@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/sdk_journal_linux_test.go

@@ -1,295 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func sdkDiskJournalFixture(t *testing.T) (*FileGrantRepository, *sdkFileJobJournal, sdkJobIntent, string) {
-	dir, inv, _ := rootGrantFixture(t)
-	r := openRootGrantRepository(t, dir, inv)
-	j, c := newSDKFileJobJournal(r)
-	if c != "" {
-		t.Fatal(c)
-	}
-	p, _ := diskGrantSnapshot(t, r)
-	i := sdkJournalIntentFixture(t)
-	b := &i.Request.Control.Binding
-	b.Inventory = sdkInventory(p.Inventory)
-	b.Inventory.DataAccess = "relaxed"
-	// Journal tests use a matching relaxed protected policy.
-	inv.DataAccess = "relaxed"
-	r.expected = inv
-	record := Record{Schema: 2, Inventory: inv, Enabled: true, Lifecycle: &Lifecycle{Schema: 2, Epoch: p.Epoch, Phase: "running", Binding: Binding{Entered: 1, Boot: "fixture-boot", Install: grantRef('7')}}}
-	if e := writeProtected(dir, "approval.json", record); e != nil {
-		t.Fatal(e)
-	}
-	p, _ = diskGrantSnapshot(t, r)
-	b.Inventory = sdkInventory(p.Inventory)
-	b.Epoch = p.Epoch
-	b.ApprovalBinding = p.ApprovalBinding
-	b.CapabilityDigest = p.CapabilityDigest
-	return r, j, i, dir
-}
-func TestSDKJournalDiskRestartOrphanAndReplay(t *testing.T) {
-	r, j, i, dir := sdkDiskJournalFixture(t)
-	if c := j.Reserve(i); c != "" {
-		t.Fatal(c)
-	}
-	if c := j.Reserve(i); c != ErrReplay {
-		t.Fatal("duplicate", c)
-	}
-	if _, c := newSDKFileJobJournal(r); c != ErrBusy {
-		t.Fatal("second journal", c)
-	}
-	inv := r.expected
-	r.Close()
-	r = openRootGrantRepository(t, dir, inv)
-	j, c := newSDKFileJobJournal(r)
-	if c != "" {
-		t.Fatal(c)
-	}
-	records, c := j.Records()
-	if c != "" || len(records) != 1 || records[0].State != "interrupted" {
-		t.Fatal(records, c)
-	}
-	if c := j.Reserve(i); c != ErrReplay {
-		t.Fatal("restart replay", c)
-	}
-	if c := j.Cancel(i.Request.Control.Binding); c != ErrStale {
-		t.Fatal("restart resumed", c)
-	}
-	if c := j.Finish(sdkJobReceipt{Job: jobcontract.Job{Binding: i.Request.Control.Binding}}); c == "" {
-		t.Fatal("orphan success")
-	}
-}
-func TestSDKJournalDiskFaultsAndTamper(t *testing.T) {
-	for _, stage := range []string{"write", "file-sync", "rename", "after-rename", "directory-sync"} {
-		t.Run(stage, func(t *testing.T) {
-			r, j, i, _ := sdkDiskJournalFixture(t)
-			r.fault = func(s string) error {
-				if s == stage {
-					return errors.New("fixture")
-				}
-				return nil
-			}
-			if c := j.Reserve(i); c == "" {
-				t.Fatal("fault acknowledged")
-			}
-			r.fault = nil
-			if c := j.Reserve(i); c != ErrFenced {
-				t.Fatal("uncertain retry", c)
-			}
-		})
-	}
-	t.Run("retained deletion", func(t *testing.T) {
-		_, j, i, dir := sdkDiskJournalFixture(t)
-		if c := j.Reserve(i); c != "" {
-			t.Fatal(c)
-		}
-		if e := os.Remove(filepath.Join(dir, "job-intent-"+i.Request.Control.Binding.Job.ID+".json")); e != nil {
-			t.Fatal(e)
-		}
-		if _, c := j.Records(); c == "" {
-			t.Fatal("lost key accepted")
-		}
-	})
-}
-
