@synopackageland/cli 0.7.3 → 0.9.0

package/dist/templates/_executor/selected_scope_test.go

@@ -1,186 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func selectedExecutor(t *testing.T) (*Executor, *fakeDSM) {
-	e, f, _ := setup(t)
-	e.Policy.Scope = installSelectedScope
-	e.Policy.Lifetime = "until-revoked"
-	e.Policy.Destinations = []string{"save"}
-	f.user.Admin = true
-	return e, f
-}
-func selectScope(e *Executor, scope string, peer int) Response {
-	state, _ := e.Store.SelectedScope()
-	b, _ := json.Marshal(map[string]any{"scope": scope, "actor": "alice", "expected_generation": state.Generation})
-	return e.handlePeer(context.Background(), Request{Version: 1, Op: "delegate.setScope", Params: b}, peer, 3000)
-}
-func selectedGrant(t *testing.T, e *Executor, path string) Delegation {
-	t.Helper()
-	r := request(e, "delegate.create", map[string]any{"scope": installSelectedScope, "ops": []string{"files.moveFromStaging"}, "path": path, "destination": "save", "lifetime": "until-revoked"})
-	if !r.OK {
-		t.Fatal(r)
-	}
-	b, _ := json.Marshal(r.Result)
-	var d Delegation
-	json.Unmarshal(b, &d)
-	return d
-}
-func TestSelectedScopeOnlyPasswordConfirmedRootPeerMayChange(t *testing.T) {
-	e, f := selectedExecutor(t)
-	if r := selectScope(e, "shared:reports", 3000); r.OK {
-		t.Fatal("package changed scope", r)
-	}
-	if r := selectScope(e, "shared:reports", 3001); r.OK {
-		t.Fatal("other peer changed scope", r)
-	}
-	f.user.Admin = false
-	if r := selectScope(e, "shared:reports", 0); r.OK {
-		t.Fatal("nonadministrator actor", r)
-	}
-	f.user.Admin = true
-	for _, params := range []string{`{"scope":"home","actor":"alice"}`, `{"scope":"home","actor":"alice","expected_generation":null}`, `{"scope":"home","actor":"alice","expected_generation":9007199254740992}`} {
-		if r := e.handlePeer(context.Background(), Request{Version: 1, Op: "delegate.setScope", Params: json.RawMessage(params)}, 0, 3000); r.OK {
-			t.Fatal("unbound root task accepted", r)
-		}
-	}
-	for _, scope := range []string{"*", "shared:../escape", "shared:homes", "shared:home", "shared:", "home\n", "shared:a:b"} {
-		if r := selectScope(e, scope, 0); r.OK {
-			t.Fatal(scope, r)
-		}
-	}
-	if r := selectScope(e, "shared:reports", 0); !r.OK {
-		t.Fatal(r)
-	}
-	state, err := e.Store.SelectedScope()
-	if err != nil || state.Scope != "shared:reports" || state.Generation != 1 {
-		t.Fatal(state, err)
-	}
-	info, _ := os.Stat(filepath.Join(e.Store.Dir, "selected-scope.record"))
-	if info.Mode().Perm() != 0600 {
-		t.Fatal(info.Mode())
-	}
-	// No admin cookie/SynoToken can turn the ordinary package socket into root authority.
-	if r := request(e, "delegate.setScope", map[string]string{"scope": "home"}); r.OK {
-		t.Fatal(r)
-	}
-}
-func TestSelectedScopeMissingCorruptAndChangeBackFailClosed(t *testing.T) {
-	e, _ := selectedExecutor(t)
-	p := map[string]any{"scope": installSelectedScope, "ops": []string{"files.moveFromStaging"}, "path": "/home", "destination": "save", "lifetime": "until-revoked"}
-	if r := request(e, "delegate.create", p); r.OK {
-		t.Fatal("unconfirmed scope", r)
-	}
-	if r := selectScope(e, "home", 0); !r.OK {
-		t.Fatal(r)
-	}
-	d := selectedGrant(t, e, "/home")
-	if d.Scope != "home" || d.ScopeGeneration != 1 {
-		t.Fatal(d)
-	}
-	if r := selectScope(e, "home", 0); !r.OK {
