pinokiod 8.2.23 → 8.2.24

package/kernel/cert_env.js

@@ -1,6 +1,6 @@
 const fs = require('fs')
 const path = require('path')
-const { randomUUID } = require('crypto')
+const { randomUUID, createHash } = require('crypto')
 
 // The managed CA bundle: the conda-forge ca-certificates package inside Miniforge.
 // Every app's Python HTTPS traffic is pointed at this one file so a revoked root is
@@ -83,25 +83,39 @@ async function readManagedBundle(file) {
 async function repairPipVendoredBundle(prefix, bundleFile, platform = process.platform) {
   const managed = await readManagedBundle(bundleFile).catch(() => null)
   if (!managed) return []
+  const sha256 = data => createHash('sha256').update(data).digest('hex')
   const repaired = []
   for (const target of await pipVendoredBundles(prefix, platform)) {
     const stat = await fs.promises.stat(target).catch(() => null)
     if (stat && !stat.isFile()) continue
+    const current = stat ? await fs.promises.readFile(target).catch(() => null) : null
     if (!stat) {
       // No pip here: nothing to do. pip present but its bundle gone (the user deleted a file
       // Pinokio could not replace): write a fresh one, or pip fails on every network call.
       const certifiDir = await fs.promises.stat(path.dirname(target)).catch(() => null)
       if (!certifiDir || !certifiDir.isDirectory()) continue
-    } else if (stat.size === managed.length) {
-      const current = await fs.promises.readFile(target).catch(() => null)
-      if (current && current.equals(managed)) continue
+    } else if (current && current.equals(managed)) {
+      console.log(`[cert] pip's vendored CA bundle already current: ${target}`, JSON.stringify({
+        timestamp: new Date().toISOString(), size_bytes: current.length, sha256: sha256(current),
+      }))
+      continue
     }
     const temporary = path.join(path.dirname(target), `.cacert-${randomUUID()}.tmp`)
     try {
       await fs.promises.writeFile(temporary, managed, { mode: stat ? stat.mode & 0o777 : 0o644 })
       await fs.promises.rename(temporary, target)
+      console.log(`[cert] replaced pip's vendored CA bundle: ${target}`, JSON.stringify({
+        timestamp: new Date().toISOString(),
+        before_size_bytes: current ? current.length : stat ? stat.size : null,
+        after_size_bytes: managed.length,
+        before_sha256: current ? sha256(current) : null,
+        after_sha256: sha256(managed),
+      }))
       repaired.push(target)
     } catch (error) {
+      console.log(`[cert] could not replace pip's vendored CA bundle: ${target}`, JSON.stringify({
+        timestamp: new Date().toISOString(), error: error.message,
+      }))
       // The caller decides what a failed replacement means; it needs to know which file.
       error.target = target
       error.prefix = prefix

package/kernel/environment.js

@@ -623,8 +623,8 @@ const init_folders = async (homedir, kernel) => {
     let is_relative = val.startsWith("./")
     if (is_absolute || is_relative) {
 
-      // skip condarc and pipconfig => special case
-      if (["PIP_CONFIG_FILE", "CONDARC", "HF_TOKEN_PATH"].includes(key)) {
+      // skip values that name a file, not a folder: config files and CA bundles
+      if (["PIP_CONFIG_FILE", "CONDARC", "HF_TOKEN_PATH", "SSL_CERT_FILE", "REQUESTS_CA_BUNDLE", "CURL_CA_BUNDLE", "PIP_CERT"].includes(kernel.platform === "win32" ? key.toUpperCase() : key)) {
         continue
       }
       // it's a path

package/kernel/shell.js

@@ -979,9 +979,6 @@ class Shell {
       blocked.cause = error
       throw blocked
     }
-    for (const target of repaired) {
-      console.log(`[cert] replaced pip's vendored CA bundle: ${target}`)
-    }
     return repaired
   }
   build (params) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.2.23",
+  "version": "8.2.24",
   "description": "",
   "main": "index.js",
   "scripts": {

package/test/cert-env.test.js

@@ -310,6 +310,62 @@ test('Shell.activate stops the step when the pip bundle cannot be replaced', { s
   await fs.chmod(certifiDir, 0o700)
 })
 
