@synopackageland/cli 0.4.0 → 0.4.1

package/templates/native-go/backend/internal/app/nas_cgi_artifact_test.go

@@ -0,0 +1,121 @@
+package app
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// The NIC-free VM points this at the actual unpacked, generated arm64 SPK CGI.
+// The VM's DSM authenticate.cgi oracle is a fixture, never a shipped adapter.
+func TestS8FinalCGIArtifactRefusal(t *testing.T) {
+	binary := os.Getenv("M2_S8_CGI_ARTIFACT")
+	if binary == "" {
+		t.Skip("requires final generated SPK in disposable Linux VM")
+	}
+
+	helperBinary := os.Getenv("M2_S8_HELPER_ARTIFACT")
+	if helperBinary != "" {
+		run := func(action string) {
+			t.Helper()
+			if b, err := exec.Command(helperBinary, action).CombinedOutput(); err != nil {
+				t.Fatalf("%s: %s %v", action, b, err)
+			}
+		}
+		state := func(want string) {
+			t.Helper()
+			for n := 0; n < 100; n++ {
+				b, err := exec.Command(helperBinary, "diagnose").Output()
+				var out map[string]any
+				json.Unmarshal(b, &out)
+				if err == nil && out["state"] == want {
+					t.Log("final generated helper state", want)
+					return
+				}
+				time.Sleep(20 * time.Millisecond)
+			}
+			t.Fatal("helper state did not become", want)
+		}
+		run("enable")
+		state("ready")
+		t.Cleanup(func() { exec.Command(helperBinary, "disable").Run() })
+		hook := os.Getenv("M2_S8_PREUPGRADE_HOOK")
+		if hook != "" {
+			if exec.Command("/bin/sh", hook).Run() == nil {
+				t.Fatal("generated preupgrade admitted a ready helper")
+			}
+		}
+		defer func() {
+			run("teardown")
+			state("stopped")
+			if hook != "" {
+				if b, err := exec.Command("/bin/sh", hook).CombinedOutput(); err != nil {
+					t.Fatal("generated preupgrade after teardown", string(b), err)
+				}
+			}
+			run("recover")
+			state("ready")
+			run("disable")
+			state("not-enabled")
+			if exec.Command(helperBinary, "recover").Run() == nil {
+				t.Fatal("disabled helper recovered without approval")
+			}
+		}()
+	}
+	methods := []string{"nas.discovery", "nas.grants.prepare", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.read-stream", "nas.files.create", "nas.files.write-stream", "nas.files.publish", "nas.unknown", "nas.files.read.binary"}
+	for _, user := range []string{"normal1", "normal2", "admin", "", "expired"} {
+		for _, method := range methods {
+			params := `{"user":"admin","path":"/volume1/secret"}`
+			if method == "nas.files.read.binary" {
+				params = sampleParams[method]
+			}
+			body := fmt.Sprintf(`{"method":%q,"params":%s}`, method, params)
+			cmd := exec.Command(binary)
+			if uidText := os.Getenv("M2_S8_CGI_PACKAGE_UID"); uidText != "" {
+				uid, err := strconv.ParseUint(uidText, 10, 32)
+				if err != nil {
+					t.Fatal(err)
+				}
+				cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: uint32(uid), Gid: uint32(uid)}}
+			}
+			cmd.Env = []string{"GATEWAY_INTERFACE=CGI/1.1", "REQUEST_METHOD=POST", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_NAME=localhost", "SERVER_PORT=80", "SCRIPT_NAME=/api.cgi", "CONTENT_TYPE=application/json", fmt.Sprintf("CONTENT_LENGTH=%d", len(body)), "REMOTE_ADDR=127.0.0.1"}
+			if user != "" {
+				cmd.Env = append(cmd.Env, "HTTP_COOKIE=fixture="+user)
+			}
+			cmd.Stdin = strings.NewReader(body)
+			b, err := cmd.Output()
+			if err != nil {
+				t.Fatal(method, err)
+			}
+			parts := bytes.SplitN(b, []byte("\r\n\r\n"), 2)
+			if len(parts) != 2 {
+				t.Fatal("not CGI", string(b))
+			}
+			var result map[string]any
+			if err = json.Unmarshal(parts[1], &result); err != nil {
+				t.Fatal(err, string(b))
+			}
+			want := "unknown_method"
+			if method == "nas.files.read.binary" {
+				want = "unsupported"
+			}
+			if user == "" || user == "expired" {
+				want = "session_required"
+			}
+			e, ok := result["error"].(map[string]any)
+			if !ok || e["code"] != want || result["success"] != false || result["data"] != nil {
+				t.Fatalf("%s %s: %s", user, method, parts[1])
+			}
+			if bytes.Contains(b, []byte("volume1")) || bytes.Contains(b, []byte("fixture=")) {
+				t.Fatal("metadata leaked")
+			}
+		}
+	}
+}

