@synopackageland/cli 0.5.0 → 0.6.0

package/templates/_executor/internal/taskscript/tasks.go

@@ -0,0 +1,42 @@
+// Package taskscript renders the canonical lifecycle scripts shared with the CLI.
+package taskscript
+
+import (
+	_ "embed"
+	"errors"
+	"regexp"
+	"strings"
+)
+
+//go:embed boot.sh
+var boot string
+
+//go:embed control.sh
+var control string
+
+type Task struct {
+	Kind   string `json:"kind"`
+	Name   string `json:"name"`
+	Header string `json:"header"`
+	Script string `json:"script"`
+}
+
+func Generate(pkg, ed, pd string) ([]Task, error) {
+	if !regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`).MatchString(pkg) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(ed) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(pd) {
+		return nil, errors.New("task pins")
+	}
+	replace := strings.NewReplacer("@PACKAGE@", pkg, "@EXECUTOR_DIGEST@", ed, "@POLICY_DIGEST@", pd)
+	tasks := []Task{}
+	for i, source := range []string{boot, control} {
+		kind, limit := "boot", 1024
+		if i == 1 {
+			kind, limit = "control", 6000
+		}
+		script := replace.Replace(source)
+		if len(script) > limit || strings.Contains(script, "%") {
+			return nil, errors.New("task script")
+		}
+		tasks = append(tasks, Task{kind, pkg + " executor " + kind, "#!/bin/sh\n# synopkgland executor " + kind + "\n", script})
+	}
+	return tasks, nil
+}

package/templates/_executor/json_review_test.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"testing"
+)
+
+func TestReviewCaseFoldedDuplicateAuthRejected(t *testing.T) {
+	for _, raw := range []string{
+		`{"v":1,"op":"delegate.list","auth":{"dsm_cookie":"a","DSM_COOKIE":"b","dsm_synotoken":"token"},"params":{}}`,
+		`{"v":1,"op":"delegate.list","auth":{"DSM_COOKIE":"a","dsm_synotoken":"token"},"params":{}}`,
+		`{"v":1,"op":"delegate.list","AUTH":{"dsm_cookie":"a","dsm_synotoken":"token"},"params":{}}`,
+		`{"v":1,"op":"files.list","auth":{},"params":{"path":"/home","PATH":"/other"}}`,
+		`{"v":1,"op":"files.list","auth":{},"params":{"PATH":"/home"}}`,
+		`{"v":1,"op":"files.list","auth":{},"Params":{}}`,
+	} {
+		var req Request
+		if strictJSON([]byte(raw), &req) == nil {
+			t.Errorf("ambiguous or case variant accepted: %s", raw)
+		}
+	}
+}
+func TestStrictJSONCaseInsensitiveKeysIncludeUnicodeFolds(t *testing.T) {
+	for _, raw := range []string{`{"key":1,"KEY":2}`, `{"s":1,"ſ":2}`, `{"k":1,"K":2}`} {
+		var out map[string]any
+		if strictJSON([]byte(raw), &out) == nil {
+			t.Errorf("case duplicate accepted: %s", raw)
+		}
+	}
+}
+
+func TestStrictJSONDirectCredentialAndParamsKeysAreCanonical(t *testing.T) {
+	var auth Auth
+	var params Params
+	if strictJSON([]byte(`{"DSM_COOKIE":"a"}`), &auth) == nil {
+		t.Fatal("uppercase direct auth key")
+	}
+	if strictJSON([]byte(`{"PATH":"/home"}`), &params) == nil {
+		t.Fatal("uppercase direct params key")
+	}
+}

package/templates/_executor/lifecycle_test.go

@@ -0,0 +1,86 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestFinishControlPurgesOfflineRuntimeGrantsAndStaleSocket(t *testing.T) {
+	root := t.TempDir()
+	state := filepath.Join(root, "state")
+	socket := filepath.Join(root, "socket")
+	for _, path := range []string{filepath.Join(state, "runtime"), filepath.Join(state, "delegations"), socket} {
+		os.MkdirAll(path, 0700)
+		os.WriteFile(filepath.Join(path, "stale"), []byte("data"), 0600)
+	}
+	if err := finishControl(state, filepath.Join(state, "runtime"), socket, true); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{state, socket} {
+		if _, err := os.Lstat(path); !os.IsNotExist(err) {
+			t.Fatalf("remnant %s", path)
+		}
+	}
+	if err := finishControl(state, filepath.Join(state, "runtime"), socket, true); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestFinishStopKeepsGrantsButRemovesSocketAndPurgeRejectsForeignRuntime(t *testing.T) {
