@synopackageland/cli 0.4.0 → 0.5.0

package/dist/templates/native-go/backend/internal/helper/unit_connection_test.go

@@ -0,0 +1,151 @@
+package helper
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"testing"
+
+	"github.com/godbus/dbus/v5"
+)
+
+type observerClosedReader struct{ *bytes.Reader }
+
+func (r observerClosedReader) Read(p []byte) (int, error) {
+	if r.Len() == 0 {
+		return 0, net.ErrClosed
+	}
+	return r.Reader.Read(p)
+}
+
+type observerTestStream struct {
+	io.Reader
+	written  bytes.Buffer
+	writeN   int
+	writeErr error
+}
+
+func (s *observerTestStream) Write(p []byte) (int, error) {
+	if s.writeN != 0 || s.writeErr != nil {
+		return s.writeN, s.writeErr
+	}
+	return s.written.Write(p)
+}
+func (s *observerTestStream) Close() error { return nil }
+
+// Cover the dependency directly as well as the production recovery boundary.
+// Canonical frames avoid EncodeTo's map-order-dependent header alignment.
+func TestDBusClosedHeaderPaddingReturnsErrorWithoutPanic(t *testing.T) {
+	for _, order := range []binary.ByteOrder{binary.LittleEndian, binary.BigEndian} {
+		t.Run(order.String(), func(t *testing.T) {
+			packet, header := observerPaddedFrame(t, order)
+			defer func() {
+				if failure := recover(); failure != nil {
+					t.Fatalf("closed socket during header alignment panicked: %v", failure)
+				}
+			}()
+			msg, err := dbus.DecodeMessage(observerClosedReader{bytes.NewReader(packet[:header])})
+			if msg != nil || !errors.Is(err, net.ErrClosed) {
+				t.Fatalf("partial frame accepted or close error lost: %+v %v", msg, err)
+			}
+		})
+	}
+}
+
+func TestObserverDBusFrameCloseReturnsError(t *testing.T) {
+	for _, order := range []binary.ByteOrder{binary.LittleEndian, binary.BigEndian} {
+		t.Run(order.String(), func(t *testing.T) {
+			packet, _ := observerPaddedFrame(t, order)
+			for end := 0; end < len(packet); end++ {
+				frame, err := readObserverDBusFrame(observerClosedReader{bytes.NewReader(packet[:end])})
+				if frame != nil || !errors.Is(err, net.ErrClosed) {
+					t.Fatalf("close at byte %d: partial frame %x error %v", end, frame, err)
+				}
+			}
+		})
+	}
+}
+
+func TestObserverDBusStreamPreservesFrames(t *testing.T) {
+	le, _ := observerPaddedFrame(t, binary.LittleEndian)
+	be, _ := observerPaddedFrame(t, binary.BigEndian)
+	wire := append(le, be...)
