@synopackageland/cli 0.8.0 → 0.9.0

package/dist/templates/_executor/anchor.go

@@ -1,156 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"syscall"
-)
-
-// Package Center writes the SPK INFO as root. The package account cannot change
-// it, so its executor digest authorizes executor-only upgrades under the
-// administrator-approved policy without a new PasswordConfirm.
-const executorAnchorKey = "synopkgland_executor_sha256"
-
-var anchorRE = regexp.MustCompile(`^"([a-f0-9]{64})"$`)
-
-type pinState int
-
-const (
-	pinsDiffer pinState = iota
-	pinsMatch
-	pinsAnchored
-)
-
-func executorAnchor(info string, trusted func(os.FileInfo) bool) (string, error) {
-	b, stat, err := readLifecycleFile(info, 65536)
-	if err != nil {
-		return "", err
-	}
-	if !trusted(stat) {
-		return "", errors.New("untrusted package INFO")
-	}
-	anchor := ""
-	for _, line := range strings.Split(string(b), "\n") {
-		value, ok := strings.CutPrefix(line, executorAnchorKey+"=")
-		if !ok {
-			continue
-		}
-		m := anchorRE.FindStringSubmatch(value)
-		if m == nil || anchor != "" {
-			return "", errors.New("executor anchor")
-		}
-		anchor = m[1]
-	}
-	if anchor == "" {
-		return "", errors.New("executor anchor")
-	}
-	return anchor, nil
-}
-
-func rootOwnedReadOnly(info os.FileInfo) bool {
-	return ownedByRoot(info) && info.Mode().Perm()&0022 == 0
-}
-
-func packagePins(ctx context.Context, dir, info string, trusted func(os.FileInfo) bool, executorDigest, policyDigest string) pinState {
-	if samePackagePins(ctx, dir, executorDigest, policyDigest) {
-		return pinsMatch
-	}
-	dir, err := filepath.EvalSymlinks(dir)
-	if err != nil {
-		return pinsDiffer
-	}
-	if pd, err := digestFile(ctx, dir+"/policy.json", maxPolicyBytes); err != nil || pd != policyDigest {
-		return pinsDiffer
-	}
-	anchor, err := executorAnchor(info, trusted)
-	if err != nil {
-		return pinsDiffer
-	}
-	if ed, err := digestFile(ctx, dir+"/executor", maxExecutorBytes); err != nil || ed != anchor {
-		return pinsDiffer
-	}
-	return pinsAnchored
-}
-
-// The policy is unchanged, so root scripts (pinned by policy digests) stay too.
-// Verify the protected copy, never the package-reachable source.
-func installAnchored(ctx context.Context, source, info string, trusted func(os.FileInfo) bool, runtime string) error {
-	anchor, err := executorAnchor(info, trusted)
-	if err != nil {
-		return err
-	}
-	// DSM links the package target to the volume; openRegular refuses links.
-	source, err = filepath.EvalSymlinks(source)
-	if err != nil {
-		return err
-	}
-	src, err := openRegular(filepath.Join(source, "executor"))
-	if err != nil {
-		return err
-	}
-	defer src.Close()
-	stat, err := src.Stat()
-	if err != nil || stat.Size() > maxExecutorBytes {
-		return errors.New("executor size")
-	}
-	staged, err := os.CreateTemp(runtime, ".executor-")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(staged.Name())
-	err = copyExact(staged, src, stat.Size())
-	if err == nil {
-		err = staged.Chmod(0700)
-	}
-	if err == nil {
-		err = staged.Sync()
-	}
-	if closeErr := staged.Close(); err == nil {
-		err = closeErr
-	}
-	if err != nil {
-		return err
-	}
-	if digest, err := digestFile(ctx, staged.Name(), maxExecutorBytes); err != nil || digest != anchor {
-		return errors.New("executor anchor mismatch")
-	}
-	return os.Rename(staged.Name(), filepath.Join(runtime, "executor"))
-}
-
-// Root control start replaces this monitor with the newly installed runtime.
-func startInstalled(runtime, pkg string) error {
-	cmd := exec.Command(filepath.Join(runtime, "executor"), "control", "start", "--package", pkg)
-	cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
-	cmd.Dir = "/"
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	return cmd.Process.Release()
-}
-
-// An anchored upgrade is handed to root start, which replaces this monitor:
-// only differing pins are an approval request, and only they say so.
-func approvedPins(state pinState, install, start func() error, log func(string)) bool {
-	if state == pinsDiffer {
-		log("executor paused: package pins require administrator approval")
-	}
-	if state != pinsAnchored {
-		return state == pinsMatch
-	}
-	if err := install(); err != nil {
-		log("executor upgrade refused: INFO-anchored executor could not be installed")
-		return false
-	}
-	if err := start(); err != nil {
-		log("executor upgrade installed; root start failed")
-		return false
-	}
-	log("executor upgrade: INFO-anchored executor installed under the approved policy")
-	return false
-}

