@synopackageland/cli 0.8.0 → 0.9.1

package/dist/templates/_executor/README.md

@@ -1,318 +0,0 @@
-# Protected executor
-
-Standalone, standard-library-only Go module. Build with `CGO_ENABLED=0 GOOS=linux
-GOARCH=amd64|arm64 go build -trimpath -o executor .`. No network listener: the
-package account uses `/run/synopkgland/<package>/executor.sock` (one JSON line,
-including newline at most 65536 bytes). Socket access additionally requires exact
-Linux SO_PEERCRED UID equality, even for another member of the package group.
-Non-Linux builds support portable tests and refuse privileged service operations.
-
-Fixed writer children verify `no_new_privs` with `PR_GET_NO_NEW_PRIVS` on their
-locked Linux thread. DSM kernel 4.4 supports this flag but omits its proc status
-field; a failed syscall or a value other than one still refuses the write.
-Saved IDs and zero capabilities remain mandatory. The parent passes the pinned
-package-owned private source as a read-only FD; destination creation and publish
-remain under the subject UID, and source cleanup runs under the package UID.
-
-## Protected inventory and policy
-
-Setup must copy the INFO-anchored executor, policy-pinned policy and root scripts into:
-
-```
-/usr/local/etc/synopkgland/<package>/             root:root 0700
-  runtime/                                     root:root 0700
-    executor                                   root:root 0700
-    policy.json                                root:root 0600
-    tasks.json                                 root:root 0600 (verified setup task inventory)
-    root/<name>.sh                             root:root 0600
-  delegations/                                 root:root 0700
-    <random-256-bit-id>.json                    root:root 0600
-    executor.pid                               root:root 0600
-    executor.log                               root:root 0600 (control start)
-```
-
-The runtime location is mandatory; `control purge` removes this package's entire
-protected inventory after stopping it. The parent `/usr/local/etc/synopkgland`
-may be root:root 0755. Ancestors must be root-owned and not group/world writable;
-symlinks and writable runtime files are refused. Neither package-owned `etc` nor
-package `var` is trusted for executor code or delegation storage. The chosen path
-was measured on vt-nas DSM 7.4; survival of future DSM updates remains unverified.
-
-`policy.json` has this strict schema (no unknown keys):
-
-```json
-{
-  "v": 1,
-  "package": "com.example.downloader",
-  "app": "com.example.downloader.Application",
-  "scope": "home",
-  "operations": [
-    "status", "delegate.create", "delegate.list", "delegate.revoke",
-    "files.list", "files.info", "files.createFolder",
-    "files.checkPermission", "files.write", "root.run"
-  ],
-  "root": {"whoami": "<64 lowercase hexadecimal SHA-256 digits>"}
-}
-```
-
-`app` is the actual registered DSM AppPriv application ID, not a guessed package
-ID. DSM 7.x omits default-allowed Apps from AppPriv preview; an absent
-entry in a valid applications array is allowed. Explicit deny/custom, duplicate
-entries and malformed responses are refused. Account eligibility is rechecked
-independently, so absence never bypasses a disabled account. `scope` is the
-manifest's fixed `home` or `shared:<share-name>`; omit it for root-only packages.
-`operations` includes every permitted ID, including management and status IDs;
-no implicit allowlist exemptions. `root` is omitted when root operations are
-disabled. Only names in this digest map can execute. Setup pins policy bytes and
-all root scripts; no policy data comes from the package socket. The caller authentication pair follows the coordinator-approved v6 update to PLAN §2.4.
-
-## Requests
-
-Every request: `{"v":1,"op":"...","auth":{},"params":{...}}` followed by
-newline. `auth.dsm_cookie` is only the DSM `id` value, never a raw Cookie header.
-Caller requests also require `auth.dsm_synotoken`, forwarded from the current
-HTTP request's X-SYNO-TOKEN or SynoToken header. Both aliases may be present
-when their values match; conflicting aliases or repeated values of either header
-are refused. Local NormalUser verification
-sends both the id cookie and X-SYNO-TOKEN; neither value enters logs or storage.
