@synopackageland/cli 0.8.0 → 0.9.1

package/templates/_daemon/main_test.go

@@ -1,315 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"os/exec"
-	"os/user"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func fixture(t *testing.T, mode string) (string, string, string) {
-	t.Helper()
-	root, err := os.MkdirTemp("/tmp", "c1-runtime-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { os.RemoveAll(root) })
-	dest, data := filepath.Join(root, "target"), filepath.Join(root, "var")
-	if err := os.MkdirAll(filepath.Join(dest, "daemon/payload"), 0755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Mkdir(data, 0700); err != nil {
-		t.Fatal(err)
-	}
-	control, child := os.Getenv("DAEMON_CONTROL_BIN"), os.Getenv("DAEMON_CHILD_BIN")
-	if control == "" {
-		control, child = filepath.Join(root, "control"), filepath.Join(root, "child")
-		for _, spec := range [][]string{{"build", "-o", control, "."}, {"build", "-o", child, "./testdata/child.go"}} {
-			if raw, err := exec.Command("go", spec...).CombinedOutput(); err != nil {
-				t.Fatalf("%v: %s", err, raw)
-			}
-		}
-	}
-	raw, err := os.ReadFile(child)
-	if err != nil {
-		t.Fatal(err)
-	}
-	app := filepath.Join(dest, "daemon/payload/app")
-	if err := os.WriteFile(app, raw, 0755); err != nil {
-		t.Fatal(err)
-	}
-	// macOS verifies a newly written executable on its first exec, which takes
-	// seconds on a loaded host; pay it here, not inside a one-second budget.
-	if raw, err := exec.Command(app, "cleanup").CombinedOutput(); err != nil {
-		t.Fatalf("payload warm-up: %v %s", err, raw)
-	}
-	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1, Uninstall: 2}}
-	if os.Geteuid() == 0 {
-		cfg.Package = "nobody"
-	} else {
-		u, err := user.Current()
-		if err != nil {
-			t.Fatal(err)
-		}
-		cfg.Package = u.Username
-	}
-	raw, _ = json.Marshal(cfg)
-	if err := os.WriteFile(filepath.Join(dest, "daemon/config.json"), raw, 0644); err != nil {
-		t.Fatal(err)
-	}
-	if os.Geteuid() == 0 {
-		// Only inside the disposable root VM: run the shipped manager as nobody.
-		if runtime.GOOS != "linux" {
-			t.Fatal("root fixture requires Linux VM")
-		}
-		filepath.Walk(root, func(path string, _ os.FileInfo, err error) error {
-			if err == nil {
-				return os.Chown(path, 65534, 65534)
-			}
-			return err
-		})
-		os.Chmod(root, 0755)
-	}
-	t.Cleanup(func() { runControl(control, "stop", dest, data) })
-	return control, dest, data
-}
-
-func runControl(control, action, dest, data string) (int, string) {
-	ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, control, action, dest, data)
-	cmd.Env = append(os.Environ(), "UNLISTED_SECRET=must-not-leak", "LD_PRELOAD=must-not-leak")
-	dropFixtureUser(cmd)
-	raw, err := cmd.CombinedOutput()
-	if err == nil {
-		return 0, string(raw)
-	}
-	if e, ok := err.(*exec.ExitError); ok {
-		return e.ExitCode(), string(raw)
-	}
-	return -1, err.Error()
-}
-
-// Readiness only proves the child stayed alive for a second, not that it reached
-// main: on a loaded host a stop can kill it before it writes its line. Spawn
-// identity therefore comes from the inventory, and log content is awaited.
-func recordedChild(t *testing.T, data string) int {
-	t.Helper()
-	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.pid"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var r record
