@synopackageland/cli 0.5.0 → 0.5.3

package/templates/_authorization/main.go

@@ -0,0 +1,104 @@
+// CLI-owned root bootstrap: accepts only compiled fixed operations. The native
+// task copies and pins this executable before it can run with root authority.
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+)
+
+var inventoryBase64 string
+
+type inventory struct {
+	Schema     int    `json:"schema"`
+	Package    string `json:"package"`
+	Version    string `json:"version"`
+	Operations []struct {
+		Name string `json:"name"`
+		Body string `json:"body"`
+	} `json:"operations"`
+	Files []struct {
+		Path string `json:"path"`
+		Size int64  `json:"size"`
+		Hash string `json:"sha256"`
+	} `json:"files"`
+}
+
+func run(args []string) error {
+	if os.Geteuid() != 0 || len(args) != 1 {
+		return errors.New("root and one fixed operation required")
+	}
+	var i inventory
+	raw, decode := base64.StdEncoding.DecodeString(inventoryBase64)
+	if decode != nil || json.Unmarshal(raw, &i) != nil || i.Schema != 2 || len(i.Operations) == 0 {
+		return errors.New("invalid compiled inventory")
+	}
+	var body string
+	for _, op := range i.Operations {
+		if op.Name == args[0] {
+			body = op.Body
+		}
+	}
+	if body == "" {
+		return errors.New("unknown operation")
+	}
+	// Disable/teardown/repair retain an escape path when UI payload is corrupt;
+	// they still execute only compiled, hash-pinned cleanup code.
+	cleanup := args[0] == "helper_disable" || args[0] == "helper_teardown" || args[0] == "helper_repair" || args[0] == "helper_purge"
+	if !cleanup {
+		if e := verifyFiles("/var/packages/"+i.Package+"/target", raw); e != nil {
+			return e
+		}
+	}
+	cmd := exec.Command("/bin/sh", "-eu", "-c", body)
+	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin"}
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+func verifyFiles(dir string, raw []byte) error {
+	var i inventory
+	if json.Unmarshal(raw, &i) != nil || i.Schema != 2 {
+		return errors.New("invalid inventory")
+	}
+	root, e := os.OpenRoot(dir)
+	if e != nil {
+		return e
+	}
+	defer root.Close()
+	for _, p := range i.Files {
+		if p.Size < 0 || p.Size > 64<<20 {
+			return errors.New("invalid size")
+		}
+		f, e := root.Open(p.Path)
+		if e != nil {
+			return e
+		}
+		st, e := f.Stat()
+		if e != nil || !st.Mode().IsRegular() || st.Size() != p.Size {
+			f.Close()
+			return errors.New("untrusted payload")
+		}
+		h := sha256.New()
+		_, e = io.Copy(h, io.LimitReader(f, p.Size+1))
+		f.Close()
+		if e != nil || hex.EncodeToString(h.Sum(nil)) != p.Hash {
+			return errors.New("untrusted payload")
+		}
+	}
+	return nil
+}
+
+func main() {
+	if e := run(os.Args[1:]); e != nil {
+		fmt.Fprintln(os.Stderr, "authorization bootstrap refused:", e)
+		os.Exit(1)
+	}
+}

package/templates/_authorization/main_test.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestInventoryRejectsReplacementAndSymlinkEscape(t *testing.T) {
+	dir := t.TempDir()
+	body := []byte("approved bytes")
+	os.WriteFile(filepath.Join(dir, "file"), body, 0600)
+	raw := fmt.Sprintf(`{"schema":2,"files":[{"path":"file","size":%d,"sha256":"%x"}]}`, len(body), sha256.Sum256(body))
+	if e := verifyFiles(dir, []byte(raw)); e != nil {
+		t.Fatal(e)
+	}
+	os.WriteFile(filepath.Join(dir, "file"), []byte("altered bytes!"), 0600)
+	if e := verifyFiles(dir, []byte(raw)); e == nil {
+		t.Fatal("accepted replacement")
+	}
+	os.Remove(filepath.Join(dir, "file"))
+	outside := filepath.Join(t.TempDir(), "file")
+	os.WriteFile(outside, body, 0600)
+	os.Symlink(outside, filepath.Join(dir, "file"))
+	if e := verifyFiles(dir, []byte(raw)); e == nil {
+		t.Fatal("accepted external symlink")
+	}
+}
+func TestUnknownOperationNeverRuns(t *testing.T) {
+	if e := run([]string{"arbitrary"}); e == nil {
+		t.Fatal("accepted unknown operation")
+	}
+}