+test('init_folders never turns a certificate file path into a directory', async t => {
+  const Environment = require('../kernel/environment')
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'cert-env-folders-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }).catch(() => {}))
+  const app = path.join(root, 'api', 'demo.git')
+  await fs.mkdir(app, { recursive: true })
+  const lines = [
+    `SSL_CERT_FILE=${path.join(root, 'custom', 'ssl.pem')}`,
+    `REQUESTS_CA_BUNDLE=${path.join(root, 'custom', 'requests.pem')}`,
+    `CURL_CA_BUNDLE=${path.join(root, 'custom', 'curl.pem')}`,
+    `PIP_CERT=${path.join(root, 'custom', 'pip.pem')}`,
+    `HF_HOME=${path.join(root, 'custom', 'hf')}`,
+  ]
+  await fs.writeFile(path.join(app, 'ENVIRONMENT'), lines.join('\n') + '\n')
+
+  await Environment.init_folders(app, createKernel(root))
+
+  for (const name of ['ssl.pem', 'requests.pem', 'curl.pem', 'pip.pem']) {
+    assert.equal(await fs.stat(path.join(root, 'custom', name)).catch(() => null), null, `${name} must not be created as a folder`)
+  }
+  assert.ok((await fs.stat(path.join(root, 'custom', 'hf'))).isDirectory(), 'ordinary path values are still created as folders')
+})
+
+test('init_folders handles Windows certificate key casing without changing POSIX key semantics', async t => {
+  const Environment = require('../kernel/environment')
+  for (const platform of ['win32', 'linux']) {
+    for (const casing of ['upper', 'lower', 'mixed']) {
+      await t.test(`${platform} ${casing}`, async t => {
+        const root = await tempRoot(t, 'cert-env-case-')
+        const app = path.join(root, 'api', 'demo.git')
+        await fs.mkdir(app, { recursive: true })
+        const keys = ['SSL_CERT_FILE', 'REQUESTS_CA_BUNDLE', 'CURL_CA_BUNDLE', 'PIP_CERT']
+        const lines = keys.map((key, index) => {
+          if (casing === 'lower') key = key.toLowerCase()
+          if (casing === 'mixed') key = key[0] + key.slice(1).toLowerCase()
+          return `${key}=${path.join(root, 'custom', `${index}.pem`)}`
+        })
+        lines.push(`HF_HOME=${path.join(root, 'custom', 'hf')}`)
+        await fs.writeFile(path.join(app, 'ENVIRONMENT'), lines.join('\n') + '\n')
+        const kernel = createKernel(root)
+        kernel.platform = platform
+        await Environment.init_folders(app, kernel)
+        for (let index = 0; index < keys.length; index++) {
+          const stat = await fs.stat(path.join(root, 'custom', `${index}.pem`)).catch(() => null)
+          if (platform === 'win32' || casing === 'upper') {
+            assert.equal(stat, null, 'recognized certificate files must not become folders')
+          } else {
+            assert.ok(stat.isDirectory(), 'nonstandard POSIX keys retain ordinary folder handling')
+          }
+        }
+        assert.ok((await fs.stat(path.join(root, 'custom', 'hf'))).isDirectory())
+      })
+    }
+  }
+})
+
 function escapeForHtml(value) {
   return require('escape-html')(value)
 }

