@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/helper/sdk_job_child_linux.go

@@ -1,309 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/helper/jobcontract"
-	"golang.org/x/sys/unix"
-	"io"
-	"net"
-	"os"
-	"runtime"
-	"strconv"
-	"time"
-)
-
-// S2's fixed child mode has NO RunLinux dispatch case. The VM builds a copy
-// with that one case added; S7 must perform the separately reviewed assembly.
-func sdkJobChildLinux(c Client) error {
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-	parent, err := strconv.Atoi(os.Getenv("SYNOPKGLAND_PARENT"))
-	if err != nil {
-		return errTrust
-	}
-	if err = armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
-		return err
-	}
-	if _, err = inspectSupervisor(parent, c.Expected); err != nil {
-		return err
-	}
-	if err = inheritLifetime(c); err != nil {
-		return err
-	}
-	f := os.NewFile(4, "sdk-job-control")
-	if f == nil {
-		return errTrust
-	}
-	defer f.Close()
-	control, err := operationSocket(f)
-	if err != nil {
-		return err
-	}
-	defer control.Close()
-	peer, err := peerCredentials(control)
-	if err != nil || int(peer.Pid) != parent || peer.Uid != 0 {
-		return errTrust
-	}
-	if err = enableCredentials(control); err != nil {
-		return err
-	}
-	var boot sdkJobBootstrap
-	cred, err := readSDKJobPacket(control, &boot, 300*time.Millisecond)
-	if err != nil || !sdkJobPeer(cred, parent, 0, peer.Gid) {
-		return errTrust
-	}
-	r, err := readRecord(c.StateDir, 0)
-	b := boot.Actor
-	if err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" || r.Lifecycle.Epoch != b.Binding.Epoch || b.Binding.Inventory != c.Expected || b.ReadOnly != nil || b.Write != nil || !allReferences(b.Token, b.SubjectRef, b.SessionRef) || b.UID == 0 || b.GID == 0 || b.Groups == nil || len(b.Groups) > 1024 {
-		return errTrust
-	}
-	if code := validateSDKJobPlan(sdkJobPlan{Request: boot.Request, Worker: boot.Worker}, b.Binding); code != "" {
-		return code
-	}
-	witness := os.NewFile(5, "sdk-job-root")
-	if witness == nil {
-		return errTrust
-	}
-	defer witness.Close()
-	pin := &pinnedReadOnlyRoot{path: boot.RootPath, file: witness}
-	for _, step := range boot.Request.Input.Steps {
-		if _, code := sdkJobWork(boot.RootPath, step); code != "" {
-			return code
-		}
-	}
-	if err = dropOperationCredentials(parent, b); err != nil {
-		return err
-	}
-	// Linux 4.4 does not expose NoNewPrivs in this fixture's /proc/status.
-	// Read back the kernel state before credential-ready on every kernel.
