@synopackageland/cli 0.6.0 → 0.7.0

package/dist/standalone/spk.js

@@ -1,3 +1,4 @@
+import { metadataInfoFields } from "../package-metadata.js";
 import { createHash } from "node:crypto";
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
@@ -8,6 +9,7 @@ import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderInstallWizardFiles, renderNativeInstallWizard } from "../build-spk/install-wizard.js";
 import { writeWizardUiFiles } from "../build-spk/wizard-i18n.js";
+import { renderDelegateScopeSteps } from '../build-spk/delegate-scope.js';
 import { createReproducibleTar } from "../build-spk/reproducible-archive.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
@@ -17,7 +19,10 @@ import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { copyDaemonPayload } from "./daemon.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
+import { nativePortal } from "./portal.js";
+import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { executorPlan } from "../runtime/executor-build.js";
+import { EXECUTOR_ANCHOR } from "../runtime/executor-inspect.js";
 import { renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps } from "./shared-folder.js";
 const FILE_MODE = 0o644;
 const EXEC_MODE = 0o755;
@@ -77,6 +82,11 @@ export async function assembleStandaloneSpk(options) {
         copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
         if (manifest.daemon)
             copyFileSync(new URL('../../templates/_shared/LICENSES/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
+        const portal = nativePortal(manifest);
+        if (portal) {
+            writeFile(join(staging, "package", PORTAL_JSON_RELPATH), renderPortalJson(portal));
+            writeFile(join(staging, "package", PORTAL_MUSTACHE_RELPATH), renderPortalMustache());
+        }
         if (options.executor) {
             const executorDir = join(staging, "package", "executor");
             mkdirSync(executorDir);
@@ -93,11 +103,11 @@ export async function assembleStandaloneSpk(options) {
         await createReproducibleTar(join(staging, "package"), packageTgz, { gzip: true });
         rmSync(join(staging, "package"), { recursive: true, force: true });
         const checksum = createHash("md5").update(readFileSync(packageTgz)).digest("hex");
-        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort() }));
-        writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum));
+        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort(), ...(manifest.entry ? { entry: manifest.entry } : {}) }));
+        writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum, options.executor?.executorDigest));
         mkdirSync(join(staging, "conf"));
         writeFile(join(staging, "conf", "privilege"), renderNativePrivilege());
-        const resource = renderStandaloneResource(manifest);
+        const resource = renderStandaloneResource(manifest, portal);
         if (resource)
             writeFile(join(staging, "conf", "resource"), resource);
         if (manifest.capabilities.jobs) {
@@ -109,7 +119,10 @@ export async function assembleStandaloneSpk(options) {
             writeFile(join(staging, "scripts", name), renderStandaloneScript(name, manifest), EXEC_MODE);
         }
         const folder = manifest.sharedFolder;
-        const install = renderInstallWizardFiles(manifest.package, folder ? sharedFolderInstallSteps(manifest.package, folder) : renderNativeInstallWizard);
+        const steps = manifest.capabilities.delegate?.scope === 'install-selected'
+            ? (t) => [...renderDelegateScopeSteps(t), ...(folder ? sharedFolderInstallSteps(manifest.package, folder)(t) : [])]
+            : folder ? sharedFolderInstallSteps(manifest.package, folder) : renderNativeInstallWizard;
+        const install = renderInstallWizardFiles(manifest.package, portal ? (t) => [...steps(t), renderPortalWizardStep(t, portal.alias)] : steps);
         writeWizardUiFiles(staging, {
             ...install.static,
             ...install.dynamic,
@@ -130,10 +143,10 @@ function writeFile(path, content, mode = FILE_MODE) {
     chmodSync(path, mode);
 }
 function quote(value) {
-    return `"${value}"`;
+    return `"${value.replace(/([\\"$`])/g, "\\$1")}"`;
 }
 /** Manifest validation already refused quotes, backslashes and newlines. */
-function renderInfo(manifest, arch, checksum) {
+function renderInfo(manifest, arch, checksum, executorDigest) {
     const fields = [
         ["package", manifest.package],
         ["version", manifest.spkVersion],
@@ -148,7 +161,12 @@ function renderInfo(manifest, arch, checksum) {
         ["startable", "yes"],
         ["checksum", checksum],
     ];
-    if (manifest.daemon)
+    // Package Center writes INFO as root; root tasks accept only this executor.