+	for _, chunk := range []int{1, 7, 128} {
+		stream := &observerDBusStream{ReadWriteCloser: &observerTestStream{Reader: bytes.NewReader(wire)}}
+		stream.messages.Store(true)
+		if n, err := stream.Read(nil); n != 0 || err != nil {
+			t.Fatalf("zero read: %d %v", n, err)
+		}
+		var replay bytes.Buffer
+		buf := make([]byte, chunk)
+		for {
+			n, err := stream.Read(buf)
+			replay.Write(buf[:n])
+			if err != nil {
+				if err != io.EOF {
+					t.Fatal(err)
+				}
+				break
+			}
+		}
+		if !bytes.Equal(replay.Bytes(), wire) {
+			t.Fatalf("chunk %d altered message bytes", chunk)
+		}
+	}
+}
+
+func TestObserverDBusStreamNeverReplaysPartialFrame(t *testing.T) {
+	packet, header := observerPaddedFrame(t, binary.LittleEndian)
+	for _, end := range []int{header, len(packet) - 1} {
+		stream := &observerDBusStream{ReadWriteCloser: &observerTestStream{Reader: observerClosedReader{bytes.NewReader(packet[:end])}}}
+		stream.messages.Store(true)
+		buf := make([]byte, 1)
+		if n, err := stream.Read(buf); n != 0 || !errors.Is(err, net.ErrClosed) {
+			t.Fatalf("close at %d exposed partial frame: %d %v", end, n, err)
+		}
+	}
+}
+
+func TestObserverDBusStreamAuthBoundary(t *testing.T) {
+	for _, kind := range []string{"auth", "begin", "short", "error"} {
+		t.Run(kind, func(t *testing.T) {
+			raw := &observerTestStream{Reader: bytes.NewReader([]byte("OK\r\n"))}
+			stream := &observerDBusStream{ReadWriteCloser: raw}
+			text := make([]byte, 4)
+			if _, err := io.ReadFull(stream, text); err != nil || string(text) != "OK\r\n" {
+				t.Fatalf("auth text was decoded as a message: %q %v", text, err)
+			}
+			out := []byte("BEGIN\r\n")
+			switch kind {
+			case "auth":
+				out = []byte("AUTH EXTERNAL\r\n")
+			case "short":
+				raw.writeN = 2
+			case "error":
+				raw.writeErr = net.ErrClosed
+			}
+			stream.Write(out)
+			if stream.messages.Load() != (kind == "begin") {
+				t.Fatal("binary mode did not match successful BEGIN")
+			}
+			if (kind == "begin" || kind == "auth") && !bytes.Equal(raw.written.Bytes(), out) {
+				t.Fatal("outgoing auth bytes changed")
+			}
+		})
+	}
+}
+
+type observerPanicReader struct{ value interface{} }
+
+func (r observerPanicReader) Read([]byte) (int, error) { panic(r.value) }
+
+func TestObserverDBusFrameUnexpectedPanicDisconnects(t *testing.T) {
+	for _, failure := range []interface{}{net.ErrClosed, "decoder failure"} {
+		frame, err := readObserverDBusFrame(observerPanicReader{failure})
+		if frame != nil || !errors.Is(err, errObserverDBusDecode) {
+			t.Fatalf("panic did not become disconnect error: %x %v", frame, err)
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/helper/unit_frame_test.go

@@ -0,0 +1,32 @@
+package helper
+
+import (
+	"bytes"
+	"encoding/binary"
+	"github.com/godbus/dbus/v5"
+	"testing"
+)
+
+func observerPaddedFrame(t *testing.T, order binary.ByteOrder) ([]byte, int) {
+	t.Helper()
+	// Canonical method reply: reply-serial precedes signature so the header
+	// always ends at byte 31. EncodeTo iterates a map; the reverse order would
+	// occasionally produce an aligned header and weaken this fixture.
+	header := 31
+	packet := make([]byte, 38)
+	packet[0], packet[1], packet[3] = 'l', byte(dbus.TypeMethodReply), 1
+	if order == binary.BigEndian {
+		packet[0] = 'B'
+	}
+	order.PutUint32(packet[4:8], 6) // string body: uint32 length + "x" + NUL
+	order.PutUint32(packet[8:12], 1)
+	order.PutUint32(packet[12:16], 15)
