@synopackageland/cli 0.6.0 → 0.7.0

package/templates/_executor/scope_cancel_contract_test.go

@@ -0,0 +1,91 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+// killedChildWriter models the subprocess writer: its child dies with the
+// context and the copy ends with a transport error, before any publish guard.
+type killedChildWriter struct{ copying chan struct{} }
+
+func (w killedChildWriter) Write(context.Context, Subject, string, string, string, string) error {
+	return nil
+}
+func (w killedChildWriter) Move(ctx context.Context, _ Subject, _ Operation, _ Delegation, _ func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
+	close(w.copying)
+	<-ctx.Done()
+	return MoveReceipt{}, errors.New("child copy")
+}
+
+func TestStopDuringCopySettlesExecutorPausedNotWriteFailed(t *testing.T) {
+	e, _, _ := setup(t)
+	id := longGrant(t, e)
+	w := killedChildWriter{copying: make(chan struct{})}
+	e.Writer = w
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if r := offline(e, "files.moveFromStaging", moveParams(id, "job")); !r.OK {
+		t.Fatal(r)
+	}
+	<-w.copying
+	e.stopOperations()
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer e.stopOperations()
+	// An executor stop is not an I/O failure of the destination.
+	wantOperation(t, offline(e, "files.operationStatus", map[string]any{"delegation_id": id, "job_id": "job"}), "interrupted", "EXECUTOR_PAUSED", "")
+}
+
+func TestScopeChangeCancelsCopyDurablyAcrossStop(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	d := selectedGrant(t, e, "/home")
+	w := newStubbornWriter()
+	e.Writer = w
+	startedCopy(t, e, w, d.ID, "job")
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	ref := map[string]any{"delegation_id": d.ID, "job_id": "job"}
+	wantOperation(t, offline(e, "files.operationStatus", ref), "copying", "CANCEL_REQUESTED", "scope-changed")
+	stopped := make(chan struct{})
+	go func() { e.stopOperations(); close(stopped) }()
+	w.let()
+	<-stopped
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer e.stopOperations()
+	wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "scope-changed")
+	select {
+	case <-w.published:
+		t.Fatal("published to a revoked destination")
+	default:
+	}
+}
+
+func TestScopeChangeCancelRecordedBeforeCrashSettlesCanceled(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	d := selectedGrant(t, e, "/home")
+	w := newStubbornWriter()
+	e.Writer = w
+	startedCopy(t, e, w, d.ID, "job")
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	e.commitMu.Lock()
+	op, err := e.Store.GetOperation("job")
+	e.commitMu.Unlock()
+	if err != nil || op.CancelRequested != "scope-changed" {
+		t.Fatal("scope cancellation not durable before the writer stops", op, err)
+	}
+}

package/templates/_executor/scope_client.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"errors"
+	"net"
+	"path/filepath"
+	"time"
+)
+
+// This command runs from the protected, pinned binary via the DSM root task.
+// It asks the live executor to serialize selection with admission and publish;
+// a second process must never write the authority file around that fence.
+func rootSelectScope(pkg, scope, actor string, expectedGeneration uint64) error {
+	c, err := net.DialTimeout("unix", filepath.Join(socketBase, pkg, "executor.sock"), 5*time.Second)
+	if err != nil {
+		return errors.New("scope executor unavailable")
+	}
+	defer c.Close()
+	if err = c.SetDeadline(time.Now().Add(30 * time.Second)); err != nil {
+		return err
+	}
+	if err = json.NewEncoder(c).Encode(map[string]any{"v": 1, "op": "delegate.setScope", "auth": map[string]string{}, "params": map[string]any{"scope": scope, "actor": actor, "expected_generation": expectedGeneration}}); err != nil {
+		return err
+	}
+	scan := bufio.NewScanner(c)
+	scan.Buffer(make([]byte, 4096), maxRequest)
+	if !scan.Scan() {
+		return errors.New("scope response unavailable")
+	}
+	var out Response
+	if strictJSON(scan.Bytes(), &out) != nil || !out.OK {
+		return errors.New("scope selection refused")
+	}
+	return nil
+}

