@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/unit_mechanisms_linux_test.go

@@ -0,0 +1,217 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"github.com/godbus/dbus/v5"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"testing"
+	"time"
+)
+
+func logObserverResult(t *testing.T, p LinuxProcesses, before Record, identity Process, mustFence bool, childBefore ...int) {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if mustFence {
+		if err := waitHealthy(ctx, func(context.Context) bool {
+			r, e := readRecord(p.StateDir, 0)
+			return e == nil && r.Lifecycle.Phase == "stopped" && r.Lifecycle.Completion != ""
+		}); err != nil {
+			t.Fatal("no durable teardown", err)
+		}
+	}
+	r, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if r.Lifecycle.Phase == "running" {
+		if mustFence || !reflect.DeepEqual(r, before) || p.Client.Status(ctx).State != "ready" {
+			t.Fatalf("invalid preservation: %+v", r)
+		}
+		current, e := readProcess(p.RunDir, 0)
+		if e != nil || current != identity {
+			t.Fatalf("helper identity changed: %+v %v", current, e)
+		}
+		if len(childBefore) == 1 && supervisedPID(t, identity.PID) != childBefore[0] {
+			t.Fatal("owned child replaced during reload")
+		}
+		t.Logf("mechanism preserved epoch=%s supervisor=%d child=%d", r.Lifecycle.Epoch, identity.PID, supervisedPID(t, identity.PID))
+		return
+	}
+	if r.Lifecycle.Phase != "stopped" {
+		t.Fatalf("incomplete fence: %+v", r)
+	}
+	proof, err := completionRecord(p.Client, r)
+	if err != nil || proof.Process != identity {
+		t.Fatalf("wrong proof: %+v %v", proof, err)
+	}
+	var d observerDiagnostic
+	if err := waitHealthy(ctx, func(context.Context) bool {
+		b, e := os.ReadFile(filepath.Join(p.StateDir, "observer-diagnostic.json"))
+		return e == nil && json.Unmarshal(b, &d) == nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if d.Epoch != before.Lifecycle.Epoch || d.Fence.Detail != r.Lifecycle.SubReason || r.Lifecycle.SubReason == "" {
+		t.Fatalf("inconsistent diagnostic: %+v %+v", r, d)
+	}
+	b, _ := json.Marshal(d)
+	t.Logf("mechanism durable reason=%s subReason=%s diagnostic=%s", r.Lifecycle.Reason, r.Lifecycle.SubReason, b)
+}
+func TestLinuxObserverDaemonReexecMechanism(t *testing.T) {
+	p := linuxFixture(t)
+	identity := startVMHelper(t, p)
+	before, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if out, err := exec.Command("systemctl", "daemon-reexec").CombinedOutput(); err != nil {
+		t.Fatalf("reexec %s %v", out, err)
+	}
+	time.Sleep(1500 * time.Millisecond)
+	logObserverResult(t, p, before, identity, false)
+}
+func TestLinuxObserverLongReloadMechanism(t *testing.T) {
+	p := linuxFixture(t)
+	identity := startVMHelper(t, p)
+	childBefore := supervisedPID(t, identity.PID)
+	before, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := "/etc/systemd/system-generators"
+	if err = os.MkdirAll(dir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	generator := filepath.Join(dir, "m1j-slow-reload")
+	if err = os.WriteFile(generator, []byte("#!/bin/sh\nsleep 4\n"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(generator)
+	start := time.Now()
+	if out, err := exec.Command("systemctl", "daemon-reload").CombinedOutput(); err != nil {
+		t.Fatalf("reload %s %v", out, err)
+	}
+	t.Logf("slow reload duration=%s", time.Since(start))
+	time.Sleep(750 * time.Millisecond)
+	logObserverResult(t, p, before, identity, false, childBefore)
+	r, err := readRecord(p.StateDir, 0)
+	if err != nil || !reflect.DeepEqual(r, before) {
+		t.Fatalf("bounded long reload retired epoch: %+v %v", r, err)
+	}
+}
+func TestLinuxObserverOtherUnitSequenceMechanism(t *testing.T) {
+	p := linuxFixture(t)
+	identity := startVMHelper(t, p)
+	childBefore := supervisedPID(t, identity.PID)
+	before, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	unit := "pkgctl-m1j-other.service"
+	path := filepath.Join("/etc/systemd/system", unit)
+	if err = os.WriteFile(path, []byte("[Service]\nType=oneshot\nExecStart=/bin/true\nRemainAfterExit=yes\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(path)
+	for _, args := range [][]string{{"daemon-reload"}, {"start", unit}, {"stop", unit}, {"restart", unit}, {"daemon-reload"}, {"stop", unit}} {
+		if out, err := exec.Command("systemctl", args...).CombinedOutput(); err != nil {
+			t.Fatalf("%v: %s %v", args, out, err)
+		}
+	}
+	time.Sleep(600 * time.Millisecond)
+	logObserverResult(t, p, before, identity, false, childBefore)
+	r, err := readRecord(p.StateDir, 0)
+	if err != nil || !reflect.DeepEqual(r, before) {
+		t.Fatalf("other unit retired helper: %+v %v", r, err)
+	}
+}
+
+// Deterministic delivery-seam probe in a real VM observer, not a claim that
+// systemd emitted an invalidation or that this packet occurred on DSM.
