@synopackageland/cli 0.6.1 → 0.7.0

package/templates/_executor/anchor.go

@@ -0,0 +1,146 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"syscall"
+)
+
+// Package Center writes the SPK INFO as root. The package account cannot change
+// it, so its executor digest authorizes executor-only upgrades under the
+// administrator-approved policy without a new PasswordConfirm.
+const executorAnchorKey = "synopkgland_executor_sha256"
+
+var anchorRE = regexp.MustCompile(`^"([a-f0-9]{64})"$`)
+
+type pinState int
+
+const (
+	pinsDiffer pinState = iota
+	pinsMatch
+	pinsAnchored
+)
+
+func executorAnchor(info string, trusted func(os.FileInfo) bool) (string, error) {
+	b, stat, err := readLifecycleFile(info, 65536)
+	if err != nil {
+		return "", err
+	}
+	if !trusted(stat) {
+		return "", errors.New("untrusted package INFO")
+	}
+	anchor := ""
+	for _, line := range strings.Split(string(b), "\n") {
+		value, ok := strings.CutPrefix(line, executorAnchorKey+"=")
+		if !ok {
+			continue
+		}
+		m := anchorRE.FindStringSubmatch(value)
+		if m == nil || anchor != "" {
+			return "", errors.New("executor anchor")
+		}
+		anchor = m[1]
+	}
+	if anchor == "" {
+		return "", errors.New("executor anchor")
+	}
+	return anchor, nil
+}
+
+func rootOwnedReadOnly(info os.FileInfo) bool {
+	return ownedByRoot(info) && info.Mode().Perm()&0022 == 0
+}
+
+func packagePins(ctx context.Context, dir, info string, trusted func(os.FileInfo) bool, executorDigest, policyDigest string) pinState {
+	if samePackagePins(ctx, dir, executorDigest, policyDigest) {
+		return pinsMatch
+	}
+	dir, err := filepath.EvalSymlinks(dir)
+	if err != nil {
+		return pinsDiffer
+	}
+	if pd, err := digestFile(ctx, dir+"/policy.json", maxPolicyBytes); err != nil || pd != policyDigest {
+		return pinsDiffer
+	}
+	anchor, err := executorAnchor(info, trusted)
+	if err != nil {
+		return pinsDiffer
+	}
+	if ed, err := digestFile(ctx, dir+"/executor", maxExecutorBytes); err != nil || ed != anchor {
+		return pinsDiffer
+	}
+	return pinsAnchored
+}
+
+// The policy is unchanged, so root scripts (pinned by policy digests) stay too.
+// Verify the protected copy, never the package-reachable source.
+func installAnchored(ctx context.Context, source, info string, trusted func(os.FileInfo) bool, runtime string) error {
+	anchor, err := executorAnchor(info, trusted)
+	if err != nil {
+		return err
+	}
+	src, err := openRegular(filepath.Join(source, "executor"))
+	if err != nil {
+		return err
+	}
+	defer src.Close()
+	stat, err := src.Stat()
+	if err != nil || stat.Size() > maxExecutorBytes {
+		return errors.New("executor size")
+	}
+	staged, err := os.CreateTemp(runtime, ".executor-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(staged.Name())
+	err = copyExact(staged, src, stat.Size())
+	if err == nil {
+		err = staged.Chmod(0700)
+	}
+	if err == nil {
+		err = staged.Sync()
+	}
+	if closeErr := staged.Close(); err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return err
+	}
+	if digest, err := digestFile(ctx, staged.Name(), maxExecutorBytes); err != nil || digest != anchor {
+		return errors.New("executor anchor mismatch")
+	}
+	return os.Rename(staged.Name(), filepath.Join(runtime, "executor"))
+}
+
+// Root control start replaces this monitor with the newly installed runtime.
+func startInstalled(runtime, pkg string) error {
+	cmd := exec.Command(filepath.Join(runtime, "executor"), "control", "start", "--package", pkg)
+	cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
+	cmd.Dir = "/"
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	return cmd.Process.Release()
+}
+
+func approvedPins(state pinState, install, start func() error, log func(string)) bool {
+	if state != pinsAnchored {
+		return state == pinsMatch
+	}
+	if err := install(); err != nil {
+		log("executor upgrade refused: INFO-anchored executor could not be installed")
+		return false
+	}
+	if err := start(); err != nil {
+		log("executor upgrade installed; root start failed")
+		return false
+	}
+	log("executor upgrade: INFO-anchored executor installed under the approved policy")
+	return false
+}