package/templates/_executor/scope_contract.go

@@ -0,0 +1,12 @@
+package main
+
+// The immutable policy opts into administrator-selected scope. Only the
+// password-confirmed root task may populate the protected runtime selection.
+const installSelectedScope = "install-selected"
+const maxScopeGeneration = uint64(1<<53 - 1)
+
+type SelectedScope struct {
+	Schema     int    `json:"schema"`
+	Scope      string `json:"scope"`
+	Generation uint64 `json:"generation"`
+}

package/templates/_executor/selected_scope.go

@@ -0,0 +1,146 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"strings"
+)
+
+func validSelectedScope(scope string) bool {
+	if scope == "home" {
+		return true
+	}
+	if !strings.HasPrefix(scope, "shared:") {
+		return false
+	}
+	name := strings.TrimPrefix(scope, "shared:")
+	return validName(name) && name != "." && strings.TrimSpace(name) == name && !strings.ContainsAny(name, "\\:%") && !strings.EqualFold(name, "home") && !strings.EqualFold(name, "homes")
+}
+func (s *Store) SelectedScope() (SelectedScope, error) {
+	var out SelectedScope
+	if err := s.record("selected-scope.record", &out); err != nil {
+		return out, err
+	}
+	if out.Schema != 1 || !validSelectedScope(out.Scope) || out.Generation == 0 || out.Generation > maxScopeGeneration {
+		return SelectedScope{}, errors.New("selected scope state")
+	}
+	return out, nil
+}
+
+// Caller holds commitMu; root selection and publish share the same fence.
+func (e *Executor) selectionLocked() (SelectedScope, string) {
+	if e.Policy.Scope != installSelectedScope {
+		return SelectedScope{Schema: 1, Scope: e.Policy.Scope}, ""
+	}
+	state, err := e.Store.SelectedScope()
+	if os.IsNotExist(err) {
+		return SelectedScope{}, "needs-scope-confirmation"
+	}
+	if err != nil {
+		return SelectedScope{}, "STORAGE_ERROR"
+	}
+	return state, ""
+}
+func (e *Executor) selection() (SelectedScope, string) {
+	e.commitMu.Lock()
+	defer e.commitMu.Unlock()
+	return e.selectionLocked()
+}
+func (e *Executor) scopeMatchesLocked(d Delegation) bool {
+	state, code := e.selectionLocked()
+	return code == "" && state.Scope == d.Scope && state.Generation == d.ScopeGeneration
+}
+func (e *Executor) scopeMatches(d Delegation) bool {
+	e.commitMu.Lock()
+	defer e.commitMu.Unlock()
+	return e.scopeMatchesLocked(d)
+}
+
+// Only a kernel-verified root peer can reach this operation. It is absent from
+// the public wire allowlist, even when a package supplies an administrator SID.
+func (e *Executor) handlePeer(ctx context.Context, r Request, peerUID, packageUID int) Response {
+	if peerUID == 0 && r.Op == "delegate.setScope" {
+		if r.Version != 1 || r.Auth.hasKeys || r.Auth.Cookie != "" || r.Auth.SynoToken != "" {
+			return deny("INVALID_REQUEST")
+		}
