@synopackageland/cli 0.4.0 → 0.4.1

package/templates/native-go/backend/internal/dsmprobe/protocol.go

@@ -0,0 +1,179 @@
+// Package dsmprobe defines a bounded, non-secret observation protocol. It is
+// private to the helper/probe; neither browser nor package RPC exposes it.
+package dsmprobe
+
+import (
+	"bytes"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+)
+
+const MaxRequestBytes = 4096
+const MaxResponseBytes = 32768
+const Protocol = 1
+
+var ErrInvalid = errors.New("invalid probe request")
+
+type Request struct {
+	Version         int      `json:"version"`
+	Nonce           string   `json:"nonce"`
+	Kind            string   `json:"kind"`
+	Username        string   `json:"username"`
+	UID             uint32   `json:"uid"`
+	GID             uint32   `json:"gid"`
+	Groups          []uint32 `json:"groups"`
+	ExpectedRuntime string   `json:"expectedRuntime"`
+}
+type LibraryEvidence struct {
+	Name    string   `json:"name"`
+	SHA256  string   `json:"sha256"`
+	Exports []string `json:"exports"`
+}
+type Runtime struct {
+	VersionDigest string            `json:"versionDigest"`
+	Architecture  string            `json:"architecture"`
+	DSMBuild      string            `json:"dsmBuild"`
+	Kernel        string            `json:"kernel"`
+	BootRef       string            `json:"bootRef"`
+	Fingerprint   string            `json:"fingerprint"`
+	Libraries     []LibraryEvidence `json:"libraries"`
+	ACLModule     bool              `json:"aclModule"`
+}
+type Identity struct {
+	UID         uint32   `json:"uid"`
+	GID         uint32   `json:"gid"`
+	Groups      []uint32 `json:"groups"`
+	NoNewPrivs  bool     `json:"noNewPrivs"`
+	NonDumpable bool     `json:"nonDumpable"`
+}
+type Account struct {
+	Username    string   `json:"username"`
+	UID         uint32   `json:"uid"`
+	GID         uint32   `json:"gid"`
+	Groups      []uint32 `json:"groups"`
+	Home        string   `json:"home"`
+	NativeKnown bool     `json:"nativeKnown"`
+	Local       bool     `json:"local"`
+	Enabled     bool     `json:"enabled"`
+	GroupsKnown bool     `json:"groupsKnown"`
+}
+type Home struct {
+	HomesPath   string `json:"homesPath"`
+	StatusKnown bool   `json:"statusKnown"`
+	Enabled     bool   `json:"enabled"`
+	Existing    bool   `json:"existing"`
+	Device      uint64 `json:"device"`
+	Inode       uint64 `json:"inode"`
+	Owner       uint32 `json:"owner"`
+}
+type Share struct {
+	Name            string `json:"name"`
+	Path            string `json:"path"`
+	NativeKnown     bool   `json:"nativeKnown"`
+	Available       bool   `json:"available"`
+	VolumeKnown     bool   `json:"volumeKnown"`
+	PermissionKnown bool   `json:"permissionKnown"`
+	ReadAllowed     bool   `json:"readAllowed"`
+}
+type ACLSample struct {
+	Attempted         bool     `json:"attempted"`
+	FilesystemSupport int64    `json:"filesystemSupport"`
+	ObjectSupport     int64    `json:"objectSupport"`
+	SupportErrno      []uint32 `json:"supportErrno"`
+	CheckResult       int64    `json:"checkResult"`
+	CheckErrno        uint32   `json:"checkErrno"`
+	Mask              uint32   `json:"mask"`
+	Certified         bool     `json:"certified"`
+}
+type Response struct {
+	Version  int       `json:"version"`
+	Nonce    string    `json:"nonce"`
+	Status   string    `json:"status"`
+	Runtime  Runtime   `json:"runtime"`
+	Identity Identity  `json:"identity"`
+	Account  Account   `json:"account"`
+	Home     Home      `json:"home"`
+	Share    Share     `json:"share"`
+	ACL      ACLSample `json:"acl"`
+}
+