package/templates/_executor/anchor_test.go

@@ -0,0 +1,126 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func trustAll(os.FileInfo) bool { return true }
+
+// anchoredPackage writes a target executor/policy pair and the package INFO.
+func anchoredPackage(t *testing.T, executor, policy string, anchors ...string) (target, info string) {
+	t.Helper()
+	pkg := realTestPath(t, t.TempDir())
+	target = filepath.Join(pkg, "target", "executor")
+	os.MkdirAll(target, 0755)
+	os.WriteFile(filepath.Join(target, "executor"), []byte(executor), 0755)
+	os.WriteFile(filepath.Join(target, "policy.json"), []byte(policy), 0644)
+	text := "package=\"TestApp\"\n"
+	for _, a := range anchors {
+		text += "synopkgland_executor_sha256=\"" + a + "\"\n"
+	}
+	info = filepath.Join(pkg, "INFO")
+	os.WriteFile(info, []byte(text), 0644)
+	return target, info
+}
+
+func TestExecutorAnchorRequiresOneLowercaseDigestInTrustedINFO(t *testing.T) {
+	digest := hashBytes([]byte("new executor"))
+	_, info := anchoredPackage(t, "new executor", "policy", digest)
+	if got, err := executorAnchor(info, trustAll); err != nil || got != digest {
+		t.Fatal("anchor", got, err)
+	}
+	if _, err := executorAnchor(info, func(os.FileInfo) bool { return false }); err == nil {
+		t.Fatal("package-writable INFO accepted")
+	}
+	for name, anchors := range map[string][]string{"missing": nil, "duplicate": {digest, digest}, "uppercase": {strings.ToUpper(digest)}, "short": {digest[:63]}} {
+		_, info := anchoredPackage(t, "new executor", "policy", anchors...)
+		if _, err := executorAnchor(info, trustAll); err == nil {
+			t.Fatal(name, "anchor accepted")
+		}
+	}
+}
+
+func TestPackagePinsAcceptAnExecutorUpgradeOnlyUnderTheApprovedPolicyAndINFOAnchor(t *testing.T) {
+	ctx := context.Background()
+	ed, pd := hashBytes([]byte("approved executor")), hashBytes([]byte("approved policy"))
+	upgraded := hashBytes([]byte("new executor"))
+	for _, tc := range []struct {
+		name, executor, policy string
+		anchors                []string
+		want                   pinState
+	}{
+		{"same bytes", "approved executor", "approved policy", nil, pinsMatch},
+		{"anchored executor", "new executor", "approved policy", []string{upgraded}, pinsAnchored},
+		{"unanchored executor", "new executor", "approved policy", nil, pinsDiffer},
+		{"different anchor", "new executor", "approved policy", []string{ed}, pinsDiffer},
+		{"changed policy", "new executor", "wider policy", []string{upgraded}, pinsDiffer},
+		{"changed policy only", "approved executor", "wider policy", []string{ed}, pinsDiffer},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			target, info := anchoredPackage(t, tc.executor, tc.policy, tc.anchors...)
+			if got := packagePins(ctx, target, info, trustAll, ed, pd); got != tc.want {
+				t.Fatal("pin state", got)
+			}
+		})
+	}
+}
+
+func TestInstallAnchoredReplacesOnlyTheProtectedExecutorWithVerifiedBytes(t *testing.T) {
+	ctx := context.Background()
+	for _, anchored := range []bool{true, false} {
+		t.Run(map[bool]string{true: "anchored", false: "swapped after check"}[anchored], func(t *testing.T) {
+			anchor := hashBytes([]byte("new executor"))
+			target, info := anchoredPackage(t, "new executor", "approved policy", anchor)
+			if !anchored {
+				os.WriteFile(filepath.Join(target, "executor"), []byte("package swapped"), 0755)
+			}
+			runtime := realTestPath(t, t.TempDir())
+			os.WriteFile(filepath.Join(runtime, "executor"), []byte("approved executor"), 0700)
+			os.WriteFile(filepath.Join(runtime, "policy.json"), []byte("approved policy"), 0600)
+			err := installAnchored(ctx, target, info, trustAll, runtime)
+			b, _ := os.ReadFile(filepath.Join(runtime, "executor"))
+			if anchored && (err != nil || string(b) != "new executor") {
+				t.Fatal("anchored executor not installed", err, string(b))
+			}
+			if !anchored && (err == nil || string(b) != "approved executor") {
+				t.Fatal("unanchored executor installed", err, string(b))
+			}
+			if info, err := os.Stat(filepath.Join(runtime, "executor")); err != nil || info.Mode().Perm() != 0700 {
+				t.Fatal("protected executor mode", err)
+			}
+			entries, _ := os.ReadDir(runtime)
+			if len(entries) != 2 {
+				t.Fatal("staging copy left in runtime", entries)
+			}
+		})
+	}
+}
+
+func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		state      pinState
+		installErr error
+		open       bool
+		installs   int
+		starts     int
+	}{
+		{"match", pinsMatch, nil, true, 0, 0},
+		{"differ", pinsDiffer, nil, false, 0, 0},
+		{"anchored", pinsAnchored, nil, false, 1, 1},
+		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			installs, starts := 0, 0
+			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(string) {})
+			if open != tc.open || installs != tc.installs || starts != tc.starts {
+				t.Fatal("handover", open, installs, starts)
+			}
+		})
+	}
+}