+    if (executorDigest)
+        fields.push([EXECUTOR_ANCHOR, executorDigest]);
+    fields.push(...metadataInfoFields(manifest.metadata));
+    // Background packages need prestart: it runs before DSM's systemd-user-unit acquire.
+    if (manifest.daemon || manifest.capabilities.jobs)
         fields.push(["precheckstartstop", "yes"]);
     for (const locale of LOCALES) {
         const text = manifest.i18n?.info[locale];

package/dist/templates/_daemon/main_test.go

@@ -41,9 +41,15 @@ func fixture(t *testing.T, mode string) (string, string, string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dest, "daemon/payload/app"), raw, 0755); err != nil {
+	app := filepath.Join(dest, "daemon/payload/app")
+	if err := os.WriteFile(app, raw, 0755); err != nil {
 		t.Fatal(err)
 	}
+	// macOS verifies a newly written executable on its first exec, which takes
+	// seconds on a loaded host; pay it here, not inside a one-second budget.
+	if raw, err := exec.Command(app, "cleanup").CombinedOutput(); err != nil {
+		t.Fatalf("payload warm-up: %v %s", err, raw)
+	}
 	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1}}
 	if os.Geteuid() == 0 {
 		cfg.Package = "nobody"
@@ -91,22 +97,69 @@ func runControl(control, action, dest, data string) (int, string) {
 	return -1, err.Error()
 }
 
+// Readiness only proves the child stayed alive for a second, not that it reached
+// main: on a loaded host a stop can kill it before it writes its line. Spawn
+// identity therefore comes from the inventory, and log content is awaited.
+func recordedChild(t *testing.T, data string) int {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.pid"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var r record
+	if err := json.Unmarshal(raw, &r); err != nil || r.Child < 1 {
+		t.Fatalf("daemon inventory: %v %s", err, raw)
+	}
+	return r.Child
+}
+
+func awaitChildLines(t *testing.T, data string, want int) {
+	t.Helper()
+	path := filepath.Join(data, "daemon/daemon.log")
+	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(20 * time.Millisecond) {
+		raw, _ := os.ReadFile(path)
+		if got := strings.Count(string(raw), `"uid":`); got >= want || time.Now().After(deadline) {
+			if got != want {
+				t.Fatalf("child lines=%d want=%d: %s", got, want, raw)
+			}
+			return
+		}
+	}
+}
+
 func TestDaemonLifecycle(t *testing.T) {
 	control, dest, data := fixture(t, "normal")
-	for _, step := range []struct {
-		action string
-		want   int
-	}{{"status", 3}, {"stop", 0}, {"start", 0}, {"status", 0}, {"start", 0}, {"restart", 0}, {"stop", 0}, {"stop", 0}, {"status", 3}, {"unknown", 1}} {
-		if rc, out := runControl(control, step.action, dest, data); rc != step.want {
-			t.Fatalf("%s rc=%d want=%d: %s", step.action, rc, step.want, out)
+	step := func(action string, want int) {
+		t.Helper()
+		if rc, out := runControl(control, action, dest, data); rc != want {
+			t.Fatalf("%s rc=%d want=%d: %s", action, rc, want, out)
 		}
 	}
+	step("status", 3)
+	step("stop", 0)
+	step("start", 0)
+	awaitChildLines(t, data, 1)
+	first := recordedChild(t, data)
+	step("status", 0)
+	step("start", 0)
+	if child := recordedChild(t, data); child != first {
+		t.Fatalf("duplicate start spawned another child: %d replaced %d", child, first)
+	}
+	step("restart", 0)
+	if child := recordedChild(t, data); child == first {
+		t.Fatalf("restart kept child %d", child)
+	}
+	awaitChildLines(t, data, 2)
+	step("stop", 0)
+	step("stop", 0)
+	step("status", 3)
+	step("unknown", 1)
 	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.log"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	if strings.Count(string(raw), `"uid":`) != 2 {
-		t.Fatalf("duplicate start spawned another child: %s", raw)
+		t.Fatalf("unexpected child spawn: %s", raw)
 	}
 	if strings.Contains(string(raw), "must-not-leak") {
 		t.Fatalf("ambient environment leaked: %s", raw)

package/dist/templates/_executor/README.md

@@ -7,9 +7,16 @@ including newline at most 65536 bytes). Socket access additionally requires exac
 Linux SO_PEERCRED UID equality, even for another member of the package group.