-func TestSDKJournalDiskRetainedCapAndReceiptFailure(t *testing.T) {
-	_, j, i, _ := sdkDiskJournalFixture(t)
-	for n := 0; n < jobcontract.MaxExecutionKeys; n++ {
-		current := i
-		current.Request.Control.Binding.Job.ID = fmt.Sprintf("%064x", n*4+1)
-		current.Request.Control.Intent.ID = fmt.Sprintf("%064x", n*4+2)
-		current.Request.Control.Nonce = fmt.Sprintf("%064x", n*4+3)
-		current.Request.Control.Ticket = fmt.Sprintf("%064x", n*4+4)
-		if c := j.Reserve(current); c != "" {
-			t.Fatal(n, c)
-		}
-	}
-	if c := j.Reserve(i); c != ErrLimit {
-		t.Fatal("retained cap", c)
-	}
-	records, c := j.Records()
-	if c != "" || len(records) != jobcontract.MaxExecutionKeys {
-		t.Fatal("evicted history", len(records), c)
-	}
-	t.Run("Q write failure", func(t *testing.T) {
-		r, j, i, _ := sdkDiskJournalFixture(t)
-		if c := j.Reserve(i); c != "" {
-			t.Fatal(c)
-		}
-		if c := j.Cancel(i.Request.Control.Binding); c != "" {
-			t.Fatal(c)
-		}
-		now := uint64(1700000000000)
-		receipt := sdkJobReceipt{Job: jobcontract.Job{Binding: i.Request.Control.Binding, State: jobcontract.Canceled, Reason: jobcontract.ReasonCanceled, AcceptedAt: now, FinishedAt: &now, Drained: true, CancelRequested: true, Progress: jobcontract.Progress{Phase: "starting"}}}
-		r.fault = func(stage string) error {
-			if stage == "directory-sync" {
-				return errors.New("fixture")
-			}
-			return nil
-		}
-		if c := j.Finish(receipt); c != ErrCommitUncertain {
-			t.Fatal(c)
-		}
-		r.fault = nil
-		if c := j.Finish(receipt); c != ErrFenced {
-			t.Fatal("uncertain Q became success", c)
-		}
-	})
-}
-
-func TestSDKJournalDiskCompletedRestartUpgrade(t *testing.T) {
-	r, j, i, dir := sdkDiskJournalFixture(t)
-	if c := j.Reserve(i); c != "" {
-		t.Fatal(c)
-	}
-	now := uint64(1700000000000)
-	receipt := sdkJobReceipt{Job: jobcontract.Job{Binding: i.Request.Control.Binding, State: jobcontract.Succeeded, AcceptedAt: now, StartedAt: &now, FinishedAt: &now, Drained: true, Progress: jobcontract.Progress{Phase: "finishing"}}, Result: &jobcontract.Result{ResultSchema: 1, CompletedSteps: 1}}
-	if c := j.Finish(receipt); c != "" {
-		t.Fatal("finish", c)
-	}
-	inv := r.expected
-	r.Close()
-	inv.Version = "0.1.0-0002"
-	record := Record{Schema: 2, Inventory: inv, Enabled: true, Lifecycle: &Lifecycle{Schema: 2, Epoch: grantRef('a'), Phase: "running", Binding: Binding{Entered: 1, Boot: "fixture-boot", Install: grantRef('7')}}}
-	if e := writeProtected(dir, "approval.json", record); e != nil {
-		t.Fatal(e)
-	}
-	r = openRootGrantRepository(t, dir, inv)
-	j, c := newSDKFileJobJournal(r)
-	if c != "" {
-		t.Fatal("retained completed startup", c)
-	}
-	records, c := j.Records()
-	if c != "" || len(records) != 1 || records[0].State != "finished" {
-		t.Fatal("retained completed records", len(records), c)
-	}
-	if c := j.Reserve(i); c != ErrFenced {
-		t.Fatal("historical replay", c)
-	}
-}
-
-// Use the session submit/poll/finish path with the real root-owned journal.
-// Synthetic File Station responses carry no native/offline authority.