package/templates/_executor/apppriv_review_test.go

@@ -20,7 +20,7 @@ func TestReviewAppPrivRejectsAmbiguousOrError(t *testing.T) {
 	for name, reply := range cases {
 		t.Run(name, func(t *testing.T) {
 			d := &liveDSM{Command: &cmdStub{reply: reply}}
-			if d.Allow(context.Background(), Subject{Username: "alice"}, "app") == nil {
+			if d.Allow(context.Background(), Subject{Username: "alice"}, "app", "") == nil {
 				t.Fatal("unsafe AppPriv response allowed")
 			}
 		})

package/templates/_executor/cancel_contract_test.go

@@ -0,0 +1,236 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// stubbornMoveWriter keeps copying after its context ends until released, like
+// a slow write syscall, so the canceling window can be observed.
+type stubbornMoveWriter struct {
+	copying, release, published chan struct{}
+	publishing, finishPublish   chan struct{}
+	once                        sync.Once
+}
+
+func (w *stubbornMoveWriter) let() { w.once.Do(func() { close(w.release) }) }
+
+func newStubbornWriter() *stubbornMoveWriter {
+	return &stubbornMoveWriter{copying: make(chan struct{}), release: make(chan struct{}), published: make(chan struct{})}
+}
+func (w *stubbornMoveWriter) Write(context.Context, Subject, string, string, string, string) error {
+	return nil
+}
+func (w *stubbornMoveWriter) Move(_ context.Context, _ Subject, op Operation, d Delegation, guard func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
+	close(w.copying)
+	<-w.release
+	return guard(func() (MoveReceipt, error) {
+		if w.publishing != nil {
+			close(w.publishing)
+			<-w.finishPublish
+		}
+		close(w.published)
+		return MoveReceipt{Path: d.Path + "/" + op.Name}, nil
+	})
+}
+
+func operationOf(t *testing.T, r Response) map[string]any {
+	t.Helper()
+	if !r.OK {
+		t.Fatal(r)
+	}
+	b, _ := json.Marshal(r.Result)
+	out := map[string]any{}
+	json.Unmarshal(b, &out)
+	return out
+}
+func wantOperation(t *testing.T, r Response, state, code, reason string) {
+	t.Helper()
+	out := operationOf(t, r)
+	got, _ := out["code"].(string)
+	why, _ := out["reason"].(string)
+	if out["state"] != state || got != code || why != reason {
+		t.Fatalf("want %s/%s/%s, got %v", state, code, reason, out)
+	}
+}
+func startedCopy(t *testing.T, e *Executor, w *stubbornMoveWriter, id, job string) {
+	t.Helper()
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	// Cleanups run in reverse: release the writer, then stop.
+	t.Cleanup(e.stopOperations)
+	t.Cleanup(w.let)
+	if r := offline(e, "files.moveFromStaging", moveParams(id, job)); !r.OK {
+		t.Fatal(r)
+	}
+	select {
+	case <-w.copying:
+	case <-time.After(2 * time.Second):
+		t.Fatal("copy did not start")
+	}
+}
+
+func TestCancelCopyingAcknowledgesDurablyUntilCanceled(t *testing.T) {
+	e, _, _ := setup(t)
+	id := longGrant(t, e)
+	w := newStubbornWriter()
+	e.Writer = w
+	startedCopy(t, e, w, id, "job")
+	ref := map[string]any{"delegation_id": id, "job_id": "job"}