 Non-Linux builds support portable tests and refuse privileged service operations.
 
+Fixed writer children verify `no_new_privs` with `PR_GET_NO_NEW_PRIVS` on their
+locked Linux thread. DSM kernel 4.4 supports this flag but omits its proc status
+field; a failed syscall or a value other than one still refuses the write.
+Saved IDs and zero capabilities remain mandatory. The parent passes the pinned
+package-owned private source as a read-only FD; destination creation and publish
+remain under the subject UID, and source cleanup runs under the package UID.
+
 ## Protected inventory and policy
 
-Setup must copy the digest-pinned executor, policy and root scripts into:
+Setup must copy the INFO-anchored executor, policy-pinned policy and root scripts into:
 
 ```
 /usr/local/etc/synopkgland/<package>/             root:root 0700
@@ -74,7 +81,7 @@ operations and policy-excluded operations are rejected. Replies follow §2.4.
 
 | Operation | Parameters | Result |
 | --- | --- | --- |
-| status | none | executor_digest, policy_digest, version, ready |
+| status | none | executor_digest, policy_digest, version, ready, disabled |
 | delegate.create | job_id, ops[], scope, path, ttl_seconds | delegation_id, subject {username, uid}, expires_at (RFC3339) |
 | delegate.list | none | delegations[] with public metadata, including revoked/expired records |
 | delegate.revoke | delegation_id; job_id required without cookie | revoked |
@@ -86,7 +93,7 @@ operations and policy-excluded operations are rejected. Replies follow §2.4.
 Create/list require a cookie and SynoToken. Revoke accepts the subject/admin session pair or a matching
 package job ID. Root operations require the session pair independently verified as an
 active administrators member. Delegated operations recheck the account, UID,
-expired=`normal`, non-admin membership, App and File Station privileges, scope,
+expired=`normal`, App and File Station privileges, scope,
 job, operation, expiry and revocation. UIDs below 1024 are excluded as system
 accounts. TTL must be 1–2592000 seconds. No cookie/SynoToken/SID/password is persisted.
 
@@ -94,22 +101,26 @@ Paths use File Station spellings `/home[/...]` or `/<share>[/...]`. A delegation
 binds the requested directory's canonical path. Symlinks resolving outside that
 directory are denied. `files.write` opens package-owned, singly linked regular
 staging files with no symlink components; its fresh child checks setgroups,
-setresgid and setresuid in order, then all real/effective IDs and groups. The child
+setresgid and setresuid in order, then real/effective/saved/filesystem IDs and groups, empty capability sets and
+`no_new_privs`. Admin users retain their own nonzero UID and current groups. The child
 opens the destination after dropping identity, verifies its pinned directory and
 scope, and copies into an exclusive hidden `.synopkgland-<job_id>-<random>.part`
 file. After fsync it publishes the complete file with a hard link, then removes
 the temporary name. Existing files and symlinks are never overwritten. The
 executor cleans the exact temporary name as the subject user after a canceled or
 killed child, using a retained directory descriptor; startup performs no scan.