-func TestSDKJournalSessionCompletedStartup(t *testing.T) {
-	f, r, dir := sdkDiskBackgroundFixture(t, "")
-	files := &sessionFilesFake{}
-	s, c := newSDKSessionJobs(f.o, files, nil)
-	if c != "" {
-		t.Fatal(c)
-	}
-	f.o.session = s
-	f.carriers = SessionCarriers{Cookie: "id=alice-session", ClientAddress: "127.0.0.1"}
-	lease := sessionSubmit(t, f.sdkJobTestFixture)
-	for n := 0; n < 100; n++ {
-		if c := f.o.poll(context.Background()); c != "" {
-			t.Fatal(c)
-		}
-		if s.jobs[lease.JobID].terminal {
-			break
-		}
-		time.Sleep(time.Millisecond)
-	}
-	if j := s.jobs[lease.JobID]; j.receipt.Job.State != jobcontract.Succeeded || !j.receipt.Job.Drained {
-		t.Fatal("session did not durably complete")
-	}
-	path := filepath.Join(dir, "job-intent-"+lease.JobID+".json")
-	before, e := os.ReadFile(path)
-	if e != nil {
-		t.Fatal(e)
-	}
-	inv := r.expected
-	r.Close()
-	inv.Version = "0.1.0-0002"
-	inv.PayloadDigest = grantRef('b')
-	record := Record{Schema: 2, Inventory: inv, Enabled: true, Lifecycle: &Lifecycle{Schema: 2, Epoch: grantRef('a'), Phase: "running", Binding: Binding{Entered: 1, Boot: "fixture-boot", Install: grantRef('7')}}}
-	if e := writeProtected(dir, "approval.json", record); e != nil {
-		t.Fatal(e)
-	}
-	r = openRootGrantRepository(t, dir, inv)
-	gate := newAdmission(record.Lifecycle.Binding)
-	gate.observe(gate.binding, 1, true, f.c.now())
-	cohort := newOperationCohort(inv, record.Lifecycle.Epoch, 42, gate, func() bool { return true })
-	cohort.now = f.c.now
-	grants, c := newSupervisorGrants(r, cohort, supervisorGrantServices{})
-	if c != "" {
-		t.Fatal("grant startup", c)
-	}
-	oldRegistry := sdkCompiledRegistry
-	sdkCompiledRegistry = f.registry
-	t.Cleanup(func() { sdkCompiledRegistry = oldRegistry })
-	owner, c, stage := openSDKJobs(Client{StateDir: dir, Expected: inv}, "/unused-fixture", grants, r)
-	if c != "" || owner == nil || owner.session == nil || !owner.session.ready() {
-		t.Fatal("production jobs startup", c, stage)
-	}
-	if len(owner.session.jobs) != 0 || len(owner.jobs) != 0 || len(cohort.operations) != 0 || len(owner.session.pending) != 0 {
-		t.Fatal("historical execution resumed")
-	}
-	h := owner.session.history[lease.JobID]
-	if h.State != "finished" || h.Receipt == nil || h.Receipt.Job.State != jobcontract.Succeeded {
-		t.Fatal("lost terminal history")
-	}
-	after, e := os.ReadFile(path)
-	if e != nil || !bytes.Equal(before, after) {
-		t.Fatal("completed journal changed", e)
-	}
-	if c := owner.services.Journal.Reserve(h.Intent); c != ErrFenced {
-		t.Fatal("old approval authorized execution", c)
-	}
-}
-
-func TestSDKJournalDiskInvalidHistoryRefusesStartup(t *testing.T) {
-	for name, mutate := range map[string]func(*sdkJournalRecord){
-		"unfinished input mismatch": func(r *sdkJournalRecord) { r.Intent.Request.Input.Steps[0].Segments[0] = "changed" },