+	for i := 0; i < 2; i++ {
+		// A repeated cancel after a lost reply returns the same acknowledgement.
+		wantOperation(t, offline(e, "files.cancelOperation", ref), "copying", "CANCEL_REQUESTED", "operation-canceled-by-user")
+	}
+	wantOperation(t, offline(e, "files.operationStatus", ref), "copying", "CANCEL_REQUESTED", "operation-canceled-by-user")
+	e.commitMu.Lock()
+	op, err := e.Store.GetOperation("job")
+	e.commitMu.Unlock()
+	if err != nil || op.CancelRequested != "operation-canceled-by-user" {
+		t.Fatal("cancel intent not durable", op, err)
+	}
+	w.let()
+	waitState(t, e, "job", "canceled")
+	select {
+	case <-w.published:
+		t.Fatal("published after cancel acknowledgement")
+	default:
+	}
+	wantOperation(t, offline(e, "files.cancelOperation", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	wantOperation(t, offline(e, "files.moveFromStaging", moveParams(id, "job")), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+}
+
+func TestCancelRequestedCopySettlesCanceledAcrossStopAndCrash(t *testing.T) {
+	t.Run("stop-while-canceling", func(t *testing.T) {
+		e, _, _ := setup(t)
+		id := longGrant(t, e)
+		w := newStubbornWriter()
+		e.Writer = w
+		startedCopy(t, e, w, id, "job")
+		ref := map[string]any{"delegation_id": id, "job_id": "job"}
+		wantOperation(t, offline(e, "files.cancelOperation", ref), "copying", "CANCEL_REQUESTED", "operation-canceled-by-user")
+		stopped := make(chan struct{})
+		go func() { e.stopOperations(); close(stopped) }()
+		w.let()
+		<-stopped
+		if err := e.startOperations(context.Background()); err != nil {
+			t.Fatal(err)
+		}
+		defer e.stopOperations()
+		wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	})
+	for _, intent := range []bool{false, true} {
+		name := map[bool]string{false: "crash-before-publish", true: "crash-after-publish-intent"}[intent]
+		t.Run(name, func(t *testing.T) {
+			e, _, _ := setup(t)
+			id := longGrant(t, e)
+			op := Operation{Version: 1, Package: e.Policy.Package, ID: id, Job: "job", State: "copying", CancelRequested: "operation-canceled-by-user", PublishIntent: intent, Staging: "result", Name: "out.csv", Size: 123}
+			if e.Store.PutOperation(op) != nil {
+				t.Fatal("put")
+			}
+			w := newStubbornWriter()
+			e.Writer = w
+			if err := e.startOperations(context.Background()); err != nil {
+				t.Fatal(err)
+			}
+			defer e.stopOperations()
+			ref := map[string]any{"delegation_id": id, "job_id": "job"}
+			if intent {
+				// A publish that may have happened is never reported as canceled.
+				wantOperation(t, offline(e, "files.operationStatus", ref), "uncertain", "uncertain", "")
+				return
+			}
+			wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+		})
+	}
+}
+
+func TestCancelBeforeAdmissionLeavesTombstoneThatIsNeverAdmitted(t *testing.T) {
+	e, f, _ := setup(t)
+	id := longGrant(t, e)
+	w := newStubbornWriter()
+	e.Writer = w
