@synopackageland/cli 0.8.0 → 0.9.0

package/dist/templates/_executor/internal/lifecycle/lifecycle_test.go

@@ -1,232 +0,0 @@
-package lifecycle
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestRequestPersistsOfflineWithoutScheduler(t *testing.T) {
-	for _, action := range []string{"stop", "purge"} {
-		t.Run(action, func(t *testing.T) {
-			root := t.TempDir()
-			// No executor ever ran: its socket directory does not exist.
-			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "run", "executor.sock")}
-			if err := Run(context.Background(), cfg, action); err != nil {
-				t.Fatal(err)
-			}
-			path := filepath.Join(root, "executor", "control")
-			b, err := os.ReadFile(path)
-			if err != nil || string(b) != action+"\n" {
-				t.Fatal(string(b), err)
-			}
-			info, _ := os.Stat(path)
-			if info.Mode().Perm() != 0600 {
-				t.Fatal(info.Mode())
-			}
-		})
-	}
-}
-func TestRequestWaitsForSocketAndTimeoutDoesNotBlockUninstall(t *testing.T) {
-	for _, action := range []string{"stop", "purge"} {
-		for _, timeout := range []bool{false, true} {
-			t.Run(action+"-"+map[bool]string{false: "confirmed", true: "timeout"}[timeout], func(t *testing.T) {
-				root := t.TempDir()
-				os.Mkdir(filepath.Join(root, "run"), 0750)
-				socket := filepath.Join(root, "run", "executor.sock")
-				os.WriteFile(socket, []byte{}, 0600)
-				warnings := []string{}
-				cfg := Config{Package: "TestApp", Data: root, Socket: socket, Log: func(s string) { warnings = append(warnings, s) }}
-				limit := 500 * time.Millisecond
-				if timeout {
-					limit = 50 * time.Millisecond
-				}
-				ctx, cancel := context.WithTimeout(context.Background(), limit)
-				defer cancel()
-				done := make(chan struct{})
-				if !timeout {
-					go func() {
-						defer close(done)
-						for {
-							if _, err := os.Stat(filepath.Join(root, "executor", "control")); err == nil {
-								// Pause closes the socket; purge ends with its directory.
-								if action == "purge" {
-									os.RemoveAll(filepath.Dir(socket))
-								} else {
-									os.Remove(socket)
-								}
-								return
-							}
-							select {
-							case <-ctx.Done():
-								return
-							case <-time.After(time.Millisecond):
-							}
-						}
-					}()
-				} else {
-					close(done)
-				}
-				if err := Run(ctx, cfg, action); err != nil {
-					t.Fatal("uninstall was blocked:", err)
-				}
-				<-done
-				if !timeout && len(warnings) != 0 {
-					t.Fatal("confirmation timed out", warnings)
-				}
-				if timeout && (len(warnings) != 1 || !strings.Contains(warnings[0], "timeout")) {
-					t.Fatal("missing warning", warnings)
-				}
-				if _, err := os.Stat(filepath.Join(root, "executor", "control")); err != nil {
-					t.Fatal("pending purge lost", err)
-				}
-			})
-		}
-	}
-}
-
-// A stopped package already paused the executor and removed its socket, so
-// preuninst's purge must wait for the root purge itself: the executor removes
-// its socket directory only after consuming purge. Returning earlier lets DSM
-// delete the mailbox before the paused monitor polls it.
-func TestPurgeOfPausedExecutorWaitsForSocketDirectoryRemoval(t *testing.T) {
-	root := t.TempDir()
-	dir := filepath.Join(root, "run")
-	os.Mkdir(dir, 0750)
-	cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(dir, "executor.sock")}
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	consumed := make(chan time.Time, 1)
-	go func() {
-		for ctx.Err() == nil {
-			if b, _ := os.ReadFile(filepath.Join(root, "executor", "control")); string(b) == "purge\n" {
-				time.Sleep(300 * time.Millisecond)
-				consumed <- time.Now()
-				os.RemoveAll(dir)
-				return
-			}
-			time.Sleep(time.Millisecond)
-		}
-	}()
-	if err := Run(ctx, cfg, "purge"); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case <-consumed:
-	default:
-		t.Fatal("purge returned before the executor removed its socket directory")