+func DigestValid(s string) bool {
+	b, e := hex.DecodeString(s)
+	return e == nil && len(b) == 32 && len(s) == 64
+}
+func (r Request) Validate() error {
+	if r.Version != Protocol || !DigestValid(r.Nonce) || r.Groups == nil || len(r.Groups) > 512 {
+		return ErrInvalid
+	}
+	for i, g := range r.Groups {
+		if i > 0 && r.Groups[i-1] >= g {
+			return ErrInvalid
+		}
+	}
+	if r.Kind == "runtime" {
+		if r.Username != "" || r.ExpectedRuntime != "" {
+			return ErrInvalid
+		}
+		return nil
+	}
+	if (r.Username != "normal3" && r.Username != "admin") || r.UID == 0 {
+		return ErrInvalid
+	}
+	switch r.Kind {
+	case "metadata":
+		if r.ExpectedRuntime != "" {
+			return ErrInvalid
+		}
+	case "acl":
+		if !DigestValid(r.ExpectedRuntime) {
+			return ErrInvalid
+		}
+	default:
+		return ErrInvalid
+	}
+	return nil
+}
+func DecodeRequest(b []byte) (Request, error) {
+	var out Request
+	if len(b) > MaxRequestBytes {
+		return out, ErrInvalid
+	}
+	d := json.NewDecoder(bytes.NewReader(b))
+	token, e := d.Token()
+	if e != nil || token != json.Delim('{') {
+		return out, ErrInvalid
+	}
+	allowed := map[string]bool{"version": true, "nonce": true, "kind": true, "username": true, "uid": true, "gid": true, "groups": true, "expectedRuntime": true}
+	raw := map[string]json.RawMessage{}
+	for d.More() {
+		t, e := d.Token()
+		if e != nil {
+			return out, ErrInvalid
+		}
+		k, ok := t.(string)
+		if !ok || !allowed[k] {
+			return out, ErrInvalid
+		}
+		if _, ok := raw[k]; ok {
+			return out, ErrInvalid
+		}
+		var v json.RawMessage
+		if d.Decode(&v) != nil {
+			return out, ErrInvalid
+		}
+		raw[k] = v
+	}
+	if t, e := d.Token(); e != nil || t != json.Delim('}') {
+		return out, ErrInvalid
+	}
+	if _, e = d.Token(); e != io.EOF {
+		return out, ErrInvalid
+	}
+	data, _ := json.Marshal(raw)
+	if json.Unmarshal(data, &out) != nil {
+		return Request{}, ErrInvalid
+	}
+	return out, out.Validate()
+}

package/templates/native-go/backend/internal/dsmprobe/protocol_test.go

@@ -0,0 +1,29 @@
+package dsmprobe
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRequestRejectsUnknownDuplicateAndOversized(t *testing.T) {
+	for _, s := range []string{`{"version":1,"nonce":"` + strings.Repeat("a", 64) + `","username":"normal3","uid":1217,"gid":100,"groups":[100],"kind":"metadata","kind":"acl"}`, `{"version":1,"nonce":"` + strings.Repeat("a", 64) + `","username":"normal3","uid":1217,"gid":100,"groups":[100],"kind":"metadata","allow":true}`, strings.Repeat(" ", MaxRequestBytes+1)} {
+		if _, e := DecodeRequest([]byte(s)); e == nil {
+			t.Fatal("invalid request accepted")
+		}
+	}
+}
+func TestRequestRestrictsFixtureAndNeverCarriesSession(t *testing.T) {
+	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Kind: "metadata", Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}}
+	if r.Validate() != nil {
+		t.Fatal("valid fixture refused")
+	}
+	r.Username = "normal1"
+	if r.Validate() == nil {
+		t.Fatal("reserved account accepted")
+	}
+	r.Username = "normal3"
+	r.Kind = "acl"
+	if r.Validate() == nil {
+		t.Fatal("ACL without runtime fingerprint accepted")
+	}
+}

package/templates/native-go/backend/internal/helper/cohort.go

@@ -0,0 +1,393 @@
+package helper
+
+import (
+	"context"
+	"syscall"
+	"time"
+)
+
+// Staged root-side API. Only the supervisor owner loop calls these methods;
+// native adapters, grant/ACL authority and a public data transport are NOT installed.
+// Operation children are fixed synthetic operations, never caller executables.
