@synopackageland/cli 0.5.0 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/observer_diagnostic_linux_test.go

@@ -1,130 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/binary"
-	"encoding/json"
-	"errors"
-	"github.com/godbus/dbus/v5"
-	"io"
-	"strings"
-	"testing"
-	"time"
-)
-
-func diagnosticObserver(t *testing.T) *unitObserver {
-	t.Helper()
-	o := &unitObserver{owner: ":1.1", unit: "pkgctl-root.service", path: systemdUnitPath("pkgctl-root.service"), gate: newAdmission(testBinding())}
-	if err := o.observeValues(testBinding(), activeUnitValues(o), 0, time.Now()); err != nil {
-		t.Fatal(err)
-	}
-	return o
-}
-func TestLinuxObserverSignalSubReasons(t *testing.T) {
-	cases := []struct {
-		detail, name string
-		body         []interface{}
-		path         dbus.ObjectPath
-		sender       string
-	}{
-		{"reload-shape", managerInterface + ".Reloading", nil, "/org/freedesktop/systemd1", ":1.1"},
-		{"reload-type", managerInterface + ".Reloading", []interface{}{"secret"}, "/org/freedesktop/systemd1", ":1.1"},
-		{"unit-removed-shape", managerInterface + ".UnitRemoved", []interface{}{"pkgctl-root.service"}, "/org/freedesktop/systemd1", ":1.1"},
-		{"properties-map", propertiesInterface + ".PropertiesChanged", []interface{}{unitInterface, "secret", []string{}}, systemdUnitPath("pkgctl-root.service"), ":1.1"},
-		{"property-invalidated-InvocationID", propertiesInterface + ".PropertiesChanged", []interface{}{unitInterface, map[string]dbus.Variant{}, []string{"InvocationID", "secret"}}, systemdUnitPath("pkgctl-root.service"), ":1.1"},
-		{"properties-invalidated-type", propertiesInterface + ".PropertiesChanged", []interface{}{unitInterface, map[string]dbus.Variant{}, "secret"}, systemdUnitPath("pkgctl-root.service"), ":1.1"},
-		{"owner-signal", "org.freedesktop.DBus.NameOwnerChanged", []interface{}{systemdName, ":1.1", ":1.2"}, "/org/freedesktop/DBus", "org.freedesktop.DBus"},
-		{"property-ActiveState", propertiesInterface + ".PropertiesChanged", []interface{}{unitInterface, map[string]dbus.Variant{"ActiveState": dbus.MakeVariant("inactive")}, []string{}}, systemdUnitPath("pkgctl-root.service"), ":1.1"},
-	}
-	for _, c := range cases {
-		t.Run(c.detail, func(t *testing.T) {
-			o := diagnosticObserver(t)
-			s := &dbus.Signal{Sender: c.sender, Name: c.name, Path: c.path, Body: c.body, Sequence: dbus.Sequence(99)}
-			o.DeliverSignal("", "", s)
-			d := o.gate.observerDiagnostic("")
-			if d.Fence.Detail != c.detail || d.Fence.Signal != c.name || d.Fence.Sender != c.sender || d.Fence.SignalSequence != 99 || d.Fence.At.IsZero() {
-				t.Fatalf("wrong diagnostic: %+v", d)
-			}
-			if strings.Contains(d.Fence.Detail, "secret") {
-				t.Fatal("body leaked")
-			}
-		})
-	}
-	o := diagnosticObserver(t)
-	o.Terminate()
-	if o.gate.observerDiagnostic("").Fence.Detail != "subscription-terminated" {
-		t.Fatal("terminate unclassified")
-	}
-}
-func TestLinuxObserverQueryErrorClassification(t *testing.T) {
-	for _, c := range []struct {
-		err  error
-		want string
-	}{{context.Canceled, "canceled"}, {context.DeadlineExceeded, "deadline"}, {io.EOF, "eof"}, {errTrust, "trust"}, {dbus.Error{Name: "org.freedesktop.systemd1.NoSuchUnit", Body: []interface{}{"secret"}}, "dbus-no-unit"}, {errors.New("secret"), "other"}} {
-		o := diagnosticObserver(t)