package/templates/native-go/README.md

@@ -39,7 +39,7 @@ greeting in the package's data folder.
 | `ui/app.js`, `ui/app.css` | The app inside the DSM window | Yes — your UI |
 | `ui/…` | Any other assets; served from `/webman/3rdparty/__PACKAGE__/app/` | Yes |
 | `i18n/messages/<locale>.json` | UI text in nine languages | Yes |
-| `i18n/glossary.json` | Synology's official DSM terms, and which messages must use them | Add terms |
+| `i18n/glossary.json` | DSM's own UI terms, and which messages must use them | Add terms |
 | `backend/internal/app/` | Your API: routes and handlers | Yes — your backend |
 | `backend/internal/api/` | The CGI front door: guards, auth order, route policies | Rarely |
 | `backend/internal/dsm/` | DSM session check and administrators lookup | Rarely |
@@ -411,3 +411,27 @@ drive the same flow from its own UI.
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each) |
 | DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build-spk --min-dsm`). Installed and tested on DSM 7.4 (x86_64). aarch64 SPKs are built the same way but have not been run on a NAS. |
 | Not supported | 32-bit ARM, DSM 6, running anything as root without an administrator's approval |
+
+### Shared root authorization (explicit opt-in)
+
+`init -t native-go --privilege root` adds `authorization.status`,
+`authorization.request` and `authorization.revoke` to the same package CGI URL.
+The Vue shell includes a centered authorization gate. Request/revoke return fixed
+plans; the host completes DSM PasswordConfirm/scheduler operations and reads status
+back before showing success. No password is sent to the package CGI.
+
+Each root SPK contains a SHA-256-pinned `authorization/bootstrap` and a v2 build
+inventory. The disabled native task copies bootstrap into a root-private directory
+and verifies the copied bytes before running a compiled fixed operation. The
+bootstrap verifies UI build hashes; helper control scripts retain their helper pins.
+Changing root code, helper or UI requires rebuilding and fresh authorization.
+`inspect --spk` checks bootstrap/CGI/window/inventory bindings; missing pins fail.
+The default `privilege: none` has no bootstrap or authorization routes, and all
+lifecycle scripts and CGI continue to use the package account.
+
+Before upgrading a helper integration, revoke/disable its current grant and verify
+cleanup. The existing pre-upgrade guard refuses a live helper; a new build never
+activates root automatically. Plain UI keeps its per-operation result controls.
+A non-Go prebuilt CGI must implement its own adapter and cannot use this generated
+root authorization contract. Native-layout products such as Reclaim retain their
+own privileged runtime until they explicitly migrate their adapters.

package/templates/native-go/backend/cmd/app/main.go

@@ -22,9 +22,10 @@ import (
 
 // Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
 var (
-	packageID       = "dev"
-	version         = "0.0.0"
-	helperInventory = ""
+	rootAuthorization = ""
+	packageID         = "dev"
+	version           = "0.0.0"
+	helperInventory   = ""
 	// "package" when the project has an integration but no privileged helper.
 	integrationMode = ""
 	// "session" when the project opted into the interactive File Station adapter.
@@ -39,9 +40,10 @@ func main() {
 		os.Exit(2)
 	}
 	cfg := app.Config{
-		PackageID: packageID,
-		Version:   version,
-		DataDir:   "/var/packages/" + packageID + "/var",
+		RootAuthorization: rootAuthorization,
+		PackageID:         packageID,
+		Version:           version,
+		DataDir:           "/var/packages/" + packageID + "/var",
 