-Only the executor's local DSM NormalUser HTTP result establishes identity. Other
-identity fields, duplicate JSON keys, invalid UTF-8, unrelated parameters, unknown
-operations and policy-excluded operations are rejected. Replies follow §2.4.
-
-| Operation | Parameters | Result |
-| --- | --- | --- |
-| status | none | executor_digest, policy_digest, version, ready, disabled |
-| delegate.create | job_id, ops[], scope, path, ttl_seconds | delegation_id, subject {username, uid}, expires_at (RFC3339) |
-| delegate.list | none | delegations[] with public metadata, including revoked/expired records |
-| delegate.revoke | delegation_id; job_id required without cookie | revoked |
-| files.list, files.info, files.checkPermission | delegation_id, job_id, path | DSM data object |
-| files.createFolder | delegation_id, job_id, path (parent), name | DSM data object |
-| files.write | delegation_id, job_id, staging (relative), dest_dir, name | path |
-| root.run | name | output (stdout and stderr combined) |
-
-Create/list require a cookie and SynoToken. Revoke accepts the subject/admin session pair or a matching
-package job ID. Root operations require the session pair independently verified as an
-active administrators member. Delegated operations recheck the account, UID,
-expired=`normal`, App and File Station privileges, scope,
-job, operation, expiry and revocation. UIDs below 1024 are excluded as system
-accounts. TTL must be 1–2592000 seconds. No cookie/SynoToken/SID/password is persisted.
-
-Paths use File Station spellings `/home[/...]` or `/<share>[/...]`. A delegation
-binds the requested directory's canonical path. Symlinks resolving outside that
-directory are denied. `files.write` opens package-owned, singly linked regular
-staging files with no symlink components; its fresh child checks setgroups,
-setresgid and setresuid in order, then real/effective/saved/filesystem IDs and groups, empty capability sets and
-`no_new_privs`. Admin users retain their own nonzero UID and current groups. The child
-opens the destination after dropping identity, verifies its pinned directory and
-scope, and copies into an exclusive hidden `.synopkgland-<job_id>-<random>.part`
-file. After fsync it publishes the complete file with a hard link, then removes
-the temporary name. Existing files and symlinks are never overwritten. The
-executor cleans the exact temporary name as the subject user after a canceled or
-killed child, using a retained directory descriptor; startup performs no scan.
-Successful writes request exact source cleanup in a separate package-UID child;
-cleanup failure retains the source and never downgrades a committed receipt. DSM ACL inheritance can
-produce a mode different from the requested 0600 (observed 0711 on vt-nas).
-
-File Station CheckPermission uses v3 with a fixed non-overwriting probe filename
-and size zero; it creates no file. Missing/failed API data is denied. DSM output
-and root script output are capped at 1 MiB; commands have 20-second deadlines,
-connection read/write deadlines are 15/5 seconds and request execution is bounded
-by 30 seconds. At most 16 connections are admitted. Legacy runner APIs use short
-admission leases; revoke/disable persist the fence then drain accepted legacy
-calls outside the commit lock before acknowledging. Bulk copy holds no commit
-lock. Linux command timeouts kill the entire command process group.
-
-File Station APIs resolve path strings inside DSM after executor scope validation;
-there is no atomic DSM API for binding that subsequent lookup to our directory
-FD. Concurrent subject-controlled directory renames remain a scope-race limitation
-for runner API operations. The writer uses pinned directory descriptors; a user
-can still move a directory after its final scope check. These are release review
-items, not assertions of complete race freedom.
-
-## Lifecycle and checks
-
-```
-executor serve --package com.example.downloader
-executor supervise --package com.example.downloader
-executor control start --package com.example.downloader
-executor control stop --package com.example.downloader
-executor control purge --package com.example.downloader
-```
-
-Root control start launches asynchronously; the caller reads socket status to
-establish readiness. It starts `executor supervise`, a root supervisor that runs
-`serve` as its child and restarts it after an abnormal end (signal or non-zero
-exit) with a 1 s backoff doubling to 60 s, reset after a minute of healthy run.