-	}
-	if ctx.Err() != nil {
-		t.Fatal("purge confirmation timed out")
-	}
-}
-
-func TestStopOfPausedExecutorDoesNotWaitForSocketDirectory(t *testing.T) {
-	root := t.TempDir()
-	dir := filepath.Join(root, "run")
-	os.Mkdir(dir, 0750)
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	if err := Run(ctx, Config{Package: "TestApp", Data: root, Socket: filepath.Join(dir, "executor.sock")}, "stop"); err != nil {
-		t.Fatal(err)
-	}
-	if ctx.Err() != nil {
-		t.Fatal("stop waited for the socket directory")
-	}
-}
-
-func TestRequestRejectsInvalidActionAndSymlink(t *testing.T) {
-	root := t.TempDir()
-	cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "socket")}
-	if Run(context.Background(), cfg, "resume") == nil {
-		t.Fatal("invalid action accepted")
-	}
-	os.Mkdir(filepath.Join(root, "executor"), 0700)
-	outside := filepath.Join(root, "outside")
-	os.WriteFile(outside, []byte("safe"), 0600)
-	os.Symlink(outside, filepath.Join(root, "executor", "control"))
-	if Run(context.Background(), cfg, "purge") == nil {
-		t.Fatal("symlink accepted")
-	}
-	b, _ := os.ReadFile(outside)
-	if string(b) != "safe" {
-		t.Fatal("outside changed")
-	}
-}
-
-func TestInaccessibleSocketDoesNotBlockStopOrUninstall(t *testing.T) {
-	// ENOTDIR is deterministic even under root, unlike chmod-based EACCES.
-	// Both are status inspection failures, not control-file write failures.
-	for _, action := range []string{"stop", "purge"} {
-		t.Run(action, func(t *testing.T) {
-			root := t.TempDir()
-			blocked := filepath.Join(root, "blocked")
-			os.WriteFile(blocked, []byte{}, 0600)
-			logged := false
-			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(blocked, "executor.sock"), Log: func(string) { logged = true }}
-			if err := Run(context.Background(), cfg, action); err != nil {
-				t.Fatal("socket inspection blocked lifecycle", err)
-			}
-			if !logged {
-				t.Fatal("missing inaccessible socket warning")
-			}
-			b, err := os.ReadFile(filepath.Join(root, "executor", "control"))
-			if err != nil || string(b) != action+"\n" {
-				t.Fatal(string(b), err)
-			}
-		})
-	}
-}
-
-func TestUnreadableSocketDirectoryStillPersistsStopAndPurge(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("EACCES requires an unprivileged process; ENOTDIR regression covers root")
-	}
-	for _, action := range []string{"stop", "purge"} {
-		t.Run(action, func(t *testing.T) {
-			root := t.TempDir()
-			dir := filepath.Join(root, "socket-dir")
-			os.Mkdir(dir, 0700)
-			os.WriteFile(filepath.Join(dir, "executor.sock"), nil, 0600)
-			os.Chmod(dir, 0)
-			defer os.Chmod(dir, 0700)
-			logged := false
-			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(dir, "executor.sock"), Log: func(string) { logged = true }}
-			if _, err := os.Lstat(cfg.Socket); !os.IsPermission(err) {
-				t.Fatal("fixture did not deny inspection", err)
-			}
-			if err := Run(context.Background(), cfg, action); err != nil {
-				t.Fatal("permission denial blocked lifecycle", err)
-			}
-			if !logged {
-				t.Fatal("missing warning")
-			}
-			b, err := os.ReadFile(filepath.Join(root, "executor", "control"))
-			if err != nil || string(b) != action+"\n" {
-				t.Fatal(string(b), err)
-			}
-		})
-	}
-}
-
-func TestStartWritesResumeWithoutWaitingForSocket(t *testing.T) {
-	root := t.TempDir()
-	socket := filepath.Join(root, "socket")
-	os.WriteFile(socket, []byte("still paused"), 0600)
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	started := time.Now()
-	if err := Run(ctx, Config{Package: "TestApp", Data: root, Socket: socket}, "start"); err != nil {
-		t.Fatal(err)
-	}
-	if time.Since(started) > 100*time.Millisecond {
-		t.Fatal("start waited for approval/socket")
-	}
-	b, err := os.ReadFile(filepath.Join(root, "executor/control"))
-	if err != nil || string(b) != "start\n" {
-		t.Fatal("missing resume request")
-	}
-}

