@synopackageland/cli 0.8.0 → 0.9.0

package/dist/templates/_executor/copy.go

@@ -1,64 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"errors"
-	"io"
-)
-
-// errParentGone means the move parent closed or broke the control pipe during
-// the copy: it exited or was killed, so no one can ever send publish.
-var errParentGone = errors.New("parent gone")
-
-type controlLine struct {
-	line string
-	err  error
-}
-
-// awaitControl reads the parent's next decision in the background. Pipe EOF
-// is the parent-death signal on every kernel, including 3.10, and unlike
-// PR_SET_PDEATHSIG it survives the child's identity drop and Go's threads.
-func awaitControl(r *bufio.Reader) <-chan controlLine {
-	next := make(chan controlLine, 1)
-	go func() {
-		line, err := r.ReadString('\n')
-		next <- controlLine{line, err}
-	}()
-	return next
-}
-
-// copyUnlessParentGone copies exactly size bytes, checking control between
-// chunks. The parent writes nothing during a copy, so any arrival ends it.
-func copyUnlessParentGone(out io.Writer, src io.Reader, size int64, control <-chan controlLine) error {
-	limited := io.LimitReader(src, size+1)
-	buf := make([]byte, 1<<20)
-	var n int64
-	for {
-		select {
-		case <-control:
-			return errParentGone
-		default:
-		}
-		m, err := limited.Read(buf)
-		if m > 0 {
-			if _, werr := out.Write(buf[:m]); werr != nil {
-				return werr
-			}
-			n += int64(m)
-		}
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return err
-		}
-	}
-	if n != size {
-		return errors.New("size mismatch")
-	}
-	return nil
-}
-
-func copyExact(out io.Writer, src io.Reader, size int64) error {
-	return copyUnlessParentGone(out, src, size, nil)
-}

package/dist/templates/_executor/copy_test.go

@@ -1,88 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"errors"
-	"io"
-	"os"
-	"testing"
-	"time"
-)
-
-type endlessZeros struct{ read int64 }
-
-func (z *endlessZeros) Read(p []byte) (int, error) {
-	clear(p)
-	z.read += int64(len(p))
-	return len(p), nil
-}
-
-// The move parent holds the child's control pipe open for the whole copy. If
-// the parent dies, the pipe closes and the child must stop copying at once
-// rather than fill a part file nobody can publish.
-func TestCopyStopsWhenParentClosesControl(t *testing.T) {
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer r.Close()
-	control := awaitControl(bufio.NewReader(r))
-	src := &endlessZeros{}
-	done := make(chan error, 1)
-	go func() { done <- copyUnlessParentGone(io.Discard, src, 1<<50, control) }()
-	time.Sleep(50 * time.Millisecond)
-	w.Close()
-	select {
-	case err := <-done:
-		if !errors.Is(err, errParentGone) {
-			t.Fatal("want errParentGone, got", err)
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatal("copy continued after the parent closed control")
-	}
-}
-
-// The parent never writes during the copy; anything arriving there is a
-// protocol violation and stops the copy too.
-func TestCopyStopsOnUnexpectedControlInput(t *testing.T) {
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer r.Close()
-	defer w.Close()
-	control := awaitControl(bufio.NewReader(r))
-	done := make(chan error, 1)
-	go func() { done <- copyUnlessParentGone(io.Discard, &endlessZeros{}, 1<<50, control) }()
-	w.Write([]byte("P\n"))
-	select {
-	case err := <-done:
-		if err == nil {
-			t.Fatal("copy accepted early control input")
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatal("copy ignored control input")
-	}
-}
-
-func TestCopyKeepsExactSizeAndLeavesDecisionForCaller(t *testing.T) {
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer r.Close()
-	control := awaitControl(bufio.NewReader(r))
-	var out bytes.Buffer
-	if err = copyUnlessParentGone(&out, bytes.NewReader(make([]byte, 3<<20)), 3<<20, control); err != nil || out.Len() != 3<<20 {
-		t.Fatal(out.Len(), err)
-	}
-	if copyUnlessParentGone(io.Discard, bytes.NewReader(make([]byte, 4)), 3, control) == nil {
-		t.Fatal("excess bytes accepted")
-	}
-	w.Write([]byte("P\n"))
-	if got := <-control; got.line != "P\n" || got.err != nil {
-		t.Fatal("decision lost", got)
-	}
-	w.Close()
-}