-	if err := json.Unmarshal(raw, &r); err != nil || r.Child < 1 {
-		t.Fatalf("daemon inventory: %v %s", err, raw)
-	}
-	return r.Child
-}
-
-func awaitChildLines(t *testing.T, data string, want int) {
-	t.Helper()
-	path := filepath.Join(data, "daemon/daemon.log")
-	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(20 * time.Millisecond) {
-		raw, _ := os.ReadFile(path)
-		if got := strings.Count(string(raw), `"uid":`); got >= want || time.Now().After(deadline) {
-			if got != want {
-				t.Fatalf("child lines=%d want=%d: %s", got, want, raw)
-			}
-			return
-		}
-	}
-}
-
-func TestDaemonLifecycle(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	step := func(action string, want int) {
-		t.Helper()
-		if rc, out := runControl(control, action, dest, data); rc != want {
-			t.Fatalf("%s rc=%d want=%d: %s", action, rc, want, out)
-		}
-	}
-	step("status", 3)
-	step("stop", 0)
-	step("start", 0)
-	awaitChildLines(t, data, 1)
-	first := recordedChild(t, data)
-	step("status", 0)
-	step("start", 0)
-	if child := recordedChild(t, data); child != first {
-		t.Fatalf("duplicate start spawned another child: %d replaced %d", child, first)
-	}
-	step("restart", 0)
-	if child := recordedChild(t, data); child == first {
-		t.Fatalf("restart kept child %d", child)
-	}
-	awaitChildLines(t, data, 2)
-	step("stop", 0)
-	step("stop", 0)
-	step("status", 3)
-	step("unknown", 1)
-	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.log"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Count(string(raw), `"uid":`) != 2 {
-		t.Fatalf("unexpected child spawn: %s", raw)
-	}
-	if strings.Contains(string(raw), "must-not-leak") {
-		t.Fatalf("ambient environment leaked: %s", raw)
-	}
-	if !strings.Contains(string(raw), "$(touch BAD)'") || !strings.Contains(string(raw), "/a space") {
-		t.Fatalf("argv changed: %s", raw)
-	}
-	stat, _ := os.Stat(filepath.Join(data, "daemon/daemon.log"))
-	if stat.Mode().Perm() != 0600 {
-		t.Fatal("log permissions")
-	}
-	stat, err = os.Stat(filepath.Join(data, "daemon/tmp"))
-	if err != nil || stat.Mode().Perm() != 0700 {
-		t.Fatal("private TMPDIR missing", err)
-	}
-}
-
-func TestImmediateExitAndEscalation(t *testing.T) {
-	for _, mode := range []string{"exit", "ignore"} {
-		t.Run(mode, func(t *testing.T) {
-			control, dest, data := fixture(t, mode)
-			rc, out := runControl(control, "start", dest, data)
-			if mode == "exit" {
-				if rc != 1 {
-					t.Fatalf("false readiness: %d %s", rc, out)
-				}
-			} else {
-				if rc != 0 {
-					t.Fatalf("start: %d %s", rc, out)
-				}
-				if rc, out = runControl(control, "stop", dest, data); rc != 0 {
-					t.Fatalf("escalation: %d %s", rc, out)
-				}
-			}
-			if rc, out = runControl(control, "status", dest, data); rc != 3 {
-				t.Fatalf("residue: %d %s", rc, out)
-			}
-		})
-	}
-}
-
-func TestForeignStateAndRootRefusal(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	if os.Geteuid() == 0 {
-		raw, err := exec.Command(control, "start", dest, data).CombinedOutput()
-		if err == nil || !strings.Contains(string(raw), "package account") {
-			t.Fatalf("root accepted: %s %v", raw, err)
-		}
-	}
-	os.Mkdir(filepath.Join(data, "daemon"), 0700)
-	if os.Geteuid() == 0 {