-		err := o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
-			return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: c.err, phase: "get-unit"}
-		})
-		d := o.gate.observerDiagnostic("")
-		if c.want == "deadline" {
-			if err != nil || o.gate.readiness(time.Now()) != "query-revalidating" {
-				t.Fatalf("deadline not pending: %+v %v", d, err)
-			}
-			continue
-		}
-		if err == nil || d.Fence.Phase != "get-unit" || d.Fence.ErrorClass != c.want || d.Fence.Detail != "query-failed" {
-			t.Fatalf("classification %s: %+v %v", c.want, d, err)
-		}
-	}
-}
-func TestLinuxObserverDeadlineAndInvalidSnapshot(t *testing.T) {
-	o := diagnosticObserver(t)
-	now := time.Now()
-	o.gate.requestUnitCheck(true, now)
-	o.gate.fenced(now.Add(unitReloadBudget))
-	if o.gate.observerDiagnostic("").Fence.Detail != "reload-deadline" {
-		t.Fatal("budget unclassified")
-	}
-	for _, key := range []string{"Id", "LoadState", "ActiveState", "SubState", "Job", "ActiveEnterTimestampMonotonic", "InvocationID"} {
-		o := diagnosticObserver(t)
-		v := activeUnitValues(o)
-		v[key] = dbus.MakeVariant("secret")
-		_ = o.observeValues(testBinding(), v, 0, time.Now())
-		d := o.gate.observerDiagnostic("")
-		if d.Fence.Detail != "snapshot-"+key || d.Fence.Phase != "validate-values" {
-			t.Fatalf("property %s: %+v", key, d.Fence)
-		}
-	}
-}
-
-func TestLinuxObserverWireSerialAndPrivacy(t *testing.T) {
-	o := diagnosticObserver(t)
-	m := &dbus.Message{Type: dbus.TypeSignal, Headers: map[dbus.HeaderField]dbus.Variant{
-		dbus.FieldInterface: dbus.MakeVariant(managerInterface), dbus.FieldMember: dbus.MakeVariant("Reloading"), dbus.FieldSender: dbus.MakeVariant(o.owner), dbus.FieldPath: dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/systemd1")), dbus.FieldSignature: dbus.MakeVariant(dbus.SignatureOf(true))}, Body: []interface{}{true}}
-	var wire bytes.Buffer
-	if err := m.EncodeTo(&wire, binary.LittleEndian); err != nil {
-		t.Fatal(err)
-	}
-	b := wire.Bytes()
-	binary.LittleEndian.PutUint32(b[8:12], 321)
-	parsed, err := dbus.DecodeMessage(bytes.NewReader(b))
-	if err != nil {
-		t.Fatal(err)
-	}
-	o.incomingObserverMessage(parsed)
-	o.DeliverSignal("", "", &dbus.Signal{Name: managerInterface + ".Reloading", Sender: o.owner, Path: "/org/freedesktop/systemd1", Body: []interface{}{"secret-session-password-path"}, Sequence: dbus.Sequence(123)})
-	d := o.gate.observerDiagnostic("")
-	if d.Fence.WireSerial != 321 || d.Fence.SignalSequence != 123 {
-		t.Fatalf("wire/receive counters confused: %+v", d)
-	}
-	payload, _ := json.Marshal(d)
-	if bytes.Contains(payload, []byte("secret")) {
-		t.Fatal("body persisted")
-	}
-	for _, sender := range []string{"session-secret", ":" + strings.Repeat("1", 40), ":1.password"} {
-		if safeBusSender(sender) != "" {
-			t.Fatal("untrusted sender persisted")
-		}
-	}
-}

package/dist/templates/native-go/backend/internal/helper/observer_diagnostic_test.go

@@ -1,98 +0,0 @@
-package helper
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-func TestObserverDiagnosticFirstFenceAndBound(t *testing.T) {
-	g := newAdmission(testBinding())
-	for n := 0; n < observerEventLimit+20; n++ {
-		g.recordObserver(observerEvent{Kind: "query-ok", QuerySerial: uint64(n)})
-	}
-	g.fenceObserver("observation-unavailable", observerEvent{Kind: "fence", Detail: "query-failed", Phase: "get-unit", ErrorClass: "canceled"})