+	copy(packet[16:31], []byte{5, 1, 'u', 0, 0, 0, 0, 0, 8, 1, 'g', 0, 1, 's', 0})
+	order.PutUint32(packet[20:24], 1)
+	order.PutUint32(packet[32:36], 1)
+	packet[36] = 'x'
+	if _, err := dbus.DecodeMessage(bytes.NewReader(packet)); err != nil {
+		t.Fatal("intact frame:", err)
+	}
+	return packet, header
+}

package/dist/templates/native-go/backend/internal/helper/unit_linux.go

@@ -0,0 +1,368 @@
+package helper
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/godbus/dbus/v5"
+)
+
+const unitQueryTimeout = 500 * time.Millisecond
+const unitProbeInterval = 250 * time.Millisecond
+
+const systemdName = "org.freedesktop.systemd1"
+const managerInterface = systemdName + ".Manager"
+const unitInterface = systemdName + ".Unit"
+const propertiesInterface = "org.freedesktop.DBus.Properties"
+const busPath = "/run/dbus/system_bus_socket"
+
+func installedBinding(i Inventory) (Binding, error) {
+	var result Binding
+	if !i.Valid() {
+		return result, errTrust
+	}
+	dir := "/var/packages/" + i.Package
+	for _, p := range []string{"/var", "/var/packages", dir} {
+		if err := protected(p, 0, true); err != nil {
+			return result, err
+		}
+	}
+	f, err := os.OpenFile(filepath.Join(dir, "INFO"), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return result, err
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return result, err
+	}
+	s, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || s.Uid != 0 || !st.Mode().IsRegular() || st.Mode().Perm()&0022 != 0 || st.Size() > 32768 {
+		return result, errTrust
+	}
+	b, err := io.ReadAll(io.LimitReader(f, 32769))
+	if err != nil || len(b) > 32768 {
+		return result, errTrust
+	}
+	values := map[string]string{}
+	for _, line := range strings.Split(string(b), "\n") {
+		k, v, found := strings.Cut(strings.TrimSpace(line), "=")
+		if !found || (k != "package" && k != "version") {
+			continue
+		}
+		if _, exists := values[k]; exists || len(v) < 2 || v[0] != '"' || v[len(v)-1] != '"' {
+			return result, errTrust
+		}
+		values[k] = v[1 : len(v)-1]
+	}
+	if values["package"] != i.Package || values["version"] != i.Version {
+		return result, errTrust
+	}
+	boot, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
+	if err != nil {
+		return result, err
+	}
+	sum := sha256.Sum256(append([]byte(fmt.Sprintf("%d:%d:%d:%d:%d:%d:", s.Dev, s.Ino, s.Mtim.Sec, s.Mtim.Nsec, s.Ctim.Sec, s.Ctim.Nsec)), b...))
+	result = Binding{Boot: strings.TrimSpace(string(boot)), Install: hex.EncodeToString(sum[:])}
+	return result, nil
+}
+func systemdUnitPath(name string) dbus.ObjectPath {
+	var out strings.Builder
+	for _, c := range []byte(name) {
+		if (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') {
+			out.WriteByte(c)
+		} else {
+			fmt.Fprintf(&out, "_%02x", c)
+		}
+	}
+	return dbus.ObjectPath("/org/freedesktop/systemd1/unit/" + out.String())
+}
+
+type unitObserver struct {
+	ownerMu     sync.RWMutex
+	wireMu      sync.Mutex
+	wire        observerEvent
+	conn        *dbus.Conn
+	owner, unit string
+	path        dbus.ObjectPath
+	inventory   Inventory
+	gate        *admission
+}
+
+// godbus invokes Terminator synchronously when its signal subscription closes.
+func (o *unitObserver) Terminate() {
+	o.gate.fenceObserver("observation-unavailable", observerEvent{Detail: "subscription-terminated"})
+}
+
+func (o *unitObserver) DeliverSignal(_ string, _ string, s *dbus.Signal) {
+	// Synchronous, constant work in godbus's receive loop: no lossy signal queue.