+	root := t.TempDir()
+	state := filepath.Join(root, "state")
+	socket := filepath.Join(root, "socket")
+	os.MkdirAll(state, 0700)
+	os.MkdirAll(socket, 0700)
+	if err := finishControl(state, filepath.Join(state, "runtime"), socket, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(state); err != nil {
+		t.Fatal(err)
+	}
+	if err := finishControl(state, root, socket, true); err == nil {
+		t.Fatal("accepted foreign runtime")
+	}
+}
+
+func TestCreatedDirectoriesHonorModesUnderPrivateUmask(t *testing.T) {
+	root := t.TempDir()
+	old := syscall.Umask(0077)
+	defer syscall.Umask(old)
+	for _, mode := range []os.FileMode{0755, 0750, 0700} {
+		path := filepath.Join(root, fmt.Sprintf("dir-%o", mode))
+		info, err := createDirectory(path, mode, os.Geteuid(), os.Getegid())
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !directoryMatches(info, mode, os.Geteuid(), os.Getegid()) {
+			t.Fatal("umask corrupted directory contract", info.Mode())
+		}
+		if _, err := createDirectory(path, mode, os.Geteuid(), os.Getegid()); err == nil {
+			t.Fatal("existing directory was adopted")
+		}
+	}
+}
+func TestDirectoryValidationRejectsExistingWrongModeOwnerAndSymlink(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, "existing")
+	os.Mkdir(path, 0700)
+	info, _ := os.Lstat(path)
+	if directoryMatches(info, 0755, os.Geteuid(), os.Getegid()) {
+		t.Fatal("wrong mode accepted")
+	}
+	if directoryMatches(info, 0700, os.Geteuid()+1, os.Getegid()) {
+		t.Fatal("wrong owner accepted")
+	}
+	if directoryMatches(info, 0700, os.Geteuid(), os.Getegid()+1) {
+		t.Fatal("wrong group accepted")
+	}
+	link := path + "-link"
+	os.Symlink(path, link)
+	info, _ = os.Lstat(link)
+	if directoryMatches(info, 0700, os.Geteuid(), os.Getegid()) {
+		t.Fatal("symlink accepted")
+	}
+}

package/templates/_executor/main.go

@@ -0,0 +1,518 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"os"
+	"os/exec"
+	"os/signal"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+)
+
+const stateBase = "/usr/local/etc/synopkgland"
+const socketBase = "/run/synopkgland"
+
+func main() {
+	if err := run(os.Args[1:]); err != nil {
+		fmt.Fprintln(os.Stderr, "executor:", err)
+		os.Exit(1)
+	}
+}
+func run(args []string) error {
+	if len(args) == 1 {
+		if args[0] == "write-child" {
+			return writeChild()
+		}
+		if args[0] == "cleanup-child" {
+			return runWriteChild(true)
+		}
+	}
+	if len(args) < 1 {
+		return errors.New("usage: executor serve --package <pkg> | control start|stop|purge --package <pkg>")
+	}
+	mode := args[0]
+	args = args[1:]
+	action := ""
+	if mode == "control" {
+		if len(args) == 0 {
+			return errors.New("control action required")
+		}
+		action = args[0]
+		args = args[1:]
+		if !contains([]string{"start", "stop", "purge"}, action) {
+			return errors.New("invalid control action")
+		}
+	} else if mode != "serve" {
+		return errors.New("invalid command")
+	}
+	fs := flag.NewFlagSet("executor", flag.ContinueOnError)
+	pkg := fs.String("package", "", "package account")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() != 0 || !tokenRE.MatchString(*pkg) {
+		return errors.New("invalid package")
+	}
+	if os.Geteuid() != 0 {
+		return errors.New("root required")
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	exe, err = filepath.EvalSymlinks(exe)
+	if err != nil {
+		return err
+	}
+	if mode == "control" && action != "start" {
+		return controlStop(*pkg, action == "purge", filepath.Dir(exe))
+	}
+	e, uid, gid, err := load(*pkg, exe)
+	if err != nil {
+		return err
+	}
+	if mode == "control" {
+		// If the validated service already owns its pidfile, start is idempotent.