package/dist/templates/_executor/digest_review_test.go

@@ -1,120 +0,0 @@
-package main
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestReviewLargePackageHashDoesNotBlockShutdown(t *testing.T) {
-	dir, err := filepath.EvalSymlinks(t.TempDir())
-	if err != nil {
-		t.Fatal(err)
-	}
-	exe := filepath.Join(dir, "executor")
-	f, err := os.Create(exe)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err = f.Truncate(1 << 40); err != nil {
-		f.Close()
-		t.Skip(err)
-	}
-	f.Close()
-	os.WriteFile(filepath.Join(dir, "policy.json"), []byte("policy"), 0600)
-	ctx, cancel := context.WithCancel(context.Background())
-	entered := make(chan struct{})
-	done := make(chan error, 1)
-	go func() {
-		done <- manageService(ctx, make(chan string), func() (func(), error) { return func() {}, nil }, func(ctx context.Context) bool {
-			close(entered)
-			return samePackagePins(ctx, dir, strings.Repeat("a", 64), strings.Repeat("b", 64))
-		}, func() error { return nil })
-	}()
-	<-entered
-	time.Sleep(20 * time.Millisecond)
-	cancel()
-	blocked := false
-	select {
-	case <-done:
-	case <-time.After(50 * time.Millisecond):
-		blocked = true
-	}
-	os.Truncate(exe, 0)
-	if blocked {
-		<-done
-		t.Fatal("canceled monitor remains blocked hashing package-controlled file")
-	}
-}
-
-func TestDigestBoundsAndCancellation(t *testing.T) {
-	dir := realTestPath(t, t.TempDir())
-	for _, tc := range []struct {
-		name  string
-		limit int64
-	}{{"executor", maxExecutorBytes}, {"policy.json", maxPolicyBytes}} {
-		path := filepath.Join(dir, tc.name)
-		f, err := os.Create(path)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if err = f.Truncate(tc.limit + 1); err != nil {
-			t.Fatal(err)
-		}
-		f.Close()
-		if _, err = digestFile(context.Background(), path, tc.limit); err == nil {
-			t.Fatal("oversize file accepted")
-		}
-		os.WriteFile(path, []byte("valid"), 0600)
-		ctx, cancel := context.WithCancel(context.Background())
-		cancel()
-		if _, err = digestFile(ctx, path, tc.limit); err != context.Canceled {
-			t.Fatal("ignored cancellation", err)
-		}
-	}
-	if _, err := digestFile(context.Background(), dir, maxExecutorBytes); err == nil {
-		t.Fatal("directory accepted")
-	}
-	os.Symlink(filepath.Join(dir, "executor"), filepath.Join(dir, "link"))
-	if _, err := digestFile(context.Background(), filepath.Join(dir, "link"), maxExecutorBytes); err == nil {
-		t.Fatal("symlink accepted")
-	}
-}
-
-func TestLifecycleCancelsPendingPinCheck(t *testing.T) {
-	for _, action := range []string{"stop", "purge", "shutdown"} {
-		t.Run(action, func(t *testing.T) {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-			entered, canceled := make(chan struct{}), make(chan struct{})
-			actions := make(chan string)
-			done := make(chan error, 1)
-			go func() {
-				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil })
-			}()
-			<-entered
-			if action == "shutdown" {
-				cancel()
-			} else {
-				actions <- action
-			}
-			select {
-			case <-canceled:
-			case <-time.After(time.Second):
-				t.Fatal("pin check not canceled")
-			}
-			cancel()
-			select {
-			case err := <-done:
-				if err != nil {
-					t.Fatal(err)
-				}
-			case <-time.After(time.Second):
-				t.Fatal("monitor stuck")
-			}
-		})
-	}
-}