-	nnp, err := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
-	if err != nil || nnp != 1 {
-		return errTrust
-	}
-	if err = writeOperationPacketBound(control, boot, MaxControlBytes); err != nil {
-		return err
-	}
-	x := &sdkJobChild{control: control, boot: boot, parent: parent, parentGID: peer.Gid}
-	if _, err = x.receive(0, false); err != nil {
-		return err
-	}
-	operationMountIDFallback = x.mount
-	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(boot.Worker.Limits.TotalMS)*time.Millisecond)
-	defer cancel()
-	return x.run(ctx, pin)
-}
-
-type sdkJobChild struct {
-	control                    *net.UnixConn
-	boot                       sdkJobBootstrap
-	parent                     int
-	parentGID                  uint32
-	sequence, progressSequence uint64
-	lastProgress               time.Time
-}
-
-func (x *sdkJobChild) receive(seq uint64, mount bool) (sdkJobWire, error) {
-	var p sdkJobWire
-	cred, err := readSDKJobPacket(x.control, &p, time.Duration(x.boot.Worker.Limits.IdleMS)*time.Millisecond)
-	if err != nil || !sdkJobPeer(cred, x.parent, 0, x.parentGID) || !sdkJobWireBound(p, x.boot, seq) || p.Event != nil || p.MountFD != nil {
-		return sdkJobWire{}, errTrust
-	}
-	if mount {
-		if p.Reply != nil || p.Mount == 0 {
-			return sdkJobWire{}, errTrust
-		}
-	} else if p.Reply == nil || p.Mount != 0 {
-		return sdkJobWire{}, errTrust
-	}
-	return p, nil
-}
-func (x *sdkJobChild) event(e sdkJobEvent) (sdkJobReply, error) {
-	x.sequence++
-	if err := writeOperationPacketBound(x.control, sdkJobWire{Binding: x.boot.Request.Control.Binding, Token: x.boot.Actor.Token, Sequence: x.sequence, Event: &e}, MaxControlBytes); err != nil {
-		return sdkJobReply{}, err
-	}
-	p, err := x.receive(x.sequence, false)
-	if err != nil {
-		return sdkJobReply{}, err
-	}
-	return *p.Reply, nil
-}
-func (x *sdkJobChild) mount(fd int) (uint64, Code) {
-	if fd < 0 || fd > 1<<20 {
-		return 0, ErrInvalid
-	}
-	x.sequence++
-	number := uint32(fd)
-	if err := writeOperationPacketBound(x.control, sdkJobWire{Binding: x.boot.Request.Control.Binding, Token: x.boot.Actor.Token, Sequence: x.sequence, MountFD: &number}, MaxControlBytes); err != nil {
-		return 0, ErrUnavailable
-	}
-	p, err := x.receive(x.sequence, true)
-	if err != nil {
-		return 0, ErrUnavailable
-	}
-	return p.Mount, ""
-}
-func sdkJobWork(root string, s jobcontract.Step) (readOnlyWork, Code) {
-	w := readOnlyWork{RootPath: root, Action: Action(s.Action), Segments: append([]string{}, s.Segments...)}
-	if s.Limit != nil {
-		if *s.Limit > MaxPageEntries {
-			return w, ErrLimit
-		}
-		w.Limit = uint32(*s.Limit)
-	}
-	if s.MaxBytes != nil {
-		w.MaxBytes = *s.MaxBytes
-	}
-	return w, w.validate()
-}
-func (x *sdkJobChild) checkpoint(ctx context.Context, phase string, step uint64, n uint32) (context.Context, context.CancelFunc, error) {
-	r, err := x.event(sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: phase, Step: step, Bytes: n}})
-	if err != nil {
-		return nil, nil, err
-	}
-	deadline := time.Unix(0, r.Deadline)
-	if r.Deadline == 0 || !time.Now().Before(deadline) || time.Until(deadline) > NativeProofFreshness {
-		return nil, nil, ErrStale
-	}
-	proof, cancel := context.WithDeadline(ctx, deadline)
-	return proof, cancel, nil
-}
-func (x *sdkJobChild) progress(r jobcontract.Result, phase string) error {
-	if !x.lastProgress.IsZero() && time.Since(x.lastProgress) < time.Second {
-		return nil
-	}
-	if x.progressSequence >= jobcontract.MaxProgressPackets {
-		return nil
-	}
-	x.progressSequence++
-	x.lastProgress = time.Now()
-	n := uint64(len(x.boot.Request.Input.Steps))
-	_, err := x.event(sdkJobEvent{Kind: "progress", Progress: &jobcontract.Progress{Sequence: x.progressSequence, Phase: phase, CompletedUnits: r.CompletedSteps, TotalUnits: &n, BytesRead: r.BytesRead}})
-	return err
-}
-func (x *sdkJobChild) run(ctx context.Context, pin *pinnedReadOnlyRoot) error {
-	total := jobcontract.Result{ResultSchema: 1}
-	for index, step := range x.boot.Request.Input.Steps {
-		stepNumber := uint64(index)
-		proof, cancel, err := x.checkpoint(ctx, "before-step", stepNumber, 0)
-		if err != nil {
-			return err
-		}
-		work, code := sdkJobWork(pin.path, step)
-		result := jobcontract.Result{ResultSchema: 1}
-		if code == "" {
-			if work.Action == ActionRead || work.Action == ActionReadStream {
-				result.BytesRead, code = x.read(ctx, proof, pin, work, stepNumber, total)
-			} else {
-				bounded, done := context.WithTimeout(proof, time.Duration(x.boot.Worker.Limits.MetadataMS)*time.Millisecond)
-				metadata, _ := executeReadOnly(bounded, pin, work, operationReadOnlyACL)
-				code = metadata.Code
-				if code == "" {
-					code = nativeContextCode(bounded)
-				}
-				done()
-				if metadata.Entry != nil {
-					result.Entries = 1
-				}
-				if metadata.List != nil {
-					result.Entries = uint64(len(metadata.List.Entries))
-				}
-			}
-		}
-		cancel()
-		if code != "" {
-			// Fixed safe refusal only; no metadata/path/raw errors cross the socket.