+		return e.setSelectedScope(ctx, r.Params)
+	}
+	if peerUID != packageUID {
+		return deny("PEER_DENIED")
+	}
+	return e.Handle(ctx, r)
+}
+func (e *Executor) setSelectedScope(ctx context.Context, raw json.RawMessage) Response {
+	if ctx.Err() != nil {
+		return deny("EXECUTOR_PAUSED")
+	}
+	if e.Policy.Scope != installSelectedScope || e.Policy.Lifetime != "until-revoked" {
+		return deny("POLICY_DENIED")
+	}
+	var in struct {
+		Scope              string  `json:"scope"`
+		Actor              string  `json:"actor"`
+		ExpectedGeneration *uint64 `json:"expected_generation"`
+	}
+	if strictJSON(raw, &in) != nil || !validSelectedScope(in.Scope) || in.Actor == "" || in.ExpectedGeneration == nil || *in.ExpectedGeneration > maxScopeGeneration {
+		return deny("INVALID_REQUEST")
+	}
+	actor, err := e.DSM.Account(ctx, in.Actor)
+	if err != nil || actor.Username != in.Actor || !actor.Admin || actor.Expired != "normal" || actor.UID < 1024 {
+		return deny("ADMIN_REQUIRED")
+	}
+	if e.DSM.Allow(ctx, actor, e.Policy.App, e.Policy.Entry) != nil {
+		return deny("APP_DENIED")
+	}
+	// Scope selection grants no data permission. Resolve existence only; each
+	// destination and subsequent write still checks its owner's current ACL/UID.
+	if in.Scope != "home" {
+		if _, err = e.DSM.ScopeRoot(ctx, actor, in.Scope); err != nil {
+			return deny("SCOPE_DENIED")
+		}
+	}
+	e.commitMu.Lock()
+	defer e.commitMu.Unlock()
+	old, err := e.Store.SelectedScope()
+	if err != nil && !os.IsNotExist(err) {
+		return deny("STORAGE_ERROR")
+	}
+	if old.Generation != *in.ExpectedGeneration {
+		return deny("SCOPE_APPROVAL_STALE")
+	}
+	if err == nil && old.Scope == in.Scope {
+		return success(old)
+	}
+	if old.Generation >= maxScopeGeneration {
+		return deny("STORAGE_ERROR")
+	}
+	next := SelectedScope{Schema: 1, Scope: in.Scope, Generation: old.Generation + 1}
+	if e.auditLocked(actor, "delegate.scope.confirm", "", scopeVirtual(in.Scope), "admitting") != nil {
+		return deny("STORAGE_ERROR")
+	}
+	b, _ := json.Marshal(next)
+	if e.Store.atomic("selected-scope.record", b) != nil {
+		return deny("STORAGE_ERROR")
+	}
+	// New generation is already authoritative if cleanup fails. Old grants fail
+	// admission/publish before acknowledgement, and switching back cannot revive them.
+	grants, err := e.Store.List()
+	if err != nil {
+		return deny("STORAGE_ERROR")
+	}
+	for _, d := range grants {
+		if d.Package == e.Policy.Package && !d.Revoked {
+			d.Revoked = true
+			if e.Store.Put(d) != nil {
+				return deny("STORAGE_ERROR")
+			}
+			e.cancelGrantLocked(d.ID, "scope-changed")
+		}
+	}
+	if e.auditLocked(actor, "delegate.scope.confirm", "", scopeVirtual(in.Scope), "confirmed") != nil {
+		return deny("STORAGE_ERROR")
+	}
+	return success(next)
+}