-A restarted `serve --revived` honors a `stop` already in the mailbox. Exit 0
-(root replacement, shutdown, purge), exit 3 (another monitor holds the pidfile)
-or a removed runtime end supervision. A held flock pidfile refuses duplicate
-serve. Root's pinned
-boot/control start can validate and terminate a previous monitor before launching
-its replacement; package-account start only writes the mailbox and cannot replace
-runtime. Stop pauses the listener while the monitor continues. Purge removes this
-package's protected state and deletes only its verified recorded scheduler tasks.
-
-Run `go test -race ./...` and `bash scripts/ci/gate.sh native-go`. The gate adds
-Linux amd64/arm64 vet, static binary builds and test compilation. Linux-specific
-syscall tests require a disposable Linux root fixture. This revision was tested
-on a Linux VM; DSM ACL, logout and reboot behavior remain unverified. The
-`testdata/live_probe.py` harness expects isolated disposable accounts and a
-manually copied runtime, reads passwords only from stdin, and logs no credentials.
-The live harness uses DSM's registered `SYNO.Desktop` AppPriv ID as a stand-in for
-an installed App; installed-package AppPriv integration belongs to setup testing.
-
-
-## Package lifecycle
-
-Package-account hooks atomically write `stop` before upgrades/stops, `start` on
-install/upgrade completion and package start, and `purge` before uninstall.
-`stop` cancels/drains requests and removes the listener without ending the root
-monitor. `start` resumes if both package executor and policy hashes equal the approved
-runtime pins. If only the executor changed, the policy hash is unchanged and the
-executor hash equals the single `synopkgland_executor_sha256` key in the
-root-owned `/var/packages/<package>/INFO`, the root monitor copies it into
-`runtime/`, verifies the copy and runs root `control start`, which replaces the
-monitor without reapproval. Any other change stays paused for administrator
-approval. Only root's pinned boot/control path or this anchored install can
-replace a monitor or runtime. To exercise this path on a NAS without a real
-executor change, the repository's `scripts/test/executor-bump.py` makes a
-build+1 SPK whose executor differs by one byte and rewrites the INFO anchor,
-`executor/setup.json` and the window script's embedded pins together.
-
-At start, scheduler readback must exactly match the canonical lifecycle scripts
-regenerated from the package identity and approved policy pin. Package
-setup metadata supplies hints only. The verified names, pins and script hashes
-are stored in root:root 0600 `runtime/tasks.json`. Purge regenerates the scripts
-and revalidates each current definition before EventScheduler v1
-delete (`task_name`) or TaskScheduler v2 delete (`tasks=[{id,real_owner}]`).
-Boot mirrors from TaskScheduler are ignored. Changed, missing, ambiguous or
-unverifiable records are logged and retained for administrator review; protected
-runtime, delegations and sockets are still removed, then the monitor exits.
-An absent process does not block uninstall; the pinned boot task handles pending
-purge or a missing package on the next boot. If the retained binary/policy is
-missing or tampered with, boot refuses execution and requires manual review.
-
-
-The separate package-account `executor/lifecycle` helper writes an atomic 0600
-mailbox request. Stop/purge wait at most 50 seconds for socket disappearance;
-start returns after writing and lets the monitor verify pins asynchronously.
-The helper never calls synowebapi or TaskScheduler. Socket inspection failures
-and timeouts warn and permit lifecycle to continue. Write/validation failures
-remain errors. Delegate hooks attempt worker stop first; a worker stop failure
-warns and still requests executor pause/purge.
-
-The monitor polls every 500 ms with bounded regular-file reads, accepting only
-exact start/stop/purge (optionally one trailing newline). Invalid values are
-ignored and logged without logging contents. The preuninst `purge` mailbox is
-handled immediately; cleanup completes asynchronously. Package directory/INFO
-identity absence is a fallback: the monitor pauses the socket and requests,
-retains runtime/delegations/tasks, and purges only after 10 continuous minutes of
-confirmed absence, even while paused. Every poll checks again; a valid identity
-resets the timer, and an unreadable path cannot count as confirmed absence.