-	g.fenceObserver("bus-owner-changed", observerEvent{Kind: "fence", Detail: "owner-signal"})
-	d := g.observerDiagnostic(strings.Repeat("e", 64))
-	if d.Fence.Detail != "query-failed" || d.Fence.Phase != "get-unit" || d.Reason != "observation-unavailable" {
-		t.Fatalf("wrong first cause: %+v", d)
-	}
-	if len(d.Events) != observerEventLimit || d.Events[0].QuerySerial != 22 {
-		t.Fatalf("bad bounded order: %+v", d.Events)
-	}
-	d.Events[0].Kind = "mutated"
-	if g.observerDiagnostic(d.Epoch).Events[0].Kind == "mutated" {
-		t.Fatal("snapshot aliases ring")
-	}
-	b, err := json.Marshal(d)
-	if err != nil || len(b) > observerDiagnosticLimit {
-		t.Fatalf("size %d err %v", len(b), err)
-	}
-}
-func TestObserverDiagnosticConcurrentAdmission(t *testing.T) {
-	g := newAdmission(testBinding())
-	var wg sync.WaitGroup
-	for n := 0; n < 8; n++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for i := 0; i < 100; i++ {
-				g.recordObserver(observerEvent{Kind: "query-start"})
-				g.fenceObserver("observation-unavailable", observerEvent{Detail: "subscription-terminated"})
-				g.allow(time.Now())
-				g.observerDiagnostic(strings.Repeat("e", 64))
-			}
-		}()
-	}
-	wg.Wait()
-	if g.allow(time.Now()) || g.observerDiagnostic("").Fence.Detail != "subscription-terminated" {
-		t.Fatal("fence changed")
-	}
-}
-func TestObserverDiagnosticPersistenceCannotBlockCompletion(t *testing.T) {
-	for _, unwritable := range []bool{false, true} {
-		t.Run(map[bool]string{false: "root-private", true: "write-failure"}[unwritable], func(t *testing.T) {
-			c := fixture(t)
-			b := testBinding()
-			l, err := newLifecycle(b)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if err = writeProtected(c.StateDir, "approval.json", Record{Schema: 2, Inventory: c.Expected, Enabled: true, Lifecycle: l}); err != nil {
-				t.Fatal(err)
-			}
-			g := newAdmission(b)
-			g.fenceObserver("observation-unavailable", observerEvent{Detail: "verification-deadline"})
-			if unwritable {
-				if err = os.Mkdir(filepath.Join(c.StateDir, "observer-diagnostic.json"), 0700); err != nil {
-					t.Fatal(err)
-				}
-			}
-			persistObserverDiagnostic(c, l.Epoch, g)
-			if err = fenceRecord(c, l.Epoch, g.reason(), g.observerDiagnostic(l.Epoch).Fence.Detail); err != nil {
-				t.Fatal(err)
-			}
-			p := Process{Inventory: c.Expected, Mode: "supervised", Boot: b.Boot, PID: 42, Start: "123", Inode: 9}
-			if err = completeRecord(c, l.Epoch, p); err != nil {
-				t.Fatal(err)
-			}
-			r, err := readRecord(c.StateDir, c.Owner)
-			if err != nil || r.Lifecycle.SubReason != "verification-deadline" || r.Lifecycle.Phase != "stopped" {
-				t.Fatalf("record %+v %v", r, err)
-			}
-			if _, err = completionRecord(c, r); err != nil {
-				t.Fatal(err)
-			}
-			if !unwritable {
-				st, err := os.Stat(filepath.Join(c.StateDir, "observer-diagnostic.json"))
-				if err != nil || st.Mode().Perm() != 0600 || st.Size() > observerDiagnosticLimit {
-					t.Fatalf("private file %v %v", st, err)
-				}
-			}
-		})
-	}
-}

package/dist/templates/native-go/backend/internal/helper/observer_diagnostic_writer.go

@@ -1,40 +0,0 @@
-package helper
-
-import "sync"
-
-// Diagnostics are independent of approval/completion authority. A single
-// worker does live writes; the signal/admission ordering point never does I/O.
