pixie-lab-dibs 0.1.0__tar.gz → 0.1.1__tar.gz

{pixie_lab_dibs-0.1.0 → pixie_lab_dibs-0.1.1}/.github/workflows/test.yml

@@ -40,3 +40,24 @@ jobs:
 
       - name: make build
         run: make build
+
+  service:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: astral-sh/setup-uv@v7.2.1
+
+      # The pixie server dibs first ran on resolves users from files only,
+      # without nss-systemd. Match it, so a unit that relies on systemd's
+      # dynamic users fails here rather than there.
+      - name: Resolve users from /etc/passwd only
+        run: |
+          sudo sed -i 's/^passwd:.*/passwd: files/' /etc/nsswitch.conf
+          grep '^passwd' /etc/nsswitch.conf
+
+      - name: make build
+        run: make build
+
+      - name: make service-smoke
+        run: make service-smoke

{pixie_lab_dibs-0.1.0 → pixie_lab_dibs-0.1.1}/CHANGELOG.md

@@ -10,6 +10,19 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-10-27
+
+### Fixed
+
+- `dibs server install` over a running service now restarts it, so
+  installing again after an upgrade runs the new version. It used to
+  write the new unit and leave the old process running.
+- The system service refused every key at `dibs register` on hosts that
+  resolve users without nss-systemd, plain Debian among them: under
+  `DynamicUser=`, `ssh-keygen` could not look its own user up. `dibs server install` now creates a `dibs` system user and runs the service
+  as it. Run `sudo dibs server install` again to update an installed
+  service.
+
 ## [0.1.0] - 2026-10-27
 
 ### Added

{pixie_lab_dibs-0.1.0 → pixie_lab_dibs-0.1.1}/Makefile

@@ -9,7 +9,7 @@ UV ?= uv
 PRECOMMIT ?= pre-commit
 
 .DEFAULT_GOAL := help
-.PHONY: help format lint typecheck test build check
+.PHONY: help format lint typecheck test build check service-smoke
 
 help: ## Show this help
 	@grep -hE '^[a-z-]+:.*?## ' $(MAKEFILE_LIST) \
@@ -35,3 +35,6 @@ build: ## Build the sdist and wheel, and check every command the wheel installs
 	done
 
 check: lint typecheck test ## Everything but format
+
+service-smoke: ## Install the built wheel as the real service and claim against it (sudo, systemd)
+	./scripts/service-smoke.sh

{pixie_lab_dibs-0.1.0 → pixie_lab_dibs-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pixie-lab-dibs
-Version: 0.1.0
+Version: 0.1.1
 Summary: Call dibs on shared lab machines: see who is using what, claim it, release it
 Project-URL: Homepage, https://github.com/safl/pixie-lab-dibs
 Author-email: "Simon A. F. Lund" <os@safl.dk>
@@ -81,8 +81,9 @@ sudo dibs server install
 
 The command writes a systemd unit for the `dibs` you ran, enables it
 and starts it. `dibs server start`, `stop`, `restart`, `status` and
-`logs` manage it from then on. The service runs as a throwaway system
-user that owns only `/var/lib/dibs`. Without root, `dibs server install --user` installs a per-user service instead. For a quick try,
+`logs` manage it from then on. The service runs as a `dibs` system
+user, which the install creates, with write access only to
+`/var/lib/dibs`. Without root, `dibs server install --user` installs a per-user service instead. For a quick try,
 `dibs serve` runs the server in the foreground.
 
 The system service can only run a `dibs` installed outside your home

{pixie_lab_dibs-0.1.0 → pixie_lab_dibs-0.1.1}/README.md

@@ -59,8 +59,9 @@ sudo dibs server install
 
 The command writes a systemd unit for the `dibs` you ran, enables it
 and starts it. `dibs server start`, `stop`, `restart`, `status` and
-`logs` manage it from then on. The service runs as a throwaway system
-user that owns only `/var/lib/dibs`. Without root, `dibs server install --user` installs a per-user service instead. For a quick try,
+`logs` manage it from then on. The service runs as a `dibs` system
+user, which the install creates, with write access only to
+`/var/lib/dibs`. Without root, `dibs server install --user` installs a per-user service instead. For a quick try,
 `dibs serve` runs the server in the foreground.
 