-Reappearance re-reads the mailbox, including an unchanged `start`: matching pins
-resume, changed pins stay paused for administrator approval, `stop` stays paused,
-and `purge` clears state immediately. A root-approved new monitor ignores the
-stop file already present at startup; that exception ends after an absence.
-
-The boot task checks pending purge/package disappearance before accessing source.
-It verifies the retained policy pin before offline purge from the root-only
-runtime. Normal boot verifies the copies against the policy pin and the INFO
-executor anchor, installs them and calls root control start to replace a
-previous monitor. Scripts stay within 1 KiB with no percent characters, including the
-longest package name. Partial/tampered retained state requires administrator
-review. All nine uninstall wizard locales name the two tasks and disclose the
-retained DSM storage/infrastructure. `inspect`/`status` cleanup guidance is
-conditional; it does not claim that remote remnants were observed.
-
-Directories newly created by the executor are explicitly chowned/chmodded through
-a directory descriptor and verified with fstat, so boot umask 0077 cannot reduce
-/run/synopkgland 0755 or its package directory 0750. Existing directories are
-validated and never repaired/adopted. The package directory must already have
-root/package-group ownership. The socket is set to root/package-group 0660 and
-verified using Linux O_PATH + fstat on its filesystem inode.
-
-## Explicit long-running v1 extension
-
-The pinned policy opts in with top-level `destinations: ["save"]` and
-`lifetime: "until-revoked"`, together with `files.moveFromStaging` in the
-operation allowlist. Destination keys match `^[a-z][a-z0-9_-]{0,63}$`; unknown
-keys/lifetimes fail closed. Legacy policies/TTL grants never become permanent.
-The existing v1 envelope, peer UID check, protected runtime and session verifier
-remain unchanged. `root.run` is independent and is never a writer fallback.
-
-| Operation | Parameters | Result |
-| --- | --- | --- |
-| delegate.create (permanent) | scope, ops:[files.moveFromStaging], path, destination, lifetime:until-revoked | delegation_id, subject, path, destination, lifetime; zero expiry |
-| files.moveFromStaging | delegation_id, job_id, staging, name, size | job_id, state |
-| files.operationStatus | original delegation_id, job_id | job_id, state, optional code/receipt |
-| files.cancelOperation | original delegation_id, job_id | current operation state |
-| delegate.disable / delegate.enable | none; live administrator session | disabled |
-| delegate.audit | none; live owner/admin session | latest bounded events |
-
-Permanent create needs the current user's cookie and SynoToken and a successful
-File Station write check. The executor derives username/UID and exact directory
-identity itself. Permanent revoke is owner-bound even for administrators; admins
-can disable the entire package. Auth-less operation submission/status/cancel is
-for the trusted package producer holding the grant reference and original job ID.
-If credentials are supplied, both must verify and the owner must match; failed
-caller auth never falls back to offline authority. A compromised package backend
-can use all valid grants it holds, as documented in the approved trust model.
-
-Grants survive service restart in the protected store. The disabled flag also
-survives; mailbox start/boot never clears it. Disable persists first and revokes
-all legacy/permanent grants. Enable checks the live admin session and completes
-revocation before clearing the flag; it never restores old grants. Repeated enable
-while already enabled is a no-op.
-
-Operations are separate `operation-<sha256(job_id)>.record` files, root:root 0600.
-They bind immutable grant/job/staging/name/size and move through queued, copying,
-committed, canceled, interrupted or uncertain. Queued resumes without credentials;
-copying becomes interrupted on restart, or uncertain after durable publish intent.
-Neither state is replayed. Changed input for the same job is `operation-conflict`.
-Committed status alone includes `receipt:{path,size}`. Cleanup failures retain
-committed and add `CLEANUP_PENDING`. No same-name/hash guessing establishes receipt.
-
-Limits: 16 GiB per file, actual size+1 read, 16 queued, one active copy per package,
-24-hour attempt, 10 MiB operation metadata. Full journals reject new admissions;
-terminal records are retained to prevent replay. Bulk input bypasses job spools
-and the old 64 MiB wrapper limit. Long copies revalidate account/AppPriv/ACL/path
-with five-second polling and bounded checks; publish revalidates again. A failed
-identity/ACL/path check invalidates the grant and requires a new selection.