+func TestLinuxObserverOwnInvalidationDuringReloadMechanism(t *testing.T) {
+	p := linuxFixture(t)
+	o, err := openUnitObserver(context.Background(), p.Expected)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer o.conn.Close()
+	for _, key := range []string{"LoadState", "ActiveState", "SubState", "Job", "ActiveEnterTimestampMonotonic", "InvocationID"} {
+		// Fresh observer for each sticky cause.
+		fresh, err := openUnitObserver(context.Background(), p.Expected)
+		if err != nil {
+			t.Fatal(err)
+		}
+		fresh.DeliverSignal("", "", &dbus.Signal{Name: managerInterface + ".Reloading", Sender: fresh.owner, Path: "/org/freedesktop/systemd1", Body: []interface{}{true}})
+		fresh.DeliverSignal("", "", &dbus.Signal{Name: propertiesInterface + ".PropertiesChanged", Sender: fresh.owner, Path: fresh.path, Body: []interface{}{unitInterface, map[string]dbus.Variant{}, []string{key}}})
+		d := fresh.gate.observerDiagnostic("")
+		t.Logf("INJECTED own invalidation key=%s cause=%s/%s", key, d.Reason, d.Fence.Detail)
+		if fresh.gate.allow(time.Now()) || d.Fence.Detail != "property-invalidated-"+key {
+			t.Fatalf("lost invalidation: %+v", d)
+		}
+		fresh.conn.Close()
+	}
+}
+
+func TestLinuxObserverDiagnosticWriteFailureStillCompletes(t *testing.T) {
+	p := linuxFixture(t)
+	identity := startVMHelper(t, p)
+	before, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(p.StateDir, "observer-diagnostic.json")
+	if err = os.Mkdir(path, 0700); err != nil {
+		t.Fatal(err)
+	}
+	vmUnit(t, "stop")
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if err = waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && r.Lifecycle.Phase == "stopped" && r.Lifecycle.Completion != ""
+	}); err != nil {
+		t.Fatal(err)
+	}
+	r, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proof, err := completionRecord(p.Client, r)
+	if err != nil || proof.Epoch != before.Lifecycle.Epoch || proof.Process != identity || r.Residual || r.Lifecycle.SubReason == "" {
+		t.Fatalf("diagnostic failure affected proof: %+v %+v %v", r, proof, err)
+	}
+	t.Logf("failed diagnostic write retained durable %s/%s and exact completion", r.Lifecycle.Reason, r.Lifecycle.SubReason)
+}
+
+func TestLinuxObserverReloadCapStillFences(t *testing.T) {
+	p := linuxFixture(t)
+	identity := startVMHelper(t, p)
+	before, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := "/etc/systemd/system-generators"
+	if err = os.MkdirAll(dir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	generator := filepath.Join(dir, "m1j-cap-reload")
+	if err = os.WriteFile(generator, []byte("#!/bin/sh\nsleep 12\n"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(generator)
+	start := time.Now()
+	if out, err := exec.Command("systemctl", "daemon-reload").CombinedOutput(); err != nil {
+		t.Fatalf("reload %s %v", out, err)
+	}
+	t.Logf("cap reload duration=%s", time.Since(start))
+	logObserverResult(t, p, before, identity, true)
+	r, err := readRecord(p.StateDir, 0)
+	if err != nil || r.Lifecycle.SubReason != "reload-deadline" {
+		t.Fatalf("wrong cap cause: %+v %v", r, err)
+	}
+}

package/templates/native-go/backend/internal/helper/unit_padding_linux_test.go

@@ -0,0 +1,178 @@
+package helper
+
+import (
+	"context"
+	"encoding/binary"
+	"errors"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/godbus/dbus/v5"
+)
+
+type observerTerminationBarrier struct {
+	*unitObserver
+	terminated chan struct{}
+	resume     chan struct{}
+}
+
+func (o *observerTerminationBarrier) Terminate() {
+	o.unitObserver.Terminate()
+	close(o.terminated)
+	<-o.resume
+}
+
+// Blocking Close after the production Terminate callback proves admission is
+// fenced synchronously, before Context cancellation or the watcher's next tick.