package/templates/native-go/backend/internal/app/nas_refusal_test.go

@@ -0,0 +1,46 @@
+package app
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+
+	"dsmapp/internal/helper"
+)
+
+// These are unavailable wire methods, not public grant/file routes. CGI names
+// are never used as S1 actors. Test both administrators and ordinary sessions.
+func TestS8NASWireRefusalHasNoDataEffects(t *testing.T) {
+	methods := []string{"nas.discovery", "nas.grants.prepare", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.read-stream", "nas.files.create", "nas.files.write-stream", "nas.files.publish", "nas.future-method"}
+	for _, auth := range []stubAuth{alice, bob, nobody} {
+		cfg := testConfig(t)
+		cfg.HelperInventory = helper.Inventory{Package: cfg.PackageID, Version: cfg.Version, Protocol: 2, PayloadDigest: strings.Repeat("a", 64), RegistryDigest: strings.Repeat("b", 64)}
+		for _, method := range methods {
+			code, out := call(t, cfg, auth, method, `{"user":"admin","path":"/volume1/private","nativeProof":true}`)
+			want := "unknown_method"
+			if auth.err != nil {
+				want = "session_required"
+			}
+			if code != want || out["success"] != false || out["data"] != nil {
+				t.Fatalf("%s: %s %v", method, code, out)
+			}
+			b, _ := json.Marshal(out)
+			if strings.Contains(string(b), "volume1") || strings.Contains(string(b), "nativeProof") {
+				t.Fatal("request metadata leaked", string(b))
+			}
+		}
+		code, out := call(t, cfg, auth, "nas.files.read.binary", sampleParams["nas.files.read.binary"])
+		want := "unsupported"
+		if auth.err != nil {
+			want = "session_required"
+		}
+		if code != want || out["data"] != nil {
+			t.Fatal(code, out)
+		}
+		entries, err := os.ReadDir(cfg.DataDir)
+		if err != nil || len(entries) != 0 {
+			t.Fatal("NAS refusal changed package data", entries, err)
+		}
+	}
+}

package/templates/native-go/backend/internal/app/routes.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"errors"
 	"io/fs"
+	"net/http"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -24,6 +25,8 @@ type Config struct {
 	PackageID       string
 	Version         string
 	HelperInventory helper.Inventory
+	// Staged trusted adapter. Nil refuses; no production data transport is installed.
+	NASBinaryRead api.BinaryReadHandler
 	// DataDir is the package's persistent, package-owned directory
 	// (/var/packages/<package>/var). It survives upgrades.
 	DataDir string
@@ -32,6 +35,7 @@ type Config struct {
 func Routes(cfg Config) []api.Route {
 	routes := []api.Route{
 		api.User("integration.status", cfg.integrationStatus),
+		api.BoundedRead(cfg.binaryRead),
 		api.User("app.status", cfg.status),
 		api.User("greeting.get", cfg.getGreeting),
 		api.Admin("greeting.set", cfg.setGreeting),
@@ -125,3 +129,10 @@ func writeFileAtomic(path string, data []byte) error {
 	}
 	return os.Rename(tmp.Name(), path)
 }
+
+func (cfg Config) binaryRead(ctx context.Context, c api.Caller, r *http.Request, p json.RawMessage) (api.BinaryRead, error) {
+	if cfg.NASBinaryRead == nil {
+		return api.BinaryRead{}, &api.Error{Code: "unsupported", Message: "NAS binary read is unavailable"}
+	}
+	return cfg.NASBinaryRead(ctx, c, r, p)
+}