-Successful writes delete staging. DSM ACL inheritance can
+Successful writes request exact source cleanup in a separate package-UID child;
+cleanup failure retains the source and never downgrades a committed receipt. DSM ACL inheritance can
 produce a mode different from the requested 0600 (observed 0711 on vt-nas).
 
 File Station CheckPermission uses v3 with a fixed non-overwriting probe filename
 and size zero; it creates no file. Missing/failed API data is denied. DSM output
 and root script output are capped at 1 MiB; commands have 20-second deadlines,
 connection read/write deadlines are 15/5 seconds and request execution is bounded
-by 30 seconds. At most 16 connections are admitted. Execution/revocation are
-serialized. Linux command timeouts kill the entire command process group.
+by 30 seconds. At most 16 connections are admitted. Legacy runner APIs use short
+admission leases; revoke/disable persist the fence then drain accepted legacy
+calls outside the commit lock before acknowledging. Bulk copy holds no commit
+lock. Linux command timeouts kill the entire command process group.
 
 File Station APIs resolve path strings inside DSM after executor scope validation;
 there is no atomic DSM API for binding that subsequent lookup to our directory
@@ -122,13 +133,20 @@ items, not assertions of complete race freedom.
 
 ```
 executor serve --package com.example.downloader
+executor supervise --package com.example.downloader
 executor control start --package com.example.downloader
 executor control stop --package com.example.downloader
 executor control purge --package com.example.downloader
 ```
 
 Root control start launches asynchronously; the caller reads socket status to
-establish readiness. A held flock pidfile refuses duplicate serve. Root's pinned
+establish readiness. It starts `executor supervise`, a root supervisor that runs
+`serve` as its child and restarts it after an abnormal end (signal or non-zero
+exit) with a 1 s backoff doubling to 60 s, reset after a minute of healthy run.
+A restarted `serve --revived` honors a `stop` already in the mailbox. Exit 0
+(root replacement, shutdown, purge), exit 3 (another monitor holds the pidfile)
+or a removed runtime end supervision. A held flock pidfile refuses duplicate
+serve. Root's pinned
 boot/control start can validate and terminate a previous monitor before launching
 its replacement; package-account start only writes the mailbox and cannot replace
 runtime. Stop pauses the listener while the monitor continues. Purge removes this
@@ -136,7 +154,8 @@ package's protected state and deletes only its verified recorded scheduler tasks
 
 Run `go test -race ./...` and `bash scripts/ci/gate.sh native-go`. The gate adds
 Linux amd64/arm64 vet, static binary builds and test compilation. Linux-specific
-syscall tests also run on vt-nas from a cross-compiled test executable. The
+syscall tests require a disposable Linux root fixture. This revision was tested
+on a Linux VM; DSM ACL, logout and reboot behavior remain unverified. The
 `testdata/live_probe.py` harness expects isolated disposable accounts and a
 manually copied runtime, reads passwords only from stdin, and logs no credentials.
 The live harness uses DSM's registered `SYNO.Desktop` AppPriv ID as a stand-in for
@@ -148,12 +167,17 @@ an installed App; installed-package AppPriv integration belongs to setup testing
 Package-account hooks atomically write `stop` before upgrades/stops, `start` on
 install/upgrade completion and package start, and `purge` before uninstall.
 `stop` cancels/drains requests and removes the listener without ending the root
-monitor. `start` resumes only if both package executor and policy hashes equal
-the approved runtime pins; otherwise the service stays paused for administrator
-approval. Only root's pinned boot/control path can replace a monitor or runtime.
+monitor. `start` resumes if both package executor and policy hashes equal the approved
+runtime pins. If only the executor changed, the policy hash is unchanged and the
+executor hash equals the single `synopkgland_executor_sha256` key in the
+root-owned `/var/packages/<package>/INFO`, the root monitor copies it into
+`runtime/`, verifies the copy and runs root `control start`, which replaces the
+monitor without reapproval. Any other change stays paused for administrator
+approval. Only root's pinned boot/control path or this anchored install can
+replace a monitor or runtime.