-		os.Chown(filepath.Join(data, "daemon"), 65534, 65534)
-	}
-	os.Symlink(filepath.Join(data, "victim"), filepath.Join(data, "daemon/daemon.log"))
-	if rc, out := runControl(control, "start", dest, data); rc != 1 {
-		t.Fatalf("symlink accepted: %d %s", rc, out)
-	}
-	if _, err := os.Stat(filepath.Join(data, "victim")); !os.IsNotExist(err) {
-		t.Fatal("followed log symlink")
-	}
-}
-
-func TestUninstallCleanup(t *testing.T) {
-	for _, mode := range []string{"cleanup", "cleanup-fail", "cleanup-hang"} {
-		t.Run(mode, func(t *testing.T) {
-			control, dest, data := fixture(t, "normal")
-			path := filepath.Join(dest, "daemon/config.json")
-			raw, _ := os.ReadFile(path)
-			var cfg config
-			json.Unmarshal(raw, &cfg)
-			cfg.UninstallArgs = []string{mode, "${SYNOPKG_PKGVAR}"}
-			raw, _ = json.Marshal(cfg)
-			os.WriteFile(path, raw, 0644)
-			if rc, out := runControl(control, "start", dest, data); rc != 0 {
-				t.Fatalf("start: %d %s", rc, out)
-			}
-			want := 1
-			if mode == "cleanup" {
-				want = 0
-			}
-			if rc, out := runControl(control, "uninstall", dest, data); rc != want {
-				t.Fatalf("cleanup rc=%d want=%d: %s", rc, want, out)
-			}
-			if rc, out := runControl(control, "status", dest, data); rc != 3 {
-				t.Fatalf("cleanup must not restart daemon: %d %s", rc, out)
-			}
-		})
-	}
-}
-
-// A revoke on uninstall can outlast the stop deadline on a loaded NAS; it has
-// its own budget instead of Stop-1.
-func TestUninstallCommandHasItsOwnBudget(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	path := filepath.Join(dest, "daemon/config.json")
-	raw, _ := os.ReadFile(path)
-	var cfg config
-	json.Unmarshal(raw, &cfg)
-	cfg.UninstallArgs = []string{"cleanup-slow"}
-	cfg.Timeouts.Uninstall = 5
-	raw, _ = json.Marshal(cfg)
-	os.WriteFile(path, raw, 0644)
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("start: %d %s", rc, out)
-	}
-	if rc, out := runControl(control, "uninstall", dest, data); rc != 0 {
-		t.Fatalf("slow uninstall within its budget failed: %d %s", rc, out)
-	}
-}
-
-func TestPackageAccountIdentity(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	path := filepath.Join(dest, "daemon/config.json")
-	raw, _ := os.ReadFile(path)
-	var cfg config
-	json.Unmarshal(raw, &cfg)
-	cfg.Package = "root"
-	raw, _ = json.Marshal(cfg)
-	os.WriteFile(path, raw, 0644)
-	rc, out := runControl(control, "start", dest, data)
-	if rc == 0 {
-		runControl(control, "stop", dest, data)
-	}
-	if rc != 1 {
-		t.Fatalf("other account accepted: %d %s", rc, out)
-	}
-}
-
-func TestFIFOInventoryCannotBlockStatus(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	state := filepath.Join(data, "daemon")
-	os.Mkdir(state, 0700)
-	path := filepath.Join(state, "daemon.pid")
-	t.Cleanup(func() { os.Remove(path) })
-	if err := syscall.Mkfifo(path, 0600); err != nil {
-		t.Fatal(err)
-	}
-	if os.Geteuid() == 0 {
-		os.Chown(state, 65534, 65534)
-		os.Chown(path, 65534, 65534)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, control, "status", dest, data)
-	dropFixtureUser(cmd)
-	raw, err := cmd.CombinedOutput()
-	if ctx.Err() != nil {
-		t.Fatal("status blocked on FIFO")
-	}
-	if e, ok := err.(*exec.ExitError); !ok || e.ExitCode() != 1 {
-		t.Fatalf("FIFO status: %s %v", raw, err)
-	}
-}