+	e := o.signalEvent(s)
+	fence := func(reason, detail string) { e.Detail = detail; o.gate.fenceObserver(reason, e) }
+	if s.Name == "org.freedesktop.DBus.NameOwnerChanged" && s.Sender == "org.freedesktop.DBus" && len(s.Body) == 3 && s.Body[0] == systemdName {
+		fence("bus-owner-changed", "owner-signal")
+		return
+	}
+	o.ownerMu.RLock()
+	owner := o.owner
+	o.ownerMu.RUnlock()
+	if s.Sender != owner {
+		return
+	}
+	switch s.Name {
+	case managerInterface + ".Reloading":
+		if s.Path != "/org/freedesktop/systemd1" || len(s.Body) != 1 {
+			fence("observation-unavailable", "reload-shape")
+			return
+		}
+		reloading, ok := s.Body[0].(bool)
+		if !ok {
+			fence("observation-unavailable", "reload-type")
+			return
+		}
+		if reloading {
+			e.Detail = "reload-start"
+		} else {
+			e.Detail = "reload-end"
+		}
+		o.gate.recordObserver(e)
+		o.gate.requestUnitCheck(reloading, time.Now())
+	case managerInterface + ".UnitRemoved":
+		if len(s.Body) >= 1 && s.Body[0] == o.unit {
+			if len(s.Body) != 2 || s.Body[1] != o.path {
+				fence("observation-unavailable", "unit-removed-shape")
+				return
+			}
+			e.Detail = "unit-removed"
+			o.gate.recordObserver(e)
+			o.gate.requestUnitRemoval(time.Now())
+		}
+	case managerInterface + ".JobNew":
+		if len(s.Body) >= 3 && s.Body[2] == o.unit {
+			fence("unit-transition", "job-new")
+		}
+	case propertiesInterface + ".PropertiesChanged":
+		if s.Path != o.path {
+			return
+		}
+		if len(s.Body) != 3 || s.Body[0] != unitInterface {
+			return
+		}
+		e.Detail = "properties-changed"
+		o.gate.recordObserver(e)
+		values, ok := s.Body[1].(map[string]dbus.Variant)
+		if !ok {
+			fence("observation-unavailable", "properties-map")
+			return
+		}
+		for _, key := range []string{"LoadState", "ActiveState", "SubState", "Job", "ActiveEnterTimestampMonotonic", "InvocationID"} {
+			if v, ok := values[key]; ok {
+				switch key {
+				case "LoadState":
+					if v.Value() != "loaded" {
+						fence("unit-stopped", "property-"+key)
+					}
+				case "ActiveState":
+					if v.Value() != "active" {
+						fence("unit-stopped", "property-"+key)
+					}
+				case "SubState":
+					if v.Value() != "running" && v.Value() != "exited" {
+						fence("unit-stopped", "property-"+key)
+					}
+				case "Job":
+					id, valid := jobID(v)
+					if !valid || id != 0 {
+						fence("unit-transition", "property-"+key)
+					}
+				case "InvocationID":
+					invocation, valid := invocationID(v)
+					o.gate.mu.Lock()
+					if !valid || (o.gate.unitObserved && (!o.gate.hasInvocation || o.gate.invocation != invocation)) {
+						e.Detail = "property-" + key
+						o.gate.fenceObserverLocked("unit-transition", e)
+					}
+					o.gate.mu.Unlock()
+				case "ActiveEnterTimestampMonotonic":
+					entered, ok := v.Value().(uint64)
+					o.gate.mu.Lock()
+					if !ok || entered == 0 || (o.gate.entered != 0 && o.gate.entered != entered) {
+						e.Detail = "property-" + key
+						o.gate.fenceObserverLocked("unit-transition", e)
+					}
+					o.gate.mu.Unlock()
+				}
+			}
+		}
+		if invalid, ok := s.Body[2].([]string); ok {
+			for _, key := range invalid {
+				if key == "LoadState" || key == "ActiveState" || key == "SubState" || key == "Job" || key == "ActiveEnterTimestampMonotonic" || key == "InvocationID" {
+					fence("observation-unavailable", "property-invalidated-"+key)
+				}
+			}
+		} else {
+			fence("observation-unavailable", "properties-invalidated-type")
+		}
+	}
+}
+func jobID(v dbus.Variant) (uint32, bool) {
+	fields, ok := v.Value().([]interface{})
+	if !ok || len(fields) != 2 {
+		return 0, false
+	}
+	id, ok := fields[0].(uint32)
+	path, valid := fields[1].(dbus.ObjectPath)
+	return id, ok && valid && path.IsValid()
+}
+
+func openUnitObserver(parent context.Context, i Inventory) (*unitObserver, error) {
+	ctx, cancel := context.WithTimeout(parent, unitQueryTimeout)
+	defer cancel()
+	binding, err := installedBinding(i)
+	if err != nil {
+		return nil, err
+	}
+	for _, p := range []string{"/run", "/run/dbus"} {
