@synopackageland/cli 0.6.0 → 0.7.0

package/templates/_executor/platform_linux.go

@@ -4,19 +4,12 @@ package main
 
 import (
 	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
 	"errors"
-	"io"
 	"net"
 	"os"
 	"os/exec"
-	"path/filepath"
-	"strconv"
 	"strings"
 	"syscall"
-	"time"
 )
 
 func ownedByRoot(info os.FileInfo) bool {
@@ -103,7 +96,7 @@ func openBeneath(root, relative string, flags int, mode uint32) (*os.File, error
 	for i, part := range parts {
 		f := flags
 		if i < len(parts)-1 {
-			f = syscall.O_RDONLY | syscall.O_DIRECTORY
+			f = 0x200000 | syscall.O_DIRECTORY // O_PATH: ancestor requires search, not listing rights
 		}
 		fd, err := syscall.Openat(int(dir.Fd()), part, f|syscall.O_NOFOLLOW|syscall.O_CLOEXEC|syscall.O_NONBLOCK, mode)
 		if err != nil {
@@ -135,104 +128,31 @@ func openRegular(path string) (*os.File, error) {
 }
 
 type subprocessWriter struct {
-	Staging, Executable string
-	PackageUID          int
-}
-type childSpec struct {
-	Subject   Subject `json:"subject"`
-	Dest      string  `json:"dest_dir"`
-	Name      string  `json:"name"`
-	Root      string  `json:"root"`
-	Temporary string  `json:"temporary"`
+	Staging, Executable    string
+	PackageUID, PackageGID int
 }
 
 func (w subprocessWriter) Write(ctx context.Context, s Subject, staging, dest, name, root string) error {
-	parent, err := filepath.EvalSymlinks(filepath.Dir(w.Staging))
-	if err != nil {
-		return err
-	}
-	stagingRoot := filepath.Join(parent, filepath.Base(w.Staging))
-	f, err := openBeneath(stagingRoot, staging, syscall.O_RDONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	info, err := f.Stat()
-	if err != nil || !info.Mode().IsRegular() {
-		return errors.New("staging file")
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok || int(st.Uid) != w.PackageUID || st.Nlink != 1 {
-		return errors.New("staging owner or hardlink")
-	}
 	job, _ := ctx.Value(writeJobKey{}).(string)
-	if !tokenRE.MatchString(job) {
-		return errors.New("write job")
-	}
-	random := make([]byte, 16)
-	if _, err = rand.Read(random); err != nil {
-		return err
-	}
-	temporary := ".synopkgland-" + job + "-" + hex.EncodeToString(random) + ".part"
-	// Retain this directory solely for cleanup. The writer opens it again after
-	// dropping identity and verifies the inode before creating any file.
-	dir, err := os.Open(dest)
+	f, _, err := w.openSource(staging)
 	if err != nil {
 		return err
 	}
-	defer dir.Close()
-	spec, err := json.Marshal(childSpec{Subject: s, Dest: dest, Name: name, Root: root, Temporary: temporary})
-	if err != nil {
-		return err
-	}
-	runChild := func(childCtx context.Context, mode string) error {
-		cmd := command(childCtx, w.Executable, []string{mode})
-		cmd.ExtraFiles = []*os.File{f, dir}
-		cmd.Stdin = strings.NewReader(string(spec))
-		cmd.Stdout = io.Discard
-		cmd.Stderr = io.Discard
-		return cmd.Run()
-	}
-	writeErr := runChild(ctx, "write-child")
-	// SIGKILL cannot execute a child defer. Cleanup uses the subject's identity
-	// and the retained directory, even if the subject has renamed that directory.
-	cleanup, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	cleanupErr := runChild(cleanup, "cleanup-child")
-	cancel()
-	if writeErr != nil || cleanupErr != nil {
-		return errors.New("write child refused")
-	}
-
-	// Unlink via the pinned staging parent; swapping staging never removes an
-	// unrelated object outside staging. A replacement is deliberately not deleted.
-	return removeStaging(stagingRoot, staging, info)
-}
-func removeStaging(root, relative string, original os.FileInfo) error {
-	parent := filepath.Dir(relative)
-	dir, err := os.Open(root)
+	info, err := f.Stat()
+	f.Close()
 	if err != nil {
 		return err
 	}
-	if parent != "." {
-		dir.Close()
-		dir, err = openBeneath(root, parent, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
-		if err != nil {
-			return err
-		}
-	}
-	defer dir.Close()
-	name := filepath.Base(relative)
-	fd, err := syscall.Openat(int(dir.Fd()), name, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC|syscall.O_NONBLOCK, 0)
+	di, err := bindDirectory(dest)
 	if err != nil {
 		return err
 	}
-	f := os.NewFile(uintptr(fd), name)
-	now, err := f.Stat()
-	f.Close()
-	if err != nil || !os.SameFile(original, now) {
-		return errors.New("staging replaced")
+	guard, _ := ctx.Value(legacyPublishKey{}).(func(func() (MoveReceipt, error)) (MoveReceipt, error))
+	if guard == nil {
+		guard = func(publish func() (MoveReceipt, error)) (MoveReceipt, error) { return publish() }
 	}
-	return syscall.Unlinkat(int(dir.Fd()), name)
+	_, err = w.Move(ctx, s, Operation{Job: job, Name: name, Staging: staging, Size: info.Size()}, Delegation{Root: dest, Directory: di}, guard)
+	return err
 }
 