 		PackageIntegration: integrationMode == "package",
 	}

package/templates/native-go/backend/cmd/app/sdk_main.go

@@ -20,9 +20,10 @@ import (
 
 // Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
 var (
-	packageID       = "dev"
-	version         = "0.0.0"
-	helperInventory = ""
+	rootAuthorization = ""
+	packageID         = "dev"
+	version           = "0.0.0"
+	helperInventory   = ""
 	// "session" when the project opted into the interactive File Station adapter.
 	fileStation = ""
 )
@@ -35,9 +36,10 @@ func main() {
 		os.Exit(2)
 	}
 	cfg := app.Config{
-		PackageID: packageID,
-		Version:   version,
-		DataDir:   "/var/packages/" + packageID + "/var",
+		RootAuthorization: rootAuthorization,
+		PackageID:         packageID,
+		Version:           version,
+		DataDir:           "/var/packages/" + packageID + "/var",
 	}
 	if helperInventory != "" {
 		if json.Unmarshal([]byte(helperInventory), &cfg.HelperInventory) != nil || cfg.HelperInventory.Package != packageID || cfg.HelperInventory.Version != version {

package/templates/native-go/backend/cmd/helper/main.go

@@ -16,7 +16,7 @@ func main() {
 	if len(os.Args) != 2 || json.Unmarshal([]byte(helperInventory), &i) != nil {
 		os.Exit(2)
 	}
-	if os.Args[1] == "check-stopped" || os.Args[1] == "diagnose" || os.Args[1] == "diagnose-startup" {
+	if os.Args[1] == "revoke" || os.Args[1] == "check-stopped" || os.Args[1] == "diagnose" || os.Args[1] == "diagnose-startup" {
 		c, err := helper.LocalClient(i)
 		if err != nil {
 			os.Exit(1)
@@ -34,11 +34,28 @@ func main() {
 			json.NewEncoder(os.Stdout).Encode(c.Status(context.Background()))
 			return
 		}
+		if os.Args[1] == "revoke" {
+			if c.Revoke(context.Background()) != nil {
+				os.Exit(1)
+			}
+			return
+		}
 		if c.CheckStopped(context.Background()) != nil {
 			os.Exit(1)
 		}
 		return
 	}
+	if os.Args[1] == "purge" {
+		if os.Geteuid() != 0 {
+			os.Exit(1)
+		}
+		c, err := helper.LocalClient(i)
+		if err != nil || c.Purge() != nil {
+			os.Exit(1)
+		}
+		fmt.Println(`{"success":true}`)
+		return
+	}
 	if err := helper.RunLinux(i, os.Args[1]); err != nil {
 		fmt.Fprintln(os.Stderr, "helper lifecycle refused")
 		os.Exit(1)

package/templates/native-go/backend/internal/app/authorization_none.go

@@ -0,0 +1,5 @@
+package app
+
+import "dsmapp/internal/api"
+
+func (Config) authorizationRoutes() []api.Route { return nil }

package/templates/native-go/backend/internal/app/routes.go

@@ -27,6 +27,8 @@ import (
 
 // Config is fixed at build time and startup, never taken from a request.
 type Config struct {
+	RootAuthorization string
+
 	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
 	SessionFiles    *filestation.Service
 	PackageID       string
@@ -45,13 +47,14 @@ type Config struct {
 }
 
 func Routes(cfg Config) []api.Route {
-	routes := []api.Route{
+	routes := cfg.authorizationRoutes()
+	routes = append(routes, []api.Route{
 		api.User("integration.status", cfg.integrationStatus),
 		api.BoundedRead(cfg.binaryRead),
 		api.User("app.status", cfg.status),
 		api.User("greeting.get", cfg.getGreeting),
 		api.Admin("greeting.set", cfg.setGreeting),
-	}
+	}...)
 	routes = append(routes, cfg.SessionFiles.Routes()...)
 	routes = append(routes, cfg.backgroundRoutes()...)
 	return append(routes, cfg.rootRoutes()...)