package/dist/templates/_executor/anchor_test.go

@@ -1,161 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-func trustAll(os.FileInfo) bool { return true }
-
-// anchoredPackage writes a target executor/policy pair and the package INFO.
-func anchoredPackage(t *testing.T, executor, policy string, anchors ...string) (target, info string) {
-	t.Helper()
-	pkg := realTestPath(t, t.TempDir())
-	target = filepath.Join(pkg, "target", "executor")
-	os.MkdirAll(target, 0755)
-	os.WriteFile(filepath.Join(target, "executor"), []byte(executor), 0755)
-	os.WriteFile(filepath.Join(target, "policy.json"), []byte(policy), 0644)
-	text := "package=\"TestApp\"\n"
-	for _, a := range anchors {
-		text += "synopkgland_executor_sha256=\"" + a + "\"\n"
-	}
-	info = filepath.Join(pkg, "INFO")
-	os.WriteFile(info, []byte(text), 0644)
-	return target, info
-}
-
-func TestExecutorAnchorRequiresOneLowercaseDigestInTrustedINFO(t *testing.T) {
-	digest := hashBytes([]byte("new executor"))
-	_, info := anchoredPackage(t, "new executor", "policy", digest)
-	if got, err := executorAnchor(info, trustAll); err != nil || got != digest {
-		t.Fatal("anchor", got, err)
-	}
-	if _, err := executorAnchor(info, func(os.FileInfo) bool { return false }); err == nil {
-		t.Fatal("package-writable INFO accepted")
-	}
-	for name, anchors := range map[string][]string{"missing": nil, "duplicate": {digest, digest}, "uppercase": {strings.ToUpper(digest)}, "short": {digest[:63]}} {
-		_, info := anchoredPackage(t, "new executor", "policy", anchors...)
-		if _, err := executorAnchor(info, trustAll); err == nil {
-			t.Fatal(name, "anchor accepted")
-		}
-	}
-}
-
-func TestPackagePinsAcceptAnExecutorUpgradeOnlyUnderTheApprovedPolicyAndINFOAnchor(t *testing.T) {
-	ctx := context.Background()
-	ed, pd := hashBytes([]byte("approved executor")), hashBytes([]byte("approved policy"))
-	upgraded := hashBytes([]byte("new executor"))
-	for _, tc := range []struct {
-		name, executor, policy string
-		anchors                []string
-		want                   pinState
-	}{
-		{"same bytes", "approved executor", "approved policy", nil, pinsMatch},
-		{"anchored executor", "new executor", "approved policy", []string{upgraded}, pinsAnchored},
-		{"unanchored executor", "new executor", "approved policy", nil, pinsDiffer},
-		{"different anchor", "new executor", "approved policy", []string{ed}, pinsDiffer},
-		{"changed policy", "new executor", "wider policy", []string{upgraded}, pinsDiffer},
-		{"changed policy only", "approved executor", "wider policy", []string{ed}, pinsDiffer},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			target, info := anchoredPackage(t, tc.executor, tc.policy, tc.anchors...)
-			if got := packagePins(ctx, target, info, trustAll, ed, pd); got != tc.want {
-				t.Fatal("pin state", got)
-			}
-		})
-	}
-}
-
-func TestInstallAnchoredReplacesOnlyTheProtectedExecutorWithVerifiedBytes(t *testing.T) {
-	ctx := context.Background()
-	for _, anchored := range []bool{true, false} {
-		t.Run(map[bool]string{true: "anchored", false: "swapped after check"}[anchored], func(t *testing.T) {
-			anchor := hashBytes([]byte("new executor"))
-			target, info := anchoredPackage(t, "new executor", "approved policy", anchor)
-			if !anchored {
-				os.WriteFile(filepath.Join(target, "executor"), []byte("package swapped"), 0755)
-			}
-			runtime := realTestPath(t, t.TempDir())