+		f, err := os.OpenFile(filepath.Join(e.Store.Dir, "executor.pid"), os.O_RDWR|os.O_CREATE, 0600)
+		if err != nil {
+			return err
+		}
+		err = lockFile(f)
+		f.Close()
+		if err != nil {
+			f, openErr := os.OpenFile(filepath.Join(e.Store.Dir, "executor.pid"), os.O_RDWR, 0600)
+			if openErr != nil {
+				return openErr
+			}
+			err = stopApprovedProcess(f, filepath.Dir(exe))
+			closeErr := f.Close() // Release the pid lock before the replacement child can run.
+			if err != nil {
+				return err
+			}
+			if closeErr != nil {
+				return closeErr
+			}
+		}
+		cmd := exec.Command(exe, "serve", "--package", *pkg)
+		cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
+		cmd.Dir = "/"
+		log, err := os.OpenFile(filepath.Join(e.Store.Dir, "executor.log"), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
+		if err != nil {
+			return err
+		}
+		defer log.Close()
+		cmd.Stdout = log
+		cmd.Stderr = log
+		cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+		if err = cmd.Start(); err != nil {
+			return err
+		}
+		return cmd.Process.Release()
+	}
+	return serve(e, uid, gid)
+}
+
+// Never chmod or chown an existing untrusted directory into trust. Check all
+// ancestors first; package-writable symlinks and directories fail closed.
+func secureDir(path string, mode os.FileMode) error {
+	if !cleanPath(path) {
+		return errors.New("directory path")
+	}
+	parts := strings.Split(strings.TrimPrefix(path, "/"), "/")
+	current := "/"
+	for i, p := range parts {
+		current = filepath.Join(current, p)
+		want := os.FileMode(0755)
+		if i == len(parts)-1 {
+			want = mode
+		}
+		info, err := os.Lstat(current)
+		if os.IsNotExist(err) {
+			info, err = createDirectory(current, want, 0, 0)
+		}
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() || !ownedByRoot(info) || info.Mode().Perm()&0022 != 0 {
+			return errors.New("untrusted directory")
+		}
+		if i == len(parts)-1 && info.Mode().Perm() != mode {
+			return errors.New("directory mode")
+		}
+	}
+	return nil
+}
+func trustedTree(path string) error {
+	return filepath.Walk(path, func(p string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if !ownedByRoot(info) || info.Mode().Perm()&0022 != 0 || (!info.IsDir() && !info.Mode().IsRegular()) {
+			return errors.New("untrusted runtime")
+		}
+		return nil
+	})
+}
+func load(pkg, exe string) (*Executor, int, int, error) {
+	dir := filepath.Dir(exe)
+	if dir != filepath.Join(stateBase, pkg, "runtime") {
+		return nil, 0, 0, errors.New("runtime must be in package protected state/runtime")
+	}
+	if err := secureDir(dir, 0700); err != nil {
+		return nil, 0, 0, err
+	}
+	if err := trustedTree(dir); err != nil {
+		return nil, 0, 0, err
+	}
+	f, err := openRegular(filepath.Join(dir, "policy.json"))
+	if err != nil {
+		return nil, 0, 0, err
+	}
+	b, err := readLimited(f, maxRequest)
+	f.Close()
+	if err != nil {
+		return nil, 0, 0, err
+	}
+	var p Policy
+	if strictJSON(b, &p) != nil || validatePolicy(p, pkg) != nil {
+		return nil, 0, 0, errors.New("invalid policy")
+	}
+	u, err := user.Lookup(pkg)
+	if err != nil {
+		return nil, 0, 0, errors.New("package account")
+	}
+	uid, err := strconv.Atoi(u.Uid)
+	if err != nil || uid <= 0 {