package/test/cert-repair-log.test.js

@@ -0,0 +1,97 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs/promises')
+const os = require('node:os')
+const path = require('node:path')
+const { createHash } = require('node:crypto')
+const test = require('node:test')
+const { repairPipVendoredBundle } = require('../kernel/cert_env')
+
+const sha256 = data => createHash('sha256').update(data).digest('hex')
+const MANAGED = 'new certificate bundle\n'
+const STALE = 'old certificate bundle\n' // Equal sizes must still produce different hashes.
+
+async function fixture(t, platform = 'linux') {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-cert-log-'))
+  t.after(() => fs.rm(root, { recursive: true, force: true }))
+  const prefix = path.join(root, 'env')
+  const site = platform === 'win32' ? 'Lib/site-packages' : 'lib/python3.10/site-packages'
+  const target = path.join(prefix, site, 'pip/_vendor/certifi/cacert.pem')
+  const managed = path.join(root, 'managed.pem')
+  await fs.mkdir(path.dirname(target), { recursive: true })
+  await fs.writeFile(target, STALE)
+  await fs.writeFile(managed, MANAGED)
+  const messages = []
+  t.mock.method(console, 'log', (...args) => messages.push(args))
+  return { root, prefix, target, managed, messages }
+}
+
+test('console logs contain independently verifiable evidence even for equal-size replacements', async t => {
+  for (const platform of ['linux', 'win32']) {
+    await t.test(platform, async t => {
+      const f = await fixture(t, platform)
+      assert.deepEqual(await repairPipVendoredBundle(f.prefix, f.managed, platform), [f.target])
+      assert.equal(f.messages.length, 1)
+      assert.ok(f.messages[0][0].includes(f.target))
+      const record = JSON.parse(f.messages[0][1])
+      assert.equal(record.before_size_bytes, Buffer.byteLength(STALE))
+      assert.equal(record.after_size_bytes, record.before_size_bytes)
+      assert.equal(record.before_sha256, sha256(STALE))
+      assert.equal(record.after_sha256, sha256(await fs.readFile(f.target)))
+      assert.notEqual(record.before_sha256, record.after_sha256)
+      assert.equal(new Date(record.timestamp).toISOString(), record.timestamp)
+      const mtime = (await fs.stat(f.target)).mtimeMs
+      assert.deepEqual(await repairPipVendoredBundle(f.prefix, f.managed, platform), [])
+      assert.equal((await fs.stat(f.target)).mtimeMs, mtime)
+      assert.ok(f.messages[1][0].includes('already current'))
+      assert.equal(JSON.parse(f.messages[1][1]).sha256, record.after_sha256)
+    })
+  }
+})
+
+test('a created PEM logs a missing baseline and the written size/hash', async t => {
+  const f = await fixture(t)
+  await fs.rm(f.target)
+  await repairPipVendoredBundle(f.prefix, f.managed, 'linux')
+  const record = JSON.parse(f.messages[0][1])
+  assert.equal(record.before_size_bytes, null)
+  assert.equal(record.before_sha256, null)
+  assert.equal(record.after_size_bytes, Buffer.byteLength(MANAGED))
+  assert.equal(record.after_sha256, sha256(MANAGED))
+})
+
+test('a failed rename logs failure and leaves the stale file and no temp file', async t => {
+  const f = await fixture(t)
+  t.mock.method(fs, 'rename', async () => { throw Object.assign(new Error('file locked'), { code: 'EPERM' }) })
+  await assert.rejects(repairPipVendoredBundle(f.prefix, f.managed, 'linux'), /file locked/)
+  assert.equal(f.messages.length, 1)
+  assert.equal(JSON.parse(f.messages[0][1]).error, 'file locked')
+  assert.equal(await fs.readFile(f.target, 'utf8'), STALE)
+  assert.deepEqual(await fs.readdir(path.dirname(f.target)), ['cacert.pem'])
+})
+
+test('logging a successful replacement adds no verification read or launch failure', async t => {
+  const f = await fixture(t)
+  const read = fs.readFile.bind(fs)
+  const rename = fs.rename.bind(fs)
+  let renamed = false
+  let reread = false
+  t.mock.method(fs, 'rename', async (...args) => {
+    await rename(...args)
+    renamed = true
+  })
+  t.mock.method(fs, 'readFile', async (file, ...args) => {
+    if (file === f.target && renamed) {
+      reread = true
+      throw Object.assign(new Error('reread denied'), { code: 'EACCES' })
+    }
+    return read(file, ...args)
+  })
+  assert.deepEqual(await repairPipVendoredBundle(f.prefix, f.managed, 'linux'), [f.target])
+  const record = JSON.parse(f.messages[0][1])
+  assert.equal(reread, false)
+  assert.equal(record.after_size_bytes, Buffer.byteLength(MANAGED))
+  assert.equal(record.after_sha256, sha256(MANAGED))
+  assert.equal(Object.hasOwn(record, 'verified'), false)
+  assert.equal(await read(f.target, 'utf8'), MANAGED)
+  assert.deepEqual(await fs.readdir(path.dirname(f.target)), ['cacert.pem'])
+})