 type realIdentity struct{}
@@ -244,93 +164,24 @@ func (realIdentity) IDs() (int, int, int, int) {
 	return os.Getuid(), os.Geteuid(), os.Getgid(), os.Getegid()
 }
 func (realIdentity) Groups() ([]int, error) { return os.Getgroups() }
-func writeChild() error                     { return runWriteChild(false) }
-func runWriteChild(cleanup bool) error {
-	if os.Geteuid() != 0 {
-		return errors.New("root required")
-	}
-	b, err := io.ReadAll(io.LimitReader(os.Stdin, maxRequest+1))
-	if err != nil || len(b) > maxRequest {
-		return errors.New("child spec")
-	}
-	var s childSpec
-	if strictJSON(b, &s) != nil {
-		return errors.New("child spec")
-	}
-	if !validTemporary(s.Temporary) || !validName(s.Name) || !cleanPath(s.Dest) || !cleanPath(s.Root) || !within(s.Root, s.Dest) {
-		return errors.New("scope")
-	}
-	if err = dropIdentity(realIdentity{}, s.Subject); err != nil {
-		return err
-	}
-	dir := os.NewFile(4, "destination")
-	defer dir.Close()
-	if cleanup {
-		info, err := dir.Stat()
-		if err != nil || !info.IsDir() {
-			return errors.New("cleanup directory")
-		}
-		err = syscall.Unlinkat(int(dir.Fd()), s.Temporary)
-		if err != nil && err != syscall.ENOENT {
-			return err
-		}
-		return dir.Sync()
-	}
-	return copyDestination(os.NewFile(3, "staging"), s.Dest, s.Name, s.Root, s.Temporary, dir)
-}
 func validTemporary(name string) bool {
 	return validName(name) && strings.HasPrefix(name, ".synopkgland-") && strings.HasSuffix(name, ".part")
 }
-func copyDestination(src *os.File, dest, name, root, temporary string, pinned *os.File) error {
-	if !validTemporary(temporary) || !validName(name) || !cleanPath(dest) || !cleanPath(root) {
-		return errors.New("path")
-	}
-	dir, err := os.Open(dest)
+func lockFile(f *os.File) error { return syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) }
+
+func bindDirectory(path string) (directoryIdentity, error) {
+	f, err := openBeneath("/", strings.TrimPrefix(path, "/"), syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
 	if err != nil {
-		return err
-	}
-	defer dir.Close()
-	info, err := dir.Stat()
-	if err != nil || !info.IsDir() {
-		return errors.New("directory")
-	}
-	expected, err := pinned.Stat()
-	if err != nil || !os.SameFile(info, expected) {
-		return errors.New("directory replaced")
-	}
-	actual, err := os.Readlink("/proc/self/fd/" + strconv.Itoa(int(dir.Fd())))
-	if err != nil || !within(root, actual) || strings.HasSuffix(actual, " (deleted)") {
-		return errors.New("scope")
+		return directoryIdentity{}, err
 	}
-	fd, err := syscall.Openat(int(dir.Fd()), temporary, syscall.O_WRONLY|syscall.O_CREAT|syscall.O_EXCL|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0600)
+	defer f.Close()
+	info, err := f.Stat()
 	if err != nil {
-		return err
-	}
-	out := os.NewFile(uintptr(fd), temporary)
-	defer func() { out.Close(); syscall.Unlinkat(int(dir.Fd()), temporary) }()
-	// Recheck the pinned directory after creation, before copying any bytes.
-	actual, err = os.Readlink("/proc/self/fd/" + strconv.Itoa(int(dir.Fd())))
-	if err != nil || !within(root, actual) || strings.HasSuffix(actual, " (deleted)") {
-		return errors.New("scope")
-	}
-	if _, err = io.Copy(out, src); err != nil {
-		return err
-	}
-	if err = out.Sync(); err != nil {
-		return err
+		return directoryIdentity{}, err
 	}
-	if err = out.Close(); err != nil {
-		return err
-	}
-	// link publishes complete fsynced bytes and atomically refuses any existing
-	// final file or symlink. Both paths resolve through the pinned directory.
-	procDir := "/proc/self/fd/" + strconv.Itoa(int(dir.Fd()))
-	if err = os.Link(procDir+"/"+temporary, procDir+"/"+name); err != nil {
-		return err
-	}
-	if err = syscall.Unlinkat(int(dir.Fd()), temporary); err != nil {
-		return err
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || !info.IsDir() {
+		return directoryIdentity{}, errors.New("directory")
 	}
-	return dir.Sync()
+	return directoryIdentity{uint64(st.Dev), st.Ino}, nil
 }
-func lockFile(f *os.File) error { return syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) }