+		if err := protected(p, 0, true); err != nil {
+			return nil, err
+		}
+	}
+	st, err := os.Lstat(busPath)
+	if err != nil {
+		return nil, err
+	}
+	s, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || s.Uid != 0 || st.Mode()&os.ModeSocket == 0 {
+		return nil, errTrust
+	}
+	raw, err := (&net.Dialer{}).DialContext(ctx, "unix", busPath)
+	if err != nil {
+		return nil, err
+	}
+	deadline, _ := ctx.Deadline()
+	raw.SetDeadline(deadline)
+	o := &unitObserver{inventory: i, unit: "pkgctl-" + i.Package + ".service", gate: newAdmission(binding)}
+	o.path = systemdUnitPath(o.unit)
+	conn, err := newObserverConnection(raw, o, dbus.WithIncomingInterceptor(o.incomingObserverMessage))
+	if err != nil {
+		raw.Close()
+		return nil, err
+	}
+	o.conn = conn
+	success := false
+	defer func() {
+		if !success {
+			conn.Close()
+		}
+	}()
+	if err := conn.Auth([]dbus.Auth{dbus.AuthExternal("0")}); err != nil {
+		return nil, err
+	}
+	if err := conn.Hello(); err != nil {
+		return nil, err
+	}
+	raw.SetDeadline(time.Time{})
+	// Resolve once and address calls to the unique owner, never a replacement.
+	var owner string
+	if err := conn.BusObject().CallWithContext(ctx, "org.freedesktop.DBus.GetNameOwner", 0, systemdName).Store(&owner); err != nil {
+		return nil, err
+	}
+	o.ownerMu.Lock()
+	o.owner = owner
+	o.ownerMu.Unlock()
+	var uid, pid uint32
+	if err := conn.BusObject().CallWithContext(ctx, "org.freedesktop.DBus.GetConnectionUnixUser", 0, o.owner).Store(&uid); err != nil {
+		return nil, err
+	}
+	if err := conn.BusObject().CallWithContext(ctx, "org.freedesktop.DBus.GetConnectionUnixProcessID", 0, o.owner).Store(&pid); err != nil || uid != 0 || pid != 1 {
+		return nil, fmt.Errorf("systemd credentials uid=%d pid=%d: %w", uid, pid, errTrust)
+	}
+	matches := [][]dbus.MatchOption{
+		{dbus.WithMatchSender("org.freedesktop.DBus"), dbus.WithMatchInterface("org.freedesktop.DBus"), dbus.WithMatchMember("NameOwnerChanged"), dbus.WithMatchArg(0, systemdName)},
+		{dbus.WithMatchSender(o.owner), dbus.WithMatchInterface(managerInterface)},
+		{dbus.WithMatchSender(o.owner), dbus.WithMatchInterface(propertiesInterface), dbus.WithMatchObjectPath(o.path)},
+	}
+	for _, m := range matches {
+		if err := conn.AddMatchSignalContext(ctx, m...); err != nil {
+			return nil, err
+		}
+	}
+	manager := conn.Object(o.owner, "/org/freedesktop/systemd1")
+	if err := manager.CallWithContext(ctx, managerInterface+".Subscribe", 0).Err; err != nil {
+		return nil, err
+	}
+	var path dbus.ObjectPath
+	if err := manager.CallWithContext(ctx, managerInterface+".GetUnit", 0, o.unit).Store(&path); err != nil || path != o.path {
+		return nil, fmt.Errorf("unit path %s: %w", path, errTrust)
+	}
+	if err := o.reconcile(ctx); err != nil || !o.gate.allow(time.Now()) {
+		return nil, fmt.Errorf("initial observation %s: %v: %w", o.gate.reason(), err, errTrust)
+	}
+	success = true
+	return o, nil
+}
+
+func (o *unitObserver) watch(ctx context.Context) {
+	ticker := time.NewTimer(unitProbeInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			o.gate.fenceObserver("observation-unavailable", observerEvent{Detail: "watch-canceled", ErrorClass: observerErrorClass(ctx.Err())})
+			return
+		case <-o.conn.Context().Done():
+			o.gate.fenceObserver("observation-unavailable", observerEvent{Detail: "bus-context-done", ErrorClass: observerErrorClass(o.conn.Context().Err())})
+			return
+		case <-ticker.C:
+			probe, cancel := context.WithTimeout(ctx, unitQueryTimeout)
+			err := o.reconcile(probe)
+			cancel()
+			if err != nil {
+				return
+			}
+			ticker.Reset(unitProbeInterval)
+		}
+	}
+}
+func observeLinux(ctx context.Context, i Inventory) (Binding, error) {
+	o, err := openUnitObserver(ctx, i)
+	if err != nil {
+		return Binding{}, err
+	}
+	defer o.conn.Close()
+	return o.gate.binding, nil
+}
+
+// Upstream v219/v229 have no InvocationID; v232 provides it. Absence is pinned for this observer;
+// a supported property must be a nonzero 128-bit ID and may never disappear.