package/templates/_daemon/process_linux.go

@@ -1,55 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"errors"
-	"net"
-	"os"
-	"strconv"
-	"syscall"
-)
-
-func childAttributes() *syscall.SysProcAttr { return &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL} }
-func processBirth(pid int) string {
-	raw, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/stat")
-	if err != nil {
-		return ""
-	}
-	birth, _ := parseBirth(string(raw))
-	return birth
-}
-func recordedChildAlive(pid int, birth string) bool {
-	raw, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/stat")
-	if os.IsNotExist(err) {
-		return false
-	}
-	if err != nil {
-		return true
-	}
-	actual, alive := parseBirth(string(raw))
-	if actual == "" {
-		return true
-	}
-	return alive && (birth == "" || actual == birth)
-}
-func checkPeer(conn *net.UnixConn, pid int) error {
-	fd, err := conn.SyscallConn()
-	if err != nil {
-		return err
-	}
-	var peer *syscall.Ucred
-	var getErr error
-	if err := fd.Control(func(raw uintptr) {
-		peer, getErr = syscall.GetsockoptUcred(int(raw), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
-	}); err != nil {
-		return err
-	}
-	if getErr != nil {
-		return getErr
-	}
-	if peer.Uid != uint32(os.Geteuid()) || peer.Pid != int32(pid) {
-		return errors.New("foreign daemon supervisor")
-	}
-	return nil
-}

package/templates/_daemon/process_linux_test.go

@@ -1,161 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"sync"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func waitDead(t *testing.T, pid int, birth string) {
-	t.Helper()
-	until := time.Now().Add(3 * time.Second)
-	for time.Now().Before(until) {
-		if !recordedChildAlive(pid, birth) {
-			return
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	t.Fatalf("PID %d remained alive", pid)
-}
-func readFixtureRecord(t *testing.T, data string) record {
-	t.Helper()
-	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.pid"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var r record
-	if err := json.Unmarshal(raw, &r); err != nil {
-		t.Fatal(err)
-	}
-	return r
-}
-
-func TestLinuxSupervisorDeathAndConcurrentStart(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	var wg sync.WaitGroup
-	results := make(chan int, 6)
-	for i := 0; i < 6; i++ {
-		wg.Add(1)
-		go func() { defer wg.Done(); rc, _ := runControl(control, "start", dest, data); results <- rc }()
-	}
-	wg.Wait()
-	close(results)
-	for rc := range results {
-		if rc != 0 {
-			t.Fatalf("concurrent start: %d", rc)
-		}
-	}
-	r := readFixtureRecord(t, data)
-	if err := syscall.Kill(r.Supervisor, syscall.SIGKILL); err != nil {
-		t.Fatal(err)
-	}
-	waitDead(t, r.Child, r.Birth)
-	if rc, out := runControl(control, "status", dest, data); rc != 1 {
-		t.Fatalf("lost-supervisor status: %d %s", rc, out)
-	}
-	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
-		t.Fatalf("retire dead child: %d %s", rc, out)
-	}
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("restart after death: %d %s", rc, out)
-	}
-	if r2 := readFixtureRecord(t, data); r2.Child == r.Child {
-		t.Fatal("did not start fresh child")
-	}
-}
-
-func TestLinuxInventoryNeverSignalsForeignPID(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("start: %d %s", rc, out)
-	}
-	r := readFixtureRecord(t, data)
-	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
-		t.Fatalf("stop: %d %s", rc, out)
-	}
-	foreign := exec.Command("/bin/sleep", "30")
-	if err := foreign.Start(); err != nil {
-		t.Fatal(err)
-	}
-	defer func() { foreign.Process.Kill(); foreign.Wait() }()
-	r.Supervisor = foreign.Process.Pid
-	r.Child = foreign.Process.Pid
-	r.Birth = processBirth(r.Child)
-	raw, _ := json.Marshal(r)
-	path := filepath.Join(data, "daemon/daemon.pid")
-	if err := os.WriteFile(path, raw, 0600); err != nil {
-		t.Fatal(err)
-	}
-	if os.Geteuid() == 0 {
-		os.Chown(path, 65534, 65534)
-	}
-	for _, action := range []string{"stop", "start", "restart"} {
-		if rc, out := runControl(control, action, dest, data); rc != 1 {
-			t.Fatalf("%s accepted live unwitnessed PID: %d %s", action, rc, out)
-		}
-		if !recordedChildAlive(r.Child, r.Birth) {
-			t.Fatal("signalled inventory PID")
-		}
-	}
-	// A reused numeric PID with a different birth can be retired without killing it.
-	r.Birth = "1"
-	raw, _ = json.Marshal(r)
-	os.WriteFile(path, raw, 0600)
-	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
-		t.Fatalf("retire reused PID: %d %s", rc, out)
-	}
-	if !recordedChildAlive(foreign.Process.Pid, processBirth(foreign.Process.Pid)) {
-		t.Fatal("killed reused PID")
-	}
-}
-
-func TestLinuxChildSelfExitAndDeadlines(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("start: %d %s", rc, out)
-	}
-	r := readFixtureRecord(t, data)
-	if err := syscall.Kill(r.Child, syscall.SIGTERM); err != nil {
-		t.Fatal(err)
-	}
-	waitDead(t, r.Child, r.Birth)
-	time.Sleep(100 * time.Millisecond)
-	if rc, out := runControl(control, "status", dest, data); rc != 1 {
-		t.Fatalf("self exit: %d %s", rc, out)
-	}
-	control, dest, data = fixture(t, "ignore")
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("start: %d %s", rc, out)
-	}
-	r = readFixtureRecord(t, data)
-	began := time.Now()
-	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
-		t.Fatalf("stop: %d %s", rc, out)
-	}
-	if elapsed := time.Since(began); elapsed < time.Second || elapsed > 3*time.Second {
-		t.Fatalf("stop deadline: %s", elapsed)
-	}
-	waitDead(t, r.Child, r.Birth)
-}
-
-func TestParseLinuxProcBirth(t *testing.T) {
-	fields := []string{"S", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "1234"}
-	raw := "42 (a ) tricky name)"
-	for _, f := range fields {
-		raw += " " + f
-	}
-	if birth, alive := parseBirth(raw); birth != "1234" || !alive {
-		t.Fatal(birth, alive)
-	}
-	if recordedChildAlive(os.Getpid(), strconv.Itoa(os.Getpid())) {
-		t.Fatal("different process birth matched")
-	}
-}