package/templates/native-go/backend/internal/app/sdk_routes.go

@@ -25,6 +25,8 @@ import (
 
 // Config is fixed at build time and startup, never taken from a request.
 type Config struct {
+	RootAuthorization string
+
 	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
 	SessionFiles    *filestation.Service
 	SDKJobs         func(context.Context, string, helper.SessionCarriers, json.RawMessage) (json.RawMessage, helper.Code)
@@ -44,13 +46,14 @@ type Config struct {
 }
 
 func Routes(cfg Config) []api.Route {
-	routes := []api.Route{
+	routes := cfg.authorizationRoutes()
+	routes = append(routes, []api.Route{
 		api.User("integration.status", cfg.integrationStatus),
 		api.BoundedRead(cfg.binaryRead),
 		api.User("app.status", cfg.status),
 		api.User("greeting.get", cfg.getGreeting),
 		api.Admin("greeting.set", cfg.setGreeting),
-	}
+	}...)
 	routes = append(routes, cfg.sdkJobRoutes()...)
 	routes = append(routes, cfg.SessionFiles.Routes()...)
 	routes = append(routes, cfg.backgroundRoutes()...)

package/templates/native-go/backend/internal/helper/management.go

@@ -16,7 +16,14 @@ import (
 // starts/signals a process. Private completion contents stay private to root.
 func (c Client) staleManagementStopped() bool {
 	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil || !c.Expected.Valid() || r.Inventory.Package != c.Expected.Package || r.Schema != 2 || !r.Enabled || r.Residual || r.Lifecycle == nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" || r.Lifecycle.Lease == nil {
+	if err != nil || !r.Enabled {
+		return false
+	}
+	return c.managementStopped(r)
+}
+
+func (c Client) managementStopped(r Record) bool {
+	if !c.Expected.Valid() || r.Inventory.Package != c.Expected.Package || r.Schema != 2 || r.Residual || r.Lifecycle == nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" || r.Lifecycle.Lease == nil {
 		return false
 	}
 	if !c.canonicalApproval(r) || !c.completionPublished(r) {