package/templates/_executor/platform_linux_test.go

@@ -29,9 +29,11 @@ func (s *switchStub) step(name string) error {
 	}
 	return nil
 }
-func (s *switchStub) Setgroups([]int) error         { return s.step("groups") }
-func (s *switchStub) Setresgid(int, int, int) error { return s.step("gid") }
-func (s *switchStub) Setresuid(int, int, int) error { return s.step("uid") }
+func (s *switchStub) Seal() error                    { return s.step("seal") }
+func (s *switchStub) VerifyPrivileges(Subject) error { return s.step("verify") }
+func (s *switchStub) Setgroups([]int) error          { return s.step("groups") }
+func (s *switchStub) Setresgid(int, int, int) error  { return s.step("gid") }
+func (s *switchStub) Setresuid(int, int, int) error  { return s.step("uid") }
 func (s *switchStub) IDs() (int, int, int, int) {
 	if s.wrong {
 		return 0, 0, 0, 0
@@ -41,13 +43,13 @@ func (s *switchStub) IDs() (int, int, int, int) {
 func (s *switchStub) Groups() ([]int, error) { return s.s.Groups, nil }
 func TestDropOrderAndFailures(t *testing.T) {
 	subject := Subject{UID: 1200, GID: 100, Groups: []int{100, 123}}
-	for _, fail := range []string{"", "groups", "gid", "uid"} {
+	for _, fail := range []string{"", "seal", "groups", "gid", "uid", "verify"} {
 		s := &switchStub{fail: fail, s: subject}
-		err := dropIdentity(s, subject)
+		err := dropSealedIdentity(s, subject)
 		if (err == nil) != (fail == "") {
 			t.Fatal(err)
 		}
-		expected := []string{"groups", "gid", "uid"}
+		expected := []string{"seal", "groups", "gid", "uid", "verify"}
 		if fail != "" {
 			for i, n := range expected {
 				if n == fail {
@@ -61,7 +63,7 @@ func TestDropOrderAndFailures(t *testing.T) {
 		}
 	}
 	s := &switchStub{s: subject, wrong: true}
-	if dropIdentity(s, subject) == nil {
+	if dropSealedIdentity(s, subject) == nil {
 		t.Fatal("identity not verified")
 	}
 }
@@ -78,43 +80,6 @@ func TestLinuxStagingSymlinks(t *testing.T) {
 		}
 	}
 }
-func TestLinuxCopyScopeAndNoOverwrite(t *testing.T) {
-	root := t.TempDir()
-	out := t.TempDir()
-	src, err := os.CreateTemp(t.TempDir(), "source")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer src.Close()
-	src.WriteString("content")
-	src.Seek(0, 0)
-	pinned, _ := os.Open(root)
-	defer pinned.Close()
-	if err = copyDestination(src, root, "new", root, ".synopkgland-job1-test.part", pinned); err != nil {
-		t.Fatal(err)
-	}
-	src.Seek(0, 0)
-	if err = copyDestination(src, root, "new", root, ".synopkgland-job1-test.part", pinned); err == nil {
-		t.Fatal("overwrite")
-	}
-	b, _ := os.ReadFile(filepath.Join(root, "new"))
-	if string(b) != "content" {
-		t.Fatal(string(b))
-	}
-	os.Symlink(out, filepath.Join(root, "escape"))
-	src.Seek(0, 0)