-			_, _ = x.event(sdkJobEvent{Kind: "step-result", Result: &jobcontract.Result{ResultSchema: 1, SafeReason: jobcontract.SafeReason(safeGrantCode(code))}})
-			return code
-		}
-		result.CompletedSteps = 1
-		if _, err = x.event(sdkJobEvent{Kind: "step-result", Result: &result}); err != nil {
-			return err
-		}
-		total.CompletedSteps++
-		total.Entries += result.Entries
-		total.BytesRead += result.BytesRead
-		if err = x.progress(total, "metadata"); err != nil {
-			return err
-		}
-	}
-	proof, cancel, err := x.checkpoint(ctx, "before-result", uint64(len(x.boot.Request.Input.Steps)), 0)
-	if err != nil {
-		return err
-	}
-	defer cancel()
-	if code := nativeContextCode(proof); code != "" {
-		return code
-	}
-	_, err = x.event(sdkJobEvent{Kind: "result", Result: &total})
-	return err
-}
-
-// The fixed read handler opens data only after permanent drop. Unlike M2's
-// eager bounded buffer, even bounded SDK reads consume one freshly authorized
-// chunk at a time. Data stays in this actor process and is discarded, not relayed.
-func (x *sdkJobChild) read(ctx, proof context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork, step uint64, total jobcontract.Result) (uint64, Code) {
-	o, code := resolveReadOnly(proof, pin, w)
-	if code != "" {
-		return 0, code
-	}
-	defer o.Close()
-	if code = authorizeReadOnly(proof, o, w, operationReadOnlyACL); code != "" {
-		return 0, code
-	}
-	if o.before.Mode&unix.S_IFMT != unix.S_IFREG {
-		return 0, ErrDenied
-	}
-	if o.before.Size < 0 || uint64(o.before.Size) > w.MaxBytes {
-		return 0, ErrLimit
-	}
-	if code = readOnlyUnchanged(int(o.data.Fd()), o.before); code != "" {
-		return 0, code
-	}
-	stepCtx := ctx
-	if w.Action == ActionRead {
-		var cancel context.CancelFunc
-		stepCtx, cancel = context.WithTimeout(ctx, time.Duration(x.boot.Worker.Limits.BoundedMS)*time.Millisecond)
-		defer cancel()
-	}
-	remaining := uint64(o.before.Size)
-	var read uint64
-	for remaining > 0 {
-		n := uint32(min(remaining, x.boot.Worker.Limits.ChunkBytes))
-		lease, cancel, err := x.checkpoint(stepCtx, "before-chunk", step, n)
-		if err != nil {
-			return read, ErrUnavailable
-		}
-		code = authorizeReadOnly(lease, o, w, operationReadOnlyACL)
-		if code == "" {
-			code = readOnlyUnchanged(int(o.data.Fd()), o.before)
-		}
-		buf := make([]byte, n)
-		if code == "" {
-			if _, err = io.ReadFull(o.data, buf); err != nil {
-				code = readOnlyError(err)
-			}
-		}
-		clear(buf)
-		if code == "" {
-			code = authorizeReadOnly(lease, o, w, operationReadOnlyACL)
-		}
-		if code == "" {
-			code = readOnlyUnchanged(int(o.data.Fd()), o.before)
-		}
-		cancel()
-		if code != "" {
-			return read, code
-		}
-		remaining -= uint64(n)
-		read += uint64(n)
-		p := total
-		p.BytesRead += read
-		if err = x.progress(p, "reading"); err != nil {
-			return read, ErrUnavailable
-		}
-	}
-	return read, ""
-}

package/dist/templates/native-go/backend/internal/helper/sdk_job_contract.go

@@ -1,122 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/helper/jobcontract"
-	"time"
-)
-
-// S2 components only. Nothing registers these with RunLinux, the supervisor
-// loop, CGI, RPC, or the compiled registry consumer. S7 must explicitly assemble
-// ONE owner on the existing locked supervisor thread, after native proof gates.