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer e.stopOperations()
+	ref := map[string]any{"delegation_id": id, "job_id": "job"}
+	if r := offline(e, "files.operationStatus", ref); r.Code != "operation-not-found" {
+		t.Fatal(r)
+	}
+	if r := offline(e, "files.cancelOperation", map[string]any{"delegation_id": strings.Repeat("f", 64), "job_id": "job"}); r.Code != "operation-not-found" {
+		t.Fatal("canceled under an unknown grant", r)
+	}
+	f.user.Username = "bob"
+	if r := request(e, "files.cancelOperation", ref); r.Code != "operation-not-found" {
+		t.Fatal("another owner canceled", r)
+	}
+	f.user.Username = "alice"
+	for i := 0; i < 2; i++ {
+		wantOperation(t, offline(e, "files.cancelOperation", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	}
+	// The original admission, arriving late or replayed, finds the tombstone.
+	for i := 0; i < 2; i++ {
+		wantOperation(t, offline(e, "files.moveFromStaging", moveParams(id, "job")), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	}
+	wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	other := map[string]any{"delegation_id": longGrant(t, e), "job_id": "job"}
+	if r := offline(e, "files.cancelOperation", other); r.Code != "operation-not-found" {
+		t.Fatal("tombstone answered another grant", r)
+	}
+	select {
+	case <-w.copying:
+		t.Fatal("canceled reference was copied")
+	case <-time.After(50 * time.Millisecond):
+	}
+}
+
+func TestCancelQueuedNeverCopies(t *testing.T) {
+	e, _, _ := setup(t)
+	id := longGrant(t, e)
+	w := newStubbornWriter()
+	e.Writer = w
+	startedCopy(t, e, w, id, "active")
+	if r := offline(e, "files.moveFromStaging", moveParams(id, "queued")); !r.OK {
+		t.Fatal(r)
+	}
+	ref := map[string]any{"delegation_id": id, "job_id": "queued"}
+	for i := 0; i < 2; i++ {
+		wantOperation(t, offline(e, "files.cancelOperation", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	}
+	w.let()
+	waitState(t, e, "active", "committed")
+	if op := waitState(t, e, "queued", "canceled"); op.Part != nil || op.PublishIntent {
+		t.Fatal("canceled queued operation copied", op)
+	}
+}
+
+func TestCancelRacingPublishReturnsCommitted(t *testing.T) {
+	e, _, _ := setup(t)
+	id := longGrant(t, e)
+	w := newStubbornWriter()
+	w.publishing, w.finishPublish = make(chan struct{}), make(chan struct{})
+	e.Writer = w
+	startedCopy(t, e, w, id, "job")
+	w.let()
+	<-w.publishing
+	reply := make(chan Response, 1)
+	go func() {
+		reply <- offline(e, "files.cancelOperation", map[string]any{"delegation_id": id, "job_id": "job"})
+	}()
+	select {
+	case r := <-reply:
+		t.Fatal("cancel answered inside the publish fence", r)
+	case <-time.After(50 * time.Millisecond):
+	}
+	close(w.finishPublish)
+	out := operationOf(t, <-reply)
+	if out["state"] != "committed" || out["receipt"] == nil || out["code"] != nil {
+		t.Fatal("cancel after publish must report committed", out)
+	}
+	waitState(t, e, "job", "committed")
+}