-	if err = copyDestination(src, filepath.Join(root, "escape"), "new", root, ".synopkgland-job1-test.part", pinned); err == nil {
-		t.Fatal("escape")
-	}
-	if _, err = os.Stat(filepath.Join(out, "new")); !os.IsNotExist(err) {
-		t.Fatal(err)
-	}
-	for _, name := range []string{"..", "../a", "a/b", "a\x00b", "a\nb"} {
-		if copyDestination(src, root, name, root, ".synopkgland-job1-test.part", pinned) == nil {
-			t.Fatal(name)
-		}
-	}
-}
 func TestLinuxPeerCredential(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "sock")
 	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: path, Net: "unix"})
@@ -224,24 +189,3 @@ func TestScriptTimeoutAndOutputLimit(t *testing.T) {
 		t.Fatal("excessive output accepted")
 	}
 }
-
-func TestLinuxCopyFailureNeverPublishesPartialDestination(t *testing.T) {
-	root := t.TempDir()
-	pinned, err := os.Open(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer pinned.Close()
-	src, err := os.CreateTemp(t.TempDir(), "source")
-	if err != nil {
-		t.Fatal(err)
-	}
-	src.Close()
-	if err = copyDestination(src, root, "final", root, ".synopkgland-job1-failed.part", pinned); err == nil {
-		t.Fatal("closed source succeeded")
-	}
-	entries, err := os.ReadDir(root)
-	if err != nil || len(entries) != 0 {
-		t.Fatal("failure published or leaked bytes", entries, err)
-	}
-}

package/templates/_executor/platform_other.go

@@ -8,6 +8,8 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"strings"
+	"syscall"
 )
 
 func verifySocket(string, int, int, os.FileMode) error { return errLinux }
@@ -29,14 +31,38 @@ func openRegular(path string) (*os.File, error) {
 }
 
 type subprocessWriter struct {
-	Staging, Executable string
-	PackageUID          int
+	Staging, Executable    string
+	PackageUID, PackageGID int
 }
 
 func (subprocessWriter) Write(context.Context, Subject, string, string, string, string) error {
 	return errLinux
 }
-func writeChild() error       { return errLinux }
 func lockFile(*os.File) error { return errLinux }
 
-func runWriteChild(bool) error { return errLinux }
+func bindDirectory(path string) (directoryIdentity, error) {
+	current := ""
+	for _, part := range strings.Split(strings.TrimPrefix(path, "/"), "/") {
+		current += "/" + part
+		info, err := os.Lstat(current)
+		if err != nil {
+			return directoryIdentity{}, err
+		}
+		if !info.IsDir() {
+			return directoryIdentity{}, errLinux
+		}
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		return directoryIdentity{}, err
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || !info.IsDir() {
+		return directoryIdentity{}, errLinux
+	}
+	return directoryIdentity{uint64(st.Dev), st.Ino}, nil
+}
+
+func runMoveChild() error          { return errLinux }
+func runPartCleanupChild() error   { return errLinux }
+func runSourceCleanupChild() error { return errLinux }