 The system service can only run a `dibs` installed outside your home

pixie_lab_dibs-0.1.1/scripts/service-smoke.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: Simon A. F. Lund <os@safl.dk>
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+# Install the built wheel as the real systemd service, then register, log
+# in and claim against it. This is the path the unit tests stub out, and
+# where dibs once broke: under systemd, ssh-keygen must be able to look its
+# own user up. Needs root through sudo and a running systemd; CI's runner
+# has both. Run from the repository root after "make build".
+set -eu
+
+wheel=$(ls dist/*.whl)
+tmp=$(mktemp -d)
+trap 'sudo dibs server uninstall >/dev/null 2>&1 || true; rm -rf "$tmp"' EXIT
+
+sudo env "PATH=$PATH" UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin \
+    uv tool install --python /usr/bin/python3 "$wheel"
+
+sudo mkdir -p /etc/dibs
+printf '[[thing]]\nname = "box"\nmac = "aa:bb:cc:dd:ee:ff"\n' | sudo tee /etc/dibs/dibs.toml >/dev/null
+sudo /usr/local/bin/dibs server install --port 8090
+
+export DIBS_URL=http://127.0.0.1:8090 XDG_CONFIG_HOME="$tmp/config"
+for _ in $(seq 1 30); do curl -fsS "$DIBS_URL/healthz" >/dev/null 2>&1 && break; sleep 1; done
+
+ssh-keygen -q -t ed25519 -N '' -f "$tmp/key"
+dibs register ci -i "$tmp/key.pub"
+sudo dibs admin approve ci
+dibs login
+dibs claim box --for smoke
+dibs list | grep -qx "'ci' has claimed 'box' for 'smoke' expires in: 'never'"
+dibs release --mine
+
+# Installing again, as an upgrade does, must replace the running process.
+before=$(systemctl show -p MainPID --value dibs.service)
+sudo /usr/local/bin/dibs server install --port 8090
+after=$(systemctl show -p MainPID --value dibs.service)
+[ "$before" != "$after" ] || { echo "install did not restart the running service" >&2; exit 1; }
+for _ in $(seq 1 30); do curl -fsS "$DIBS_URL/healthz" >/dev/null 2>&1 && break; sleep 1; done
+dibs list | grep -qx "'box' is free"
+echo "service smoke test passed"

{pixie_lab_dibs-0.1.0 → pixie_lab_dibs-0.1.1}/src/dibs/__init__.py

@@ -12,4 +12,4 @@ everyone who is on a machine, and it never stops anyone from logging
 in.
 """
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"

{pixie_lab_dibs-0.1.0 → pixie_lab_dibs-0.1.1}/src/dibs/cli.py

@@ -41,6 +41,7 @@ EXIT_ERROR = 2
 
 DEFAULT_PORT = 8090
 UNIT_NAME = "dibs.service"
+SERVICE_USER = "dibs"
 
 _DURATION_RE = re.compile(r"^(?:(\d+)d)?(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$")
 _DEFAULT_KEYS = ("id_ed25519.pub", "id_ecdsa.pub", "id_rsa.pub")
@@ -405,10 +406,12 @@ ConfigurationDirectory=dibs
 Restart=on-failure"""
         target = "default.target"
     else:
-        # DynamicUser gives the service a throwaway system user that owns
-        # only its StateDirectory, so it needs no account set up.
+        # A static user rather than DynamicUser=: ssh-keygen looks its own
+        # user up, and a dynamic user resolves only where nss-systemd is set
+        # up, which plain Debian does not do.
         service = f"""ExecStart={serve}
-DynamicUser=yes
+User={SERVICE_USER}
+Group={SERVICE_USER}
 StateDirectory=dibs
 ConfigurationDirectory=dibs
 Restart=on-failure
@@ -444,6 +447,25 @@ def _systemctl(user: bool, *argv: str) -> None:
         raise CliError(f"{' '.join(cmd)} failed")
 