-			os.WriteFile(filepath.Join(runtime, "executor"), []byte("approved executor"), 0700)
-			os.WriteFile(filepath.Join(runtime, "policy.json"), []byte("approved policy"), 0600)
-			err := installAnchored(ctx, target, info, trustAll, runtime)
-			b, _ := os.ReadFile(filepath.Join(runtime, "executor"))
-			if anchored && (err != nil || string(b) != "new executor") {
-				t.Fatal("anchored executor not installed", err, string(b))
-			}
-			if !anchored && (err == nil || string(b) != "approved executor") {
-				t.Fatal("unanchored executor installed", err, string(b))
-			}
-			if info, err := os.Stat(filepath.Join(runtime, "executor")); err != nil || info.Mode().Perm() != 0700 {
-				t.Fatal("protected executor mode", err)
-			}
-			entries, _ := os.ReadDir(runtime)
-			if len(entries) != 2 {
-				t.Fatal("staging copy left in runtime", entries)
-			}
-		})
-	}
-}
-
-// The pause message names administrator approval only when the pins differ:
-// an anchored handover is a finished upgrade, not a request for approval.
-func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
-	for _, tc := range []struct {
-		name       string
-		state      pinState
-		installErr error
-		open       bool
-		installs   int
-		starts     int
-		logged     string
-	}{
-		{"match", pinsMatch, nil, true, 0, 0, ""},
-		{"differ", pinsDiffer, nil, false, 0, 0, "executor paused: package pins require administrator approval"},
-		{"anchored", pinsAnchored, nil, false, 1, 1, "executor upgrade: INFO-anchored executor installed under the approved policy"},
-		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0, "executor upgrade refused: INFO-anchored executor could not be installed"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			installs, starts := 0, 0
-			var logged []string
-			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(s string) { logged = append(logged, s) })
-			if open != tc.open || installs != tc.installs || starts != tc.starts {
-				t.Fatal("handover", open, installs, starts)
-			}
-			if want := []string{tc.logged}; tc.logged == "" {
-				if len(logged) != 0 {
-					t.Fatal("matching pins logged", logged)
-				}
-			} else if !reflect.DeepEqual(logged, want) {
-				t.Fatal("log", logged, want)
-			}
-		})
-	}
-}
-
-// DSM: /var/packages/<pkg>/target links to /volume1/@appstore/<pkg>.
-func TestInstallAnchoredFollowsTheDSMTargetLink(t *testing.T) {
-	ctx := context.Background()
-	anchor := hashBytes([]byte("new executor"))
-	appstore, info := anchoredPackage(t, "new executor", "approved policy", anchor)
-	link := filepath.Join(filepath.Dir(info), "linked-target")
-	if err := os.Symlink(filepath.Dir(appstore), link); err != nil {
-		t.Fatal(err)
-	}
-	runtime := realTestPath(t, t.TempDir())
-	os.WriteFile(filepath.Join(runtime, "executor"), []byte("approved executor"), 0700)
-	target := filepath.Join(link, "executor")
-	if state := packagePins(ctx, target, info, trustAll, hashBytes([]byte("approved executor")), hashBytes([]byte("approved policy"))); state != pinsAnchored {
-		t.Fatal("pin state", state)
-	}
-	if err := installAnchored(ctx, target, info, trustAll, runtime); err != nil {
-		t.Fatal("anchored executor behind the target link refused", err)
-	}
-	if b, _ := os.ReadFile(filepath.Join(runtime, "executor")); string(b) != "new executor" {
-		t.Fatal("installed", string(b))
-	}
-}