package/templates/_executor/process.go

@@ -47,6 +47,9 @@ func (processCommand) Exec(ctx context.Context, path string, args []string) ([]b
 	cmd.Stdout = &out
 	cmd.Stderr = io.Discard
 	if err := cmd.Run(); err != nil {
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
 		return nil, err
 	}
 	return out.buf.Bytes(), nil

package/templates/_executor/records.go

@@ -0,0 +1,242 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const maxJournalBytes int64 = 10 << 20
+const maxAuditBytes int64 = 50 << 20
+const maxMoveBytes int64 = 16 << 30
+const maxQueued = 16
+
+type directoryIdentity struct {
+	Device uint64 `json:"dev"`
+	Inode  uint64 `json:"ino"`
+}
+type Operation struct {
+	Version       int           `json:"v"`
+	Package       string        `json:"package"`
+	ID            string        `json:"delegation_id"`
+	Job           string        `json:"job_id"`
+	Subject       Subject       `json:"subject"`
+	Staging       string        `json:"staging"`
+	Name          string        `json:"name"`
+	Size          int64         `json:"size"`
+	State         string        `json:"state"`
+	Path          string        `json:"path,omitempty"`
+	Code          string        `json:"code,omitempty"`
+	Reason        string        `json:"reason,omitempty"`
+	Part          *partMetadata `json:"part,omitempty"`
+	PublishIntent bool          `json:"publish_intent,omitempty"`
+	// CancelRequested durably keeps an acknowledged cancel of a copy in flight.
+	CancelRequested string    `json:"cancel_requested,omitempty"`
+	Updated         time.Time `json:"updated_at"`
+}
+
+// canceledBeforeAdmission marks the tombstone of a cancel that found no
+// operation; admitted operations always carry their staging name.
+func (op Operation) canceledBeforeAdmission() bool {
+	return op.State == "canceled" && op.Staging == ""
+}
+
+type MoveReceipt struct {
+	Path           string `json:"path,omitempty"`
+	CleanupPending bool   `json:"cleanup_pending,omitempty"`
+}
+type AuditEvent struct {
+	At        time.Time `json:"at"`
+	Package   string    `json:"package"`
+	Username  string    `json:"username"`
+	UID       int       `json:"uid"`
+	Operation string    `json:"operation"`
+	Job       string    `json:"job_id,omitempty"`
+	Path      string    `json:"path,omitempty"`
+	Result    string    `json:"result"`
+}
+
+func recordKey(job string) string { h := sha256.Sum256([]byte(job)); return hex.EncodeToString(h[:]) }
+func (s *Store) atomic(name string, b []byte) error {
+	f, err := os.CreateTemp(s.Dir, ".record-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(f.Name())
+	defer f.Close()
+	if err = f.Chmod(0600); err != nil {
+		return err
+	}
+	if _, err = f.Write(b); err != nil {
+		return err
+	}
+	if err = f.Sync(); err != nil {
+		return err
+	}
+	if err = f.Close(); err != nil {
+		return err
+	}
+	if err = os.Rename(f.Name(), filepath.Join(s.Dir, name)); err != nil {
+		return err
+	}
+	dir, err := os.Open(s.Dir)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	return dir.Sync()
+}
+func (s *Store) record(name string, v any) error {
+	info, err := os.Lstat(filepath.Join(s.Dir, name))
+	if err != nil {
+		return err
+	}
+	if !info.Mode().IsRegular() || info.Mode().Perm() != 0600 || info.Size() > maxRequest {
+		return errors.New("record mode")
+	}
+	b, err := os.ReadFile(filepath.Join(s.Dir, name))
+	if err != nil {
+		return err
+	}
+	return strictJSON(b, v)
+}
+func (s *Store) Disabled() (bool, error) {
+	var b struct {
+		Disabled bool `json:"disabled"`
+	}
+	err := s.record("disabled.record", &b)
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+	return b.Disabled, err
+}
