := Respond(i, false, req)
+				if reply != nil {
+					r = reply(req)
+				}
+				json.NewEncoder(conn).Encode(r)
+			}()
+		}
+	}()
+}
+
+func TestSixStatesAndPriority(t *testing.T) {
+	c := fixture(t)
+	check := func(want string) {
+		t.Helper()
+		s := c.Status(context.Background())
+		if s.State != want {
+			t.Fatalf("want %s, got %+v", want, s)
+		}
+	}
+	c.Expected = Inventory{}
+	check("not-enabled")
+	c.Expected = fixture(t).Expected
+	check("needs-approval")
+	record(t, c, Record{Inventory: c.Expected, Enabled: true})
+	check("stopped")
+	live(t, c, c.Expected, nil)
+	check("ready")
+	old := c.Expected
+	old.Protocol++
+	record(t, c, Record{Inventory: old, Enabled: true})
+	check("incompatible")
+	record(t, c, Record{Inventory: old, Enabled: false})
+	check("not-enabled")
+}
+
+func TestLiveProbeCannotBeReplacedByApprovalOrHistoricalOutput(t *testing.T) {
+	c := fixture(t)
+	record(t, c, Record{Inventory: c.Expected, Enabled: true})
+	if err := os.WriteFile(filepath.Join(c.RunDir, "helper.sock"), []byte("ready"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if got := c.Status(context.Background()).State; got != "incompatible" {
+		t.Fatal(got)
+	}
+}
+
+func TestHandshakeFailuresAreRedacted(t *testing.T) {
+	for _, kind := range []string{"nonce", "protocol", "payload", "worker", "version", "peer"} {
+		t.Run(kind, func(t *testing.T) {
+			c := fixture(t)
+			record(t, c, Record{Inventory: c.Expected, Enabled: true})
+			live(t, c, c.Expected, func(req Request) Response {
+				r := Respond(c.Expected, false, req)
+				switch kind {
+				case "nonce":
+					r.Nonce = "replay"
+				case "protocol":
+					r.Inventory.Protocol++
+				case "payload":
+					r.Inventory.PayloadDigest = "foreign"
+				case "worker":
+					r.Inventory.RegistryDigest = "foreign"
+				case "version":
+					r.Inventory.Version = "old"
+				}
+				return r
+			})
+			if kind == "peer" {
+				c.Peer = func(*net.UnixConn) error { return os.ErrPermission }
+			}
+			s := c.Status(context.Background())
+			if s.State != "incompatible" {
+				t.Fatalf("%+v", s)
+			}
+			b, _ := json.Marshal(s)
+			if strings.Contains(string(b), c.StateDir) || strings.Contains(string(b), "foreign") {
+				t.Fatal(string(b))
+			}
+		})
+	}
+	c := fixture(t)
+	record(t, c, Record{Inventory: c.Expected, Enabled: true})
+	live(t, c, c.Expected, func(req Request) Response { return Response{Inventory: c.Expected, Nonce: req.Nonce, Error: "failed"} })
+	if c.Status(context.Background()).State != "failed" {
+		t.Fatal("health failure must be failed")
+	}
+}
+
+func TestUntrustedPersistentStateFailsClosed(t *testing.T) {
+	for _, kind := range []string{"writable", "symlink", "malformed"} {
+		t.Run(kind, func(t *testing.T) {
+			c := fixture(t)
+			record(t, c, Record{Inventory: c.Expected, Enabled: true})
+			p := filepath.Join(c.StateDir, "approval.json")
+			switch kind {
+			case "writable":
+				os.Chmod(p, 0666)
+			case "symlink":
+				os.Rename(p, p+".real")
+				os.Symlink(p+".real", p)
+			case "malformed":
+				os.WriteFile(p, []byte(`{"enabled":false}`), 0644)
+			}
+			if c.Status(context.Background()).State != "incompatible" {
+				t.Fatal("untrusted state accepted")
+			}
+		})
+	}
+}
+
+func TestOldHelperRejectsNewInventoryAndAllUnimplementedWork(t *testing.T) {
+	i := fixture(t).Expected
+	for _, field := range []string{"protocol", "payload", "workers", "version", "package"} {
+		new := i
+		switch field {
+		case "protocol":
+			new.Protocol++
+		case "payload":
+			new.PayloadDigest = strings.Repeat("c", 64)
+		case "workers":
+			new.RegistryDigest = strings.Repeat("c", 64)
+		case "version":
+			new.Version = "2.0.0-0001"
+		case "package":
+			new.Package = "Other"
+		}
+		r := Respond(i, false, Request{Inventory: new, Op: "work", Nonce: "test"})
+		if r.Error != "incompatible" || r.OK {
