@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/supervision.go

@@ -1,107 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"syscall"
-	"time"
-)
-
-// Also runs after exec: the parent can die between fork's prctl and exec.
-func armParentDeath(expected int, set func() error, parent func() int) error {
-	if expected <= 1 || parent() != expected {
-		return errTrust
-	}
-	if err := set(); err != nil {
-		return err
-	}
-	if parent() != expected {
-		return errTrust
-	}
-	return nil
-}
-
-type supervisedChild interface {
-	exited() (bool, error)
-	signal(syscall.Signal) error
-}
-
-// Caller is the sole reaper and signal owner. A zombie retains its PID until
-// exited() reaps it; a background Wait goroutine would invalidate this proof.
-func stopChild(ctx context.Context, child supervisedChild, grace time.Duration) error {
-	if err := ctx.Err(); err != nil {
-		return err
-	}
-	done, err := child.exited()
-	if err != nil || done {
-		return err
-	}
-	if err := child.signal(syscall.SIGTERM); err != nil {
-		return err
-	}
-	escalate := time.Now().Add(grace)
-	killed := false
-	for {
-		if err := ctx.Err(); err != nil {
-			return err
-		}
-		done, err := child.exited()
-		if err != nil || done {
-			return err
-		}
-		if !killed && !time.Now().Before(escalate) {
-			if err := child.signal(syscall.SIGKILL); err != nil {
-				return err
-			}
-			killed = true
-		}
-		timer := time.NewTimer(time.Millisecond)
-		select {
-		case <-ctx.Done():
-			timer.Stop()
-			return ctx.Err()
-		case <-timer.C:
-		}
-	}
-}
-
-// Read to actual connection EOF. A LimitReader's synthetic EOF at the size
-// cap can never certify supervisor exit, so reaching that cap is a refusal.
-func readSupervisorReply(reader io.Reader, want Inventory, nonce string) error {
-	res, err := decodeSupervisorReply(reader, want, nonce)
-	if err != nil || !res.OK || res.Error != "" {
-		return errTrust
-	}
-	return nil
-}
-
-// Parsing authenticates the entire bounded reply; readiness and stop ACKs
-// retain separate acceptance rules. No refusal can certify supervisor exit.
-func decodeSupervisorReply(reader io.Reader, want Inventory, nonce string) (Response, error) {
-	var res Response
-	b, err := io.ReadAll(io.LimitReader(reader, 4097))
-	if err != nil || len(b) > 4096 {
-		return res, errTrust
-	}
-	d := json.NewDecoder(bytes.NewReader(b))
-	d.DisallowUnknownFields()
-	if d.Decode(&res) != nil || d.Decode(new(any)) != io.EOF || res.Inventory != want || res.Nonce != nonce {
-		return Response{}, errTrust
-	}
-	return res, nil
-}
-
-// A pending health refusal cannot be used as a successful admission or stop ACK.
-func supervisorReadiness(res Response, err error) string {
-	if err == nil {
-		if res.OK && res.Error == "" {
-			return "ready"
-		}
-		if !res.OK && (res.Error == "reload-revalidating" || res.Error == "query-revalidating") {
-			return res.Error
-		}
-	}
-	return "fenced"
-}