package/dist/templates/_executor/apppriv_review_test.go

@@ -1,28 +0,0 @@
-package main
-
-import (
-	"context"
-	"testing"
-)
-
-func TestReviewAppPrivRejectsAmbiguousOrError(t *testing.T) {
-	cases := map[string]string{
-		"outer error":                    `{"success":true,"error":{"code":105},"data":{"applications":[]}}`,
-		"inner error":                    `{"success":true,"data":{"applications":[],"error":{"code":105}}}`,
-		"duplicate array hides deny":     `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}],"applications":[]}}`,
-		"duplicate privilege hides deny": `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny","privilelge":"allow"}]}}`,
-		"duplicate app id":               `{"success":true,"data":{"applications":[{"app_id":"other","app_id":"app","privilelge":"allow"}]}}`,
-		"null error":                     `{"success":true,"data":{"applications":[],"error":null}}`,
-		"nonobject entry":                `{"success":true,"data":{"applications":[42]}}`,
-		"nested error":                   `{"success":true,"data":{"applications":[{"app_id":"other","privilelge":"allow","details":{"error":null}}]}}`,
-		"malformed entries":              `{"success":true,"data":{"applications":[null,{}]}}`,
-	}
-	for name, reply := range cases {
-		t.Run(name, func(t *testing.T) {
-			d := &liveDSM{Command: &cmdStub{reply: reply}}
-			if d.Allow(context.Background(), Subject{Username: "alice"}, "app", "") == nil {
-				t.Fatal("unsafe AppPriv response allowed")
-			}
-		})
-	}
-}

package/dist/templates/_executor/auth_presence_review_test.go

@@ -1,38 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-)
-
-func TestReviewEmptyPartialAuthMustNotBecomeWorkerRevoke(t *testing.T) {
-	for _, auth := range []string{`{"dsm_cookie":""}`, `{"dsm_synotoken":""}`, `{"dsm_cookie":"","dsm_synotoken":""}`, `null`} {
-		e, _, _ := setup(t)
-		id := create(t, e)
-		var req Request
-		p, _ := json.Marshal(map[string]string{"delegation_id": id, "job_id": "job1"})
-		raw := []byte(`{"v":1,"op":"delegate.revoke","auth":` + auth + `,"params":` + string(p) + `}`)
-		if err := strictJSON(raw, &req); err != nil {
-			t.Fatal(err)
-		}
-		if r := e.Handle(context.Background(), req); r.Code != "AUTH_DENIED" {
-			t.Errorf("partial auth %s became worker revoke: %+v", auth, r)
-		}
-	}
-}
-
-func TestWorkerRevokeRequiresAbsentOrEmptyAuthObject(t *testing.T) {
-	for _, auth := range []string{"", `,"auth":{}`} {
-		e, _, _ := setup(t)
-		id := create(t, e)
-		p, _ := json.Marshal(map[string]string{"delegation_id": id, "job_id": "job1"})
-		var req Request
-		if err := strictJSON([]byte(`{"v":1,"op":"delegate.revoke"`+auth+`,"params":`+string(p)+`}`), &req); err != nil {
-			t.Fatal(err)
-		}
-		if r := e.Handle(context.Background(), req); !r.OK {
-			t.Fatal("valid worker revoke denied", r)
-		}
-	}
-}