package/templates/_executor/copy.go

@@ -0,0 +1,64 @@
+package main
+
+import (
+	"bufio"
+	"errors"
+	"io"
+)
+
+// errParentGone means the move parent closed or broke the control pipe during
+// the copy: it exited or was killed, so no one can ever send publish.
+var errParentGone = errors.New("parent gone")
+
+type controlLine struct {
+	line string
+	err  error
+}
+
+// awaitControl reads the parent's next decision in the background. Pipe EOF
+// is the parent-death signal on every kernel, including 3.10, and unlike
+// PR_SET_PDEATHSIG it survives the child's identity drop and Go's threads.
+func awaitControl(r *bufio.Reader) <-chan controlLine {
+	next := make(chan controlLine, 1)
+	go func() {
+		line, err := r.ReadString('\n')
+		next <- controlLine{line, err}
+	}()
+	return next
+}
+
+// copyUnlessParentGone copies exactly size bytes, checking control between
+// chunks. The parent writes nothing during a copy, so any arrival ends it.
+func copyUnlessParentGone(out io.Writer, src io.Reader, size int64, control <-chan controlLine) error {
+	limited := io.LimitReader(src, size+1)
+	buf := make([]byte, 1<<20)
+	var n int64
+	for {
+		select {
+		case <-control:
+			return errParentGone
+		default:
+		}
+		m, err := limited.Read(buf)
+		if m > 0 {
+			if _, werr := out.Write(buf[:m]); werr != nil {
+				return werr
+			}
+			n += int64(m)
+		}
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return err
+		}
+	}
+	if n != size {
+		return errors.New("size mismatch")
+	}
+	return nil
+}
+
+func copyExact(out io.Writer, src io.Reader, size int64) error {
+	return copyUnlessParentGone(out, src, size, nil)
+}

package/templates/_executor/copy_test.go

@@ -0,0 +1,88 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"io"
+	"os"
+	"testing"
+	"time"
+)
+
+type endlessZeros struct{ read int64 }
+
+func (z *endlessZeros) Read(p []byte) (int, error) {
+	clear(p)
+	z.read += int64(len(p))
+	return len(p), nil
+}
+
+// The move parent holds the child's control pipe open for the whole copy. If
+// the parent dies, the pipe closes and the child must stop copying at once
+// rather than fill a part file nobody can publish.
+func TestCopyStopsWhenParentClosesControl(t *testing.T) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer r.Close()
+	control := awaitControl(bufio.NewReader(r))
+	src := &endlessZeros{}
+	done := make(chan error, 1)
+	go func() { done <- copyUnlessParentGone(io.Discard, src, 1<<50, control) }()
+	time.Sleep(50 * time.Millisecond)
+	w.Close()
+	select {
+	case err := <-done:
+		if !errors.Is(err, errParentGone) {
+			t.Fatal("want errParentGone, got", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("copy continued after the parent closed control")
+	}
+}
+
+// The parent never writes during the copy; anything arriving there is a
+// protocol violation and stops the copy too.
+func TestCopyStopsOnUnexpectedControlInput(t *testing.T) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer r.Close()
+	defer w.Close()
+	control := awaitControl(bufio.NewReader(r))
+	done := make(chan error, 1)
+	go func() { done <- copyUnlessParentGone(io.Discard, &endlessZeros{}, 1<<50, control) }()
+	w.Write([]byte("P\n"))
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Fatal("copy accepted early control input")
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("copy ignored control input")
+	}
+}
+
+func TestCopyKeepsExactSizeAndLeavesDecisionForCaller(t *testing.T) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer r.Close()
+	control := awaitControl(bufio.NewReader(r))
+	var out bytes.Buffer
+	if err = copyUnlessParentGone(&out, bytes.NewReader(make([]byte, 3<<20)), 3<<20, control); err != nil || out.Len() != 3<<20 {
+		t.Fatal(out.Len(), err)
+	}
+	if copyUnlessParentGone(io.Discard, bytes.NewReader(make([]byte, 4)), 3, control) == nil {
+		t.Fatal("excess bytes accepted")
+	}
+	w.Write([]byte("P\n"))
+	if got := <-control; got.line != "P\n" || got.err != nil {
+		t.Fatal("decision lost", got)
+	}
+	w.Close()
+}