+			t.Fatalf("%s: %+v", field, r)
+		}
+	}
+	if r := Respond(i, true, Request{Inventory: i, Op: "health"}); r.OK || r.Error != "disabled" {
+		t.Fatal(r)
+	}
+	if r := Respond(i, false, Request{Inventory: i, Op: "work"}); r.OK || r.Error != "unsupported" {
+		t.Fatal(r)
+	}
+}
+
+func TestMissingEnableFieldIsNotARevocationRecord(t *testing.T) {
+	c := fixture(t)
+	b, _ := json.Marshal(map[string]any{"inventory": c.Expected})
+	os.WriteFile(filepath.Join(c.StateDir, "approval.json"), b, 0644)
+	if c.Status(context.Background()).State != "incompatible" {
+		t.Fatal("incomplete approval treated as trusted disable")
+	}
+}
+
+func TestProcessRecordIsNotReadableByOrdinaryOSUsers(t *testing.T) {
+	c, _ := controlFixture(t)
+	s, err := os.Stat(filepath.Join(c.RunDir, "process.json"))
+	if err != nil || s.Mode().Perm() != 0600 {
+		t.Fatalf("process record permissions: %v %v", s, err)
+	}
+}

package/dist/templates/native-go/backend/internal/helper/supervision.go

@@ -0,0 +1,84 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"syscall"
+	"time"
+)
+
+// Also runs after exec: the parent can die between fork's prctl and exec.
+func armParentDeath(expected int, set func() error, parent func() int) error {
+	if expected <= 1 || parent() != expected {
+		return errTrust
+	}
+	if err := set(); err != nil {
+		return err
+	}
+	if parent() != expected {
+		return errTrust
+	}
+	return nil
+}
+
+type supervisedChild interface {
+	exited() (bool, error)
+	signal(syscall.Signal) error
+}
+
+// Caller is the sole reaper and signal owner. A zombie retains its PID until
+// exited() reaps it; a background Wait goroutine would invalidate this proof.
+func stopChild(ctx context.Context, child supervisedChild, grace time.Duration) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	done, err := child.exited()
+	if err != nil || done {
+		return err
+	}
+	if err := child.signal(syscall.SIGTERM); err != nil {
+		return err
+	}
+	escalate := time.Now().Add(grace)
+	killed := false
+	for {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		done, err := child.exited()
+		if err != nil || done {
+			return err
+		}
+		if !killed && !time.Now().Before(escalate) {
+			if err := child.signal(syscall.SIGKILL); err != nil {
+				return err
+			}
+			killed = true
+		}
+		timer := time.NewTimer(time.Millisecond)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return ctx.Err()
+		case <-timer.C:
+		}
+	}
+}
+
+// Read to actual connection EOF. A LimitReader's synthetic EOF at the size
+// cap can never certify supervisor exit, so reaching that cap is a refusal.
+func readSupervisorReply(reader io.Reader, want Inventory, nonce string) error {
+	b, err := io.ReadAll(io.LimitReader(reader, 4097))
+	if err != nil || len(b) > 4096 {
+		return errTrust
+	}
+	var res Response
+	d := json.NewDecoder(bytes.NewReader(b))
+	d.DisallowUnknownFields()
+	if d.Decode(&res) != nil || d.Decode(new(any)) != io.EOF || !res.OK || res.Error != "" || res.Inventory != want || res.Nonce != nonce {
+		return errTrust
+	}
+	return nil
+}

package/dist/templates/native-go/backend/internal/helper/supervision_test.go

@@ -0,0 +1,124 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestParentDeathSetupChecksBeforeAndAfterPrctl(t *testing.T) {
+	for _, tc := range []struct {
+		before, after int
+		setErr        error
+		ok            bool
+	}{
+		{42, 42, nil, true}, {1, 1, nil, false}, {42, 1, nil, false}, {42, 42, syscall.EPERM, false},
+	} {
+		calls, sets := 0, 0
+		err := armParentDeath(42, func() error { sets++; return tc.setErr }, func() int {
+			calls++
+			if calls == 1 {
+				return tc.before
+			}
+			return tc.after
+		})
+		if (err == nil) != tc.ok {
+			t.Fatalf("%+v: %v", tc, err)
+		}
+		if tc.before != 42 && sets != 0 {
+			t.Fatal("already reparented child armed")
+		}
+		if tc.ok && calls != 2 {