-// Shutdown retains the existing best-effort final snapshot after teardown.
-func startObserverDiagnostics(c Client, epoch string, g *admission) func() {
-	return startObserverDiagnosticWriter(g, func() { persistObserverDiagnostic(c, epoch, g) })
-}
-
-func startObserverDiagnosticWriter(g *admission, persist func()) func() {
-	wake, stop, done := make(chan struct{}, 1), make(chan struct{}), make(chan struct{})
-	g.mu.Lock()
-	g.diagnosticWake = wake
-	g.mu.Unlock()
-	go func() {
-		defer close(done)
-		persist()
-		for {
-			select {
-			case <-wake:
-				persist()
-			case <-stop:
-				persist()
-				return
-			}
-		}
-	}()
-	var once sync.Once
-	return func() {
-		once.Do(func() {
-			g.mu.Lock()
-			g.diagnosticWake = nil
-			g.mu.Unlock()
-			close(stop)
-			<-done
-		})
-	}
-}

package/dist/templates/native-go/backend/internal/helper/operation_bootstrap_linux.go

@@ -1,193 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"net"
-	"os"
-	"runtime"
-	"strconv"
-	"time"
-)
-
-// Root bootstrap accepts only an anonymous descriptor bound to its root parent.
-// After permanent credential drop there is no root-side business filesystem I/O.
-func operationChildLinux(c Client) error {
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-	parent, err := strconv.Atoi(os.Getenv("SYNOPKGLAND_PARENT"))
-	if err != nil {
-		return errTrust
-	}
-	if err := armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
-		return err
-	}
-	if _, err := inspectSupervisor(parent, c.Expected); err != nil {
-		return err
-	}
-	if err := inheritLifetime(c); err != nil {
-		return err
-	}
-	f := os.NewFile(4, "operation-control")
-	if f == nil {
-		return errTrust
-	}
-	defer f.Close()
-	control, err := operationSocket(f)
-	if err != nil {
-		return err
-	}
-	defer control.Close()
-	peer, err := peerCredentials(control)
-	if err != nil || int(peer.Pid) != parent || peer.Uid != 0 {
-		return errTrust
-	}
-	var boot operationBootstrap
-	if _, err := readOperationPacketBound(control, &boot, MaxControlBytes, 300*time.Millisecond); err != nil {
-		return err
-	}
-	r, err := readRecord(c.StateDir, 0)
-	if err != nil || r.Lifecycle == nil || boot.Binding.Inventory != c.Expected || boot.Binding.Epoch != r.Lifecycle.Epoch || !digestPattern.MatchString(boot.Token) || !digestPattern.MatchString(boot.Binding.OperationID) || boot.UID == 0 || boot.GID == 0 || boot.Groups == nil || len(boot.Groups) > 65536 {
-		return errTrust
-	}
-	if boot.ReadOnly != nil && (boot.ReadOnly.validate() != "" || !allReferences(boot.SubjectRef, boot.SessionRef)) {
-		return errTrust
-	}
-	if boot.Write != nil && (boot.ReadOnly != nil || boot.Write.validate() != "" || !allReferences(boot.SubjectRef, boot.SessionRef)) {
-		return errTrust
-	}
-	if err := dropOperationCredentials(parent, boot); err != nil {
-		return err
-	}
-	packetLimit := MaxHealthBytes
-	if boot.ReadOnly != nil || boot.Write != nil {
-		packetLimit = MaxControlBytes
-	}
-	if err := writeOperationPacketBound(control, boot, packetLimit); err != nil {
-		return err
-	}
-	if boot.Write != nil {
-		timeout := BoundedTimeout
-		if boot.Write.Staged {
-			timeout = StreamTotalTimeout
-		}
-		ctx, cancel := context.WithTimeout(context.Background(), timeout)
-		defer cancel()
-		return operationWriteChild(ctx, control, boot)
-	}
-	var source *actorReadTransfer
-	operationTimeout := BoundedTimeout
-	if boot.ReadOnly != nil && boot.ReadOnly.Action == ActionReadStream {
-		operationTimeout = StreamTotalTimeout