package/templates/native-go/backend/internal/helper/purge.go

@@ -0,0 +1,115 @@
+package helper
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"syscall"
+)
+
+var terminalFile = regexp.MustCompile(`^(completion-[a-f0-9]{64}\.json|lifetime-[a-f0-9]{64}\.lock)$`)
+var cachedPayload = regexp.MustCompile(`^payload-[a-f0-9]{64}$`)
+
+// Purge is a separate fixed, administrator-approved operation. Never expose
+// deletion through the package socket. Unknown files (including data/grants)
+// are retained and cause refusal; only terminal lifecycle metadata is removed.
+func (c Client) Purge() error {
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || r.Enabled || r.Inventory != c.Expected || !c.managementStopped(r) {
+		return errTrust
+	}
+	locks := []*os.File{}
+	defer func() {
+		for _, f := range locks {
+			f.Close()
+		}
+	}()
+	lock := func(name string) error {
+		f, err := os.OpenFile(filepath.Join(c.StateDir, name), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+		if err != nil {
+			return err
+		}
+		locks = append(locks, f)
+		if err := protected(f.Name(), c.Owner, false); err != nil {
+			return err
+		}
+		if syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) != nil {
+			return errBusy
+		}
+		return nil
+	}
+	for _, name := range []string{"control.lock", "policy.lock"} {
+		if err := lock(name); err != nil {
+			return err
+		}
+	}
+	// Recheck after serialization against enable and the terminal publisher.
+	r, err = readRecord(c.StateDir, c.Owner)
+	if err != nil || r.Enabled || r.Inventory != c.Expected || !c.managementStopped(r) {
+		return errTrust
+	}
+	entries, err := os.ReadDir(c.StateDir)
+	if err != nil || len(entries) > 512 {
+		return errTrust
+	}
+	for _, entry := range entries {
+		name := entry.Name()
+		mode := fs.FileMode(0600)
+		switch {
+		case name == "approval.json":
+			mode = 0644
+		case cachedPayload.MatchString(name):
+			mode = 0700
+		case terminalFile.MatchString(name), name == "control.lock", name == "policy.lock", name == "observer-diagnostic.json":
+		default:
+			return errTrust
+		}
+		st, err := os.Lstat(filepath.Join(c.StateDir, name))
+		if err != nil {
+			return err
+		}
+		stat, ok := st.Sys().(*syscall.Stat_t)
+		if !ok || !st.Mode().IsRegular() || st.Mode().Perm() != mode || stat.Uid != c.Owner || stat.Nlink != 1 {
+			return errTrust
+		}
+		if filepath.Ext(name) == ".lock" && name != "control.lock" && name != "policy.lock" {
+			if err := lock(name); err != nil {
+				return err
+			}
+		}
+	}
+	// No recursive removal. A socket/process/foreign file prevents all deletion.
+	if err := protected(c.RunDir, c.Owner, true); err != nil {
+		return err
+	}
+	runtime, err := os.ReadDir(c.RunDir)
+	if err != nil || len(runtime) != 0 {
+		return errTrust
+	}
+	// If an I/O failure interrupts cleanup, retain a durable disabled gate and
+	// cleanup-required diagnostic. Remove that record only after other files.
+	r.Residual = true
+	if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+		return err
+	}
+	for _, entry := range entries {
+		if entry.Name() == "approval.json" {
+			continue
+		}
+		if err := os.Remove(filepath.Join(c.StateDir, entry.Name())); err != nil {
+			return err
+		}
+	}
+	if err := os.Remove(c.RunDir); err != nil {
+		return err
+	}
+	if err := os.Remove(filepath.Join(c.StateDir, "approval.json")); err != nil {
+		return err
+	}
+	if err := os.Remove(c.StateDir); err != nil {
+		_ = writeProtected(c.StateDir, "approval.json", r)
+		return err
+	}
+	return nil
+}

package/templates/native-go/backend/internal/helper/purge_test.go

@@ -0,0 +1,59 @@
+package helper
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func terminalPurgeFixture(t *testing.T) Client {
+	c, f := controlFixture(t)
+	l := testLifecycle("fenced")
+	if err := createLifetime(c.Client, l); err != nil {
+		t.Fatal(err)
+	}
+	record(t, c.Client, Record{Schema: 2, Inventory: c.Expected, Enabled: false, Residual: true, Lifecycle: l})
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, l.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	return c.Client
+}
+func TestPurgeRemovesOnlyVerifiedDisabledTerminalState(t *testing.T) {
+	c := terminalPurgeFixture(t)
+	if err := c.Purge(); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{c.StateDir, c.RunDir} {
+		if _, err := os.Lstat(path); !os.IsNotExist(err) {
+			t.Fatalf("residue %s: %v", path, err)
+		}
+	}
+}
+func TestPurgeRefusesLiveStateUnknownEntriesAndLinks(t *testing.T) {
+	for _, which := range []string{"live", "unknown", "link", "proof"} {
+		t.Run(which, func(t *testing.T) {
+			c := terminalPurgeFixture(t)
+			switch which {
+			case "live":
+				r, _ := readRecord(c.StateDir, c.Owner)
+				r.Enabled = true
+				record(t, c, r)
+			case "unknown":
+				os.WriteFile(filepath.Join(c.StateDir, "user-data"), []byte("retain"), 0600)
+			case "link":
+				os.Symlink("/etc/passwd", filepath.Join(c.StateDir, "payload-"+c.Expected.PayloadDigest))
+			case "proof":
+				os.Remove(filepath.Join(c.StateDir, "completion-"+testLifecycle("stopped").Epoch+".json"))
+			}
+			if c.Purge() == nil {
+				t.Fatal("unsafe purge accepted")
+			}
+			if _, err := os.Stat(filepath.Join(c.StateDir, "approval.json")); err != nil {
+				t.Fatal("refusal deleted approval")
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/revoke.go