 
 At start, scheduler readback must exactly match the canonical lifecycle scripts
-regenerated from the package identity and approved executor/policy pins. Package
+regenerated from the package identity and approved policy pin. Package
 setup metadata supplies hints only. The verified names, pins and script hashes
 are stored in root:root 0600 `runtime/tasks.json`. Purge regenerates the scripts
 and revalidates each current definition before EventScheduler v1
@@ -188,9 +212,10 @@ and `purge` clears state immediately. A root-approved new monitor ignores the
 stop file already present at startup; that exception ends after an absence.
 
 The boot task checks pending purge/package disappearance before accessing source.
-It verifies retained pins and protected copies again before offline purge. Normal
-boot installs verified copies and calls root control start to replace a previous
-monitor. Scripts stay within 1 KiB with no percent characters, including the
+It verifies the retained policy pin before offline purge from the root-only
+runtime. Normal boot verifies the copies against the policy pin and the INFO
+executor anchor, installs them and calls root control start to replace a
+previous monitor. Scripts stay within 1 KiB with no percent characters, including the
 longest package name. Partial/tampered retained state requires administrator
 review. All nine uninstall wizard locales name the two tasks and disclose the
 retained DSM storage/infrastructure. `inspect`/`status` cleanup guidance is
@@ -202,3 +227,89 @@ a directory descriptor and verified with fstat, so boot umask 0077 cannot reduce
 validated and never repaired/adopted. The package directory must already have
 root/package-group ownership. The socket is set to root/package-group 0660 and
 verified using Linux O_PATH + fstat on its filesystem inode.
+
+## Explicit long-running v1 extension
+
+The pinned policy opts in with top-level `destinations: ["save"]` and
+`lifetime: "until-revoked"`, together with `files.moveFromStaging` in the
+operation allowlist. Destination keys match `^[a-z][a-z0-9_-]{0,63}$`; unknown
+keys/lifetimes fail closed. Legacy policies/TTL grants never become permanent.
+The existing v1 envelope, peer UID check, protected runtime and session verifier
+remain unchanged. `root.run` is independent and is never a writer fallback.
+
+| Operation | Parameters | Result |
+| --- | --- | --- |
+| delegate.create (permanent) | scope, ops:[files.moveFromStaging], path, destination, lifetime:until-revoked | delegation_id, subject, path, destination, lifetime; zero expiry |
+| files.moveFromStaging | delegation_id, job_id, staging, name, size | job_id, state |
+| files.operationStatus | original delegation_id, job_id | job_id, state, optional code/receipt |
+| files.cancelOperation | original delegation_id, job_id | current operation state |
+| delegate.disable / delegate.enable | none; live administrator session | disabled |
+| delegate.audit | none; live owner/admin session | latest bounded events |
+
+Permanent create needs the current user's cookie and SynoToken and a successful
+File Station write check. The executor derives username/UID and exact directory
+identity itself. Permanent revoke is owner-bound even for administrators; admins
+can disable the entire package. Auth-less operation submission/status/cancel is
+for the trusted package producer holding the grant reference and original job ID.
+If credentials are supplied, both must verify and the owner must match; failed
+caller auth never falls back to offline authority. A compromised package backend
+can use all valid grants it holds, as documented in the approved trust model.
+
+Grants survive service restart in the protected store. The disabled flag also
+survives; mailbox start/boot never clears it. Disable persists first and revokes
+all legacy/permanent grants. Enable checks the live admin session and completes
+revocation before clearing the flag; it never restores old grants. Repeated enable
+while already enabled is a no-op.
+
+Operations are separate `operation-<sha256(job_id)>.record` files, root:root 0600.