-		"finished without receipt":  func(r *sdkJournalRecord) { r.State = "finished" },
-		"interrupted with receipt":  func(r *sdkJournalRecord) { r.State = "interrupted"; r.Receipt = &sdkJobReceipt{} },
-		"finished binding mismatch": func(r *sdkJournalRecord) {
-			r.State = "finished"
-			now := uint64(1700000000000)
-			b := r.Intent.Request.Control.Binding
-			b.Job.ID = grantRef('e')
-			r.Receipt = &sdkJobReceipt{Job: jobcontract.Job{Binding: b, State: jobcontract.Succeeded, AcceptedAt: now, StartedAt: &now, FinishedAt: &now, Drained: true, Progress: jobcontract.Progress{Phase: "finishing"}}}
-		},
-	} {
-		t.Run(name, func(t *testing.T) {
-			r, j, i, dir := sdkDiskJournalFixture(t)
-			if c := j.Reserve(i); c != "" {
-				t.Fatal(c)
-			}
-			record := sdkJournalRecord{Schema: 1, Intent: i, State: "pending"}
-			mutate(&record)
-			raw, e := json.Marshal(record)
-			if e != nil {
-				t.Fatal(e)
-			}
-			if e = os.WriteFile(filepath.Join(dir, "job-intent-"+i.Request.Control.Binding.Job.ID+".json"), raw, 0600); e != nil {
-				t.Fatal(e)
-			}
-			inv := r.expected
-			r.Close()
-			r = openRootGrantRepository(t, dir, inv)
-			if _, c := newSDKFileJobJournal(r); c == "" {
-				t.Fatal("inconsistent history accepted")
-			}
-			if c := r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) {
-				t.Fatal("poisoned authority admitted transaction")
-				return false, ""
-			}); c != ErrFenced {
-				t.Fatal("not fail closed", c)
-			}
-		})
-	}
-}

package/dist/templates/native-go/backend/internal/helper/sdk_journal_test.go

@@ -1,71 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"testing"
-)
-
-func sdkJournalIntentFixture(t *testing.T) sdkJobIntent {
-	f := sdkJobFixture(t)
-	a, c := f.s.authority.actor(context.Background(), f.carriers, nil)
-	if c != "" {
-		t.Fatal(c)
-	}
-	return sdkJobIntent{Request: f.r, Actor: jobcontract.Principal{IdentityBasis: "uid-username", UID: a.UID(), Username: a.Username()}, SessionRef: a.SessionRef()}
-}
-func TestSDKJournalStrictImmutableInput(t *testing.T) {
-	i := sdkJournalIntentFixture(t)
-	r := sdkJournalRecord{Schema: 1, Intent: i, State: "pending"}
-	b, _ := json.Marshal(r)
-	if _, c := decodeSDKJournal(b); c != "" {
-		t.Fatal(c)
-	}
-	for _, mutate := range []func(*sdkJournalRecord){
-		func(r *sdkJournalRecord) { r.Schema++ },
-		func(r *sdkJournalRecord) { r.Intent.Actor.UID = 0 },
-		func(r *sdkJournalRecord) { r.Intent.Request.Input.Steps[0].Segments[0] = "changed" },
-		func(r *sdkJournalRecord) { r.State = "running" },
-		func(r *sdkJournalRecord) { r.State = "finished" },
-	} {
-		fresh, _ := decodeSDKJournal(b)
-		mutate(&fresh)
-		raw, _ := json.Marshal(fresh)
-		if _, c := decodeSDKJournal(raw); c == "" {
-			t.Fatal("invalid journal accepted", string(raw))
-		}
-	}
-	for _, suffix := range []string{`,"extra":true}`, `,"schema":1}`} {
-		bad := append(append([]byte{}, b[:len(b)-1]...), suffix...)