+		return nil, 0, 0, errors.New("package uid")
+	}
+	gid, err := strconv.Atoi(u.Gid)
+	if err != nil || gid <= 0 {
+		return nil, 0, 0, errors.New("package gid")
+	}
+	state := filepath.Join(stateBase, pkg, "delegations")
+	if err = secureDir(filepath.Join(stateBase, pkg), 0700); err != nil {
+		return nil, 0, 0, err
+	}
+	if err = secureDir(state, 0700); err != nil {
+		return nil, 0, 0, err
+	}
+	ed, err := digestFile(context.Background(), exe, maxExecutorBytes)
+	if err != nil {
+		return nil, 0, 0, err
+	}
+	pd, err := digestFile(context.Background(), filepath.Join(dir, "policy.json"), maxPolicyBytes)
+	if err != nil {
+		return nil, 0, 0, err
+	}
+	return &Executor{Policy: p, DSM: newDSM(), Writer: subprocessWriter{Staging: filepath.Join("/var/packages", pkg, "var/executor-staging"), Executable: exe, PackageUID: uid}, Runner: scriptRunner{Dir: dir}, Store: &Store{Dir: state}, Now: time.Now, ExecutorDigest: ed, PolicyDigest: pd}, uid, gid, nil
+}
+func validatePolicy(p Policy, pkg string) error {
+	if p.Version != 1 || p.Package != pkg || !tokenRE.MatchString(p.App) || len(p.Operations) == 0 {
+		return errors.New("policy")
+	}
+	seen := map[string]bool{}
+	for _, op := range p.Operations {
+		if !contains(allOps, op) || seen[op] {
+			return errors.New("policy operation")
+		}
+		seen[op] = true
+		if strings.HasPrefix(op, "files.") && scopeVirtual(p.Scope) == "" {
+			return errors.New("policy scope")
+		}
+	}
+	if seen["delegate.create"] && scopeVirtual(p.Scope) == "" {
+		return errors.New("policy scope")
+	}
+	for n, d := range p.Root {
+		if !tokenRE.MatchString(n) || !idRE.MatchString(d) || !seen["root.run"] {
+			return errors.New("policy root")
+		}
+	}
+	return nil
+}
+func serve(e *Executor, uid, gid int) error {
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+	actions := make(chan string, 1)
+	stopControls := rootControlSignals(ctx, actions)
+	defer stopControls()
+	pkgDir := filepath.Join("/var/packages", e.Policy.Package)
+	monitor := newLifecycleMonitor(e.Policy.Package, pkgDir, filepath.Join(pkgDir, "var/executor/control"), func(s string) { log.Print(s) })
+	pidpath := filepath.Join(e.Store.Dir, "executor.pid")
+	pid, err := os.OpenFile(pidpath, os.O_RDWR|os.O_CREATE, 0600)
+	if err != nil {
+		return err
+	}
+	defer pid.Close()
+	if err = lockFile(pid); err != nil {
+		return errors.New("already running")
+	}
+	if err = pid.Truncate(0); err != nil {
+		return err
+	}
+	if _, err = fmt.Fprintln(pid, os.Getpid()); err != nil {
+		return err
+	}
+	if err = pid.Sync(); err != nil {
+		return err
+	}
+	if err = secureDir(socketBase, 0755); err != nil {
+		return err
+	}
+	sockDir := filepath.Join(socketBase, e.Policy.Package)
+	info, err := os.Lstat(sockDir)
+	if os.IsNotExist(err) {
+		if _, err = createDirectory(sockDir, 0750, 0, gid); err != nil {
+			return err
+		}
+	} else if err != nil || !directoryMatches(info, 0750, 0, gid) {
+		return errors.New("socket directory")
+	}
+	sock := filepath.Join(sockDir, "executor.sock")
+	if info, err = os.Lstat(sock); err == nil {
+		if info.Mode()&os.ModeSocket == 0 || !ownedByRoot(info) {
+			return errors.New("socket path")
+		}
+		if err = os.Remove(sock); err != nil {
+			return err
+		}