-		t.Fatal(r)
-	}
-	state, _ := e.Store.SelectedScope()
-	if state.Generation != 1 {
-		t.Fatal("unchanged scope invalidates", state)
-	}
-	if r := selectScope(e, "shared:reports", 0); !r.OK {
-		t.Fatal(r)
-	}
-	if r := request(e, "delegate.create", p); r.Code != "SCOPE_DENIED" {
-		t.Fatal("outside chosen share", r)
-	}
-	if r := selectScope(e, "home", 0); !r.OK {
-		t.Fatal(r)
-	}
-	if _, code := e.validateMove(context.Background(), d); code == "" {
-		t.Fatal("change-back revived old grant")
-	}
-	fresh := &Executor{Policy: e.Policy, DSM: e.DSM, Store: &Store{Dir: e.Store.Dir}, Now: e.Now}
-	if _, code := fresh.validateMove(context.Background(), d); code == "" {
-		t.Fatal("restart revived old grant")
-	}
-	d = selectedGrant(t, e, "/home")
-	if d.ScopeGeneration != 3 {
-		t.Fatal(d)
-	}
-	os.WriteFile(filepath.Join(e.Store.Dir, "selected-scope.record"), []byte(`{"schema":1,"scope":"home","generation":0}`), 0600)
-	if r := request(e, "delegate.create", p); r.OK {
-		t.Fatal("corrupt scope allowed", r)
-	}
-	if _, code := e.validateMove(context.Background(), d); code == "" {
-		t.Fatal("corrupt state allowed move")
-	}
-}
-func TestSelectedScopeChangeFencesActivePublish(t *testing.T) {
-	e, _ := selectedExecutor(t)
-	if r := selectScope(e, "home", 0); !r.OK {
-		t.Fatal(r)
-	}
-	d := selectedGrant(t, e, "/home")
-	w := &barrierMoveWriter{copying: make(chan struct{}), release: make(chan struct{}), published: make(chan struct{})}
-	e.Writer = w
-	if err := e.startOperations(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	defer e.stopOperations()
-	if r := offline(e, "files.moveFromStaging", moveParams(d.ID, "scope-race")); !r.OK {
-		t.Fatal(r)
-	}
-	<-w.copying
-	if r := selectScope(e, "shared:reports", 0); !r.OK {
-		t.Fatal(r)
-	}
-	close(w.release)
-	if op := waitState(t, e, "scope-race", "canceled"); op.Reason != "scope-changed" {
-		t.Fatal("missing scope cancellation reason", op)
-	}
-	select {
-	case <-w.published:
-		t.Fatal("published after scope change acknowledgement")
-	default:
-	}
-}
-
-func TestSelectedDestinationReplacesOnlyThisOwnerAndKey(t *testing.T) {
-	e, _ := selectedExecutor(t)
-	if r := selectScope(e, "home", 0); !r.OK {
-		t.Fatal(r)
-	}
-	old := selectedGrant(t, e, "/home")
-	fresh := selectedGrant(t, e, "/home")
-	prior, err := e.Store.Get(old.ID)
-	if err != nil || !prior.Revoked {
-		t.Fatal("prior destination still active", prior, err)
-	}
-	current, err := e.Store.Get(fresh.ID)
-	if err != nil || current.Revoked {
-		t.Fatal(current, err)
-	}
-}
-
-func TestSelectedScopeTaskCannotReplayAfterAnotherConfirmation(t *testing.T) {
-	e, _ := selectedExecutor(t)
-	b, _ := json.Marshal(map[string]any{"scope": "home", "actor": "alice", "expected_generation": uint64(0)})
-	old := Request{Version: 1, Op: "delegate.setScope", Params: b}
-	if r := e.handlePeer(context.Background(), old, 0, 3000); !r.OK {
-		t.Fatal(r)
-	}
-	if r := selectScope(e, "shared:reports", 0); !r.OK {
-		t.Fatal(r)
-	}
-	if r := e.handlePeer(context.Background(), old, 0, 3000); r.Code != "SCOPE_APPROVAL_STALE" {
-		t.Fatal("old root task widened the newly confirmed scope", r)
-	}
-	state, err := e.Store.SelectedScope()
-	if err != nil || state.Scope != "shared:reports" || state.Generation != 2 {
-		t.Fatal(state, err)
-	}
-}