+func invocationID(v dbus.Variant) (string, bool) {
+	b, ok := v.Value().([]byte)
+	if !ok || len(b) != 16 {
+		return "", false
+	}
+	var nonzero byte
+	for _, c := range b {
+		nonzero |= c
+	}
+	if nonzero == 0 {
+		return "", false
+	}
+	return hex.EncodeToString(b), true
+}
+func unitInvocation(values map[string]dbus.Variant) (string, bool, bool) {
+	v, present := values["InvocationID"]
+	if !present {
+		return "", false, true
+	}
+	id, ok := invocationID(v)
+	return id, true, ok
+}

package/dist/templates/native-go/backend/internal/helper/unit_linux_test.go

@@ -0,0 +1,46 @@
+package helper
+
+import (
+	"github.com/godbus/dbus/v5"
+	"testing"
+	"time"
+)
+
+func TestLinuxSignalSourceAndUnitIsolation(t *testing.T) {
+	for _, kind := range []string{"foreign", "other-unit", "same-active", "stop-start", "job", "owner", "invalidated"} {
+		t.Run(kind, func(t *testing.T) {
+			b := testBinding()
+			g := newAdmission(b)
+			g.observe(b, 7, true, time.Now())
+			o := &unitObserver{unit: "pkgctl-root.service", path: systemdUnitPath("pkgctl-root.service"), owner: ":1.1", gate: g}
+			s := &dbus.Signal{Sender: ":1.1", Path: o.path, Name: propertiesInterface + ".PropertiesChanged", Body: []interface{}{unitInterface, map[string]dbus.Variant{"ActiveState": dbus.MakeVariant("inactive")}, []string{}}}
+			want := false
+			switch kind {
+			case "foreign":
+				s.Sender = ":1.2"
+				want = true
+			case "other-unit":
+				s.Path = systemdUnitPath("pkgctl-other.service")
+				want = true
+			case "same-active":
+				s.Body[1] = map[string]dbus.Variant{"ActiveState": dbus.MakeVariant("active")}
+				want = true
+			case "job":
+				s.Name = managerInterface + ".JobNew"
+				s.Body = []interface{}{uint32(1), dbus.ObjectPath("/job/1"), o.unit}
+			case "owner":
+				s.Sender = "org.freedesktop.DBus"
+				s.Name = "org.freedesktop.DBus.NameOwnerChanged"
+				s.Body = []interface{}{systemdName, ":1.1", ":1.2"}
+			case "invalidated":
+				s.Body[1] = map[string]dbus.Variant{}
+				s.Body[2] = []string{"ActiveState"}
+			}
+			o.DeliverSignal("", "", s)
+			g.observe(b, 7, true, time.Now())
+			if g.allow(time.Now()) != want {
+				t.Fatalf("signal %s isolation failed: %s", kind, g.reason())
+			}
+		})
+	}
+}