package/templates/_executor/selected_scope_test.go

@@ -0,0 +1,186 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func selectedExecutor(t *testing.T) (*Executor, *fakeDSM) {
+	e, f, _ := setup(t)
+	e.Policy.Scope = installSelectedScope
+	e.Policy.Lifetime = "until-revoked"
+	e.Policy.Destinations = []string{"save"}
+	f.user.Admin = true
+	return e, f
+}
+func selectScope(e *Executor, scope string, peer int) Response {
+	state, _ := e.Store.SelectedScope()
+	b, _ := json.Marshal(map[string]any{"scope": scope, "actor": "alice", "expected_generation": state.Generation})
+	return e.handlePeer(context.Background(), Request{Version: 1, Op: "delegate.setScope", Params: b}, peer, 3000)
+}
+func selectedGrant(t *testing.T, e *Executor, path string) Delegation {
+	t.Helper()
+	r := request(e, "delegate.create", map[string]any{"scope": installSelectedScope, "ops": []string{"files.moveFromStaging"}, "path": path, "destination": "save", "lifetime": "until-revoked"})
+	if !r.OK {
+		t.Fatal(r)
+	}
+	b, _ := json.Marshal(r.Result)
+	var d Delegation
+	json.Unmarshal(b, &d)
+	return d
+}
+func TestSelectedScopeOnlyPasswordConfirmedRootPeerMayChange(t *testing.T) {
+	e, f := selectedExecutor(t)
+	if r := selectScope(e, "shared:reports", 3000); r.OK {
+		t.Fatal("package changed scope", r)
+	}
+	if r := selectScope(e, "shared:reports", 3001); r.OK {
+		t.Fatal("other peer changed scope", r)
+	}
+	f.user.Admin = false
+	if r := selectScope(e, "shared:reports", 0); r.OK {
+		t.Fatal("nonadministrator actor", r)
+	}
+	f.user.Admin = true
+	for _, params := range []string{`{"scope":"home","actor":"alice"}`, `{"scope":"home","actor":"alice","expected_generation":null}`, `{"scope":"home","actor":"alice","expected_generation":9007199254740992}`} {
+		if r := e.handlePeer(context.Background(), Request{Version: 1, Op: "delegate.setScope", Params: json.RawMessage(params)}, 0, 3000); r.OK {
+			t.Fatal("unbound root task accepted", r)
+		}
+	}
+	for _, scope := range []string{"*", "shared:../escape", "shared:homes", "shared:home", "shared:", "home\n", "shared:a:b"} {
+		if r := selectScope(e, scope, 0); r.OK {
+			t.Fatal(scope, r)
+		}
+	}
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	state, err := e.Store.SelectedScope()
+	if err != nil || state.Scope != "shared:reports" || state.Generation != 1 {
+		t.Fatal(state, err)
+	}
+	info, _ := os.Stat(filepath.Join(e.Store.Dir, "selected-scope.record"))
+	if info.Mode().Perm() != 0600 {
+		t.Fatal(info.Mode())
+	}
+	// No admin cookie/SynoToken can turn the ordinary package socket into root authority.
+	if r := request(e, "delegate.setScope", map[string]string{"scope": "home"}); r.OK {
+		t.Fatal(r)
+	}
+}
+func TestSelectedScopeMissingCorruptAndChangeBackFailClosed(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	p := map[string]any{"scope": installSelectedScope, "ops": []string{"files.moveFromStaging"}, "path": "/home", "destination": "save", "lifetime": "until-revoked"}
+	if r := request(e, "delegate.create", p); r.OK {
+		t.Fatal("unconfirmed scope", r)
+	}
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	d := selectedGrant(t, e, "/home")