package/dist/templates/_executor/socket_linux_test.go

@@ -1,46 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"net"
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-)
-
-func TestBoundSocketPermissionsAreVerifiedOnFilesystemInode(t *testing.T) {
-	root := t.TempDir()
-	old := syscall.Umask(0077)
-	defer syscall.Umask(old)
-	socket := filepath.Join(root, "executor.sock")
-	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer ln.Close()
-	if err = os.Chown(socket, os.Geteuid(), os.Getegid()); err != nil {
-		t.Fatal(err)
-	}
-	if err = os.Chmod(socket, 0660); err != nil {
-		t.Fatal(err)
-	}
-	if err = verifySocket(socket, os.Geteuid(), os.Getegid(), 0660); err != nil {
-		t.Fatal(err)
-	}
-	if verifySocket(socket, os.Geteuid()+1, os.Getegid(), 0660) == nil {
-		t.Fatal("wrong owner accepted")
-	}
-	if verifySocket(socket, os.Geteuid(), os.Getegid()+1, 0660) == nil {
-		t.Fatal("wrong group accepted")
-	}
-	if verifySocket(socket, os.Geteuid(), os.Getegid(), 0600) == nil {
-		t.Fatal("wrong mode accepted")
-	}
-	link := socket + "-link"
-	os.Symlink(socket, link)
-	if verifySocket(link, os.Geteuid(), os.Getegid(), 0660) == nil {
-		t.Fatal("symlink accepted")
-	}
-}

package/dist/templates/_executor/status_disabled_test.go

@@ -1,33 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestStatusReadsProtectedDisabledAndRefusesStoreError(t *testing.T) {
-	e, _, _ := setup(t)
-	check := func(ready, disabled bool) {
-		t.Helper()
-		r := request(e, "status", map[string]any{})
-		b, _ := json.Marshal(r.Result)
-		var out struct {
-			Ready    bool  `json:"ready"`
-			Disabled *bool `json:"disabled"`
-		}
-		if !r.OK || json.Unmarshal(b, &out) != nil || out.Ready != ready || out.Disabled == nil || *out.Disabled != disabled {
-			t.Fatalf("status: %s", b)
-		}
-	}
-	check(true, false)
-	if err := e.Store.SetDisabled(true); err != nil {
-		t.Fatal(err)
-	}
-	check(true, true)
-	if err := os.WriteFile(filepath.Join(e.Store.Dir, "disabled.record"), []byte("broken"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	check(false, false)
-}