+They bind immutable grant/job/staging/name/size and move through queued, copying,
+committed, canceled, interrupted or uncertain. Queued resumes without credentials;
+copying becomes interrupted on restart, or uncertain after durable publish intent.
+Neither state is replayed. Changed input for the same job is `operation-conflict`.
+Committed status alone includes `receipt:{path,size}`. Cleanup failures retain
+committed and add `CLEANUP_PENDING`. No same-name/hash guessing establishes receipt.
+
+Limits: 16 GiB per file, actual size+1 read, 16 queued, one active copy per package,
+24-hour attempt, 10 MiB operation metadata. Full journals reject new admissions;
+terminal records are retained to prevent replay. Bulk input bypasses job spools
+and the old 64 MiB wrapper limit. Long copies revalidate account/AppPriv/ACL/path
+with five-second polling and bounded checks; publish revalidates again. A failed
+identity/ACL/path check invalidates the grant and requires a new selection.
+
+The fixed child drops identity before opening the destination and creating any
+inode. Every component uses FD-relative O_NOFOLLOW; ancestors use O_PATH so only
+search rights are required. Source is package-owned, regular and singly linked;
+destination is the exact granted device/inode, never a caller-supplied path.
+Part metadata is durable before copying. Publish links the open part inode with
+no replacement, refusing files/symlinks/FIFOs at the final name. Revoke, disable
+and publish share the commit lock. Lost/malformed publish replies drain the child
+before releasing that lock and produce uncertain; a confirmed no-side-effect
+refusal such as `destination-exists` remains interrupted. The lock covers bounded
+publish handshake/fsync, never the bulk copy. During the copy the child watches
+its control pipe: if `serve` dies the pipe closes, so the child stops within one
+1 MiB chunk and unlinks its part (no `PR_SET_PDEATHSIG`, which the identity drop
+clears; works on kernel 3.10). Kernel-blocked filesystem I/O can
+still delay draining; it cannot be declared safely complete by a timeout.
+Legacy `files.write` uses this same child and publish handshake; the executor
+has no other writer, so no child can publish after `serve` is gone.
+
+Destination/part cleanup runs as the owner; source cleanup runs as package UID.
+Restart cleans only journaled exact part identity as the current eligible owner;
+changed/missing/inaccessible directories are retained for review, never scanned
+or deleted as root. Subject-controlled directory moves after the final check
+can still complete in the pinned directory object. DSM ACL changes and publication
+are not atomic, and silent UID/inode reuse is not universally detected. A subject
+who owns the destination can mutate its own output; this is not a content sandbox.
+
+Structured audit lives in protected `audit.jsonl`/`audit.previous`, at most 50 MiB
+combined, separate from authority. Events include package, username/UID, operation,
+job, location and result; no session credentials. Owner queries are filtered,
+admins can view this package's events. Replies contain at most 256 events/1 MiB.
+Admission events are labeled `admitting` because a subsequent durable write can
+fail. The operation journal, not an admission audit event, establishes completion.
+
+The existing status operation reads `Store.Disabled`; protected-store errors set
+`ready:false` rather than assuming enabled. Backend `delegate.status` exposes the
+verified boolean and `disabled` capability state. Backend `delegate.operations.list`
+is strictly empty-params, freshly owner/UID-filtered move-mirror metadata; it is
+not an executor operation. Live completion remains `files.operationStatus`.

package/dist/templates/_executor/anchor.go

@@ -0,0 +1,146 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"syscall"
+)
+
+// Package Center writes the SPK INFO as root. The package account cannot change
+// it, so its executor digest authorizes executor-only upgrades under the
+// administrator-approved policy without a new PasswordConfirm.