package/dist/templates/_executor/directories.go

@@ -1,40 +0,0 @@
-package main
-
-import (
-	"errors"
-	"os"
-	"syscall"
-)
-
-func directoryMatches(info os.FileInfo, mode os.FileMode, uid, gid int) bool {
-	st, ok := info.Sys().(*syscall.Stat_t)
-	return ok && info.IsDir() && info.Mode().Perm() == mode && int(st.Uid) == uid && int(st.Gid) == gid
-}
-
-// Only repair permissions on a directory this invocation created. mkdir's
-// requested mode is reduced by the inherited boot-task umask (normally 0077).
-func createDirectory(path string, mode os.FileMode, uid, gid int) (os.FileInfo, error) {
-	if err := os.Mkdir(path, mode); err != nil {
-		return nil, err
-	}
-	fd, err := syscall.Open(path, syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, err
-	}
-	f := os.NewFile(uintptr(fd), path)
-	defer f.Close()
-	if err = f.Chown(uid, gid); err != nil {
-		return nil, err
-	}
-	if err = f.Chmod(mode); err != nil {
-		return nil, err
-	}
-	info, err := f.Stat()
-	if err != nil {
-		return nil, err
-	}
-	if !directoryMatches(info, mode, uid, gid) {
-		return nil, errors.New("created directory permissions")
-	}
-	return info, nil
-}