+type operationBinding struct {
+	Inventory     Inventory `json:"inventory"`
+	Epoch         string    `json:"epoch"`
+	OperationID   string    `json:"operationId"`
+	Nonce         string    `json:"nonce"`
+	GrantID       string    `json:"grantId"`
+	GrantRevision uint64    `json:"grantRevision"`
+}
+type operationPeer struct {
+	PID int
+	UID uint32
+}
+type operationProcess interface {
+	supervisedChild
+	chunk(uint32) error
+	idle() (bool, error)
+	stopRelay()
+	relayStopped() bool
+}
+type cohortOperation struct {
+	binding        operationBinding
+	actor          NativeActor
+	process        operationProcess
+	bytes          uint64
+	canceled       bool
+	admittedAt     time.Time
+	lastActivity   time.Time
+	maxBytes       uint64
+	segments       []string
+	commitReserved bool
+	writeWork      *writeWork
+	work           *readOnlyWork
+	root           readOnlyRootWitness
+}
+type CohortCompletion struct {
+	Started             uint64 `json:"started"`
+	Reaped              uint64 `json:"reaped"`
+	WriteIntents        uint64 `json:"writeIntents,omitempty"`
+	WriteEffectsUnknown bool   `json:"writeEffectsUnknown,omitempty"`
+	RelaysStopped       bool   `json:"relaysStopped"`
+}
+
+func (q CohortCompletion) valid() bool {
+	return q.Started > 0 && q.Started <= MaxReplayEntries && q.Started == q.Reaped && q.RelaysStopped && q.WriteIntents <= q.Started && (!q.WriteEffectsUnknown || q.WriteIntents > 0)
+}
+
+type operationCohort struct {
+	inventory       Inventory
+	epoch           string
+	helperPID       int
+	helperLive      func() bool
+	gate            *admission
+	now             func() time.Time
+	startChild      func(NativeActor, operationBinding) (operationProcess, error)
+	operations      map[string]*cohortOperation
+	seen            map[string]bool
+	started, reaped uint64
+	receipts        map[string]cohortReceipt
+	fenced          bool
+}
+
+func newOperationCohort(i Inventory, epoch string, pid int, g *admission, live func() bool) *operationCohort {
+	return &operationCohort{inventory: i, epoch: epoch, helperPID: pid, gate: g, helperLive: live, now: time.Now, operations: map[string]*cohortOperation{}, seen: map[string]bool{}, receipts: map[string]cohortReceipt{}}
+}
+func (c *operationCohort) peerAllowed(p operationPeer) bool {
+	return c.helperPID > 1 && p.PID == c.helperPID && p.UID == 0 && c.helperLive != nil && c.helperLive()
+}
+func (c *operationCohort) bound(b operationBinding) bool {
+	return c.inventory.Protocol == DataProtocol && c.inventory.Valid() && b.Inventory == c.inventory && b.Epoch == c.epoch && digestPattern.MatchString(c.epoch) && digestPattern.MatchString(b.OperationID) && digestPattern.MatchString(b.Nonce) && digestPattern.MatchString(b.GrantID) && b.GrantRevision > 0
+}
+
+// Called with the observer's mutex held, including child/lease admission.
+func (c *operationCohort) allowed() bool {
+	if c.now().Before(c.gate.seen) {
+		c.gate.fenceLocked("observation-expired")
+	}
+	return !c.fenced && c.gate.allowLocked(c.now())
+}
+func (c *operationCohort) start(ctx context.Context, peer operationPeer, p *NativeProvider, carriers SessionCarriers, old NativeActor, b operationBinding) Code {
+	if c.fenced {
+		return ErrFenced
+	}
+	if !c.peerAllowed(peer) {
+		return ErrDenied
+	}
+	if !c.bound(b) {
+		return ErrInvalid
+	}
+	if !old.valid || old.UID() == 0 || old.GID() == 0 || old.account.Groups == nil {
+		return ErrDenied
+	}
+	actor, code := p.Revalidate(ctx, carriers, old)
+	if code != "" {
+		return code
+	}
+	c.gate.mu.Lock()
+	op, code := c.reserveLocked(actor, b)
+	c.gate.mu.Unlock()
+	if code != "" {
+		return code
+	}
+	return c.launchReserved(op)
+}
+
+// Only registers a slot and replay history. No child/bootstrap/I/O under locks.