package/templates/native-go/backend/internal/helper/supervision_test.go

@@ -1,124 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func TestParentDeathSetupChecksBeforeAndAfterPrctl(t *testing.T) {
-	for _, tc := range []struct {
-		before, after int
-		setErr        error
-		ok            bool
-	}{
-		{42, 42, nil, true}, {1, 1, nil, false}, {42, 1, nil, false}, {42, 42, syscall.EPERM, false},
-	} {
-		calls, sets := 0, 0
-		err := armParentDeath(42, func() error { sets++; return tc.setErr }, func() int {
-			calls++
-			if calls == 1 {
-				return tc.before
-			}
-			return tc.after
-		})
-		if (err == nil) != tc.ok {
-			t.Fatalf("%+v: %v", tc, err)
-		}
-		if tc.before != 42 && sets != 0 {
-			t.Fatal("already reparented child armed")
-		}
-		if tc.ok && calls != 2 {
-			t.Fatal("parent race not checked")
-		}
-	}
-}
-
-type childFixture struct {
-	reaped  bool
-	err     error
-	signals []syscall.Signal
-	exitOn  syscall.Signal
-}
-
-func (c *childFixture) exited() (bool, error) { return c.reaped, c.err }
-func (c *childFixture) signal(s syscall.Signal) error {
-	if c.reaped {
-		panic("signalled a reaped child")
-	}
-	c.signals = append(c.signals, s)
-	if s == c.exitOn {
-		c.reaped = true
-	}
-	return nil
-}
-func TestOnlyUnreapedOwnedChildCanBeSignalled(t *testing.T) {
-	for _, tc := range []struct {
-		reaped bool
-		err    error
-		exit   syscall.Signal
-		count  int
-		ok     bool
-	}{
-		{true, nil, 0, 0, true}, {false, syscall.ECHILD, 0, 0, false}, {false, nil, syscall.SIGTERM, 1, true}, {false, nil, syscall.SIGKILL, 2, true}, {false, nil, 0, 2, false},
-	} {
-		c := &childFixture{reaped: tc.reaped, err: tc.err, exitOn: tc.exit}
-		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
-		err := stopChild(ctx, c, time.Millisecond)
-		cancel()
-		if (err == nil) != tc.ok || len(c.signals) != tc.count {
-			t.Fatalf("%+v: err=%v signals=%v", tc, err, c.signals)
-		}
-		if c.reaped {
-			n := len(c.signals)
-			if stopChild(context.Background(), c, time.Millisecond) != nil || len(c.signals) != n {
-				t.Fatal("reaped PID reused")
-			}
-		}
-	}
-}
-func TestCancelledStopCannotSignal(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	c := &childFixture{}
-	if stopChild(ctx, c, time.Millisecond) == nil || len(c.signals) != 0 {
-		t.Fatal("cancelled operation signalled")
-	}
-}
-
-func TestSupervisorReplyRequiresRealEOFAndStrictBoundedAcknowledgement(t *testing.T) {
-	i := fixture(t).Expected
-	nonce := strings.Repeat("c", 64)
-	good, _ := json.Marshal(Response{Inventory: i, Nonce: nonce, OK: true})
-	for _, tc := range []struct {
-		data []byte
-		ok   bool
-	}{
-		{good, true}, {append(append([]byte{}, good...), []byte(" {}")...), false},
-		{bytes.Replace(good, []byte(nonce), []byte(strings.Repeat("d", 64)), 1), false},
-		{append(append([]byte{}, good[:len(good)-1]...), []byte(",\"unknown\":true}")...), false},
-		{append(append([]byte{}, good...), bytes.Repeat([]byte(" "), 4097)...), false},
-	} {
-		if (readSupervisorReply(bytes.NewReader(tc.data), i, nonce) == nil) != tc.ok {
-			t.Fatalf("reply accepted=%v expected=%v", !tc.ok, tc.ok)
-		}
-	}
-	if readSupervisorReply(&brokenReplyReader{data: good}, i, nonce) == nil {
-		t.Fatal("read error treated as cooperative exit")
-	}
-}
-
-type brokenReplyReader struct{ data []byte }
-
-func (r *brokenReplyReader) Read(p []byte) (int, error) {
-	if len(r.data) == 0 {
-		return 0, syscall.ECONNRESET
-	}
-	n := copy(p, r.data)
-	r.data = r.data[n:]
-	return n, nil
-}