package/templates/_daemon/process_other.go

@@ -1,14 +0,0 @@
-//go:build !linux
-
-package main
-
-import (
-	"net"
-	"syscall"
-)
-
-// Host-only tests exercise lifecycle/quoting; published controllers target Linux.
-func childAttributes() *syscall.SysProcAttr     { return &syscall.SysProcAttr{} }
-func processBirth(int) string                   { return "host-fixture" }
-func recordedChildAlive(pid int, _ string) bool { return syscall.Kill(pid, 0) == nil }
-func checkPeer(*net.UnixConn, int) error        { return nil }

package/templates/_daemon/testdata/child.go

@@ -1,44 +0,0 @@
-// Linux/host fixture: a foreground process; never installed on a NAS.
-package main
-
-import (
-	"encoding/json"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-)
-
-func main() {
-	if len(os.Args) > 1 {
-		switch os.Args[1] {
-		case "cleanup":
-			os.Exit(0)
-		case "cleanup-slow":
-			time.Sleep(2500 * time.Millisecond)
-			os.Exit(0)
-		case "cleanup-fail":
-			os.Exit(2)
-		case "cleanup-hang":
-			signal.Ignore(syscall.SIGTERM, syscall.SIGINT)
-			for {
-				time.Sleep(time.Second)
-			}
-		}
-	}
-	if os.Getenv("APP_MODE") == "exit" {
-		os.Exit(2)
-	}
-	raw, _ := json.Marshal(map[string]any{"uid": os.Geteuid(), "args": os.Args[1:], "env": os.Environ()})
-	fmtOutput := append(raw, '\n')
-	os.Stdout.Write(fmtOutput)
-	if os.Getenv("APP_MODE") == "ignore" {
-		signal.Ignore(syscall.SIGTERM, syscall.SIGINT)
-		for {
-			time.Sleep(time.Second)
-		}
-	}
-	c := make(chan os.Signal, 1)
-	signal.Notify(c, syscall.SIGTERM, syscall.SIGINT)
-	<-c
-}