package/dist/templates/_executor/internal/taskscript/boot.sh

@@ -1,31 +0,0 @@
-#!/bin/sh
-# synopkgland executor boot
-set -eu
-umask 77
-export PATH=/usr/bin:/bin
-p=@PACKAGE@
-q=/var/packages/$p
-s=$q/target/executor
-r=/usr/local/etc/synopkgland/$p
-d=$r/runtime
-o="--package $p"
-v(){ echo "$2@POLICY_DIGEST@  ${1}policy.json"|sha256sum -c - >/dev/null||{ logger digest;exit 1;};}
-a=purge
-if [ -d $q ];then
-a=stop
-[ "$(cat $q/var/executor/control)" != purge ] || { a=purge;[ -e $d ] || [ -L $d ] || { logger purged;exit 0;};}
-else [ -d $r ] || exit 0;fi
-mkdir -p -m 700 $d
-[ "$(find $d -maxdepth 0 -uid 0 -type d -perm 700)" = $d ]
-cd $d
-[ $a = stop ] || { v ./ "";exec ./executor control purge $o;}
-e=$(sed -n 's/^synopkgland_executor_sha256="\([0-9a-f]*\)"$/\1/p' $q/INFO)
-[ ${#e} = 64 ]
-cp $s/executor .executor
-cp $s/policy.json .policy.json
-v . "$e  .executor
-"
-chmod 700 .executor
-for f in executor policy.json;do mv .$f $f;done
-[ -e $s/../root ] && cp -R $s/../root .
-./executor control start $o

package/dist/templates/_executor/internal/taskscript/cmd/main.go

@@ -1,19 +0,0 @@
-// Canonical renderer used to check CLI/executor byte equivalence locally.
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"synopkgland/executor/internal/taskscript"
-)
-
-func main() {
-	if len(os.Args) != 3 {
-		os.Exit(2)
-	}
-	tasks, err := taskscript.Generate(os.Args[1], os.Args[2])
-	if err != nil {
-		os.Exit(1)
-	}
-	json.NewEncoder(os.Stdout).Encode(tasks)
-}

package/dist/templates/_executor/internal/taskscript/control.sh

@@ -1,31 +0,0 @@
-#!/bin/sh
-# synopkgland executor control
-set -eu
-umask 77
-export PATH=/usr/bin:/bin
-p=@PACKAGE@
-q=/var/packages/$p
-s=$q/target/executor
-r=/usr/local/etc/synopkgland/$p
-d=$r/runtime
-v(){ echo "$3@POLICY_DIGEST@  $1/$2policy.json"|sha256sum -c - >/dev/null || { logger digest;exit 1;};}
-mkdir -p -m 700 "$d"
-[ "$(find "$d" -maxdepth 0 -uid 0 -type d -perm 700)" = "$d" ]
-a=$(cat "$q/var/executor/control")
-case "$a" in start|stop|purge) ;; *) exit 1;; esac
-if [ "$a" = stop ]; then
-v "$d" '' ''
-exec "$d/executor" control stop --package "$p"
-fi
-# Root runs only executor bytes anchored in the root-owned INFO, under the approved policy.
-e=$(sed -n 's/^synopkgland_executor_sha256="\([0-9a-f]*\)"$/\1/p' "$q/INFO")
-[ ${#e} = 64 ] || { logger anchor;exit 1;}
-cp "$s/executor" "$d/.executor"
-cp "$s/policy.json" "$d/.policy.json"
-v "$d" . "$e  $d/.executor
-"
-chmod 700 "$d/.executor"
-[ "$a" = start ] || exec "$d/.executor" control purge --package "$p"
-for f in executor policy.json; do mv "$d/.$f" "$d/$f"; done
-[ -e "$s/../root" ] && cp -R "$s/../root" "$d"
-"$d/executor" control start --package "$p"