package/templates/native-go/backend/internal/app/routes_test.go

@@ -57,10 +57,11 @@ var (
 // sampleParams holds valid params for every route, so the denial test below
 // proves the refusal came from the policy and not from bad input.
 var sampleParams = map[string]string{
-	"integration.status": `{}`,
-	"app.status":         `{}`,
-	"greeting.get":       `{}`,
-	"greeting.set":       `{"text":"Hi"}`,
+	"integration.status":    `{}`,
+	"nas.files.read.binary": `{"operationId":"` + strings.Repeat("a", 64) + `","epoch":"` + strings.Repeat("b", 64) + `","token":"` + strings.Repeat("c", 64) + `"}`,
+	"app.status":            `{}`,
+	"greeting.get":          `{}`,
+	"greeting.set":          `{"text":"Hi"}`,
 }
 
 func TestIntegrationStatusIsReadableByOrdinaryUsers(t *testing.T) {
@@ -117,7 +118,11 @@ func TestEveryAdminRouteRefusesOrdinaryUsersAndChangesNothing(t *testing.T) {
 func TestEveryRouteSucceedsForAnAdmin(t *testing.T) {
 	for _, r := range Routes(testConfig(t)) {
 		code, out := call(t, testConfig(t), alice, r.Method(), sampleParams[r.Method()])
-		if code != "" {
+		want := ""
+		if r.Method() == "nas.files.read.binary" {
+			want = "unsupported"
+		}
+		if code != want {
 			t.Errorf("%s: %q %v", r.Method(), code, out)
 		}
 	}