package/dist/templates/_executor/cancel_contract_test.go

@@ -1,236 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-// stubbornMoveWriter keeps copying after its context ends until released, like
-// a slow write syscall, so the canceling window can be observed.
-type stubbornMoveWriter struct {
-	copying, release, published chan struct{}
-	publishing, finishPublish   chan struct{}
-	once                        sync.Once
-}
-
-func (w *stubbornMoveWriter) let() { w.once.Do(func() { close(w.release) }) }
-
-func newStubbornWriter() *stubbornMoveWriter {
-	return &stubbornMoveWriter{copying: make(chan struct{}), release: make(chan struct{}), published: make(chan struct{})}
-}
-func (w *stubbornMoveWriter) Write(context.Context, Subject, string, string, string, string) error {
-	return nil
-}
-func (w *stubbornMoveWriter) Move(_ context.Context, _ Subject, op Operation, d Delegation, guard func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
-	close(w.copying)
-	<-w.release
-	return guard(func() (MoveReceipt, error) {
-		if w.publishing != nil {
-			close(w.publishing)
-			<-w.finishPublish
-		}
-		close(w.published)
-		return MoveReceipt{Path: d.Path + "/" + op.Name}, nil
-	})
-}
-
-func operationOf(t *testing.T, r Response) map[string]any {
-	t.Helper()
-	if !r.OK {
-		t.Fatal(r)
-	}
-	b, _ := json.Marshal(r.Result)
-	out := map[string]any{}
-	json.Unmarshal(b, &out)
-	return out
-}
-func wantOperation(t *testing.T, r Response, state, code, reason string) {
-	t.Helper()
-	out := operationOf(t, r)
-	got, _ := out["code"].(string)
-	why, _ := out["reason"].(string)
-	if out["state"] != state || got != code || why != reason {
-		t.Fatalf("want %s/%s/%s, got %v", state, code, reason, out)
-	}
-}
-func startedCopy(t *testing.T, e *Executor, w *stubbornMoveWriter, id, job string) {
-	t.Helper()
-	if err := e.startOperations(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	// Cleanups run in reverse: release the writer, then stop.
-	t.Cleanup(e.stopOperations)
-	t.Cleanup(w.let)
-	if r := offline(e, "files.moveFromStaging", moveParams(id, job)); !r.OK {
-		t.Fatal(r)
-	}
-	select {
-	case <-w.copying:
-	case <-time.After(2 * time.Second):
-		t.Fatal("copy did not start")
-	}
-}
-
-func TestCancelCopyingAcknowledgesDurablyUntilCanceled(t *testing.T) {
-	e, _, _ := setup(t)
-	id := longGrant(t, e)
-	w := newStubbornWriter()
-	e.Writer = w
-	startedCopy(t, e, w, id, "job")
-	ref := map[string]any{"delegation_id": id, "job_id": "job"}
-	for i := 0; i < 2; i++ {
-		// A repeated cancel after a lost reply returns the same acknowledgement.
-		wantOperation(t, offline(e, "files.cancelOperation", ref), "copying", "CANCEL_REQUESTED", "operation-canceled-by-user")
-	}
-	wantOperation(t, offline(e, "files.operationStatus", ref), "copying", "CANCEL_REQUESTED", "operation-canceled-by-user")
-	e.commitMu.Lock()
-	op, err := e.Store.GetOperation("job")
-	e.commitMu.Unlock()
-	if err != nil || op.CancelRequested != "operation-canceled-by-user" {
-		t.Fatal("cancel intent not durable", op, err)
-	}
-	w.let()
-	waitState(t, e, "job", "canceled")
-	select {
-	case <-w.published:
-		t.Fatal("published after cancel acknowledgement")
-	default:
-	}
-	wantOperation(t, offline(e, "files.cancelOperation", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
-	wantOperation(t, offline(e, "files.moveFromStaging", moveParams(id, "job")), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
-}
-
-func TestCancelRequestedCopySettlesCanceledAcrossStopAndCrash(t *testing.T) {
-	t.Run("stop-while-canceling", func(t *testing.T) {
-		e, _, _ := setup(t)
-		id := longGrant(t, e)
-		w := newStubbornWriter()
-		e.Writer = w
-		startedCopy(t, e, w, id, "job")
-		ref := map[string]any{"delegation_id": id, "job_id": "job"}
-		wantOperation(t, offline(e, "files.cancelOperation", ref), "copying", "CANCEL_REQUESTED", "operation-canceled-by-user")
-		stopped := make(chan struct{})
-		go func() { e.stopOperations(); close(stopped) }()
-		w.let()
-		<-stopped
-		if err := e.startOperations(context.Background()); err != nil {
-			t.Fatal(err)
-		}
-		defer e.stopOperations()
-		wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