package/dist/templates/_executor/internal/taskscript/tasks.go

@@ -1,44 +0,0 @@
-// Package taskscript renders the canonical lifecycle scripts shared with the CLI.
-package taskscript
-
-import (
-	_ "embed"
-	"errors"
-	"regexp"
-	"strings"
-)
-
-//go:embed boot.sh
-var boot string
-
-//go:embed control.sh
-var control string
-
-type Task struct {
-	Kind   string `json:"kind"`
-	Name   string `json:"name"`
-	Header string `json:"header"`
-	Script string `json:"script"`
-}
-
-// Tasks pin only the approved policy. Executor bytes are anchored per SPK in the
-// root-owned package INFO, so an executor-only upgrade keeps both definitions.
-func Generate(pkg, pd string) ([]Task, error) {
-	if !regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`).MatchString(pkg) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(pd) {
-		return nil, errors.New("task pins")
-	}
-	replace := strings.NewReplacer("@PACKAGE@", pkg, "@POLICY_DIGEST@", pd)
-	tasks := []Task{}
-	for i, source := range []string{boot, control} {
-		kind, limit := "boot", 1024
-		if i == 1 {
-			kind, limit = "control", 6000
-		}
-		script := replace.Replace(source)
-		if len(script) > limit || strings.Contains(script, "%") {
-			return nil, errors.New("task script")
-		}
-		tasks = append(tasks, Task{kind, pkg + " executor " + kind, "#!/bin/sh\n# synopkgland executor " + kind + "\n", script})
-	}
-	return tasks, nil
-}

package/dist/templates/_executor/json_review_test.go

@@ -1,40 +0,0 @@
-package main
-
-import (
-	"testing"
-)
-
-func TestReviewCaseFoldedDuplicateAuthRejected(t *testing.T) {
-	for _, raw := range []string{
-		`{"v":1,"op":"delegate.list","auth":{"dsm_cookie":"a","DSM_COOKIE":"b","dsm_synotoken":"token"},"params":{}}`,
-		`{"v":1,"op":"delegate.list","auth":{"DSM_COOKIE":"a","dsm_synotoken":"token"},"params":{}}`,
-		`{"v":1,"op":"delegate.list","AUTH":{"dsm_cookie":"a","dsm_synotoken":"token"},"params":{}}`,
-		`{"v":1,"op":"files.list","auth":{},"params":{"path":"/home","PATH":"/other"}}`,
-		`{"v":1,"op":"files.list","auth":{},"params":{"PATH":"/home"}}`,
-		`{"v":1,"op":"files.list","auth":{},"Params":{}}`,
-	} {
-		var req Request
-		if strictJSON([]byte(raw), &req) == nil {
-			t.Errorf("ambiguous or case variant accepted: %s", raw)
-		}
-	}
-}
-func TestStrictJSONCaseInsensitiveKeysIncludeUnicodeFolds(t *testing.T) {
-	for _, raw := range []string{`{"key":1,"KEY":2}`, `{"s":1,"ſ":2}`, `{"k":1,"K":2}`} {
-		var out map[string]any
-		if strictJSON([]byte(raw), &out) == nil {
-			t.Errorf("case duplicate accepted: %s", raw)
-		}
-	}
-}
-
-func TestStrictJSONDirectCredentialAndParamsKeysAreCanonical(t *testing.T) {
-	var auth Auth
-	var params Params
-	if strictJSON([]byte(`{"DSM_COOKIE":"a"}`), &auth) == nil {
-		t.Fatal("uppercase direct auth key")
-	}
-	if strictJSON([]byte(`{"PATH":"/home"}`), &params) == nil {
-		t.Fatal("uppercase direct params key")
-	}
-}