-
-The fixed child drops identity before opening the destination and creating any
-inode. Every component uses FD-relative O_NOFOLLOW; ancestors use O_PATH so only
-search rights are required. Source is package-owned, regular and singly linked;
-destination is the exact granted device/inode, never a caller-supplied path.
-Part metadata is durable before copying. Publish links the open part inode with
-no replacement, refusing files/symlinks/FIFOs at the final name. Revoke, disable
-and publish share the commit lock. Lost/malformed publish replies drain the child
-before releasing that lock and produce uncertain; a confirmed no-side-effect
-refusal such as `destination-exists` remains interrupted. The lock covers bounded
-publish handshake/fsync, never the bulk copy. During the copy the child watches
-its control pipe: if `serve` dies the pipe closes, so the child stops within one
-1 MiB chunk and unlinks its part (no `PR_SET_PDEATHSIG`, which the identity drop
-clears; works on kernel 3.10). Kernel-blocked filesystem I/O can
-still delay draining; it cannot be declared safely complete by a timeout.
-Legacy `files.write` uses this same child and publish handshake; the executor
-has no other writer, so no child can publish after `serve` is gone.
-
-Destination/part cleanup runs as the owner; source cleanup runs as package UID.
-Restart cleans only journaled exact part identity as the current eligible owner;
-changed/missing/inaccessible directories are retained for review, never scanned
-or deleted as root. Subject-controlled directory moves after the final check
-can still complete in the pinned directory object. DSM ACL changes and publication
-are not atomic, and silent UID/inode reuse is not universally detected. A subject
-who owns the destination can mutate its own output; this is not a content sandbox.
-
-Structured audit lives in protected `audit.jsonl`/`audit.previous`, at most 50 MiB
-combined, separate from authority. Events include package, username/UID, operation,
-job, location and result; no session credentials. Owner queries are filtered,
-admins can view this package's events. Replies contain at most 256 events/1 MiB.
-Admission events are labeled `admitting` because a subsequent durable write can
-fail. The operation journal, not an admission audit event, establishes completion.
-
-The existing status operation reads `Store.Disabled`; protected-store errors set
-`ready:false` rather than assuming enabled. Backend `delegate.status` exposes the
-verified boolean and `disabled` capability state. Backend `delegate.operations.list`
-is strictly empty-params, freshly owner/UID-filtered move-mirror metadata; it is
-not an executor operation. Live completion remains `files.operationStatus`.

package/dist/templates/_executor/anchor.go

@@ -1,156 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"syscall"
-)
-
-// Package Center writes the SPK INFO as root. The package account cannot change
-// it, so its executor digest authorizes executor-only upgrades under the
-// administrator-approved policy without a new PasswordConfirm.
-const executorAnchorKey = "synopkgland_executor_sha256"
-
-var anchorRE = regexp.MustCompile(`^"([a-f0-9]{64})"$`)
-
-type pinState int
-
-const (
-	pinsDiffer pinState = iota
-	pinsMatch
-	pinsAnchored
-)
-
-func executorAnchor(info string, trusted func(os.FileInfo) bool) (string, error) {
-	b, stat, err := readLifecycleFile(info, 65536)
-	if err != nil {
-		return "", err
-	}
-	if !trusted(stat) {
-		return "", errors.New("untrusted package INFO")
-	}
-	anchor := ""
-	for _, line := range strings.Split(string(b), "\n") {
-		value, ok := strings.CutPrefix(line, executorAnchorKey+"=")
-		if !ok {
-			continue
-		}
-		m := anchorRE.FindStringSubmatch(value)
-		if m == nil || anchor != "" {
-			return "", errors.New("executor anchor")
-		}
-		anchor = m[1]
-	}
-	if anchor == "" {
-		return "", errors.New("executor anchor")
-	}
-	return anchor, nil
-}
-
-func rootOwnedReadOnly(info os.FileInfo) bool {
-	return ownedByRoot(info) && info.Mode().Perm()&0022 == 0
-}
-
-func packagePins(ctx context.Context, dir, info string, trusted func(os.FileInfo) bool, executorDigest, policyDigest string) pinState {
-	if samePackagePins(ctx, dir, executorDigest, policyDigest) {
-		return pinsMatch
-	}
-	dir, err := filepath.EvalSymlinks(dir)
-	if err != nil {
-		return pinsDiffer
-	}
-	if pd, err := digestFile(ctx, dir+"/policy.json", maxPolicyBytes); err != nil || pd != policyDigest {
-		return pinsDiffer
-	}
-	anchor, err := executorAnchor(info, trusted)
-	if err != nil {
-		return pinsDiffer
-	}
-	if ed, err := digestFile(ctx, dir+"/executor", maxExecutorBytes); err != nil || ed != anchor {
-		return pinsDiffer
-	}
-	return pinsAnchored
-}
-
-// The policy is unchanged, so root scripts (pinned by policy digests) stay too.