package/templates/native-go/backend/internal/dsmprobe/collector_linux.go

@@ -0,0 +1,335 @@
+package dsmprobe
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"debug/elf"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+// root is test-only filesystem injection. The executable exposes no path/root
+// option or environment override. It reads no shadow, native DB, or data file.
+type collector struct{ root string }
+
+func (c *collector) path(p string) string {
+	if c.root != "" {
+		return c.root + p
+	}
+	return p
+}
+func openObserved(path string, flags int) (*os.File, error) {
+	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
+		return nil, ErrInvalid
+	}
+	fd, e := unix.Open("/", unix.O_PATH|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if e != nil {
+		return nil, e
+	}
+	parts := strings.Split(path[1:], "/")
+	for i, p := range parts {
+		f := unix.O_PATH | unix.O_DIRECTORY
+		if i == len(parts)-1 {
+			f = flags
+		}
+		next, e := unix.Openat(fd, p, f|unix.O_NOFOLLOW|unix.O_CLOEXEC|unix.O_NONBLOCK, 0)
+		unix.Close(fd)
+		if e != nil {
+			return nil, e
+		}
+		fd = next
+	}
+	return os.NewFile(uintptr(fd), "observation"), nil
+}
+func (c *collector) read(ctx context.Context, path string, maximum int) ([]byte, error) {
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+	f, e := openObserved(c.path(path), unix.O_RDONLY)
+	if e != nil {
+		return nil, e
+	}
+	defer f.Close()
+	var st unix.Stat_t
+	if unix.Fstat(int(f.Fd()), &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Size > int64(maximum) {
+		return nil, ErrInvalid
+	}
+	out, e := io.ReadAll(io.LimitReader(f, int64(maximum+1)))
+	if len(out) > maximum {
+		return nil, ErrInvalid
+	}
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+	return out, e
+}
+func hash(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }
+func version(b []byte) string {
+	values := map[string]string{}
+	for _, line := range strings.Split(string(b), "\n") {
+		k, v, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		if k != "productversion" && k != "buildnumber" {
+			continue
+		}
+		if _, ok := values[k]; ok {
+			return ""
+		}
+		values[k] = strings.Trim(v, "\"")
+	}
+	if values["productversion"] == "" || values["buildnumber"] == "" {
+		return ""
+	}
+	return values["productversion"] + "-" + values["buildnumber"]
+}
+func (c *collector) runtime(ctx context.Context) (Runtime, error) {
+	r := Runtime{Architecture: runtime.GOARCH, Libraries: []LibraryEvidence{}}
+	var u unix.Utsname
+	if unix.Uname(&u) != nil {
+		return r, ErrInvalid
+	}
+	r.Kernel = unix.ByteSliceToString(u.Release[:])
+	b, e := c.read(ctx, "/etc.defaults/VERSION", 4096)
+	if e == nil {
+		r.DSMBuild = version(b)
+		r.VersionDigest = hash(b)
+	}
+	boot, e := c.read(ctx, "/proc/sys/kernel/random/boot_id", 128)
+	if e == nil && len(strings.TrimSpace(string(boot))) == 36 {
+		r.BootRef = hash(bytes.TrimSpace(boot))
+	}
+	modules, _ := c.read(ctx, "/proc/modules", 1<<20)
+	for _, line := range strings.Split(string(modules), "\n") {
+		if strings.HasPrefix(line, "synoacl_vfs ") {
+			r.ACLModule = true
+		}
+	}
+	for _, name := range []string{"libsynoacl.so", "libsynosdk.so.7", "libsynolocalaccount.so.7"} {
+		b, e := c.read(ctx, "/usr/lib/"+name, 32<<20)
+		if e != nil {
+			continue
+		}
+		evidence := LibraryEvidence{Name: name, SHA256: hash(b), Exports: []string{}}
+		image, e := elf.NewFile(bytes.NewReader(b))
+		if e != nil {
+			r.Libraries = append(r.Libraries, evidence)
+			continue
+		}
+		symbols, _ := image.DynamicSymbols()
+		image.Close()
+		for _, s := range symbols {
+			switch s.Name {
+			case "SYNOACLPermCheck", "SYNOACLIsSupport", "SYNOUserGetLocal", "SYNOServiceUserHomeStatusGet", "SYNOShareGet", "SYNOShareUGPrivGetLocalInt":
+				if s.Section != elf.SHN_UNDEF {
+					evidence.Exports = append(evidence.Exports, s.Name)
+				}
+			}
+		}
+		slices.Sort(evidence.Exports)
+		r.Libraries = append(r.Libraries, evidence)
+	}
+	// Deterministic fingerprint binds actual bytes and kernel/build/architecture;
+	// it is an observation, NOT a source-to-build or native semantics certificate.
+	seed, _ := json.Marshal(struct {
+		Architecture, DSMBuild, Kernel, VersionDigest string
+		Libraries                                     []LibraryEvidence
+		ACLModule                                     bool
+	}{r.Architecture, r.DSMBuild, r.Kernel, r.VersionDigest, r.Libraries, r.ACLModule})
+	r.Fingerprint = hash(seed)
+	if ctx.Err() != nil {
+		return r, ctx.Err()
+	}
+	return r, nil
+}
+func identity() Identity {
+	groups, _ := os.Getgroups()
+	g := make([]uint32, 0, len(groups))
+	for _, v := range groups {
+		g = append(g, uint32(v))
+	}
+	slices.Sort(g)
+	g = slices.Compact(g)
+	n, e := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
+	d, de := unix.PrctlRetInt(unix.PR_GET_DUMPABLE, 0, 0, 0, 0)
+	return Identity{UID: uint32(os.Geteuid()), GID: uint32(os.Getegid()), Groups: g, NoNewPrivs: e == nil && n == 1, NonDumpable: de == nil && d == 0}
+}
+func (c *collector) account(ctx context.Context, r Request) (Account, error) {
+	b, e := c.read(ctx, "/etc/passwd", 128<<10)
+	if e != nil {
+		return Account{}, e
+	}
+	var found *Account
+	for _, line := range strings.Split(string(b), "\n") {
+		fields := strings.Split(line, ":")
+		if len(fields) != 7 || fields[0] != r.Username {
+			continue