-// The ordinary build excludes every sdk_job*.go production source file.
-type sdkJobRequest struct {
-	Control jobcontract.Control `json:"control"`
-	Input   jobcontract.Input   `json:"input"`
-}
-
-// Trusted root-side proof, never decoded from a caller or persisted as authority.
-// ValidateJob must observe the exact input/scope/action, App permission and root
-// continuity at every checkpoint. GrantAuthority independently checks the parent
-// under its existing admission order; this seam cannot replace that authority.
-type sdkJobProof struct {
-	Intent                    jobcontract.RevisionRef
-	Binding                   jobcontract.Binding
-	Principal                 Principal
-	SessionRef, Nonce, Ticket string
-	ExpiresAt, CheckedAt      time.Time
-	Continuity                ContinuityBinding
-	Continuous                bool
-	Root                      readOnlyRootWitness
-}
-type sdkJobValidator interface {
-	ValidateJob(context.Context, NativeActor, sdkJobRequest, Grant, sdkJobCheckpoint) (sdkJobProof, Code)
-}
-
-// A root-owned bounded journal must retain execution keys across owner restarts.
-// Reserve is immutable, exclusive and durable before admission/spawn, capped at
-// 256 lifetime intents. Cancel/Finish acknowledge only fsynced records. An error
-// is not a receipt, and uncertain writes never permit retry/redispatch. S2 has no
-// production journal assembly; the VM supplies a real fsync-backed fixture.
-type sdkJobJournal interface {
-	Reserve(sdkJobIntent) Code
-	Cancel(jobcontract.Binding) Code
-	Finish(sdkJobReceipt) Code
-}
-type sdkJobIntent struct {
-	Request    sdkJobRequest         `json:"request"`
-	Actor      jobcontract.Principal `json:"actor"`
-	SessionRef string                `json:"sessionRef,omitempty"`
-}
-type sdkJobReceipt struct {
-	Job    jobcontract.Job     `json:"job"`
-	Result *jobcontract.Result `json:"result,omitempty"`
-}
-type sdkJobCheckpoint struct {
-	Phase string `json:"phase"`
-	Step  uint64 `json:"step"`
-	Bytes uint32 `json:"bytes"`
-}
-type sdkJobEvent struct {
-	Kind       string                `json:"kind"`
-	Checkpoint sdkJobCheckpoint      `json:"checkpoint"`
-	Progress   *jobcontract.Progress `json:"progress,omitempty"`
-	Result     *jobcontract.Result   `json:"result,omitempty"`
-}
-type sdkJobReply struct {
-	Deadline int64 `json:"deadline"`
-}
-type sdkJobPlan struct {
-	Request sdkJobRequest
-	Worker  jobcontract.Worker
-	Root    readOnlyRootWitness
-}
-
-// Sole owner/reaper calls this interface. Its private receiver authenticates
-// SCM_CREDENTIALS, token, full binding and packet sequence before returning an
-// event. next/idle/reply must not wait for child I/O; stopRelay closes gates but
-// relayStopped is true only after the receiver and all FD users have returned.