-// Verify the protected copy, never the package-reachable source.
-func installAnchored(ctx context.Context, source, info string, trusted func(os.FileInfo) bool, runtime string) error {
-	anchor, err := executorAnchor(info, trusted)
-	if err != nil {
-		return err
-	}
-	// DSM links the package target to the volume; openRegular refuses links.
-	source, err = filepath.EvalSymlinks(source)
-	if err != nil {
-		return err
-	}
-	src, err := openRegular(filepath.Join(source, "executor"))
-	if err != nil {
-		return err
-	}
-	defer src.Close()
-	stat, err := src.Stat()
-	if err != nil || stat.Size() > maxExecutorBytes {
-		return errors.New("executor size")
-	}
-	staged, err := os.CreateTemp(runtime, ".executor-")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(staged.Name())
-	err = copyExact(staged, src, stat.Size())
-	if err == nil {
-		err = staged.Chmod(0700)
-	}
-	if err == nil {
-		err = staged.Sync()
-	}
-	if closeErr := staged.Close(); err == nil {
-		err = closeErr
-	}
-	if err != nil {
-		return err
-	}
-	if digest, err := digestFile(ctx, staged.Name(), maxExecutorBytes); err != nil || digest != anchor {
-		return errors.New("executor anchor mismatch")
-	}
-	return os.Rename(staged.Name(), filepath.Join(runtime, "executor"))
-}
-
-// Root control start replaces this monitor with the newly installed runtime.
-func startInstalled(runtime, pkg string) error {
-	cmd := exec.Command(filepath.Join(runtime, "executor"), "control", "start", "--package", pkg)
-	cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
-	cmd.Dir = "/"
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	return cmd.Process.Release()
-}
-
-// An anchored upgrade is handed to root start, which replaces this monitor:
-// only differing pins are an approval request, and only they say so.
-func approvedPins(state pinState, install, start func() error, log func(string)) bool {
-	if state == pinsDiffer {
-		log("executor paused: package pins require administrator approval")
-	}
-	if state != pinsAnchored {
-		return state == pinsMatch
-	}
-	if err := install(); err != nil {
-		log("executor upgrade refused: INFO-anchored executor could not be installed")
-		return false
-	}
-	if err := start(); err != nil {
-		log("executor upgrade installed; root start failed")
-		return false
-	}
-	log("executor upgrade: INFO-anchored executor installed under the approved policy")
-	return false
-}

package/dist/templates/_executor/anchor_test.go

@@ -1,161 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-func trustAll(os.FileInfo) bool { return true }
-
-// anchoredPackage writes a target executor/policy pair and the package INFO.