package/dist/templates/_executor/lifecycle_test.go

@@ -1,97 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-)
-
-func TestFinishControlPurgesOfflineRuntimeGrantsAndStaleSocket(t *testing.T) {
-	root := t.TempDir()
-	state := filepath.Join(root, "state")
-	socket := filepath.Join(root, "socket")
-	for _, path := range []string{filepath.Join(state, "runtime"), filepath.Join(state, "delegations"), socket} {
-		os.MkdirAll(path, 0700)
-		os.WriteFile(filepath.Join(path, "stale"), []byte("data"), 0600)
-	}
-	if err := finishControl(state, filepath.Join(state, "runtime"), socket, true); err != nil {
-		t.Fatal(err)
-	}
-	for _, path := range []string{state, socket} {
-		if _, err := os.Lstat(path); !os.IsNotExist(err) {
-			t.Fatalf("remnant %s", path)
-		}
-	}
-	if err := finishControl(state, filepath.Join(state, "runtime"), socket, true); err != nil {
-		t.Fatal(err)
-	}
-}
-func TestFinishStopKeepsGrantsButRemovesSocketAndPurgeRejectsForeignRuntime(t *testing.T) {
-	root := t.TempDir()
-	state := filepath.Join(root, "state")
-	socket := filepath.Join(root, "socket")
-	os.MkdirAll(state, 0700)
-	os.MkdirAll(socket, 0700)
-	if err := finishControl(state, filepath.Join(state, "runtime"), socket, false); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(state); err != nil {
-		t.Fatal(err)
-	}
-	if err := finishControl(state, root, socket, true); err == nil {
-		t.Fatal("accepted foreign runtime")
-	}
-}
-
-func TestCreatedDirectoriesHonorModesUnderPrivateUmask(t *testing.T) {
-	root := t.TempDir()
-	old := syscall.Umask(0077)
-	defer syscall.Umask(old)
-	for _, mode := range []os.FileMode{0755, 0750, 0700} {
-		path := filepath.Join(root, fmt.Sprintf("dir-%o", mode))
-		info, err := createDirectory(path, mode, os.Geteuid(), os.Getegid())
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !directoryMatches(info, mode, os.Geteuid(), os.Getegid()) {
-			t.Fatal("umask corrupted directory contract", info.Mode())
-		}
-		if _, err := createDirectory(path, mode, os.Geteuid(), os.Getegid()); err == nil {
-			t.Fatal("existing directory was adopted")
-		}
-	}
-}
-func TestDirectoryValidationRejectsExistingWrongModeOwnerAndSymlink(t *testing.T) {
-	root := t.TempDir()
-	path := filepath.Join(root, "existing")
-	os.Mkdir(path, 0700)
-	info, _ := os.Lstat(path)
-	if directoryMatches(info, 0755, os.Geteuid(), os.Getegid()) {
-		t.Fatal("wrong mode accepted")
-	}
-	if directoryMatches(info, 0700, os.Geteuid()+1, os.Getegid()) {
-		t.Fatal("wrong owner accepted")
-	}
-	if directoryMatches(info, 0700, os.Geteuid(), os.Getegid()+1) {
-		t.Fatal("wrong group accepted")
-	}
-	link := path + "-link"
-	os.Symlink(path, link)
-	info, _ = os.Lstat(link)
-	if directoryMatches(info, 0700, os.Geteuid(), os.Getegid()) {
-		t.Fatal("symlink accepted")
-	}
-}
-
-// The legacy write child linked its own copy without waiting for serve, so an
-// orphan could still publish. Nothing spawns it since files.write moved to the
-// move child; neither it nor its cleanup child may run at all.
-func TestLegacyWriteChildrenAreNotCommands(t *testing.T) {
-	for _, child := range []string{"write-child", "cleanup-child"} {
-		if err := run([]string{child}); err == nil || err.Error() != "invalid command" {
-			t.Fatalf("%s: %v", child, err)
-		}
-	}
-}

package/dist/templates/_executor/link_linux.go

@@ -1,28 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"syscall"
-	"unsafe"
-)
-
-func linkOpenPart(part, dir *os.File, name string) error {
-	// /proc/self/fd/<fd> refers to the still-open inode. Following that one trusted
-	// proc link prevents a subject from swapping a guessed temporary pathname.
-	old, err := syscall.BytePtrFromString(fmt.Sprintf("/proc/self/fd/%d", part.Fd()))
-	if err != nil {
-		return err
-	}
-	new, err := syscall.BytePtrFromString(name)
-	if err != nil {
-		return err
-	}
-	_, _, errno := syscall.Syscall6(syscall.SYS_LINKAT, ^uintptr(99), uintptr(unsafe.Pointer(old)), dir.Fd(), uintptr(unsafe.Pointer(new)), 0x400, 0)
-	if errno != 0 {
-		return errno
-	}
-	return nil
-}