+	if d.Scope != "home" || d.ScopeGeneration != 1 {
+		t.Fatal(d)
+	}
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	state, _ := e.Store.SelectedScope()
+	if state.Generation != 1 {
+		t.Fatal("unchanged scope invalidates", state)
+	}
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	if r := request(e, "delegate.create", p); r.Code != "SCOPE_DENIED" {
+		t.Fatal("outside chosen share", r)
+	}
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	if _, code := e.validateMove(context.Background(), d); code == "" {
+		t.Fatal("change-back revived old grant")
+	}
+	fresh := &Executor{Policy: e.Policy, DSM: e.DSM, Store: &Store{Dir: e.Store.Dir}, Now: e.Now}
+	if _, code := fresh.validateMove(context.Background(), d); code == "" {
+		t.Fatal("restart revived old grant")
+	}
+	d = selectedGrant(t, e, "/home")
+	if d.ScopeGeneration != 3 {
+		t.Fatal(d)
+	}
+	os.WriteFile(filepath.Join(e.Store.Dir, "selected-scope.record"), []byte(`{"schema":1,"scope":"home","generation":0}`), 0600)
+	if r := request(e, "delegate.create", p); r.OK {
+		t.Fatal("corrupt scope allowed", r)
+	}
+	if _, code := e.validateMove(context.Background(), d); code == "" {
+		t.Fatal("corrupt state allowed move")
+	}
+}
+func TestSelectedScopeChangeFencesActivePublish(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	d := selectedGrant(t, e, "/home")
+	w := &barrierMoveWriter{copying: make(chan struct{}), release: make(chan struct{}), published: make(chan struct{})}
+	e.Writer = w
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer e.stopOperations()
+	if r := offline(e, "files.moveFromStaging", moveParams(d.ID, "scope-race")); !r.OK {
+		t.Fatal(r)
+	}
+	<-w.copying
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	close(w.release)
+	if op := waitState(t, e, "scope-race", "canceled"); op.Reason != "scope-changed" {
+		t.Fatal("missing scope cancellation reason", op)
+	}
+	select {
+	case <-w.published:
+		t.Fatal("published after scope change acknowledgement")
+	default:
+	}
+}
+
+func TestSelectedDestinationReplacesOnlyThisOwnerAndKey(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	old := selectedGrant(t, e, "/home")
+	fresh := selectedGrant(t, e, "/home")
+	prior, err := e.Store.Get(old.ID)
+	if err != nil || !prior.Revoked {
+		t.Fatal("prior destination still active", prior, err)
+	}
+	current, err := e.Store.Get(fresh.ID)
+	if err != nil || current.Revoked {
+		t.Fatal(current, err)
+	}
+}
+
+func TestSelectedScopeTaskCannotReplayAfterAnotherConfirmation(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	b, _ := json.Marshal(map[string]any{"scope": "home", "actor": "alice", "expected_generation": uint64(0)})
+	old := Request{Version: 1, Op: "delegate.setScope", Params: b}
+	if r := e.handlePeer(context.Background(), old, 0, 3000); !r.OK {
+		t.Fatal(r)
+	}
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	if r := e.handlePeer(context.Background(), old, 0, 3000); r.Code != "SCOPE_APPROVAL_STALE" {
+		t.Fatal("old root task widened the newly confirmed scope", r)
+	}
+	state, err := e.Store.SelectedScope()
+	if err != nil || state.Scope != "shared:reports" || state.Generation != 2 {
+		t.Fatal(state, err)
+	}
+}