+			t.Fatal("parent race not checked")
+		}
+	}
+}
+
+type childFixture struct {
+	reaped  bool
+	err     error
+	signals []syscall.Signal
+	exitOn  syscall.Signal
+}
+
+func (c *childFixture) exited() (bool, error) { return c.reaped, c.err }
+func (c *childFixture) signal(s syscall.Signal) error {
+	if c.reaped {
+		panic("signalled a reaped child")
+	}
+	c.signals = append(c.signals, s)
+	if s == c.exitOn {
+		c.reaped = true
+	}
+	return nil
+}
+func TestOnlyUnreapedOwnedChildCanBeSignalled(t *testing.T) {
+	for _, tc := range []struct {
+		reaped bool
+		err    error
+		exit   syscall.Signal
+		count  int
+		ok     bool
+	}{
+		{true, nil, 0, 0, true}, {false, syscall.ECHILD, 0, 0, false}, {false, nil, syscall.SIGTERM, 1, true}, {false, nil, syscall.SIGKILL, 2, true}, {false, nil, 0, 2, false},
+	} {
+		c := &childFixture{reaped: tc.reaped, err: tc.err, exitOn: tc.exit}
+		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
+		err := stopChild(ctx, c, time.Millisecond)
+		cancel()
+		if (err == nil) != tc.ok || len(c.signals) != tc.count {
+			t.Fatalf("%+v: err=%v signals=%v", tc, err, c.signals)
+		}
+		if c.reaped {
+			n := len(c.signals)
+			if stopChild(context.Background(), c, time.Millisecond) != nil || len(c.signals) != n {
+				t.Fatal("reaped PID reused")
+			}
+		}
+	}
+}
+func TestCancelledStopCannotSignal(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	c := &childFixture{}
+	if stopChild(ctx, c, time.Millisecond) == nil || len(c.signals) != 0 {
+		t.Fatal("cancelled operation signalled")
+	}
+}
+
+func TestSupervisorReplyRequiresRealEOFAndStrictBoundedAcknowledgement(t *testing.T) {
+	i := fixture(t).Expected
+	nonce := strings.Repeat("c", 64)
+	good, _ := json.Marshal(Response{Inventory: i, Nonce: nonce, OK: true})
+	for _, tc := range []struct {
+		data []byte
+		ok   bool
+	}{
+		{good, true}, {append(append([]byte{}, good...), []byte(" {}")...), false},
+		{bytes.Replace(good, []byte(nonce), []byte(strings.Repeat("d", 64)), 1), false},
+		{append(append([]byte{}, good[:len(good)-1]...), []byte(",\"unknown\":true}")...), false},
+		{append(append([]byte{}, good...), bytes.Repeat([]byte(" "), 4097)...), false},
+	} {
+		if (readSupervisorReply(bytes.NewReader(tc.data), i, nonce) == nil) != tc.ok {
+			t.Fatalf("reply accepted=%v expected=%v", !tc.ok, tc.ok)
+		}
+	}
+	if readSupervisorReply(&brokenReplyReader{data: good}, i, nonce) == nil {
+		t.Fatal("read error treated as cooperative exit")
+	}
+}
+
+type brokenReplyReader struct{ data []byte }
+
+func (r *brokenReplyReader) Read(p []byte) (int, error) {
+	if len(r.data) == 0 {
+		return 0, syscall.ECONNRESET
+	}
+	n := copy(p, r.data)
+	r.data = r.data[n:]
+	return n, nil
+}

package/dist/templates/native-go/backend/internal/helper/supervisor_linux.go

@@ -0,0 +1,192 @@
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"syscall"
+	"time"
+)
+
+func setParentDeath() error {
+	_, _, err := syscall.Syscall6(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(syscall.SIGKILL), 0, 0, 0, 0)
+	if err != 0 {
+		return err
+	}
+	return nil
+}
+
+type ownedLinuxChild struct {
+	process *os.Process
+	reaped  bool
+}
+
+func (c *ownedLinuxChild) exited() (bool, error) {
+	if c.reaped {
+		return true, nil
+	}
+	var status syscall.WaitStatus
+	pid, err := syscall.Wait4(c.process.Pid, &status, syscall.WNOHANG, nil)
+	if errors.Is(err, syscall.EINTR) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	} // ECHILD never permits signalling.
+	if pid == c.process.Pid {
+		c.reaped = true
+		c.process.Release()
+	}
+	return c.reaped, nil
+}
+func (c *ownedLinuxChild) signal(s syscall.Signal) error {
+	if c.reaped {
+		return errTrust
+	}
+	// This PID came from our own Start, and ONLY this event loop calls Wait4.
+	// Even if it exits here it remains an unreaped zombie, pinning its PID.