+		}
+		if found != nil {
+			return Account{}, ErrInvalid
+		}
+		uid, e := strconv.ParseUint(fields[2], 10, 32)
+		if e != nil {
+			return Account{}, ErrInvalid
+		}
+		gid, e := strconv.ParseUint(fields[3], 10, 32)
+		if e != nil {
+			return Account{}, ErrInvalid
+		}
+		found = &Account{Username: r.Username, UID: uint32(uid), GID: uint32(gid), Home: fields[5], Groups: []uint32{}}
+	}
+	if found == nil {
+		return Account{}, os.ErrNotExist
+	}
+	if found.UID != r.UID || found.GID != r.GID || found.Home != "/var/services/homes/"+r.Username {
+		return Account{}, ErrInvalid
+	}
+	// passwd is metadata only. Enabled/local/group/service/share native proofs
+	// remain false; no UID/name fingerprint is advertised as incarnation.
+	return *found, nil
+}
+func (c *collector) home(ctx context.Context, r Request) (Home, *os.File, error) {
+	var h Home
+	if ctx.Err() != nil {
+		return h, nil, ctx.Err()
+	}
+	link := c.path("/var/services/homes")
+	before, e := os.Lstat(link)
+	if e != nil || before.Mode()&os.ModeSymlink == 0 {
+		return h, nil, ErrInvalid
+	}
+	target, e := os.Readlink(link)
+	if e != nil || !filepath.IsAbs(target) || filepath.Clean(target) != target || !strings.HasPrefix(target, "/volume") || !strings.HasSuffix(target, "/homes") {
+		return h, nil, ErrInvalid
+	}
+	h.HomesPath = target
+	f, e := openObserved(c.path(target+"/"+r.Username), unix.O_PATH|unix.O_DIRECTORY)
+	if e != nil {
+		return h, nil, e
+	}
+	var st unix.Stat_t
+	if unix.Fstat(int(f.Fd()), &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFDIR {
+		f.Close()
+		return h, nil, ErrInvalid
+	}
+	after, e := os.Lstat(link)
+	again, re := os.Readlink(link)
+	if e != nil || re != nil || !os.SameFile(before, after) || target != again {
+		f.Close()
+		return h, nil, ErrInvalid
+	}
+	h.Existing = true
+	h.Device = uint64(st.Dev)
+	h.Inode = st.Ino
+	h.Owner = st.Uid
+	return h, f, nil
+}
+func sampleACL(ctx context.Context, r Request, out Response, fd int) ACLSample {
+	sample := ACLSample{Mask: 0x105, SupportErrno: []uint32{}}
+	// Exact source-reviewed candidate only, explicitly requested for evidence.
+	// Never feed this result into bridge certification or a production Allow.
+	if ctx.Err() != nil || runtime.GOARCH != "amd64" || out.Runtime.DSMBuild != "7.4-90069" || out.Runtime.Kernel != "4.4.302+" || !out.Runtime.ACLModule || len(out.Runtime.Libraries) != 3 || r.ExpectedRuntime != out.Runtime.Fingerprint || out.Identity.UID != r.UID || out.Identity.GID != r.GID || !slices.Equal(out.Identity.Groups, r.Groups) || !out.Identity.NoNewPrivs || !out.Identity.NonDumpable || out.Home.Owner != r.UID {
+		return sample
+	}
+	ru, eu, su := unix.Getresuid()
+	rg, eg, sg := unix.Getresgid()
+	if ru != int(r.UID) || eu != ru || su != ru || rg != int(r.GID) || eg != rg || sg != rg {
+		return sample
+	}
+	var caps [2]unix.CapUserData
+	head := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
+	if unix.Capget(&head, &caps[0]) != nil || caps[0] != (unix.CapUserData{}) || caps[1] != (unix.CapUserData{}) {
+		return sample
+	}
+	var before unix.Stat_t
+	if unix.Fstat(fd, &before) != nil {
+		return sample
+	}
+	alias, e := unix.BytePtrFromString(fmt.Sprintf("/proc/self/fd/%d", fd))
+	if e != nil {
+		return sample
+	}
+	defer runtime.KeepAlive(alias)
+	sample.Attempted = true
+	for _, tag := range []uintptr{1, 2} {
+		result, _, errno := unix.Syscall(813, uintptr(unsafe.Pointer(alias)), uintptr(fd), tag)
+		sample.SupportErrno = append(sample.SupportErrno, uint32(errno))
+		if tag == 1 {
+			sample.FilesystemSupport = int64(result)
+		} else {
+			sample.ObjectSupport = int64(result)
+		}
+		if errno != 0 || result != 1 {
+			return sample
+		}
+		if ctx.Err() != nil {
+			return sample
+		}
+	}
+	result, _, errno := unix.Syscall(812, uintptr(unsafe.Pointer(alias)), uintptr(sample.Mask), 0)
+	sample.CheckResult = int64(result)
+	sample.CheckErrno = uint32(errno)
+	runtime.KeepAlive(alias)
+	var after unix.Stat_t
+	if unix.Fstat(fd, &after) != nil || before.Dev != after.Dev || before.Ino != after.Ino || before.Uid != after.Uid || before.Mode != after.Mode {
+		sample.CheckErrno = uint32(unix.ESTALE)
+	}
+	return sample
+}
+func (c *collector) collect(ctx context.Context, r Request) (Response, error) {
+	out := Response{Version: Protocol, Nonce: r.Nonce, Status: "unsupported", Identity: identity(), Account: Account{Groups: []uint32{}}, ACL: ACLSample{SupportErrno: []uint32{}}}
+	if r.Validate() != nil {
+		return out, ErrInvalid
+	}
+	rt, e := c.runtime(ctx)
+	out.Runtime = rt
+	if e != nil {
+		return out, e
+	}
+	if rt.DSMBuild != "" && rt.BootRef != "" {
+		out.Status = "ok"
+	}
+	if r.Kind == "runtime" {
+		return out, nil
+	}
+	a, e := c.account(ctx, r)
+	out.Account = a
+	if e != nil {
+		return out, e
+	}
+	h, f, e := c.home(ctx, r)
+	out.Home = h
+	out.Share = Share{Name: "homes", Path: h.HomesPath}
+	if e != nil {
+		return out, e
+	}
+	defer f.Close()
+	if r.Kind == "acl" {
+		out.ACL = sampleACL(ctx, r, out, int(f.Fd()))
+	}
+	if ctx.Err() != nil {
+		return out, ctx.Err()
+	}
+	return out, nil
+}
+func Collect(ctx context.Context, r Request) (Response, error) {
+	out, e := (&collector{}).collect(ctx, r)
+	if e != nil && !errors.Is(e, context.Canceled) && !errors.Is(e, context.DeadlineExceeded) {
+		out.Status = "unsupported"
+	}
+	return out, e
+}