+const executorAnchorKey = "synopkgland_executor_sha256"
+
+var anchorRE = regexp.MustCompile(`^"([a-f0-9]{64})"$`)
+
+type pinState int
+
+const (
+	pinsDiffer pinState = iota
+	pinsMatch
+	pinsAnchored
+)
+
+func executorAnchor(info string, trusted func(os.FileInfo) bool) (string, error) {
+	b, stat, err := readLifecycleFile(info, 65536)
+	if err != nil {
+		return "", err
+	}
+	if !trusted(stat) {
+		return "", errors.New("untrusted package INFO")
+	}
+	anchor := ""
+	for _, line := range strings.Split(string(b), "\n") {
+		value, ok := strings.CutPrefix(line, executorAnchorKey+"=")
+		if !ok {
+			continue
+		}
+		m := anchorRE.FindStringSubmatch(value)
+		if m == nil || anchor != "" {
+			return "", errors.New("executor anchor")
+		}
+		anchor = m[1]
+	}
+	if anchor == "" {
+		return "", errors.New("executor anchor")
+	}
+	return anchor, nil
+}
+
+func rootOwnedReadOnly(info os.FileInfo) bool {
+	return ownedByRoot(info) && info.Mode().Perm()&0022 == 0
+}
+
+func packagePins(ctx context.Context, dir, info string, trusted func(os.FileInfo) bool, executorDigest, policyDigest string) pinState {
+	if samePackagePins(ctx, dir, executorDigest, policyDigest) {
+		return pinsMatch
+	}
+	dir, err := filepath.EvalSymlinks(dir)
+	if err != nil {
+		return pinsDiffer
+	}
+	if pd, err := digestFile(ctx, dir+"/policy.json", maxPolicyBytes); err != nil || pd != policyDigest {
+		return pinsDiffer
+	}
+	anchor, err := executorAnchor(info, trusted)
+	if err != nil {
+		return pinsDiffer
+	}
+	if ed, err := digestFile(ctx, dir+"/executor", maxExecutorBytes); err != nil || ed != anchor {
+		return pinsDiffer
+	}
+	return pinsAnchored
+}
+
+// The policy is unchanged, so root scripts (pinned by policy digests) stay too.
+// Verify the protected copy, never the package-reachable source.
+func installAnchored(ctx context.Context, source, info string, trusted func(os.FileInfo) bool, runtime string) error {
+	anchor, err := executorAnchor(info, trusted)
+	if err != nil {
+		return err
+	}
+	src, err := openRegular(filepath.Join(source, "executor"))
+	if err != nil {
+		return err
+	}
+	defer src.Close()
+	stat, err := src.Stat()
+	if err != nil || stat.Size() > maxExecutorBytes {
+		return errors.New("executor size")
+	}
+	staged, err := os.CreateTemp(runtime, ".executor-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(staged.Name())
+	err = copyExact(staged, src, stat.Size())
+	if err == nil {
+		err = staged.Chmod(0700)
+	}
+	if err == nil {
+		err = staged.Sync()
+	}
+	if closeErr := staged.Close(); err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return err
+	}
+	if digest, err := digestFile(ctx, staged.Name(), maxExecutorBytes); err != nil || digest != anchor {
+		return errors.New("executor anchor mismatch")
+	}
+	return os.Rename(staged.Name(), filepath.Join(runtime, "executor"))
+}
+
+// Root control start replaces this monitor with the newly installed runtime.
+func startInstalled(runtime, pkg string) error {
+	cmd := exec.Command(filepath.Join(runtime, "executor"), "control", "start", "--package", pkg)
+	cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
+	cmd.Dir = "/"
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	return cmd.Process.Release()
+}
+
+func approvedPins(state pinState, install, start func() error, log func(string)) bool {
+	if state != pinsAnchored {
+		return state == pinsMatch
+	}
+	if err := install(); err != nil {
+		log("executor upgrade refused: INFO-anchored executor could not be installed")
+		return false
+	}
+	if err := start(); err != nil {
+		log("executor upgrade installed; root start failed")
+		return false
+	}
+	log("executor upgrade: INFO-anchored executor installed under the approved policy")
+	return false
+}