+	} else if !os.IsNotExist(err) {
+		return err
+	}
+	d := e.DSM.(*liveDSM)
+	runtime := filepath.Join(stateBase, e.Policy.Package, "runtime")
+	if err := snapshotTasks(ctx, d, e.Policy.Package, e.ExecutorDigest, e.PolicyDigest, filepath.Join(pkgDir, "target/executor/setup.json"), runtime); err != nil {
+		log.Print("task inventory snapshot unavailable; cleanup will use retained verified inventory")
+	}
+	go func() {
+		for {
+			a := monitor.watch(ctx, 500*time.Millisecond)
+			select {
+			case <-ctx.Done():
+				return
+			case actions <- a:
+			}
+			if a == "purge" {
+				return
+			}
+		}
+	}()
+	open := func() (func(), error) { return openService(ctx, e, uid, gid, sock) }
+	samePins := func(ctx context.Context) bool {
+		return samePackagePins(ctx, filepath.Join(pkgDir, "target/executor"), e.ExecutorDigest, e.PolicyDigest)
+	}
+	purge := func() error {
+		return purgeProtected(ctx, d, e.Policy.Package, filepath.Join(stateBase, e.Policy.Package), runtime, sockDir)
+	}
+	return manageService(ctx, actions, open, samePins, purge, func(s string) { log.Print(s) })
+}
+
+func openService(parent context.Context, e *Executor, uid, gid int, sock string) (func(), error) {
+	old := syscall.Umask(0077)
+	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: sock, Net: "unix"})
+	syscall.Umask(old)
+	if err != nil {
+		return nil, err
+	}
+	ln.SetUnlinkOnClose(false)
+	if err = os.Chown(sock, 0, gid); err == nil {
+		err = os.Chmod(sock, 0660)
+	}
+	if err == nil {
+		err = verifySocket(sock, 0, gid, 0660)
+	}
+	if err != nil {
+		ln.Close()
+		os.Remove(sock)
+		return nil, err
+	}
+	ctx, cancel := context.WithCancel(parent)
+	var active sync.WaitGroup
+	var mu sync.Mutex
+	connections := map[*net.UnixConn]bool{}
+	done := make(chan struct{})
+	slots := make(chan struct{}, 16)
+	go func() {
+		defer close(done)
+		for {
+			c, err := ln.AcceptUnix()
+			if err != nil {
+				return
+			}
+			select {
+			case slots <- struct{}{}:
+				mu.Lock()
+				if ctx.Err() != nil {
+					mu.Unlock()
+					c.Close()
+					<-slots
+					continue
+				}
+				connections[c] = true
+				active.Add(1)
+				mu.Unlock()
+				go func() {
+					defer active.Done()
+					defer func() { <-slots; mu.Lock(); delete(connections, c); mu.Unlock(); c.Close() }()
+					e.Connection(ctx, c, uid, peerUID)
+				}()
+			default:
+				c.Close()
+			}
+		}
+	}()
+	return func() {
+		cancel()
+		ln.Close()
+		<-done
+		mu.Lock()
+		for c := range connections {
+			c.Close()
+		}
+		mu.Unlock()
+		active.Wait()
+		os.Remove(sock)
+	}, nil
+}
+func purgeProtected(ctx context.Context, d *liveDSM, pkg, state, runtime, socket string) error {
+	inv, err := readTaskInventory(runtime)
+	if err != nil {
+		log.Print("task cleanup skipped: protected inventory unavailable")
+	} else {
+		return purgeWithInventory(ctx, d, pkg, inv, state, runtime, socket, func(s string) { log.Print(s) })
+	}
+	return finishControl(state, runtime, socket, true)
+}
+
+func controlStop(pkg string, purge bool, runtime string) error {
+	state := filepath.Join(stateBase, pkg)
+	if _, err := os.Lstat(state); os.IsNotExist(err) {
+		return finishControl(state, runtime, filepath.Join(socketBase, pkg), purge)
+	}