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), operationTimeout)
-	defer cancel()
-	if boot.ReadOnly != nil {
-		witness := os.NewFile(6, "readonly-root-witness")
-		if witness == nil {
-			return errTrust
-		}
-		defer witness.Close()
-		operationMountIDFallback = operationMountIDProxy(control, boot)
-		pin := &pinnedReadOnlyRoot{path: boot.ReadOnly.RootPath, file: witness}
-		var result readOnlyResult
-		if boot.ReadOnly.Action == ActionRead || boot.ReadOnly.Action == ActionReadStream {
-			source, result = openActorReadTransfer(ctx, pin, *boot.ReadOnly, operationReadOnlyACL)
-			if source != nil {
-				defer source.Close()
-			}
-		} else {
-			result, _ = executeReadOnly(ctx, pin, *boot.ReadOnly, operationReadOnlyACL)
-		}
-		if err := writeOperationPacketBound(control, readOnlyPacket{Binding: boot.Binding, Token: boot.Token, Result: &result}, MaxControlBytes); err != nil {
-			return err
-		}
-		if result.Code != "" || result.Bytes == 0 {
-			return awaitReadOnlyFinish(control, boot.Token)
-		}
-	}
-	output := os.NewFile(5, "operation-data")
-	if output == nil {
-		return errTrust
-	}
-	defer output.Close()
-	deadline, _ := ctx.Deadline()
-	ceiling := uint64(MaxBoundedBytes)
-	if boot.ReadOnly != nil {
-		ceiling = boot.ReadOnly.MaxBytes
-	}
-	var total, sequence uint64
-	for {
-		// Idle synthetic children are bounded by the future stream idle ceiling.
-		readDeadline := deadline
-		if boot.ReadOnly != nil && boot.ReadOnly.Action == ActionReadStream && time.Now().Add(StreamIdleTimeout).Before(readDeadline) {
-			readDeadline = time.Now().Add(StreamIdleTimeout)
-		}
-		control.SetReadDeadline(readDeadline)
-		raw := make([]byte, MaxHealthBytes+1)
-		n, err := control.Read(raw)
-		if err != nil {
-			return err
-		}
-		var lease operationLease
-		d := json.NewDecoder(bytes.NewReader(raw[:n]))
-		d.DisallowUnknownFields()
-		if n > MaxHealthBytes || d.Decode(&lease) != nil || d.Decode(new(any)) != io.EOF || lease.Token != boot.Token || lease.Sequence != sequence+1 || lease.Bytes == 0 || lease.Bytes > MaxChunkBytes || uint64(lease.Bytes) > ceiling || total > ceiling-uint64(lease.Bytes) {
-			return errTrust
-		}
-		sequence++
-		total += uint64(lease.Bytes)
-		if boot.ReadOnly != nil {
-			if source == nil || lease.ProofDeadline == 0 || lease.SubjectRef != boot.SubjectRef || lease.SessionRef != boot.SessionRef {
-				return errTrust
-			}
-			proofDeadline := time.Unix(0, lease.ProofDeadline)
-			if !time.Now().Before(proofDeadline) || time.Until(proofDeadline) > NativeProofFreshness {
-				return ErrStale
-			}
-			proofCtx, proofCancel := context.WithDeadline(ctx, proofDeadline)
-			data, code := source.ReadChunk(proofCtx, lease.Bytes)
-			proofCancel()
-			result := readOnlyResult{Code: code}
-			if code == "" {
-				result.Bytes = uint64(len(data))
-			}
-			if err := writeOperationPacketBound(control, readOnlyPacket{Binding: boot.Binding, Token: boot.Token, Result: &result, ChunkSequence: sequence}, MaxControlBytes); err != nil {
-				return err
-			}
-			if code != "" {
-				return code
-			}
-			if _, err := io.CopyN(output, bytes.NewReader(data), int64(lease.Bytes)); err != nil {
-				return err
-			}
-			if source.remaining == 0 {
-				return awaitReadOnlyFinish(control, boot.Token)
-			}
-		} else if _, err := io.CopyN(output, zeroReader{}, int64(lease.Bytes)); err != nil {
-			return err
-		}
-	}
-}
-
-// Unset until native share/home and object ACL obligations are proven on DSM.