-		if _, c := decodeSDKJournal(bad); c == "" {
-			t.Fatal("non-strict journal accepted")
-		}
-	}
-}
-
-func TestSDKJournalCompletedRoundTrip(t *testing.T) {
-	for _, state := range []jobcontract.State{jobcontract.Succeeded, jobcontract.Failed, jobcontract.Canceled, jobcontract.Interrupted} {
-		t.Run(string(state), func(t *testing.T) {
-			i := sdkJournalIntentFixture(t)
-			now := uint64(1700000000000)
-			receipt := sdkJobReceipt{Job: jobcontract.Job{Binding: i.Request.Control.Binding, State: state, AcceptedAt: now, StartedAt: &now, FinishedAt: &now, Drained: true, Progress: jobcontract.Progress{Phase: "finishing"}}}
-			if state == jobcontract.Succeeded {
-				receipt.Result = &jobcontract.Result{ResultSchema: 1, CompletedSteps: 1}
-			} else {
-				receipt.Job.Reason = jobcontract.ReasonCanceled
-			}
-			receipt.Job.CancelRequested = state == jobcontract.Canceled
-			record := sdkJournalRecord{Schema: 1, Intent: i, State: "finished", Receipt: &receipt}
-			raw, c := encodeSDKJournal(record)
-			if c != "" {
-				t.Fatal("completed journal encode", c)
-			}
-			if _, c := decodeSDKJournal(raw); c != "" {
-				t.Fatal("completed journal decode", c)
-			}
-		})
-	}
-}

package/dist/templates/native-go/backend/internal/helper/sdk_picker_test.go

@@ -1,50 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"testing"
-)
-
-func TestSDKSessionStatusProjectsOnlyInteractiveFileStationWorkers(t *testing.T) {
-	f, files, _ := sessionFixture(t)
-	w := f.o.workers["scan"]
-	w.Revision = 7
-	w.Limits.BoundedBytes = 4096
-	f.o.workers["scan"] = w
-	background := w
-	background.ID = "offline"
-	background.Modes = []jobcontract.Mode{jobcontract.Background}
-	f.o.workers[background.ID] = background
-	stream := w
-	stream.ID = "stream"
-	stream.Actions = []jobcontract.Action{jobcontract.ReadStream}
-	f.o.workers[stream.ID] = stream
-	r := sessionCall(f, "jobs.status", sdkStatusArgs{})
-	if r.Code != "" {
-		t.Fatal(r.Code)
-	}
-	var page struct {
-		Workers []sdkSessionWorker `json:"workers"`
-	}
-	if json.Unmarshal(r.Data, &page) != nil {
-		t.Fatal("decode")
-	}
-	if len(page.Workers) != 1 || page.Workers[0].ID != "scan" || page.Workers[0].Revision != 7 || page.Workers[0].MaxBytes != 4096 {
-		t.Fatalf("worker display: %+v", page.Workers)
-	}
-	if len(page.Workers[0].Actions) != 3 {
-		t.Fatal("unsupported action displayed")
-	}
-	files.admin = true
-	r = sessionCall(f, "jobs.admin.status", sdkStatusArgs{})
-	var admin map[string]json.RawMessage
-	if r.Code != "" || json.Unmarshal(r.Data, &admin) != nil {
-		t.Fatal("admin status", r.Code)
-	}
-	if _, ok := admin["workers"]; ok {
-		t.Fatal("worker metadata leaked into management")
-	}
-}

package/dist/templates/native-go/backend/internal/helper/sdk_process_linux.go

@@ -1,184 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-	"syscall"
-	"time"
-)
-
-func executableDigest(path string) (string, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-	st, err := f.Stat()
-	if err != nil {
-		return "", err
-	}
-	s, ok := st.Sys().(*syscall.Stat_t)
-	if !ok || s.Uid != 0 || st.Mode().Perm()&0022 != 0 || !st.Mode().IsRegular() || st.Size() > 64<<20 {
-		return "", errTrust
-	}
-	h := sha256.New()
-	if _, err := io.Copy(h, f); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(h.Sum(nil)), nil
-}
-
-func inspectSupervisor(pid int, i Inventory) (Process, error) {
-	base := fmt.Sprintf("/proc/%d/", pid)
-	b, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
-	if err != nil {
-		return Process{}, err
-	}
-	stat, err := os.ReadFile(base + "stat")
-	if err != nil {
-		return Process{}, err
-	}
-	end := strings.LastIndex(string(stat), ") ")