-type sdkJobProcess interface {
-	operationProcess
-	next() (sdkJobEvent, bool)
-	reply(sdkJobReply) error
-	exitSuccess() bool
-}
-type sdkJobServices struct {
-	Validator sdkJobValidator
-	Journal   sdkJobJournal
-	Start     func(NativeActor, operationBinding, sdkJobPlan) (sdkJobProcess, error)
-}
-type sdkJob struct {
-	attach                                            *sdkAttachLease
-	background                                        *sdkBackgroundRuntime
-	journalUncertain                                  bool
-	request                                           sdkJobRequest
-	worker                                            jobcontract.Worker
-	actor                                             NativeActor
-	carriers                                          SessionCarriers // transient only; clear at terminal or canceled
-	root                                              readOnlyRootWitness
-	op                                                *cohortOperation
-	process                                           sdkJobProcess
-	receipt                                           sdkJobReceipt
-	step, admitted, stepAdmitted                      uint64
-	stepOpen, resultAllowed, resultReceived, terminal bool
-	lastCheckpoint, lastProgress                      time.Time
-	lastSeenProgress                                  *jobcontract.Progress
-	progress                                          []jobcontract.Progress
-	progressPackets                                   uint64
-	counters                                          jobcontract.Result
-	failure                                           Code
-}
-type sdkJobOwner struct {
-	session   *sdkSessionJobs      // opt-in session/File Station mode; no native authority fabrication
-	attachNow func() time.Duration // elapsed monotonic time; never restored from disk
-	views     *sdkJobViews         // one status budget/cursor owner, installed only by S5/S7 fixtures
-	grants    *supervisorGrants
-	services  sdkJobServices
-	workers   map[string]jobcontract.Worker
-	jobs      map[string]*sdkJob
-	controls  map[string]bool
-}

package/dist/templates/native-go/backend/internal/helper/sdk_job_linux_test.go

@@ -1,159 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"encoding/json"
-	"net"
-	"os"
-	"os/exec"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func sdkSocketPair(t *testing.T) (*net.UnixConn, *net.UnixConn) {
-	t.Helper()
-	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	open := func(fd int) *net.UnixConn {
-		f := os.NewFile(uintptr(fd), "sdk-test")
-		c, e := operationSocket(f)
-		f.Close()
-		if e != nil {
-			t.Fatal(e)
-		}
-		if e = enableCredentials(c); e != nil {
-			t.Fatal(e)
-		}
-		t.Cleanup(func() { c.Close() })
-		return c
-	}
-	return open(pair[0]), open(pair[1])
-}
-
-func TestSDKJobPrivatePacketClosesUnexpectedRights(t *testing.T) {
-	a, b := sdkSocketPair(t)
-	f, err := os.Open("/dev/null")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer f.Close()
-	before, err := os.ReadDir("/proc/self/fd")
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, _ := json.Marshal(sdkJobWire{Token: grantRef('a'), Sequence: 1, Event: &sdkJobEvent{Kind: "ready"}})
-	if _, _, err = a.WriteMsgUnix(raw, syscall.UnixRights(int(f.Fd())), nil); err != nil {
-		t.Fatal(err)
-	}
-	var packet sdkJobWire
-	if _, err = readSDKJobPacket(b, &packet, time.Second); err == nil {
-		t.Fatal("unexpected fd accepted")
-	}
-	after, err := os.ReadDir("/proc/self/fd")
-	if err != nil || len(after) != len(before) {