-var operationReadOnlyACL readOnlyACL
-
-type zeroReader struct{}
-
-func (zeroReader) Read(b []byte) (int, error) { clear(b); return len(b), nil }
-
-// Keep the child and lifetime witness until the owner observes metadata/last
-// relay completion. Exiting at the last pipe write would race S2 poll's Close.
-func awaitReadOnlyFinish(control *net.UnixConn, token string) error {
-	var done operationReadOnlyFinish
-	if _, err := readOperationPacketBound(control, &done, MaxHealthBytes, BoundedTimeout); err != nil {
-		return err
-	}
-	if done.Token != token {
-		return errTrust
-	}
-	return nil
-}

package/dist/templates/native-go/backend/internal/helper/operation_credentials_linux.go

@@ -1,56 +0,0 @@
-package helper
-
-import (
-	"golang.org/x/sys/unix"
-	"os"
-	"slices"
-	"syscall"
-)
-
-// Runs on the pinned operation-child thread before any business filesystem I/O.
-func dropOperationCredentials(parent int, boot operationBootstrap) error {
-	if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
-		return err
-	}
-	if err := unix.Prctl(unix.PR_SET_KEEPCAPS, 0, 0, 0, 0); err != nil {
-		return err
-	}
-	groups := make([]int, len(boot.Groups))
-	for n, g := range boot.Groups {
-		groups[n] = int(g)
-	}
-	if err := syscall.Setgroups(groups); err != nil {
-		return err
-	}
-	if err := syscall.Setresgid(int(boot.GID), int(boot.GID), int(boot.GID)); err != nil {
-		return err
-	}
-	if err := syscall.Setresuid(int(boot.UID), int(boot.UID), int(boot.UID)); err != nil {
-		return err
-	}
-	// Linux clears PDEATHSIG on credential changes. Re-arm while the creator
-	// thread is still pinned, then recheck parent on BOTH sides of prctl.
-	if err := armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
-		return err
-	}
-	ru, eu, su := unix.Getresuid()
-	rg, eg, sg := unix.Getresgid()
-	current, err := syscall.Getgroups()
-	if err != nil || ru != int(boot.UID) || eu != ru || su != ru || rg != int(boot.GID) || eg != rg || sg != rg {
-		return errTrust
-	}
-	slices.Sort(current)
-	slices.Sort(groups)
-	if !slices.Equal(current, groups) {
-		return errTrust
-	}
-	var caps [2]unix.CapUserData
-	header := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
-	if err := unix.Capset(&header, &caps[0]); err != nil {
-		return err
-	}
-	if err := unix.Capget(&header, &caps[0]); err != nil || caps[0] != (unix.CapUserData{}) || caps[1] != (unix.CapUserData{}) {
-		return errTrust
-	}
-	return nil
-}