-	if end < 0 {
-		return Process{}, errTrust
-	}
-	fields := strings.Fields(string(stat)[end+2:])
-	if len(fields) < 20 {
-		return Process{}, errTrust
-	}
-	status, err := os.ReadFile(base + "status")
-	if err != nil {
-		return Process{}, err
-	}
-	root := false
-	for _, line := range strings.Split(string(status), "\n") {
-		if strings.HasPrefix(line, "Uid:") {
-			u := strings.Fields(line)
-			root = len(u) == 5 && u[1] == "0" && u[2] == "0" && u[3] == "0" && u[4] == "0"
-		}
-	}
-	if !root {
-		return Process{}, errTrust
-	}
-	cmd, err := os.ReadFile(base + "cmdline")
-	if err != nil {
-		return Process{}, err
-	}
-	wantExe := "/var/lib/synopkgland-" + i.Package + "/payload-" + i.PayloadDigest
-	if string(cmd) != wantExe+"\x00supervise\x00" {
-		return Process{}, errTrust
-	}
-	st, err := os.Stat(base + "exe")
-	if err != nil {
-		return Process{}, err
-	}
-	s := st.Sys().(*syscall.Stat_t)
-	digest, err := executableDigest(base + "exe")
-	if err != nil || digest != i.PayloadDigest {
-		return Process{}, errTrust
-	}
-	return Process{Inventory: i, Mode: "supervised", PID: pid, Boot: strings.TrimSpace(string(b)), Start: fields[19], Device: uint64(s.Dev), Inode: s.Ino}, nil
-}
-
-type LinuxProcesses struct {
-	Client
-	Binary string
-}
-
-func (p LinuxProcesses) Start(i Inventory) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	if i != p.Expected {
-		return errTrust
-	}
-	if err := protected(p.RunDir, 0, true); err != nil {
-		return err
-	}
-	cmd := exec.Command(p.Binary, "supervise")
-	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin"}
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	go cmd.Wait()
-	if waitHealthy(ctx, func(ctx context.Context) bool {
-		state, _ := p.probe(ctx, filepath.Join(p.RunDir, "helper.sock"))
-		return state == "ready"
-	}) == nil {
-		return nil
-	}
-	return errors.New("helper start timeout; residual preserved")
-}
-
-// RunLinux runs a fixed control action or the health-only server. Its caller
-// must be the hash-verified, root-owned copy, never the SPK staging executable.
-func RunLinux(base Inventory, action string) error {
-	if os.Geteuid() != 0 {
-		return errTrust
-	}
-	exe, err := os.Executable()
-	if err != nil {
-		return err
-	}
-	digest, err := executableDigest(exe)
-	if err != nil {
-		return err
-	}
-	base.PayloadDigest = digest
-	if !base.Valid() || exe != "/var/lib/synopkgland-"+base.Package+"/payload-"+digest {
-		return errTrust
-	}
-	c := NewClient(base)
-	if err := protected(c.StateDir, 0, true); err != nil {
-		return err
-	}
-	if err := protected(c.RunDir, 0, true); err != nil {
-		return err
-	}
-	switch action {
-	case "supervise":
-		return superviseLinux(c, exe)
-	case "sdk-job-child":
-		if len(sdkCompiledRegistry) == 0 {
-			return errTrust
-		}
-		return sdkJobChildLinux(c)
-	case "operation-child":
-		return operationChildLinux(c)
-	case "serve-child":
-		parent, err := strconv.Atoi(os.Getenv("SYNOPKGLAND_PARENT"))
-		if err != nil {
-			return errTrust
-		}
-		runtime.LockOSThread()
-		defer runtime.UnlockOSThread()
-		if err := armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
-			return err
-		}
-		if _, err := inspectSupervisor(parent, base); err != nil {
-			return err
-		}
-		if err := inheritLifetime(c); err != nil {
-			return err
-		}
-		return serveLinux(c)
-	}
-	return (Controller{Client: c, Processes: LinuxProcesses{Client: c, Binary: exe}, Observe: observeLinux, Boot: linuxBoot}).Control(context.Background(), action)
-}
-
-func linuxBoot() (string, error) {
-	b, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
-	return strings.TrimSpace(string(b)), err
-}