-		t.Fatal("received rights leaked", len(before), len(after), err)
-	}
-}
-func TestSDKJobForeignPeerSender(t *testing.T) {
-	if os.Getenv("S2_FOREIGN_PEER") != "1" {
-		return
-	}
-	f := os.NewFile(3, "foreign-peer")
-	defer f.Close()
-	conn, err := operationSocket(f)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	if err = writeOperationPacketBound(conn, sdkJobWire{Token: grantRef('a'), Sequence: 1, Event: &sdkJobEvent{Kind: "ready"}}, MaxControlBytes); err != nil {
-		t.Fatal(err)
-	}
-}
-func TestSDKJobSCMCredentialsRejectRealForeignProcess(t *testing.T) {
-	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	parent := os.NewFile(uintptr(pair[0]), "parent")
-	child := os.NewFile(uintptr(pair[1]), "child")
-	defer parent.Close()
-	defer child.Close()
-	conn, err := operationSocket(parent)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	if err = enableCredentials(conn); err != nil {
-		t.Fatal(err)
-	}
-	cmd := exec.Command(os.Args[0], "-test.run=^TestSDKJobForeignPeerSender$")
-	cmd.Env = append(os.Environ(), "S2_FOREIGN_PEER=1")
-	cmd.ExtraFiles = []*os.File{child}
-	if err = cmd.Start(); err != nil {
-		t.Fatal(err)
-	}
-	var packet sdkJobWire
-	cred, readErr := readSDKJobPacket(conn, &packet, time.Second)
-	if err = cmd.Wait(); err != nil || readErr != nil {
-		t.Fatal(err, readErr)
-	}
-	if sdkJobPeer(cred, os.Getpid(), uint32(os.Geteuid()), uint32(os.Getegid())) || !sdkJobPeer(cred, cmd.Process.Pid, uint32(os.Geteuid()), uint32(os.Getegid())) {
-		t.Fatal("actual writer identity not enforced", cred)
-	}
-}
-func TestSDKJobPrivatePacketsAreCanonicalAndCredentialBound(t *testing.T) {
-	for _, kind := range []string{"valid", "unknown", "duplicate", "case", "null", "large"} {
-		t.Run(kind, func(t *testing.T) {
-			a, b := sdkSocketPair(t)
-			packet := sdkJobWire{Token: grantRef('a'), Sequence: 1, Event: &sdkJobEvent{Kind: "ready"}}
-			raw, _ := json.Marshal(packet)
-			switch kind {
-			case "unknown":
-				raw = append(raw[:len(raw)-1], []byte(`,"extra":1}`)...)
-			case "duplicate":
-				raw = append(raw[:len(raw)-1], []byte(`,"sequence":1}`)...)
-			case "case":
-				raw = []byte(`{"Token":"a","sequence":1}`)
-			case "null":
-				raw = []byte(`{"token":null,"sequence":1}`)
-			case "large":
-				raw = make([]byte, MaxControlBytes+1)
-			}
-			if _, e := a.Write(raw); e != nil {
-				t.Fatal(e)
-			}
-			var got sdkJobWire
-			cred, err := readSDKJobPacket(b, &got, time.Second)
-			if kind == "valid" {
-				if err != nil || cred == nil || int(cred.Pid) != os.Getpid() || cred.Uid != uint32(os.Geteuid()) {
-					t.Fatal(cred, err)
-				}
-			} else if err == nil {
-				t.Fatal("accepted noncanonical private frame")
-			}
-		})
-	}
-}
-func TestSDKJobLinuxFactoryRefusesNonSupervisor(t *testing.T) {
-	f := sdkJobFixture(t)
-	a := relaxedActor(t, f.s.services.native, f.carriers)
-	b := operationBinding{f.c.inventory, f.c.epoch, f.r.Control.Binding.Job.ID, f.r.Control.Nonce, f.g.ID, f.g.Revision}
-	if p, err := startLinuxSDKJob(NewClient(f.c.inventory), "/tmp/untrusted", a, b, sdkJobPlan{Request: f.r, Worker: f.o.workers["scan"], Root: f.validator.root}); err == nil || p != nil {
-		t.Fatal("non-supervisor spawned", p, err)
-	}
-}
-
-func TestSDKJobChildRefusesMissingParentBeforeCredentials(t *testing.T) {
-	t.Setenv("SYNOPKGLAND_PARENT", "")
-	before := os.Geteuid()
-	if err := sdkJobChildLinux(Client{}); err == nil {
-		t.Fatal("child entered without protected supervisor")
-	}
-	if os.Geteuid() != before {
-		t.Fatal("credentials changed before parent proof")
-	}
-}