-	})
-	for _, intent := range []bool{false, true} {
-		name := map[bool]string{false: "crash-before-publish", true: "crash-after-publish-intent"}[intent]
-		t.Run(name, func(t *testing.T) {
-			e, _, _ := setup(t)
-			id := longGrant(t, e)
-			op := Operation{Version: 1, Package: e.Policy.Package, ID: id, Job: "job", State: "copying", CancelRequested: "operation-canceled-by-user", PublishIntent: intent, Staging: "result", Name: "out.csv", Size: 123}
-			if e.Store.PutOperation(op) != nil {
-				t.Fatal("put")
-			}
-			w := newStubbornWriter()
-			e.Writer = w
-			if err := e.startOperations(context.Background()); err != nil {
-				t.Fatal(err)
-			}
-			defer e.stopOperations()
-			ref := map[string]any{"delegation_id": id, "job_id": "job"}
-			if intent {
-				// A publish that may have happened is never reported as canceled.
-				wantOperation(t, offline(e, "files.operationStatus", ref), "uncertain", "uncertain", "")
-				return
-			}
-			wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
-		})
-	}
-}
-
-func TestCancelBeforeAdmissionLeavesTombstoneThatIsNeverAdmitted(t *testing.T) {
-	e, f, _ := setup(t)
-	id := longGrant(t, e)
-	w := newStubbornWriter()
-	e.Writer = w
-	if err := e.startOperations(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	defer e.stopOperations()
-	ref := map[string]any{"delegation_id": id, "job_id": "job"}
-	if r := offline(e, "files.operationStatus", ref); r.Code != "operation-not-found" {
-		t.Fatal(r)
-	}
-	if r := offline(e, "files.cancelOperation", map[string]any{"delegation_id": strings.Repeat("f", 64), "job_id": "job"}); r.Code != "operation-not-found" {
-		t.Fatal("canceled under an unknown grant", r)
-	}
-	f.user.Username = "bob"
-	if r := request(e, "files.cancelOperation", ref); r.Code != "operation-not-found" {
-		t.Fatal("another owner canceled", r)
-	}
-	f.user.Username = "alice"
-	for i := 0; i < 2; i++ {
-		wantOperation(t, offline(e, "files.cancelOperation", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
-	}
-	// The original admission, arriving late or replayed, finds the tombstone.
-	for i := 0; i < 2; i++ {
-		wantOperation(t, offline(e, "files.moveFromStaging", moveParams(id, "job")), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
-	}
-	wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
-	other := map[string]any{"delegation_id": longGrant(t, e), "job_id": "job"}
-	if r := offline(e, "files.cancelOperation", other); r.Code != "operation-not-found" {
-		t.Fatal("tombstone answered another grant", r)
-	}
-	select {
-	case <-w.copying:
-		t.Fatal("canceled reference was copied")
-	case <-time.After(50 * time.Millisecond):
-	}
-}
-
-func TestCancelQueuedNeverCopies(t *testing.T) {
-	e, _, _ := setup(t)
-	id := longGrant(t, e)
-	w := newStubbornWriter()
-	e.Writer = w
-	startedCopy(t, e, w, id, "active")
-	if r := offline(e, "files.moveFromStaging", moveParams(id, "queued")); !r.OK {
-		t.Fatal(r)
-	}
-	ref := map[string]any{"delegation_id": id, "job_id": "queued"}
-	for i := 0; i < 2; i++ {
-		wantOperation(t, offline(e, "files.cancelOperation", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
-	}
-	w.let()
-	waitState(t, e, "active", "committed")
-	if op := waitState(t, e, "queued", "canceled"); op.Part != nil || op.PublishIntent {
-		t.Fatal("canceled queued operation copied", op)
-	}
-}
-
-func TestCancelRacingPublishReturnsCommitted(t *testing.T) {
-	e, _, _ := setup(t)
-	id := longGrant(t, e)
-	w := newStubbornWriter()
-	w.publishing, w.finishPublish = make(chan struct{}), make(chan struct{})
-	e.Writer = w
-	startedCopy(t, e, w, id, "job")
-	w.let()
-	<-w.publishing
-	reply := make(chan Response, 1)
-	go func() {
-		reply <- offline(e, "files.cancelOperation", map[string]any{"delegation_id": id, "job_id": "job"})
-	}()
-	select {
-	case r := <-reply:
-		t.Fatal("cancel answered inside the publish fence", r)
-	case <-time.After(50 * time.Millisecond):
-	}
-	close(w.finishPublish)
-	out := operationOf(t, <-reply)
-	if out["state"] != "committed" || out["receipt"] == nil || out["code"] != nil {
-		t.Fatal("cancel after publish must report committed", out)
-	}
-	waitState(t, e, "job", "committed")
-}