+	return syscall.Kill(c.process.Pid, s)
+}
+
+type supervisorRequest struct {
+	Process Process `json:"process"`
+	Op      string  `json:"op"`
+	Nonce   string  `json:"nonce"`
+}
+
+// The thread creating the child must remain alive: PDEATHSIG is tied to that
+// Linux thread, not merely the supervisor's thread group / Go process.
+func superviseLinux(c Client, binary string) error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	r, err := readRecord(c.StateDir, 0)
+	if err != nil || !r.Enabled || r.Inventory != c.Expected {
+		return errTrust
+	}
+	identity, err := inspectSupervisor(os.Getpid(), c.Expected)
+	if err != nil {
+		return err
+	}
+	if err := writeProcess(c.RunDir, identity); err != nil {
+		return err
+	}
+	socket := filepath.Join(c.RunDir, "supervisor.sock")
+	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
+	if err != nil {
+		return err
+	}
+	l.SetUnlinkOnClose(false)
+	defer l.Close()
+	if err := os.Chmod(socket, 0600); err != nil {
+		return err
+	}
+	cmd := exec.Command(binary, "serve-child")
+	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=" + strconv.Itoa(os.Getpid())}
+	// Go sets prctl before exec and rechecks the parent immediately afterward.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	child := &ownedLinuxChild{process: cmd.Process}
+	// No cmd.Wait goroutine: reaping and signalling are serialized below.
+	for {
+		if _, err := child.exited(); err != nil {
+			return err
+		}
+		l.SetDeadline(time.Now().Add(20 * time.Millisecond))
+		conn, err := l.AcceptUnix()
+		if err != nil {
+			if e, ok := err.(net.Error); ok && e.Timeout() {
+				continue
+			}
+			return err
+		}
+		conn.SetDeadline(time.Now().Add(3 * time.Second))
+		peer, err := peerCredentials(conn)
+		if err != nil || peer.Uid != 0 {
+			conn.Close()
+			continue
+		}
+		var req supervisorRequest
+		d := json.NewDecoder(io.LimitReader(conn, 4097))
+		d.DisallowUnknownFields()
+		if d.Decode(&req) != nil || req.Process != identity || req.Op != "stop" || len(req.Nonce) != 64 || !digestPattern.MatchString(req.Nonce) {
+			conn.Close()
+			continue
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		err = stopChild(ctx, child, time.Second)
+		cancel()
+		// Kernel process-exit fd cleanup is not ordered: close the listener
+		// before ACK, so connection EOF cannot race a still-listening socket.
+		if err == nil {
+			err = l.Close()
+		}
+		res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: err == nil}
+		if err != nil {
+			res.Error = "cleanup-required"
+		}
+		json.NewEncoder(conn).Encode(res)
+		if err == nil {
+			// Keep this connection open until OS exit. An ACK plus EOF proves both
+			// that the child was reaped and this supervisor finished cooperatively.
+			os.Exit(0)
+		}
+		conn.Close()
+	}
+}
+
+func (p LinuxProcesses) Stop(want Process) error {
+	if want.Mode != "supervised" {
+		return errTrust
+	}
+	// Loss/reboot/PID reuse is not sufficient proof of child teardown. Preserve
+	// the record for fixed admin repair; never signal this recorded PID.
+	actual, err := inspectSupervisor(want.PID, want.Inventory)
+	if err != nil || actual != want {
+		return errTrust
+	}
+	socket := filepath.Join(p.RunDir, "supervisor.sock")
+	st, err := os.Lstat(socket)
+	if err != nil {
+		return err
+	}
+	stat, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || stat.Uid != 0 || st.Mode()&os.ModeSocket == 0 || st.Mode().Perm() != 0600 {
+		return errTrust
+	}
+	conn, err := net.DialTimeout("unix", socket, time.Second)
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	peer, err := peerCredentials(conn.(*net.UnixConn))
+	if err != nil || peer.Uid != 0 || int(peer.Pid) != want.PID {
+		return errTrust
+	}
+	// Recheck after binding the connection too. A connected socket cannot be
+	// substituted by a later process that reused the path or PID.
+	actual, err = inspectSupervisor(want.PID, want.Inventory)
+	if err != nil || actual != want {
+		return errTrust
+	}
+	conn.SetDeadline(time.Now().Add(3 * time.Second))
+	var nonce [32]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return err
+	}
+	req := supervisorRequest{Process: want, Op: "stop", Nonce: hex.EncodeToString(nonce[:])}
+	if err := json.NewEncoder(conn).Encode(req); err != nil {
+		return err
+	}
+	return readSupervisorReply(conn, want.Inventory, req.Nonce)
+}