package/templates/native-go/backend/internal/dsmprobe/collector_linux_test.go

@@ -0,0 +1,41 @@
+package dsmprobe
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestCollectorMetadataNeverCertifiesNativePolicyOrCreatesHome(t *testing.T) {
+	root := t.TempDir()
+	for _, p := range []string{"etc.defaults", "etc", "proc/sys/kernel/random", "volume1/homes", "var/services"} {
+		if e := os.MkdirAll(filepath.Join(root, p), 0755); e != nil {
+			t.Fatal(e)
+		}
+	}
+	os.WriteFile(root+"/etc/passwd", []byte("normal3:x:1217:100::/var/services/homes/normal3:/sbin/nologin\n"), 0644)
+	os.WriteFile(root+"/etc.defaults/VERSION", []byte("productversion=\"7.4\"\nbuildnumber=\"90069\"\n"), 0644)
+	os.WriteFile(root+"/proc/sys/kernel/random/boot_id", []byte("11111111-2222-3333-4444-555555555555\n"), 0644)
+	os.Symlink("/volume1/homes", root+"/var/services/homes")
+	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, Kind: "metadata"}
+	c := collector{root: root}
+	out, e := c.collect(context.Background(), r)
+	if !os.IsNotExist(e) || out.Account.UID != 1217 || out.Account.Home != "/var/services/homes/normal3" {
+		t.Fatal(e, out)
+	}
+	if out.Account.NativeKnown || out.Account.GroupsKnown || out.Home.StatusKnown || out.Share.NativeKnown || out.Share.PermissionKnown || out.ACL.Certified || out.ACL.Attempted {
+		t.Fatal("metadata became authority")
+	}
+	if _, e := os.Stat(root + "/volume1/homes/normal3"); !os.IsNotExist(e) {
+		t.Fatal("missing home created")
+	}
+}
+func TestCollectorACLRefusesDifferentActorAndFingerprint(t *testing.T) {
+	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, Kind: "acl", ExpectedRuntime: strings.Repeat("b", 64)}
+	out, _ := (&collector{}).collect(context.Background(), r)
+	if out.ACL.Attempted || out.ACL.Certified {
+		t.Fatal("unproven ABI or actor reached raw syscall")
+	}
+}