+func (c *operationCohort) reserveLocked(actor NativeActor, b operationBinding) (*cohortOperation, Code) {
+	if !c.allowed() {
+		return nil, ErrFenced
+	}
+	if !c.bound(b) || !actor.valid || actor.UID() == 0 || actor.GID() == 0 || actor.account.Groups == nil {
+		return nil, ErrDenied
+	}
+	if !nativeFresh(actor.account.CheckedAt, c.now()) {
+		return nil, ErrStale
+	}
+	if c.seen["op:"+b.OperationID] || c.seen["nonce:"+b.Nonce] {
+		return nil, ErrReplay
+	}
+	count := 0
+	for _, op := range c.operations {
+		if op.actor.Principal().SubjectRef == actor.Principal().SubjectRef {
+			count++
+		}
+	}
+	if len(c.operations) >= MaxPackageOperations || count >= MaxSubjectOperations || len(c.seen) >= 2*MaxReplayEntries {
+		return nil, ErrBusy
+	}
+	if c.startChild == nil {
+		return nil, ErrUnavailable
+	}
+	op := &cohortOperation{binding: b, actor: actor, admittedAt: c.now(), maxBytes: MaxBoundedBytes}
+	c.operations[b.OperationID] = op
+	c.seen["op:"+b.OperationID] = true
+	c.seen["nonce:"+b.Nonce] = true
+	return op, ""
+}
+func (c *operationCohort) launchReserved(op *cohortOperation) Code {
+	c.gate.mu.Lock()
+	exists := c.operations[op.binding.OperationID] == op && !op.canceled && c.allowed()
+	if !exists {
+		delete(c.operations, op.binding.OperationID)
+	}
+	c.gate.mu.Unlock()
+	if !exists {
+		return ErrFenced
+	}
+	child, err := c.startChild(op.actor, op.binding)
+	c.gate.mu.Lock()
+	defer c.gate.mu.Unlock()
+	if child == nil {
+		delete(c.operations, op.binding.OperationID)
+		return ErrUnavailable
+	}
+	c.started++
+	op.process = child
+	if !c.allowed() {
+		op.canceled = true
+		child.stopRelay()
+		return ErrFenced
+	}
+	if err != nil {
+		op.canceled = true
+		child.stopRelay()
+		return ErrCleanupRequired
+	}
+	return ""
+}
+func (c *operationCohort) chunk(ctx context.Context, peer operationPeer, p *NativeProvider, carriers SessionCarriers, b operationBinding, n uint32) Code {
+	if c.fenced || !c.gate.allow(c.now()) {
+		return ErrFenced
+	}
+	if !c.peerAllowed(peer) {
+		return ErrDenied
+	}
+	op := c.operations[b.OperationID]
+	if op == nil || op.binding != b {
+		return ErrDenied
+	}
+	if op.canceled {
+		return ErrCanceled
+	}
+	if op.expired(c.now()) {
+		op.canceled = true
+		op.process.stopRelay()
+		return ErrTimeout
+	}
+	actor, code := p.Revalidate(ctx, carriers, op.actor)
+	if code != "" {
+		op.canceled = true
+		op.process.stopRelay()
+		return code
+	}
+	c.gate.mu.Lock()
+	code = c.reserveChunkLocked(op, actor, n)
+	c.gate.mu.Unlock()
+	if code != "" {
+		return code
+	}
+	return c.deliverChunk(op, n)
+}
+func (c *operationCohort) reserveChunkLocked(op *cohortOperation, actor NativeActor, n uint32) Code {
+	if !c.allowed() {
+		return ErrFenced
+	}
+	if op.process == nil || op.canceled {
+		return ErrCanceled
+	}
+	if op.expired(c.now()) {
+		op.canceled = true
+		op.process.stopRelay()
+		return ErrTimeout
+	}
+	if !nativeFresh(actor.account.CheckedAt, c.now()) {
+		op.canceled = true
+		op.process.stopRelay()
+		return ErrStale
+	}
+	ceiling := op.maxBytes
+	if ceiling == 0 {
+		ceiling = MaxBoundedBytes
+	}
+	if n == 0 || n > MaxChunkBytes || uint64(n) > ceiling || op.bytes > ceiling-uint64(n) {
+		return ErrLimit
+	}
+	idle, err := op.process.idle()
+	if err != nil {
+		op.canceled = true
+		op.process.stopRelay()
+		return ErrCleanupRequired
+	}
+	if !idle {
+		return ErrBusy
+	}
+	op.bytes += uint64(n)
+	op.actor = actor
+	op.lastActivity = c.now()
+	return ""
+}
+func (c *operationCohort) deliverChunk(op *cohortOperation, n uint32) Code {
+	if op.canceled {
+		return ErrCanceled
+	}
+	var err error
+	if p, ok := op.process.(interface {
+		chunkWithActor(uint32, NativeActor) error
+	}); ok {
+		err = p.chunkWithActor(n, op.actor)
+	} else {
+		err = op.process.chunk(n)
+	}
+	if err != nil {