+// Closing only the underlying socket is essential: calling dbus.Conn.Close
+// ourselves would fence even with the unfixed background decoder panic.
+func testObserverPaddingClose(t *testing.T, order binary.ByteOrder, state string, verifyFence func(*unitObserver)) {
+	t.Helper()
+	b := testBinding()
+	o := &unitObserver{gate: newAdmission(b)}
+	now := time.Now()
+	o.gate.observe(b, 7, true, now)
+	if !o.gate.allow(now) {
+		t.Fatal("fixture did not begin ready")
+	}
+	wantReason := "observation-unavailable"
+	switch state {
+	case "reload":
+		o.gate.requestUnitCheck(true, now)
+	case "previous-fence":
+		wantReason = "unit-transition"
+		o.gate.fence(wantReason)
+	}
+	barrier := &observerTerminationBarrier{o, make(chan struct{}), make(chan struct{})}
+	conn, raw, peer := observerTestBus(t, barrier, dbus.WithIncomingInterceptor(o.incomingObserverMessage))
+	o.conn = conn
+	// Release before the bus fixture's cleanup tries to Close the connection.
+	released := false
+	defer func() {
+		if !released {
+			close(barrier.resume)
+		}
+	}()
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	call := conn.BusObject().GoWithContext(ctx, "org.freedesktop.DBus.GetNameOwner", 0, make(chan *dbus.Call, 1), systemdName)
+	if _, err := dbus.DecodeMessage(peer); err != nil {
+		t.Fatal("pending method request:", err)
+	}
+	packet, header := observerPaddedFrame(t, order)
+	raw.arm(header)
+	if _, err := peer.Write(packet[:header]); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-raw.padding:
+	case <-time.After(time.Second):
+		t.Fatal("reader did not reach header alignment padding")
+	}
+	if err := raw.Conn.Close(); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-barrier.terminated:
+	case <-time.After(time.Second):
+		t.Fatal("socket failure did not synchronously terminate subscription")
+	}
+	select {
+	case <-conn.Context().Done():
+		t.Fatal("connection cancelled before subscription barrier")
+	default:
+	}
+	if o.gate.allow(time.Now()) || o.gate.reason() != wantReason {
+		t.Fatalf("subscription did not immediately preserve sticky fence: %s", o.gate.reason())
+	}
+	if verifyFence != nil {
+		verifyFence(o)
+	}
+	// Subsequent healthy observations, reload edges, and errors cannot revive or
+	// overwrite the first fence, even when the socket failed inside revalidation.
+	o.gate.observe(b, 7, true, time.Now())
+	o.gate.requestUnitCheck(false, time.Now())
+	o.gate.fence("bus-owner-changed")
+	if o.gate.allow(time.Now()) || o.gate.reason() != wantReason {
+		t.Fatalf("disconnect fence was cleared or overwritten: %s", o.gate.reason())
+	}
+	if verifyFence != nil {
+		verifyFence(o)
+	}
+	close(barrier.resume)
+	released = true
+	select {
+	case <-conn.Context().Done():
+	case <-time.After(time.Second):
+		t.Fatal("background reader did not close the connection")
+	}
+	select {
+	case completed := <-call.Done:
+		if !errors.Is(completed.Err, net.ErrClosed) {
+			t.Fatalf("pending call did not return the socket close error: %v", completed.Err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("background reader left a pending call unresolved")
+	}
+}
+
+func TestLinuxObserverDBusPaddingClose(t *testing.T) {
+	for _, order := range []binary.ByteOrder{binary.LittleEndian, binary.BigEndian} {
+		for _, state := range []string{"ready", "reload", "previous-fence"} {
+			t.Run(order.String()+"/"+state, func(t *testing.T) {
+				testObserverPaddingClose(t, order, state, observerPaddingFenceProof(t, state))
+			})
+		}
+	}
+}
+
+// M1j is now on the base: verify the actual sticky sub-reason and durable
+// completion in each production-path socket-close case, not only an overlay.