+func (s *Store) SetDisabled(disabled bool) error {
+	b, _ := json.Marshal(map[string]bool{"disabled": disabled})
+	return s.atomic("disabled.record", b)
+}
+func (s *Store) PutOperation(op Operation) error {
+	if op.Version != 1 || !tokenRE.MatchString(op.Job) || !idRE.MatchString(op.ID) || !validState(op.State) {
+		return errors.New("operation")
+	}
+	b, err := json.Marshal(op)
+	if err != nil || len(b) > maxRequest {
+		return errors.New("operation size")
+	}
+	entries, err := os.ReadDir(s.Dir)
+	if err != nil {
+		return err
+	}
+	var total int64
+	name := "operation-" + recordKey(op.Job) + ".record"
+	for _, ent := range entries {
+		if strings.HasPrefix(ent.Name(), "operation-") && ent.Name() != name {
+			info, err := ent.Info()
+			if err != nil {
+				return err
+			}
+			total += info.Size()
+		}
+	}
+	if total+int64(len(b)) > maxJournalBytes {
+		return errors.New("journal full")
+	}
+	return s.atomic(name, b)
+}
+func validState(state string) bool {
+	return contains([]string{"queued", "copying", "committed", "canceled", "interrupted", "uncertain"}, state)
+}
+func (s *Store) GetOperation(job string) (Operation, error) {
+	var op Operation
+	if !tokenRE.MatchString(job) {
+		return op, errors.New("job")
+	}
+	err := s.record("operation-"+recordKey(job)+".record", &op)
+	if err != nil {
+		return op, err
+	}
+	if op.Version != 1 || op.Job != job || !idRE.MatchString(op.ID) || !validState(op.State) {
+		return op, errors.New("operation schema")
+	}
+	return op, nil
+}
+func (s *Store) Operations() ([]Operation, error) {
+	entries, err := os.ReadDir(s.Dir)
+	if err != nil {
+		return nil, err
+	}
+	out := []Operation{}
+	for _, ent := range entries {
+		if !strings.HasPrefix(ent.Name(), "operation-") || !strings.HasSuffix(ent.Name(), ".record") {
+			continue
+		}
+		var op Operation
+		if err = s.record(ent.Name(), &op); err != nil {
+			return nil, err
+		}
+		if ent.Name() != "operation-"+recordKey(op.Job)+".record" || op.Version != 1 || !validState(op.State) || !idRE.MatchString(op.ID) {
+			return nil, errors.New("operation schema")
+		}
+		out = append(out, op)
+	}
+	return out, nil
+}
+func (s *Store) Audit(event AuditEvent) error {
+	path := filepath.Join(s.Dir, "audit.jsonl")
+	b, err := json.Marshal(event)
+	if err != nil {
+		return err
+	}
+	b = append(b, '\n')
+	info, err := os.Lstat(path)
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if err == nil {
+		if !info.Mode().IsRegular() || info.Mode().Perm() != 0600 {
+			return errors.New("audit mode")
+		}
+		if info.Size()+int64(len(b)) > maxAuditBytes/2 {
+			if err = os.Rename(path, filepath.Join(s.Dir, "audit.previous")); err != nil {
+				return err
+			}
+		}
+	}
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if _, err = f.Write(b); err != nil {
+		return err
+	}
+	if err = f.Sync(); err != nil {
+		return err
+	}
+	dir, err := os.Open(s.Dir)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	return dir.Sync()
+}
+func (e *Executor) auditLocked(s Subject, operation, job, path, result string) error {
+	return e.Store.Audit(AuditEvent{At: e.Now().UTC(), Package: e.Policy.Package, Username: s.Username, UID: s.UID, Operation: operation, Job: job, Path: path, Result: result})
+}
+
+type partMetadata struct {
+	Temporary   string            `json:"temporary"`
+	Directory   directoryIdentity `json:"directory"`
+	Part        directoryIdentity `json:"part"`
+	Destination string            `json:"destination"`
+}
+type partRecordKey struct{}
+type legacyPublishKey struct{}
+
+type publishRejectedError struct{ Code string }
+
+func (e publishRejectedError) Error() string { return e.Code }