 
+def ensure_service_user() -> None:
+    """Create the ``dibs`` system user the system service runs as, once."""
+    if subprocess.run(["getent", "passwd", SERVICE_USER], capture_output=True).returncode == 0:
+        return
+    cmd = [
+        "useradd",
+        "--system",
+        "--user-group",
+        "--home-dir",
+        "/var/lib/dibs",
+        "--no-create-home",
+        "--shell",
+        "/usr/sbin/nologin",
+        SERVICE_USER,
+    ]
+    if subprocess.run(cmd).returncode != 0:
+        raise CliError(f"{' '.join(cmd)} failed; run dibs server install as root")
+
+
 def cmd_server_install(args: argparse.Namespace) -> None:
     exe = _exe()
     if not args.user and str(exe).startswith(str(Path.home())):
@@ -455,11 +477,16 @@ def cmd_server_install(args: argparse.Namespace) -> None:
     if args.print:
         sys.stdout.write(text)
         return
+    if not args.user:
+        ensure_service_user()
     path = unit_path(args.user)
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(text)
     _systemctl(args.user, "daemon-reload")
-    _systemctl(args.user, "enable", "--now", UNIT_NAME)
+    _systemctl(args.user, "enable", UNIT_NAME)
+    # Restart rather than start, so installing over a running service, as
+    # an upgrade does, replaces the process with the new code and unit.
+    _systemctl(args.user, "restart", UNIT_NAME)
     print(f"Installed {path} and started it; dibs listens on port {args.port}.")
     if args.user:
         print("To keep it running while you are logged out: loginctl enable-linger")

{pixie_lab_dibs-0.1.0 → pixie_lab_dibs-0.1.1}/tests/test_cli.py

@@ -128,7 +128,7 @@ def test_system_unit_runs_this_dibs_sandboxed() -> None:
     text = cli.unit_text(Path("/usr/local/bin/dibs"), user=False, host="0.0.0.0", port=8090)
     assert "ExecStart=/usr/local/bin/dibs serve --host 0.0.0.0 --port 8090\n" in text
     for line in (
-        "DynamicUser=yes",
+        "User=dibs",
         "StateDirectory=dibs",
         "ProtectHome=yes",
         "WantedBy=multi-user.target",
@@ -155,7 +155,8 @@ def test_server_install_writes_enables_and_controls(
     assert "--port 9000 --user" in unit.read_text()
     assert calls == [
         ["systemctl", "--user", "daemon-reload"],
-        ["systemctl", "--user", "enable", "--now", "dibs.service"],
+        ["systemctl", "--user", "enable", "dibs.service"],
+        ["systemctl", "--user", "restart", "dibs.service"],
     ]
     calls.clear()
     cli.main(["server", "stop", "--user"])
@@ -175,6 +176,29 @@ def test_server_install_writes_enables_and_controls(
     ]
 
 
+def test_system_unit_avoids_dynamic_user() -> None:
+    """ssh-keygen needs its user to resolve, and a DynamicUser= user does
+    not resolve without nss-systemd (plain Debian has none)."""
+    text = cli.unit_text(Path("/usr/local/bin/dibs"), user=False, host="0.0.0.0", port=8090)
+    assert "DynamicUser" not in text and "User=dibs\nGroup=dibs\n" in text
+
+
+@pytest.mark.parametrize(("exists", "want_useradd"), [(True, False), (False, True)])
+def test_service_user_is_created_once(
+    monkeypatch: pytest.MonkeyPatch, exists: bool, want_useradd: bool
+) -> None:
+    calls: list[list[str]] = []
+
+    def fake_run(cmd: list[str], *a: Any, **kw: Any) -> subprocess.CompletedProcess[str]:
+        calls.append(cmd)
+        return subprocess.CompletedProcess(cmd, 0 if exists or cmd[0] != "getent" else 2)
+
+    monkeypatch.setattr(cli.subprocess, "run", fake_run)
+    cli.ensure_service_user()
+    assert calls[0] == ["getent", "passwd", "dibs"]
+    assert any(c[0] == "useradd" and c[-1] == "dibs" for c in calls) == want_useradd
+
+
 def test_system_install_refuses_a_dibs_in_home(monkeypatch: pytest.MonkeyPatch, capsys) -> None:
     monkeypatch.setattr(cli, "_exe", lambda: Path.home() / ".local" / "bin" / "dibs")
     assert cli.main(["server", "install"]) == cli.EXIT_ERROR