+func observerPaddingFenceProof(t *testing.T, state string) func(*unitObserver) {
+	t.Helper()
+	want := "subscription-terminated"
+	if state == "previous-fence" {
+		want = "unit-transition"
+	}
+	var first observerEvent
+	checks := 0
+	return func(o *unitObserver) {
+		t.Helper()
+		d := o.gate.observerDiagnostic("")
+		if d.Fence.Detail != want {
+			t.Fatalf("wrong sticky detail: %+v", d)
+		}
+		checks++
+		if checks == 1 {
+			first = d.Fence
+			return
+		}
+		if d.Fence != first {
+			t.Fatalf("first fence changed: %+v -> %+v", first, d.Fence)
+		}
+		c := fixture(t)
+		b := testBinding()
+		l, err := newLifecycle(b)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err = writeProtected(c.StateDir, "approval.json", Record{Schema: 2, Inventory: c.Expected, Enabled: true, Lifecycle: l}); err != nil {
+			t.Fatal(err)
+		}
+		if err = fenceRecord(c, l.Epoch, o.gate.reason(), d.Fence.Detail); err != nil {
+			t.Fatal(err)
+		}
+		p := Process{Inventory: c.Expected, Mode: "supervised", Boot: b.Boot, PID: 42, Start: "123", Inode: 9}
+		if err = completeRecord(c, l.Epoch, p); err != nil {
+			t.Fatal(err)
+		}
+		record, err := readRecord(c.StateDir, c.Owner)
+		if err != nil || record.Lifecycle.SubReason != want || record.Lifecycle.Phase != "stopped" {
+			t.Fatalf("completion lost disconnect detail: %+v %v", record, err)
+		}
+		if _, err = completionRecord(c, record); err != nil {
+			t.Fatal(err)
+		}
+	}
+}

package/templates/native-go/backend/internal/helper/unit_query_linux.go

@@ -0,0 +1,115 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"github.com/godbus/dbus/v5"
+	"time"
+)
+
+// Queries have no admission side effects. A reload edge may invalidate their
+// transient result while the fixed verification budget continues to deny access.
+type unitSnapshotError struct {
+	reason     string
+	definitive bool
+	cause      error
+	phase      string
+	detail     string
+}
+
+func (e *unitSnapshotError) Error() string { return fmt.Sprintf("%s: %v", e.reason, e.cause) }
+func (e *unitSnapshotError) Unwrap() error { return e.cause }
+func (o *unitObserver) snapshot(ctx context.Context) (Binding, map[string]dbus.Variant, error) {
+	o.gate.recordObserver(observerEvent{Kind: "query-phase", Phase: "get-owner"})
+	var owner string
+	if err := o.conn.BusObject().CallWithContext(ctx, "org.freedesktop.DBus.GetNameOwner", 0, systemdName).Store(&owner); err != nil {
+		return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", definitive: false, cause: err, phase: "get-owner", detail: "query-failed"}
+	}
+	if owner != o.owner {
+		return Binding{}, nil, &unitSnapshotError{reason: "bus-owner-changed", definitive: true, cause: errTrust, phase: "get-owner", detail: "owner-query-changed"}
+	}
+	o.gate.recordObserver(observerEvent{Kind: "query-phase", Phase: "get-unit"})
+	var path dbus.ObjectPath
+	if err := o.conn.Object(o.owner, "/org/freedesktop/systemd1").CallWithContext(ctx, managerInterface+".GetUnit", 0, o.unit).Store(&path); err != nil {
+		return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", definitive: false, cause: err, phase: "get-unit", detail: "query-failed"}
+	}
+	if path != o.path {
+		return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", definitive: true, cause: errTrust, phase: "get-unit", detail: "unit-path-changed"}
+	}
+	o.gate.recordObserver(observerEvent{Kind: "query-phase", Phase: "installed-binding"})
+	b, err := installedBinding(o.inventory)