package/dist/templates/_executor/cmd/lifecycle/main.go

@@ -1,42 +0,0 @@
-// This helper runs as the package account, separately from the root executor.
-package main
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"path/filepath"
-	"time"
-
-	"synopkgland/executor/internal/lifecycle"
-)
-
-func main() {
-	if err := run(os.Args[1:]); err != nil {
-		fmt.Fprintln(os.Stderr, "executor lifecycle:", err)
-		os.Exit(1)
-	}
-}
-func run(args []string) error {
-	if len(args) == 0 {
-		return errors.New("start, stop or purge required")
-	}
-	action := args[0]
-	fs := flag.NewFlagSet("lifecycle", flag.ContinueOnError)
-	pkg := fs.String("package", "", "package account")
-	if err := fs.Parse(args[1:]); err != nil {
-		return err
-	}
-	if fs.NArg() != 0 {
-		return errors.New("unexpected arguments")
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Second)
-	defer cancel()
-	data := os.Getenv("SYNOPKG_PKGVAR")
-	if data == "" {
-		data = filepath.Join("/var/packages", *pkg, "var")
-	}
-	return lifecycle.Run(ctx, lifecycle.Config{Package: *pkg, Data: data, Socket: filepath.Join("/run/synopkgland", *pkg, "executor.sock"), Log: func(s string) { fmt.Fprintln(os.Stderr, s) }}, action)
-}

package/dist/templates/_executor/cookie_review_test.go

@@ -1,27 +0,0 @@
-package main
-
-import (
-	"context"
-	"testing"
-)
-
-func TestReviewCookieControlRejectedBeforeDSM(t *testing.T) {
-	for _, cookie := range []string{"sess\tion", "sess\x7fion", "sess\x01ion"} {
-		e, _, _ := setup(t)
-		if _, code := e.verified(context.Background(), Auth{Cookie: cookie, SynoToken: "token"}); code == "" {
-			t.Errorf("cookie control character accepted: %q", cookie)
-		}
-	}
-}
-
-func TestExecutorCookieRejectsEveryASCIIControl(t *testing.T) {
-	for c := 0; c <= 127; c++ {
-		if c >= 32 && c != 127 {
-			continue
-		}
-		e, _, _ := setup(t)
-		if _, code := e.verified(context.Background(), Auth{Cookie: "sess" + string(rune(c)) + "ion", SynoToken: "token"}); code != "AUTH_DENIED" {
-			t.Errorf("accepted control %d", c)
-		}
-	}
-}