-func anchoredPackage(t *testing.T, executor, policy string, anchors ...string) (target, info string) {
-	t.Helper()
-	pkg := realTestPath(t, t.TempDir())
-	target = filepath.Join(pkg, "target", "executor")
-	os.MkdirAll(target, 0755)
-	os.WriteFile(filepath.Join(target, "executor"), []byte(executor), 0755)
-	os.WriteFile(filepath.Join(target, "policy.json"), []byte(policy), 0644)
-	text := "package=\"TestApp\"\n"
-	for _, a := range anchors {
-		text += "synopkgland_executor_sha256=\"" + a + "\"\n"
-	}
-	info = filepath.Join(pkg, "INFO")
-	os.WriteFile(info, []byte(text), 0644)
-	return target, info
-}
-
-func TestExecutorAnchorRequiresOneLowercaseDigestInTrustedINFO(t *testing.T) {
-	digest := hashBytes([]byte("new executor"))
-	_, info := anchoredPackage(t, "new executor", "policy", digest)
-	if got, err := executorAnchor(info, trustAll); err != nil || got != digest {
-		t.Fatal("anchor", got, err)
-	}
-	if _, err := executorAnchor(info, func(os.FileInfo) bool { return false }); err == nil {
-		t.Fatal("package-writable INFO accepted")
-	}
-	for name, anchors := range map[string][]string{"missing": nil, "duplicate": {digest, digest}, "uppercase": {strings.ToUpper(digest)}, "short": {digest[:63]}} {
-		_, info := anchoredPackage(t, "new executor", "policy", anchors...)
-		if _, err := executorAnchor(info, trustAll); err == nil {
-			t.Fatal(name, "anchor accepted")
-		}
-	}
-}
-
-func TestPackagePinsAcceptAnExecutorUpgradeOnlyUnderTheApprovedPolicyAndINFOAnchor(t *testing.T) {
-	ctx := context.Background()
-	ed, pd := hashBytes([]byte("approved executor")), hashBytes([]byte("approved policy"))
-	upgraded := hashBytes([]byte("new executor"))
-	for _, tc := range []struct {
-		name, executor, policy string
-		anchors                []string
-		want                   pinState
-	}{
-		{"same bytes", "approved executor", "approved policy", nil, pinsMatch},
-		{"anchored executor", "new executor", "approved policy", []string{upgraded}, pinsAnchored},
-		{"unanchored executor", "new executor", "approved policy", nil, pinsDiffer},
-		{"different anchor", "new executor", "approved policy", []string{ed}, pinsDiffer},
-		{"changed policy", "new executor", "wider policy", []string{upgraded}, pinsDiffer},
-		{"changed policy only", "approved executor", "wider policy", []string{ed}, pinsDiffer},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			target, info := anchoredPackage(t, tc.executor, tc.policy, tc.anchors...)
-			if got := packagePins(ctx, target, info, trustAll, ed, pd); got != tc.want {
-				t.Fatal("pin state", got)
-			}
-		})
-	}
-}
-
-func TestInstallAnchoredReplacesOnlyTheProtectedExecutorWithVerifiedBytes(t *testing.T) {
-	ctx := context.Background()
-	for _, anchored := range []bool{true, false} {
-		t.Run(map[bool]string{true: "anchored", false: "swapped after check"}[anchored], func(t *testing.T) {
-			anchor := hashBytes([]byte("new executor"))
-			target, info := anchoredPackage(t, "new executor", "approved policy", anchor)
-			if !anchored {
-				os.WriteFile(filepath.Join(target, "executor"), []byte("package swapped"), 0755)
-			}
-			runtime := realTestPath(t, t.TempDir())
-			os.WriteFile(filepath.Join(runtime, "executor"), []byte("approved executor"), 0700)
-			os.WriteFile(filepath.Join(runtime, "policy.json"), []byte("approved policy"), 0600)
-			err := installAnchored(ctx, target, info, trustAll, runtime)
-			b, _ := os.ReadFile(filepath.Join(runtime, "executor"))
-			if anchored && (err != nil || string(b) != "new executor") {
-				t.Fatal("anchored executor not installed", err, string(b))
-			}
-			if !anchored && (err == nil || string(b) != "approved executor") {
-				t.Fatal("unanchored executor installed", err, string(b))
-			}
-			if info, err := os.Stat(filepath.Join(runtime, "executor")); err != nil || info.Mode().Perm() != 0700 {
-				t.Fatal("protected executor mode", err)
-			}
-			entries, _ := os.ReadDir(runtime)
-			if len(entries) != 2 {
-				t.Fatal("staging copy left in runtime", entries)
-			}
-		})
-	}
-}
-
-// The pause message names administrator approval only when the pins differ:
-// an anchored handover is a finished upgrade, not a request for approval.