+	if err != nil {
+		return Binding{}, nil, &unitSnapshotError{reason: "installation-changed", definitive: true, cause: err, phase: "installed-binding", detail: "installation-query-failed"}
+	}
+	o.gate.recordObserver(observerEvent{Kind: "query-phase", Phase: "get-all"})
+	var values map[string]dbus.Variant
+	if err := o.conn.Object(o.owner, o.path).CallWithContext(ctx, propertiesInterface+".GetAll", 0, unitInterface).Store(&values); err != nil {
+		return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", definitive: false, cause: err, phase: "get-all", detail: "query-failed"}
+	}
+	return b, values, nil
+}
+
+func (o *unitObserver) reconcile(ctx context.Context) error {
+	return o.reconcileSnapshot(ctx, o.snapshot)
+}
+func (o *unitObserver) reconcileSnapshot(ctx context.Context, query func(context.Context) (Binding, map[string]dbus.Variant, error)) error {
+	started := time.Now()
+	serial, ready := o.gate.unitProbe(started)
+	// Initial observation has no freshness baseline yet.
+	if !ready {
+		return nil
+	}
+	o.gate.recordObserver(observerEvent{Kind: "query-start", QuerySerial: serial})
+	b, values, err := query(ctx)
+	if err != nil {
+		reason, definitive := "observation-unavailable", false
+		e := observerEvent{Kind: "query-error", Detail: "query-failed", Phase: "snapshot", ErrorClass: observerErrorClass(err), QuerySerial: serial}
+		var failure *unitSnapshotError
+		if errors.As(err, &failure) {
+			reason, definitive = failure.reason, failure.definitive
+			e.Phase = failure.phase
+			if failure.detail != "" {
+				e.Detail = failure.detail
+			}
+		}
+		o.gate.recordObserver(e)
+		if !definitive && errors.Is(err, context.DeadlineExceeded) && (e.Phase == "get-owner" || e.Phase == "get-unit" || e.Phase == "get-all") && o.gate.deferUnitDeadline(serial, started, time.Now(), e) {
+			return nil
+		}
+		if o.gate.failUnitProbe(serial, reason, definitive, time.Now(), e) {
+			return err
+		}
+		return nil
+	}
+	return o.observeValues(b, values, serial, time.Now())
+}
+
+func (o *unitObserver) observeValues(b Binding, values map[string]dbus.Variant, serial uint64, now time.Time) error {
+	id, jobOK := jobID(values["Job"])
+	entered, enteredOK := values["ActiveEnterTimestampMonotonic"].Value().(uint64)
+	active := values["Id"].Value() == o.unit && values["LoadState"].Value() == "loaded" && values["ActiveState"].Value() == "active" && (values["SubState"].Value() == "running" || values["SubState"].Value() == "exited") && jobOK && id == 0 && enteredOK && entered > 0
+	invocation, present, valid := unitInvocation(values)
+	detail := ""
+	switch {
+	case values["Id"].Value() != o.unit:
+		detail = "snapshot-Id"
+	case values["LoadState"].Value() != "loaded":
+		detail = "snapshot-LoadState"
+	case values["ActiveState"].Value() != "active":
+		detail = "snapshot-ActiveState"
+	case values["SubState"].Value() != "running" && values["SubState"].Value() != "exited":
+		detail = "snapshot-SubState"
+	case !jobOK || id != 0:
+		detail = "snapshot-Job"
+	case !enteredOK || entered == 0:
+		detail = "snapshot-ActiveEnterTimestampMonotonic"
+	case !valid:
+		detail = "snapshot-InvocationID"
+	}
+	o.gate.observeUnit(b, entered, invocation, present, active && valid, serial, now, observerEvent{Detail: detail, Phase: "validate-values", QuerySerial: serial})
+	if reason := o.gate.reason(); reason != "" {
+		return fmt.Errorf("unit observation %s: %w", reason, errTrust)
+	}
+	return nil
+}