package/dist/templates/_executor/store.go

@@ -1,91 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// Dir and its ancestors are validated root-owned at service startup. No client
-// supplies a store path. Atomic replacement + fsync persists revocations.
-type Store struct{ Dir string }
-
-func (s *Store) Put(d Delegation) error {
-	if !idRE.MatchString(d.ID) {
-		return errors.New("id")
-	}
-	b, err := json.Marshal(d)
-	if err != nil || len(b) > maxRequest {
-		return errors.New("grant size")
-	}
-	f, err := os.CreateTemp(s.Dir, ".delegation-")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(f.Name())
-	defer f.Close()
-	if err = f.Chmod(0600); err != nil {
-		return err
-	}
-	if _, err = f.Write(b); err != nil {
-		return err
-	}
-	if err = f.Sync(); err != nil {
-		return err
-	}
-	if err = f.Close(); err != nil {
-		return err
-	}
-	if err = os.Rename(f.Name(), filepath.Join(s.Dir, d.ID+".json")); err != nil {
-		return err
-	}
-	dir, err := os.Open(s.Dir)
-	if err != nil {
-		return err
-	}
-	defer dir.Close()
-	return dir.Sync()
-}
-func (s *Store) Get(id string) (Delegation, error) {
-	var d Delegation
-	if !idRE.MatchString(id) {
-		return d, errors.New("id")
-	}
-	path := filepath.Join(s.Dir, id+".json")
-	info, err := os.Lstat(path)
-	if err != nil {
-		return d, err
-	}
-	if !info.Mode().IsRegular() || info.Mode().Perm() != 0600 || info.Size() > maxRequest {
-		return d, errors.New("store mode")
-	}
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return d, err
-	}
-	err = strictJSON(b, &d)
-	if d.ID != id {
-		return d, errors.New("id mismatch")
-	}
-	return d, err
-}
-func (s *Store) List() ([]Delegation, error) {
-	entries, err := os.ReadDir(s.Dir)
-	if err != nil {
-		return nil, err
-	}
-	ds := []Delegation{}
-	for _, ent := range entries {
-		if filepath.Ext(ent.Name()) != ".json" || !idRE.MatchString(strings.TrimSuffix(ent.Name(), ".json")) {
-			continue
-		}
-		d, err := s.Get(ent.Name()[:len(ent.Name())-5])
-		if err != nil {
-			return nil, err
-		}
-		ds = append(ds, d)
-	}
-	return ds, nil
-}

package/dist/templates/_executor/supervise.go

@@ -1,109 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log"
-	"os"
-	"os/exec"
-	"os/signal"
-	"syscall"
-	"time"
-)
-
-// serve exits with this status when another monitor holds executor.pid; the
-// flock, not the supervisor, decides which monitor survives.
-const exitAlreadyRunning = 3
-
-var errAlreadyRunning = errors.New("already running")
-
-func exitStatus(err error) int {
-	if errors.Is(err, errAlreadyRunning) {
-		return exitAlreadyRunning
-	}
-	return 1
-}
-
-const (
-	minRestartDelay = time.Second
-	maxRestartDelay = time.Minute
-	stableServeRun  = time.Minute
-)
-
-// supervise reruns the approved serve after an abnormal end. A clean exit
-// (root replacement, shutdown or purge), another live monitor, termination of
-// the supervisor or a purged runtime all end supervision instead.
-func supervise(ctx context.Context, run func(ctx context.Context, revived bool) error, runtimePresent func() bool, sleep func(context.Context, time.Duration) bool, now func() time.Time, log func(string)) error {
-	delay := minRestartDelay
-	revived := false
-	for {
-		started := now()
-		err := run(ctx, revived)
-		if err == nil || ctx.Err() != nil {
-			return nil
-		}
-		var exit *exec.ExitError
-		if errors.As(err, &exit) && exit.ExitCode() == exitAlreadyRunning {
-			log("executor supervisor: another monitor is running")
-			return nil
-		}
-		if now().Sub(started) >= stableServeRun {
-			delay = minRestartDelay
-		}
-		if !runtimePresent() {
-			log("executor supervisor: runtime removed")
-			return nil
-		}
-		log(fmt.Sprintf("executor supervisor: serve ended (%v); restarting in %s", err, delay))
-		if !sleep(ctx, delay) || !runtimePresent() {
-			return nil
-		}
-		delay = min(2*delay, maxRestartDelay)
-		revived = true
-	}
-}
-
-func serveArgs(pkg string, revived bool) []string {
-	args := []string{"serve", "--package", pkg}
-	if revived {
-		args = append(args, "--revived")
-	}
-	return args
-}
-
-// Root control start launches the supervisor in its own session; serve runs as
-// its child and still owns executor.pid for root stop/purge/replacement.
-func supervisorCommand(exe, pkg string) *exec.Cmd {
-	cmd := exec.Command(exe, "supervise", "--package", pkg)
-	cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
-	cmd.Dir = "/"
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
-	return cmd
-}
-
-func runSupervisor(exe, pkg string) error {
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
-	defer stop()
-	run := func(ctx context.Context, revived bool) error {
-		cmd := exec.CommandContext(ctx, exe, serveArgs(pkg, revived)...)
-		cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
-		cmd.Dir = "/"
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-		cmd.Cancel = func() error { return cmd.Process.Signal(syscall.SIGTERM) }
-		return cmd.Run()
-	}
-	present := func() bool { _, err := os.Lstat(exe); return err == nil }
-	sleep := func(ctx context.Context, d time.Duration) bool {
-		t := time.NewTimer(d)
-		defer t.Stop()
-		select {
-		case <-ctx.Done():
-			return false
-		case <-t.C:
-			return true
-		}
-	}
-	return supervise(ctx, run, present, sleep, time.Now, func(s string) { log.Print(s) })
-}