@@ -0,0 +1,109 @@
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"net"
+	"os"
+	"path/filepath"
+	"syscall"
+	"time"
+)
+
+// Called by the already approved root child after SO_PEERCRED authorization.
+// This endpoint can only withdraw the exact installed build's authority. It
+// cannot start a process, select a path, signal a PID, or replace an inventory.
+func packageRevoke(c Client, req Request) error {
+	if req.Op != "revoke" || req.Inventory != c.Expected || !c.Expected.Valid() || !digestPattern.MatchString(req.Nonce) {
+		return errTrust
+	}
+	if err := protected(c.StateDir, c.Owner, true); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if err := protected(f.Name(), c.Owner, false); err != nil {
+		return err
+	}
+	if syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) != nil {
+		return errBusy
+	}
+	defer syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
+	return policyUpdate(c, func(r *Record) error {
+		if r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" || !r.Enabled {
+			return errTrust
+		}
+		r.Enabled = false
+		r.Residual = true
+		r.Lifecycle.Phase = "fenced"
+		r.Lifecycle.Completion = ""
+		r.Lifecycle.Reason = "package-revoke"
+		return nil
+	})
+}
+
+// Revoke runs as the package UID. A socket acknowledgement proves only durable
+// withdrawal; success additionally requires the owning supervisor's sealed
+// terminal publication and absent runtime. No missing-socket shortcut.
+func (c Client) Revoke(ctx context.Context) error {
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	r, err := readRecord(c.StateDir, c.Owner)
+	if errors.Is(err, fs.ErrNotExist) {
+		return c.CheckStopped(ctx)
+	}
+	// The new build may manage the old disabled terminal publication without
+	// acquiring its authority or mutating it. This keeps uninstall possible
+	// before the user has approved the upgraded build.
+	if err == nil && !r.Enabled && c.managementStopped(r) {
+		return nil
+	}
+	if err != nil || r.Inventory != c.Expected {
+		return errTrust
+	}
+	if !r.Enabled {
+		if c.managementStopped(r) {
+			return nil
+		}
+		return errTrust
+	}
+	if r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	dialer := net.Dialer{Timeout: time.Second}
+	conn, err := dialer.DialContext(ctx, "unix", filepath.Join(c.RunDir, "helper.sock"))
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	if c.Peer == nil || c.Peer(conn.(*net.UnixConn)) != nil {
+		return errTrust
+	}
+	conn.SetDeadline(time.Now().Add(time.Second))
+	var nonce [32]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return err
+	}
+	req := Request{Inventory: c.Expected, Op: "revoke", Nonce: hex.EncodeToString(nonce[:])}
+	if err := json.NewEncoder(conn).Encode(req); err != nil {
+		return err
+	}
+	var res Response
+	d := json.NewDecoder(io.LimitReader(conn, 4097))
+	d.DisallowUnknownFields()
+	if d.Decode(&res) != nil || res.Inventory != c.Expected || res.Nonce != req.Nonce || !res.OK || res.Error != "" {
+		return errTrust
+	}
+	return waitHealthy(ctx, func(context.Context) bool {
+		r, err := readRecord(c.StateDir, c.Owner)
+		return err == nil && r.Inventory == c.Expected && !r.Enabled && c.managementStopped(r)
+	})
+}