package/templates/_executor/status_disabled_test.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestStatusReadsProtectedDisabledAndRefusesStoreError(t *testing.T) {
+	e, _, _ := setup(t)
+	check := func(ready, disabled bool) {
+		t.Helper()
+		r := request(e, "status", map[string]any{})
+		b, _ := json.Marshal(r.Result)
+		var out struct {
+			Ready    bool  `json:"ready"`
+			Disabled *bool `json:"disabled"`
+		}
+		if !r.OK || json.Unmarshal(b, &out) != nil || out.Ready != ready || out.Disabled == nil || *out.Disabled != disabled {
+			t.Fatalf("status: %s", b)
+		}
+	}
+	check(true, false)
+	if err := e.Store.SetDisabled(true); err != nil {
+		t.Fatal(err)
+	}
+	check(true, true)
+	if err := os.WriteFile(filepath.Join(e.Store.Dir, "disabled.record"), []byte("broken"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	check(false, false)
+}

package/templates/_executor/store.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 )
 
 // Dir and its ancestors are validated root-owned at service startup. No client
@@ -16,8 +17,8 @@ func (s *Store) Put(d Delegation) error {
 		return errors.New("id")
 	}
 	b, err := json.Marshal(d)
-	if err != nil {
-		return err
+	if err != nil || len(b) > maxRequest {
+		return errors.New("grant size")
 	}
 	f, err := os.CreateTemp(s.Dir, ".delegation-")
 	if err != nil {
@@ -77,7 +78,7 @@ func (s *Store) List() ([]Delegation, error) {
 	}
 	ds := []Delegation{}
 	for _, ent := range entries {
-		if filepath.Ext(ent.Name()) != ".json" {
+		if filepath.Ext(ent.Name()) != ".json" || !idRE.MatchString(strings.TrimSuffix(ent.Name(), ".json")) {
 			continue
 		}
 		d, err := s.Get(ent.Name()[:len(ent.Name())-5])

package/templates/_executor/supervise.go

@@ -0,0 +1,109 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"os/signal"
+	"syscall"
+	"time"
+)
+
+// serve exits with this status when another monitor holds executor.pid; the
+// flock, not the supervisor, decides which monitor survives.
+const exitAlreadyRunning = 3
+
+var errAlreadyRunning = errors.New("already running")
+
+func exitStatus(err error) int {
+	if errors.Is(err, errAlreadyRunning) {
+		return exitAlreadyRunning
+	}
+	return 1
+}
+
+const (
+	minRestartDelay = time.Second
+	maxRestartDelay = time.Minute
+	stableServeRun  = time.Minute
+)
+
+// supervise reruns the approved serve after an abnormal end. A clean exit
+// (root replacement, shutdown or purge), another live monitor, termination of
+// the supervisor or a purged runtime all end supervision instead.
+func supervise(ctx context.Context, run func(ctx context.Context, revived bool) error, runtimePresent func() bool, sleep func(context.Context, time.Duration) bool, now func() time.Time, log func(string)) error {
+	delay := minRestartDelay
+	revived := false
+	for {
+		started := now()
+		err := run(ctx, revived)
+		if err == nil || ctx.Err() != nil {
+			return nil
+		}
+		var exit *exec.ExitError
+		if errors.As(err, &exit) && exit.ExitCode() == exitAlreadyRunning {
+			log("executor supervisor: another monitor is running")
+			return nil
+		}
+		if now().Sub(started) >= stableServeRun {
+			delay = minRestartDelay
+		}
+		if !runtimePresent() {
+			log("executor supervisor: runtime removed")
+			return nil
+		}
+		log(fmt.Sprintf("executor supervisor: serve ended (%v); restarting in %s", err, delay))
+		if !sleep(ctx, delay) || !runtimePresent() {
+			return nil
+		}
+		delay = min(2*delay, maxRestartDelay)
+		revived = true
+	}
+}
+
+func serveArgs(pkg string, revived bool) []string {
+	args := []string{"serve", "--package", pkg}
+	if revived {
+		args = append(args, "--revived")
+	}
+	return args
+}
+
+// Root control start launches the supervisor in its own session; serve runs as
+// its child and still owns executor.pid for root stop/purge/replacement.
+func supervisorCommand(exe, pkg string) *exec.Cmd {
+	cmd := exec.Command(exe, "supervise", "--package", pkg)
+	cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
+	cmd.Dir = "/"
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	return cmd
+}
+
+func runSupervisor(exe, pkg string) error {
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+	run := func(ctx context.Context, revived bool) error {
+		cmd := exec.CommandContext(ctx, exe, serveArgs(pkg, revived)...)
+		cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
+		cmd.Dir = "/"
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		cmd.Cancel = func() error { return cmd.Process.Signal(syscall.SIGTERM) }
+		return cmd.Run()
+	}
+	present := func() bool { _, err := os.Lstat(exe); return err == nil }
+	sleep := func(ctx context.Context, d time.Duration) bool {
+		t := time.NewTimer(d)
+		defer t.Stop()
+		select {
+		case <-ctx.Done():
+			return false
+		case <-t.C:
+			return true
+		}
+	}
+	return supervise(ctx, run, present, sleep, time.Now, func(s string) { log.Print(s) })
+}