package/dist/templates/_executor/supervise_test.go

@@ -1,130 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"reflect"
-	"testing"
-	"time"
-)
-
-type superviseFixture struct {
-	scripts []string
-	revived []bool
-	delays  []time.Duration
-	present bool
-	clock   time.Time
-	runFor  []time.Duration
-}
-
-// Each run executes a real child so exit status and signal death come from the
-// kernel, exactly as the supervisor sees serve.
-func (f *superviseFixture) run(ctx context.Context, revived bool) error {
-	i := len(f.revived)
-	f.revived = append(f.revived, revived)
-	if i < len(f.runFor) {
-		f.clock = f.clock.Add(f.runFor[i])
-	}
-	script := "exit 0"
-	if i < len(f.scripts) {
-		script = f.scripts[i]
-	}
-	return exec.CommandContext(ctx, "/bin/sh", "-c", script).Run()
-}
-func (f *superviseFixture) sleep(_ context.Context, d time.Duration) bool {
-	f.delays = append(f.delays, d)
-	return true
-}
-func (f *superviseFixture) supervise(ctx context.Context) error {
-	return supervise(ctx, f.run, func() bool { return f.present }, f.sleep, func() time.Time { return f.clock }, func(string) {})
-}
-
-func TestSuperviseRestartsAbnormalServeUntilCleanExit(t *testing.T) {
-	f := &superviseFixture{present: true, scripts: []string{"kill -KILL $$", "exit 1", "exit 0"}}
-	if err := f.supervise(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	if want := []bool{false, true, true}; !reflect.DeepEqual(f.revived, want) {
-		t.Fatalf("revived %v, want %v", f.revived, want)
-	}
-	if want := []time.Duration{time.Second, 2 * time.Second}; !reflect.DeepEqual(f.delays, want) {
-		t.Fatalf("delays %v, want %v", f.delays, want)
-	}
-}
-
-func TestSuperviseLeavesWhenAnotherMonitorOwnsThePidfile(t *testing.T) {
-	f := &superviseFixture{present: true, scripts: []string{"exit 3", "exit 0"}}
-	if err := f.supervise(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	if len(f.revived) != 1 || len(f.delays) != 0 {
-		t.Fatalf("runs %v delays %v", f.revived, f.delays)
-	}
-}
-
-func TestSuperviseStopsOnceRuntimeIsPurged(t *testing.T) {
-	f := &superviseFixture{present: false, scripts: []string{"kill -KILL $$", "exit 0"}}
-	if err := f.supervise(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	if len(f.revived) != 1 || len(f.delays) != 0 {
-		t.Fatalf("runs %v delays %v", f.revived, f.delays)
-	}
-}
-
-func TestSuperviseBacksOffToCapAndResetsAfterStableRun(t *testing.T) {
-	scripts := make([]string, 10)
-	for i := range scripts {
-		scripts[i] = "exit 2"
-	}
-	scripts = append(scripts, "exit 0")
-	runFor := make([]time.Duration, len(scripts))
-	runFor[8] = time.Minute
-	f := &superviseFixture{present: true, scripts: scripts, runFor: runFor}
-	if err := f.supervise(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	s := time.Second
-	want := []time.Duration{s, 2 * s, 4 * s, 8 * s, 16 * s, 32 * s, 60 * s, 60 * s, s, 2 * s}
-	if !reflect.DeepEqual(f.delays, want) {
-		t.Fatalf("delays %v, want %v", f.delays, want)
-	}
-}
-
-func TestSuperviseTerminationEndsWithoutRestart(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	f := &superviseFixture{present: true, scripts: []string{"sleep 30", "exit 0"}}
-	time.AfterFunc(100*time.Millisecond, cancel)
-	if err := f.supervise(ctx); err != nil {
-		t.Fatal(err)
-	}
-	if len(f.revived) != 1 || len(f.delays) != 0 {
-		t.Fatalf("runs %v delays %v", f.revived, f.delays)
-	}
-}
-
-func TestRootStartLaunchesSupervisorThatRevivesServe(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("checks the non-root refusal")
-	}
-	if err := run([]string{"supervise", "--package", "TestApp"}); err == nil || err.Error() != "root required" {
-		t.Fatalf("supervise mode: %v", err)
-	}
-	if err := run([]string{"control", "start", "--package", "TestApp", "--revived"}); err == nil || err.Error() != "unexpected revive" {
-		t.Fatalf("revive outside serve: %v", err)
-	}
-	if got := supervisorCommand("/x/runtime/executor", "TestApp").Args; !reflect.DeepEqual(got, []string{"/x/runtime/executor", "supervise", "--package", "TestApp"}) {
-		t.Fatal(got)
-	}
-	for revived, want := range map[bool][]string{false: {"serve", "--package", "TestApp"}, true: {"serve", "--package", "TestApp", "--revived"}} {
-		if got := serveArgs("TestApp", revived); !reflect.DeepEqual(got, want) {
-			t.Fatal(got)
-		}
-	}
-	if exitStatus(fmt.Errorf("serve: %w", errAlreadyRunning)) != exitAlreadyRunning || exitStatus(errors.New("other")) != 1 {
-		t.Fatal("exit status")
-	}
-}