+	if err := secureDir(state, 0700); err != nil {
+		return err
+	}
+	dir := filepath.Join(state, "delegations")
+	if err := secureDir(dir, 0700); err != nil {
+		return err
+	}
+	pidpath := filepath.Join(dir, "executor.pid")
+	f, err := os.OpenFile(pidpath, os.O_RDWR, 0600)
+	if os.IsNotExist(err) {
+		if purge {
+			return purgeProtected(context.Background(), newDSM(), pkg, state, runtime, filepath.Join(socketBase, pkg))
+		}
+		return finishControl(state, runtime, filepath.Join(socketBase, pkg), false)
+	}
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if lockFile(f) != nil {
+		action := "stop"
+		if purge {
+			action = "purge"
+		}
+		pid, err := verifiedPID(f, runtime)
+		if err != nil {
+			return err
+		}
+		controlSignal := syscall.SIGUSR1
+		if action == "purge" {
+			controlSignal = syscall.SIGUSR2
+		}
+		if err = syscall.Kill(pid, controlSignal); err != nil {
+			return err
+		}
+		if !purge {
+			return nil
+		}
+		deadline := time.Now().Add(40 * time.Second)
+		for lockFile(f) != nil {
+			if time.Now().After(deadline) {
+				return errors.New("purge timeout")
+			}
+			time.Sleep(50 * time.Millisecond)
+		}
+	}
+	if purge {
+		return purgeProtected(context.Background(), newDSM(), pkg, state, runtime, filepath.Join(socketBase, pkg))
+	}
+	return finishControl(state, runtime, filepath.Join(socketBase, pkg), purge)
+}
+
+// Only root setup/control may replace the approved monitor. Package stop never
+// reaches this signal path; it only pauses via the mailbox.
+func verifiedPID(f *os.File, runtime string) (int, error) {
+	b, err := readLimited(f, 32)
+	if err != nil {
+		return 0, err
+	}
+	pid, err := strconv.Atoi(strings.TrimSpace(string(b)))
+	if err != nil || pid <= 1 {
+		return 0, errors.New("pid")
+	}
+	actual, err := os.Readlink(fmt.Sprintf("/proc/%d/exe", pid))
+	if err != nil || strings.TrimSuffix(actual, " (deleted)") != filepath.Join(runtime, "executor") {
+		return 0, errors.New("pid executable mismatch")
+	}
+	return pid, nil
+}
+func stopApprovedProcess(f *os.File, runtime string) error {
+	if lockFile(f) == nil {
+		return nil
+	}
+	pid, err := verifiedPID(f, runtime)
+	if err != nil {
+		return err
+	}
+	if err = syscall.Kill(pid, syscall.SIGTERM); err != nil {
+		return err
+	}
+	deadline := time.Now().Add(40 * time.Second)
+	for lockFile(f) != nil {
+		if time.Now().After(deadline) {
+			return errors.New("replace timeout")
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+	return nil
+}
+func finishControl(state, runtime, socket string, purge bool) error {
+	if purge && runtime != filepath.Join(state, "runtime") {
+		return errors.New("runtime outside package protected state")
+	}
+	if purge {
+		if err := purgeRuntime(state, runtime); err != nil {
+			return err
+		}
+	}
+	return os.RemoveAll(socket)
+}
+func purgeRuntime(state, runtime string) error {
+	if runtime != filepath.Join(state, "runtime") {
+		return errors.New("runtime outside package protected state")
+	}
+	return os.RemoveAll(state)
+}
+func readLimited(f *os.File, n int) ([]byte, error) {
+	b, err := io.ReadAll(io.LimitReader(f, int64(n)+1))
+	if err != nil {
+		return nil, err
+	}
+	if len(b) > n {
+		return nil, errors.New("size")
+	}
+	return b, nil
+}