+		op.canceled = true
+		op.process.stopRelay()
+		return ErrCleanupRequired
+	}
+	return ""
+}
+func (c *operationCohort) poll() error {
+	for id, op := range c.operations {
+		if op.process == nil {
+			if op.canceled {
+				delete(c.operations, id)
+			}
+			continue
+		}
+		if op.expired(c.now()) {
+			op.canceled = true
+			op.process.stopRelay()
+		}
+		if _, relayErr := op.process.idle(); relayErr != nil {
+			op.canceled = true
+			op.process.stopRelay()
+		}
+		done, err := op.process.exited()
+		if err != nil {
+			return err
+		}
+		if op.canceled && !done {
+			if err := op.process.signal(syscall.SIGKILL); err != nil {
+				return err
+			}
+		}
+		if done {
+			op.process.stopRelay()
+			if op.process.relayStopped() {
+				c.retire(id, op)
+			}
+		}
+	}
+	return nil
+}
+func (c *operationCohort) deny() {
+	c.fenced = true
+	for _, op := range c.operations {
+		op.canceled = true
+		if op.process != nil {
+			op.process.stopRelay()
+		}
+	}
+}
+func (c *operationCohort) drain(ctx context.Context, grace time.Duration) error {
+	c.deny()
+	return c.drainSelected(ctx, grace, func(*cohortOperation) bool { return true })
+}
+
+// S3 calls this after durable R; other grants keep running. This is only Q proof.
+func (c *operationCohort) cancelGrant(ctx context.Context, id string, revision uint64) error {
+	return c.drainSelected(ctx, TerminateGrace, func(op *cohortOperation) bool {
+		return op.binding.GrantID == id && op.binding.GrantRevision <= revision
+	})
+}
+func (c *operationCohort) drainSelected(ctx context.Context, grace time.Duration, selected func(*cohortOperation) bool) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	killed := map[string]bool{}
+	term := map[string]bool{}
+	escalate := time.Now().Add(grace)
+	for {
+		pending := false
+		for id, op := range c.operations {
+			if !selected(op) {
+				continue
+			}
+			op.canceled = true
+			if op.process == nil {
+				delete(c.operations, id)
+				continue
+			}
+			op.process.stopRelay()
+			done, err := op.process.exited()
+			if err != nil {
+				return err
+			}
+			if done {
+				if op.process.relayStopped() {
+					c.retire(id, op)
+					continue
+				}
+			} else if !term[id] {
+				if err := op.process.signal(syscall.SIGTERM); err != nil {
+					return err
+				}
+				term[id] = true
+			} else if !killed[id] && !time.Now().Before(escalate) {
+				if err := op.process.signal(syscall.SIGKILL); err != nil {
+					return err
+				}
+				killed[id] = true
+			}
+			pending = true
+		}
+		if !pending {
+			return nil
+		}
+		timer := time.NewTimer(time.Millisecond)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return ctx.Err()
+		case <-timer.C:
+		}
+	}
+}
+func (c *operationCohort) proof() (*CohortCompletion, error) {
+	if !c.fenced || len(c.operations) != 0 || c.started != c.reaped {
+		return nil, errTrust
+	}
+	if c.started == 0 {
+		return nil, nil
+	}
+	proof := &CohortCompletion{Started: c.started, Reaped: c.reaped, RelaysStopped: true}
+	for _, r := range c.receipts {
+		if r.write != nil {
+			proof.WriteIntents++
+			if r.write.unknown || r.write.code == ErrCommitUncertain {
+				proof.WriteEffectsUnknown = true
+			}
+		}
+	}
+	return proof, nil
+}

package/templates/native-go/backend/internal/helper/cohort_publication.go

@@ -0,0 +1,18 @@
+package helper
+
+import (
+	"context"
+	"errors"
+)
+
+// Match the controller's completion-publication handoff: only a busy lock may
+// be retried, with the caller's finite budget. The transaction re-reads and
+// validates authority after acquiring policy.lock. Expiry preserves refusal.
+func retryCohortPolicy(ctx context.Context, commit func() error) error {
+	last := errBusy
+	_ = waitHealthy(ctx, func(context.Context) bool {
+		last = commit()
+		return !errors.Is(last, errBusy)
+	})
+	return last
+}