package/templates/native-go/backend/internal/helper/supervisor_frame.go

@@ -1,79 +0,0 @@
-//go:build !synopkgland_sdk_workers
-
-//line dsmapp/internal/helper/supervisor_frame.go:1
-package helper
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"io"
-	"net"
-	"time"
-)
-
-type supervisorRequest struct {
-	Process Process         `json:"process"`
-	Op      string          `json:"op"`
-	Nonce   string          `json:"nonce"`
-	Data    json.RawMessage `json:"data,omitempty"`
-}
-
-// Legacy M1 requests do not half-close; grant controls MUST half-close. Count
-// the entire v2 frame (including whitespace), reject duplicates and trailing
-// frames, and bound both time and memory. The outer process binds this socket.
-func decodeSupervisorRequest(reader io.Reader) (supervisorRequest, Code) {
-	var req supervisorRequest
-	limited := &io.LimitedReader{R: reader, N: MaxControlBytes + 1}
-	d := json.NewDecoder(limited)
-	var raw json.RawMessage
-	if d.Decode(&raw) != nil {
-		return req, ErrInvalid
-	}
-	if code := decodeDataObject(bytes.NewReader(raw), &req, MaxControlBytes); code != "" {
-		return req, code
-	}
-	if req.Op == "grants" {
-		rest, err := io.ReadAll(io.MultiReader(d.Buffered(), limited))
-		if err != nil {
-			return req, ErrInvalid
-		}
-		if limited.N <= 0 {
-			return req, ErrLimit
-		}
-		if len(bytes.TrimSpace(rest)) != 0 {
-			return req, ErrInvalid
-		}
-	} else if d.InputOffset() > 4096 || len(req.Data) > 0 {
-		return req, ErrInvalid
-	}
-	if !allReferences(req.Nonce) || (req.Op != "admit" && req.Op != "stop" && req.Op != "grants") {
-		return req, ErrInvalid
-	}
-	return req, ""
-}
-
-const supervisorAttestationWait = time.Second
-const supervisorFrameBudget = 100 * time.Millisecond
-
-// The caller sends no frame bytes until its full post-connect hash succeeds.
-// Separate the bounded wait for that computation from the fixed frame budget.
-func receiveSupervisorRequest(conn net.Conn) (supervisorRequest, Code) {
-	firstDeadline := time.Now().Add(supervisorAttestationWait)
-	if err := conn.SetReadDeadline(firstDeadline); err != nil {
-		return supervisorRequest{}, ErrInvalid
-	}
-	reader := bufio.NewReader(conn)
-	if _, err := reader.Peek(1); err != nil || !time.Now().Before(firstDeadline) {
-		return supervisorRequest{}, ErrInvalid
-	}
-	frameDeadline := time.Now().Add(supervisorFrameBudget)
-	if err := conn.SetDeadline(frameDeadline); err != nil {
-		return supervisorRequest{}, ErrInvalid
-	}
-	req, code := decodeSupervisorRequest(reader)
-	if !time.Now().Before(frameDeadline) {
-		return supervisorRequest{}, ErrInvalid
-	}
-	return req, code
-}

package/templates/native-go/backend/internal/helper/supervisor_frame_linux_test.go

@@ -1,69 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"net"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestLinuxSupervisorFrameWaitPreservesStopFence(t *testing.T) {
-	p := linuxFixture(t)
-	process := startVMHelper(t, p)
-	conn, err := net.Dial("unix", filepath.Join(p.RunDir, "supervisor.sock"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	time.Sleep(50 * time.Millisecond)
-	vmUnit(t, "stop")
-	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-	defer cancel()
-	if err = waitHealthy(ctx, func(context.Context) bool {
-		r, e := readRecord(p.StateDir, 0)
-		return e == nil && r.Lifecycle.Phase == "stopped" && r.Lifecycle.Completion != ""
-	}); err != nil {
-		t.Fatal("stalled peer prevented owned fence/completion", err)
-	}
-	record, err := readRecord(p.StateDir, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	proof, err := completionRecord(p.Client, record)
-	if err != nil || proof.Process != process {
-		t.Fatal("wrong completion", err)
-	}
-	t.Logf("stalled root peer lifecycle reason=%s", record.Lifecycle.Reason)
-	vmUnit(t, "start")
-	if p.Client.Status(context.Background()).State == "ready" {
-		t.Fatal("later active revived stopped epoch")
-	}
-}
-
-func TestLinuxSupervisorRejectsForeignFrameAfterWait(t *testing.T) {
-	p := linuxFixture(t)
-	process := startVMHelper(t, p)
-	conn, err := net.Dial("unix", filepath.Join(p.RunDir, "supervisor.sock"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	time.Sleep(150 * time.Millisecond)
-	foreign := process
-	foreign.Start = "foreign"
-	req := supervisorRequest{Process: foreign, Op: "admit", Nonce: strings.Repeat("a", 64)}
-	conn.SetDeadline(time.Now().Add(time.Second))
-	if err = json.NewEncoder(conn).Encode(req); err != nil {
-		t.Fatal(err)
-	}
-	var response Response
-	if err = json.NewDecoder(conn).Decode(&response); err == nil || response.OK {
-		t.Fatal("foreign Process frame accepted", response)
-	}
-	if p.Client.Status(context.Background()).State != "ready" {
-		t.Fatal("foreign frame changed valid epoch")
-	}
-}