package/dist/templates/_executor/dsm.go

@@ -1,369 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"net/http"
-	"net/url"
-	"os/user"
-	"path/filepath"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-)
-
-type Command interface {
-	Exec(context.Context, string, []string) ([]byte, error)
-}
-type Accounts interface{ Lookup(string) (Subject, error) }
-type localAccounts struct{}
-
-func (localAccounts) Lookup(name string) (Subject, error) {
-	var s Subject
-	u, err := user.Lookup(name)
-	if err != nil || u.Username != name {
-		return s, errors.New("account")
-	}
-	uid, err := strconv.Atoi(u.Uid)
-	if err != nil {
-		return s, err
-	}
-	gid, err := strconv.Atoi(u.Gid)
-	if err != nil {
-		return s, err
-	}
-	gs, err := u.GroupIds()
-	if err != nil {
-		return s, err
-	}
-	admin, err := user.LookupGroup("administrators")
-	if err != nil {
-		return s, err
-	}
-	s = Subject{Username: name, UID: uid, GID: gid, Home: u.HomeDir}
-	for _, v := range gs {
-		g, err := strconv.Atoi(v)
-		if err != nil {
-			return Subject{}, err
-		}
-		s.Groups = append(s.Groups, g)
-		if v == admin.Gid {
-			s.Admin = true
-		}
-	}
-	sort.Ints(s.Groups)
-	return s, nil
-}
-
-type HTTPDoer interface {
-	Do(*http.Request) (*http.Response, error)
-}
-type liveDSM struct {
-	Command  Command
-	Accounts Accounts
-	HTTP     HTTPDoer
-	Endpoint string
-}
-
-func newDSM() *liveDSM {
-	return &liveDSM{Command: processCommand{}, Accounts: localAccounts{}, HTTP: &http.Client{Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}, Endpoint: "http://127.0.0.1:5000/webapi/entry.cgi"}
-}
-
-type envelope struct {
-	Success bool            `json:"success"`
-	Data    json.RawMessage `json:"data"`
-}
-
-// dsmError keeps the DSM error code of a refused call; the message stays generic.
-type dsmError struct{ Code int }
-
-func (*dsmError) Error() string { return "DSM refused" }
-
-func decodeEnvelope(b []byte) (json.RawMessage, error) {
-	data, err := decodeSuccess(b)
-	if err == nil && (len(data) == 0 || string(data) == "null") {
-		return nil, &dsmError{}
-	}
-	return data, err
-}
-
-// decodeSuccess accepts a success without data: scheduler deletes answer
-// {"success":true}, sometimes with httpd_restart, and that confirms the delete.
-func decodeSuccess(b []byte) (json.RawMessage, error) {
-	var r envelope
-	d := json.NewDecoder(bytes.NewReader(b))
-	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success {
-		var refused struct {
-			Error struct {
-				Code int `json:"code"`
-			} `json:"error"`
-		}
-		json.Unmarshal(b, &refused)
-		return nil, &dsmError{Code: refused.Error.Code}
-	}
-	return r.Data, nil
-}
-func (d *liveDSM) Verify(ctx context.Context, cookie, token string) (string, error) {
-	form := url.Values{"api": {"SYNO.Core.NormalUser"}, "version": {"1"}, "method": {"get"}}
-	req, err := http.NewRequestWithContext(ctx, "POST", d.Endpoint, strings.NewReader(form.Encode()))
-	if err != nil {
-		return "", err
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	req.AddCookie(&http.Cookie{Name: "id", Value: cookie})
-	req.Header.Set("X-SYNO-TOKEN", token)
-	res, err := d.HTTP.Do(req)
-	if err != nil {
-		return "", errors.New("session")
-	}
-	defer res.Body.Close()
-	b, err := io.ReadAll(io.LimitReader(res.Body, maxRequest+1))
-	if err != nil || len(b) > maxRequest || res.StatusCode != 200 {
-		return "", errors.New("session")
-	}
-	data, err := decodeEnvelope(b)
-	if err != nil {
-		return "", err
-	}
-	var out struct {
-		Username string `json:"username"`
-	}
-	if json.Unmarshal(data, &out) != nil || out.Username == "" || strings.ContainsFunc(out.Username, func(r rune) bool { return r < 32 }) {
-		return "", errors.New("session")
-	}
-	return out.Username, nil
-}
-func (d *liveDSM) call(ctx context.Context, api, method, version, runner string, params map[string]any) (json.RawMessage, error) {
-	b, err := d.exec(ctx, api, method, version, runner, params)
-	if err != nil {
-		return nil, err
-	}
-	return decodeEnvelope(b)
-}
-
-// mutate runs a call whose success carries no data, such as a scheduler delete.
-func (d *liveDSM) mutate(ctx context.Context, api, method, version string, params map[string]any) error {
-	b, err := d.exec(ctx, api, method, version, "", params)
-	if err == nil {
-		_, err = decodeSuccess(b)
-	}
-	return err
-}
-func (d *liveDSM) exec(ctx context.Context, api, method, version, runner string, params map[string]any) ([]byte, error) {
-	args := []string{"--exec", "api=" + api, "method=" + method, "version=" + version}
-	if runner != "" {
-		args = append(args, "runner="+runner)
-	}
-	keys := make([]string, 0, len(params))
-	for k := range params {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		b, err := json.Marshal(params[k])
-		if err != nil {
-			return nil, err
-		}
-		args = append(args, k+"="+string(b))
-	}
-	b, err := d.Command.Exec(ctx, "/usr/syno/bin/synowebapi", args)
-	if err != nil {
-		if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
-			return nil, err
-		}
-		return nil, errors.New("DSM command")
-	}
-	return b, nil
-}
-func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
-	s, err := d.Accounts.Lookup(name)
-	if err != nil {
-		return s, err
-	}
-	data, err := d.call(ctx, "SYNO.Core.User", "get", "1", "", map[string]any{"name": name, "additional": []string{"expired"}})
-	if err != nil {
-		return Subject{}, err
-	}
-	var out struct {
-		Users []struct {