-func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
-	for _, tc := range []struct {
-		name       string
-		state      pinState
-		installErr error
-		open       bool
-		installs   int
-		starts     int
-		logged     string
-	}{
-		{"match", pinsMatch, nil, true, 0, 0, ""},
-		{"differ", pinsDiffer, nil, false, 0, 0, "executor paused: package pins require administrator approval"},
-		{"anchored", pinsAnchored, nil, false, 1, 1, "executor upgrade: INFO-anchored executor installed under the approved policy"},
-		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0, "executor upgrade refused: INFO-anchored executor could not be installed"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			installs, starts := 0, 0
-			var logged []string
-			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(s string) { logged = append(logged, s) })
-			if open != tc.open || installs != tc.installs || starts != tc.starts {
-				t.Fatal("handover", open, installs, starts)
-			}
-			if want := []string{tc.logged}; tc.logged == "" {
-				if len(logged) != 0 {
-					t.Fatal("matching pins logged", logged)
-				}
-			} else if !reflect.DeepEqual(logged, want) {
-				t.Fatal("log", logged, want)
-			}
-		})
-	}
-}
-
-// DSM: /var/packages/<pkg>/target links to /volume1/@appstore/<pkg>.
-func TestInstallAnchoredFollowsTheDSMTargetLink(t *testing.T) {
-	ctx := context.Background()
-	anchor := hashBytes([]byte("new executor"))
-	appstore, info := anchoredPackage(t, "new executor", "approved policy", anchor)
-	link := filepath.Join(filepath.Dir(info), "linked-target")
-	if err := os.Symlink(filepath.Dir(appstore), link); err != nil {
-		t.Fatal(err)
-	}
-	runtime := realTestPath(t, t.TempDir())
-	os.WriteFile(filepath.Join(runtime, "executor"), []byte("approved executor"), 0700)
-	target := filepath.Join(link, "executor")
-	if state := packagePins(ctx, target, info, trustAll, hashBytes([]byte("approved executor")), hashBytes([]byte("approved policy"))); state != pinsAnchored {
-		t.Fatal("pin state", state)
-	}
-	if err := installAnchored(ctx, target, info, trustAll, runtime); err != nil {
-		t.Fatal("anchored executor behind the target link refused", err)
-	}
-	if b, _ := os.ReadFile(filepath.Join(runtime, "executor")); string(b) != "new executor" {
-		t.Fatal("installed", string(b))
-	}
-}

package/dist/templates/_executor/apppriv_review_test.go

@@ -1,28 +0,0 @@
-package main
-
-import (
-	"context"
-	"testing"
-)
-
-func TestReviewAppPrivRejectsAmbiguousOrError(t *testing.T) {
-	cases := map[string]string{
-		"outer error":                    `{"success":true,"error":{"code":105},"data":{"applications":[]}}`,
-		"inner error":                    `{"success":true,"data":{"applications":[],"error":{"code":105}}}`,
-		"duplicate array hides deny":     `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}],"applications":[]}}`,
-		"duplicate privilege hides deny": `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny","privilelge":"allow"}]}}`,
-		"duplicate app id":               `{"success":true,"data":{"applications":[{"app_id":"other","app_id":"app","privilelge":"allow"}]}}`,
-		"null error":                     `{"success":true,"data":{"applications":[],"error":null}}`,
-		"nonobject entry":                `{"success":true,"data":{"applications":[42]}}`,
-		"nested error":                   `{"success":true,"data":{"applications":[{"app_id":"other","privilelge":"allow","details":{"error":null}}]}}`,
-		"malformed entries":              `{"success":true,"data":{"applications":[null,{}]}}`,
-	}
-	for name, reply := range cases {
-		t.Run(name, func(t *testing.T) {
-			d := &liveDSM{Command: &cmdStub{reply: reply}}
-			if d.Allow(context.Background(), Subject{Username: "alice"}, "app", "") == nil {
-				t.Fatal("unsafe AppPriv response allowed")
-			}
-		})
-	}
-}