package/dist/templates/_executor/task_race_review_test.go

@@ -1,47 +0,0 @@
-package main
-
-import (
-	"context"
-	"strings"
-	"testing"
-)
-
-type reviewEditDuringDelete struct {
-	schedulerFixture
-	calls []string
-}
-
-func (s *reviewEditDuringDelete) Exec(ctx context.Context, path string, args []string) ([]byte, error) {
-	for _, a := range args {
-		if strings.HasPrefix(a, "method=") {
-			s.calls = append(s.calls, a)
-		}
-	}
-	if contains(args, "method=delete") {
-		s.changed = true
-	}
-	return s.schedulerFixture.Exec(ctx, path, args)
-}
-func TestReviewPurgeAcceptedAdminRaceLogsRemainingTasksWithoutRetry(t *testing.T) {
-	cmd := &reviewEditDuringDelete{}
-	inv := taskInventory{Package: "TestApp", PolicyDigest: strings.Repeat("b", 64), Tasks: []approvedTask{{Kind: "boot", Name: "TestApp executor boot", ScriptDigest: canonicalTaskDigest(t, "boot")}, {Kind: "control", Name: "TestApp executor control", ScriptDigest: canonicalTaskDigest(t, "control")}}}
-	logs := []string{}
-	purgeTasks(context.Background(), &liveDSM{Command: cmd}, "TestApp", inv, func(s string) { logs = append(logs, s) })
-	if len(cmd.deleted) != 1 {
-		t.Fatal("must delete immediately once, skip subsequent changed definition", cmd.deleted)
-	}
-	found := false
-	for _, s := range logs {
-		if strings.Contains(s, "boot") && strings.Contains(s, "remains") {
-			found = true
-		}
-	}
-	if !found {
-		t.Fatal("remaining replaced boot task not logged", logs)
-	}
-	for i, c := range cmd.calls {
-		if c == "method=delete" && (i == 0 || cmd.calls[i-1] != "method=get" || i+1 >= len(cmd.calls) || cmd.calls[i+1] != "method=get") {
-			t.Fatal("expected get/delete/readback without retry", cmd.calls)
-		}
-	}
-}