-			Name    string `json:"name"`
-			UID     *int   `json:"uid"`
-			Expired string `json:"expired"`
-		} `json:"users"`
-	}
-	if json.Unmarshal(data, &out) != nil || len(out.Users) != 1 || out.Users[0].Name != name || out.Users[0].UID == nil || *out.Users[0].UID != s.UID || out.Users[0].Expired != "normal" {
-		return Subject{}, errors.New("account ineligible")
-	}
-	s.Expired = out.Users[0].Expired
-	return s, nil
-}
-
-// Allow is the executor's offline App Privileges decision. It follows the CGI
-// EntryGate: administrators pass, admin-only refuses everyone else, and
-// app-privilege requires DSM's own allow. Preview lists only effective allows
-// (user, group and everyone rules), so an absent App is allowed only when the
-// package declares no entry mode and DSM therefore never manages its App.
-func (d *liveDSM) Allow(ctx context.Context, s Subject, app, entry string) error {
-	if !contains([]string{"", "admin-only", "app-privilege"}, entry) {
-		return errors.New("entry mode")
-	}
-	data, err := d.call(ctx, "SYNO.Core.AppPriv.App", "preview", "2", "", map[string]any{"username": s.Username})
-	if err != nil {
-		return err
-	}
-	// An explicit deny/custom entry or malformed/ambiguous response refuses.
-	var out struct {
-		Apps *[]json.RawMessage `json:"applications"`
-	}
-	if json.Unmarshal(data, &out) != nil || out.Apps == nil || app == "" {
-		return errors.New("app privilege")
-	}
-	count := 0
-	for _, raw := range *out.Apps {
-		var a struct {
-			ID        string `json:"app_id"`
-			Privilege string `json:"privilelge"`
-		}
-		if json.Unmarshal(raw, &a) != nil || a.ID == "" || !contains([]string{"allow", "deny", "custom"}, a.Privilege) {
-			return errors.New("app privilege entry")
-		}
-		if a.ID == app {
-			count++
-			if a.Privilege != "allow" {
-				return errors.New("app denied")
-			}
-		}
-	}
-	if count > 1 {
-		return errors.New("app ambiguous")
-	}
-	if entry == "" || s.Admin || entry == "app-privilege" && count == 1 {
-		return nil
-	}
-	return errors.New("app denied")
-}
-func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (string, error) {
-	if scope == "home" {
-		if !cleanPath(s.Home) || s.Home == "/" {
-			return "", errors.New("home")
-		}
-		return filepath.EvalSymlinks(s.Home)
-	}
-	if scopeVirtual(scope) == "" {
-		return "", errors.New("scope")
-	}
-	name := strings.TrimPrefix(scope, "shared:")
-	data, err := d.call(ctx, "SYNO.Core.Share", "get", "1", "", map[string]any{"name": name})
-	if err != nil {
-		return "", err
-	}
-	// DSM Share.get returns one share and its volume, not Share.list's array.
-	var out struct {
-		Name   string `json:"name"`
-		Volume string `json:"vol_path"`
-	}
-	if json.Unmarshal(data, &out) != nil || out.Name != name || !validSelectedScope(scope) || !cleanPath(out.Volume) || out.Volume == "/" {
-		return "", errors.New("share")
-	}
-	return filepath.EvalSymlinks(filepath.Join(out.Volume, out.Name))
-}
-func (d *liveDSM) API(ctx context.Context, runner, op string, p map[string]any) (json.RawMessage, error) {
-	if runner == "" {
-		return nil, errors.New("runner")
-	}
-	api, method := "", ""
-	version := "2"
-	params := map[string]any{}
-	switch op {
-	case "files.list":
-		api = "SYNO.FileStation.List"
-		method = "list"
-		params["folder_path"] = p["path"]
-	case "files.info":
-		api = "SYNO.FileStation.List"
-		method = "getinfo"
-		params["path"] = []any{p["path"]}
-	case "files.createFolder":
-		api = "SYNO.FileStation.CreateFolder"
-		method = "create"
-		params["folder_path"] = p["path"]
-		params["name"] = p["name"]
-		params["force_parent"] = false
-	case "files.checkPermission":
-		api = "SYNO.FileStation.CheckPermission"
-		method = "write"
-		version = "3"
-		params["path"] = p["path"]
-		params["filename"] = ".synopkgland-permission-probe"
-		params["overwrite"] = false
-		params["size"] = 0
-	default:
-		return nil, errors.New("operation")
-	}
-	data, err := d.call(ctx, api, method, version, runner, params)
-	if err != nil {
-		return nil, err
-	}
-	// Some File Station methods report per-file errors inside success:true.
-	if hasDSMError(data) {
-		return nil, errors.New("DSM file error")
-	}
-	var shape map[string]json.RawMessage
-	if json.Unmarshal(data, &shape) != nil {
-		return nil, errors.New("DSM data")
-	}
-	if op == "files.checkPermission" {
-		var skip *bool
-		if json.Unmarshal(shape["blSkip"], &skip) != nil || skip == nil || *skip {
-			return nil, errors.New("permission not confirmed")
-		}
-	} else {
-		key := "files"
-		if op == "files.createFolder" {
-			key = "folders"
-		}
-		var entries []json.RawMessage
-		if json.Unmarshal(shape[key], &entries) != nil || entries == nil {
-			return nil, errors.New("missing files")
-		}
-		if (op == "files.info" || op == "files.createFolder") && len(entries) != 1 {
-			return nil, errors.New("missing target")
-		}
-	}
-	return data, nil
-}
-func hasDSMError(data json.RawMessage) bool {
-	var v any
-	if json.Unmarshal(data, &v) != nil {
-		return true
-	}
-	var walk func(any) bool
-	walk = func(v any) bool {
-		switch x := v.(type) {
-		case map[string]any:
-			for k, v := range x {
-				if k == "error" {
-					return true
-				}
-				if k == "success" && v == false {
-					return true
-				}
-				if walk(v) {
-					return true
-				}
-			}
-		case []any:
-			for _, v := range x {
-				if walk(v) {
-					return true
-				}
-			}
-		}
-		return false
-	}
-	return walk(v)
-}