package/templates/native-go/backend/internal/helper/supervisor_frame_test.go

@@ -1,107 +0,0 @@
-package helper
-
-import (
-	"encoding/json"
-	"net"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestSupervisorReceivePhases(t *testing.T) {
-	req := supervisorRequest{Op: "grants", Nonce: strings.Repeat("a", 64), Data: json.RawMessage(`{}`)}
-	frame, _ := json.Marshal(req)
-	for _, kind := range []string{"delayed-attestation", "late-attestation", "buffered-large", "empty-eof", "silent", "partial", "drip", "trailing", "oversize", "duplicate", "valid"} {
-		t.Run(kind, func(t *testing.T) {
-			server, client := supervisorSocketPair(t)
-			defer server.Close()
-			defer client.Close()
-			// Legacy server starts its receive clock before the caller's full hash.
-			if err := server.SetDeadline(time.Now().Add(100 * time.Millisecond)); err != nil {
-				t.Fatal(err)
-			}
-			done := make(chan struct{})
-			go func() {
-				defer close(done)
-				switch kind {
-				case "silent":
-					return
-				case "late-attestation":
-					time.Sleep(1100 * time.Millisecond)
-					client.Write(frame)
-				case "buffered-large":
-					large := req
-					large.Data = json.RawMessage(`{"padding":"` + strings.Repeat("a", 8192) + `"}`)
-					raw, _ := json.Marshal(large)
-					client.Write(raw)
-				case "empty-eof":
-				case "delayed-attestation":
-					time.Sleep(150 * time.Millisecond)
-					client.Write(frame)
-				case "partial":
-					client.Write([]byte("{"))
-					time.Sleep(200 * time.Millisecond)
-				case "drip":
-					for n := 0; n < 8; n++ {
-						if _, e := client.Write([]byte(" ")); e != nil {
-							return
-						}
-						time.Sleep(30 * time.Millisecond)
-					}
-				case "trailing":
-					client.Write(append(frame, []byte(`{}`)...))
-				case "oversize":
-					client.Write(append(frame, []byte(strings.Repeat(" ", MaxControlBytes))...))
-				case "duplicate":
-					client.Write([]byte(`{"op":"grants","op":"grants","nonce":"` + req.Nonce + `","data":{}}`))
-				default:
-					client.Write(frame)
-				}
-				client.CloseWrite()
-			}()
-			started := time.Now()
-			got, code := receiveSupervisorRequest(server)
-			elapsed := time.Since(started)
-			server.Close()
-			client.Close()
-			<-done
-			if kind == "valid" || kind == "delayed-attestation" || kind == "buffered-large" {
-				if code != "" || got.Nonce != req.Nonce {
-					t.Fatalf("valid delayed/buffered frame refused: %s", code)
-				}
-			} else if code == "" {
-				t.Fatal("invalid/stalled frame accepted")
-			}
-			if kind == "silent" && (elapsed < 900*time.Millisecond || elapsed > 1500*time.Millisecond) {
-				t.Fatalf("first-byte bound: %s", elapsed)
-			}
-			if (kind == "partial" || kind == "drip") && elapsed > 180*time.Millisecond {
-				t.Fatalf("frame deadline was extended: %s", elapsed)
-			}
-		})
-	}
-}
-
-func TestSupervisorFrameBudgetAlsoBoundsLegacyReply(t *testing.T) {
-	// Keep the synchronous pipe here: an unread small Unix socket reply fits in
-	// the kernel buffer and would not exercise the bounded blocked-write path.
-	server, client := net.Pipe()
-	defer server.Close()
-	defer client.Close()
-	// A watchdog protects the test if reply writes accidentally lose their bound.
-	server.SetWriteDeadline(time.Now().Add(2 * time.Second))
-	req := supervisorRequest{Op: "admit", Nonce: strings.Repeat("b", 64)}
-	frame, _ := json.Marshal(req)
-	sent := make(chan struct{})
-	go func() { defer close(sent); time.Sleep(150 * time.Millisecond); client.Write(frame) }()
-	if _, code := receiveSupervisorRequest(server); code != "" {
-		t.Fatal(code)
-	}
-	<-sent
-	started := time.Now()
-	_, err := server.Write([]byte(`{"ok":true}`))
-	elapsed := time.Since(started)
-	if e, ok := err.(net.Error); !ok || !e.Timeout() || elapsed < 70*time.Millisecond || elapsed > 350*time.Millisecond {
-		t.Fatalf("unbounded/expired legacy reply: %s %v", elapsed, err)
-	}
-}