Hold the trust-before-push order by a test, and refuse early what would stop it (issue 92)

The fix is an order, and nothing failed if the trust call moved after the
push or went: steps 7 and 8 are now one function a test drives against a
runtime that refuses an untrusted push. Preflight now refuses, before
anything is raised, a runtime file that is no JSON object, a docker.service
that is not loaded and active, and a dockerd started with
--insecure-registry, which would refuse the reload. The comment names the
order the docker module's takeover rests on.

internal/bootstrap/trust_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
@@ -218,3 +219,129 @@ func TestARangeTheRuntimeTrustsCoversAnAddressInIt(t *testing.T) {
 		t.Errorf("missing %v", missing)
 	}
 }
+
+// **The order, which is the fault issue 92 is about.** Steps 7 and 8 against a runtime that behaves
+// as dockerd does: a push to a registry it has not been told to trust is refused with the error the
+// first genesis met. The trust must be written and confirmed before anything is tagged or pushed;
+// moving the trust after the push, or dropping it, fails this test.
+func TestNothingIsPushedToTheRegistryBeforeTheRuntimeTrustsIt(t *testing.T) {
+	o, runtime, sys := trustSetup(t, `{"data-root":"/srv/docker"}`)
+	o.Catalogue = catalogueWith(t, RegistryModule, upstreamRegistryManifest)
+	o.Registry = "192.0.2.10:5100"
+
+	pushed := false
+	mesh := aMeshThatAgrees(nil)
+	run := func(ctx context.Context, name string, args ...string) (string, error) {
+		if name == "systemctl" || (name == "docker" && args[0] == "info") {
+			return runtime.run(ctx, name, args...)
+		}
+		runtime.commands = append(runtime.commands, name+" "+strings.Join(args, " "))
+		if name == "docker" {
+			switch args[0] {
+			case "tag":
+				return "", nil
+			case "push":
+				trusted := false
+				for _, n := range runtime.trusted {
+					trusted = trusted || strings.HasPrefix(args[1], n+"/")
+				}
+				if !trusted {
+					return "", fmt.Errorf(`Get "https://%s/v2/": http: server gave HTTP response to HTTPS client`, o.Registry)
+				}
+				pushed = true
+				return "", nil
+			case "image":
+				return `["` + o.Registry + `/mesh-controller@sha256:` + strings.Repeat("a", 64) + `"]`, nil
+			}
+		}
+		return mesh(name, args)
+	}
+	d := Deps{Run: run, Fetch: func(_ context.Context, url string) (int, string, error) {
+		if strings.HasSuffix(url, "/v2/") || pushed {
+			return http.StatusOK, `{"name":"mesh-controller","tags":["genesis"]}`, nil
+		}
+		return http.StatusNotFound, "", nil
+	}}
+	var result Result
+	published, err := RegistryAndPublish(context.Background(), o, d, sys,
+		controlPlane{container: "temp-mesh-controller", run: run, timeout: time.Second}, held, &result, func(string) {})
+	if err != nil {
+		t.Fatalf("genesis did not get past the push: %v\ncommands: %v", err, runtime.commands)
+	}
+	if !strings.HasPrefix(published.Reference, o.Registry+"/mesh-controller@sha256:") {
+		t.Errorf("published as %q", published.Reference)
+	}
+
+	firstPush, reloaded, confirmed := -1, -1, -1
+	for i, c := range runtime.commands {
+		switch {
+		case firstPush < 0 && (strings.HasPrefix(c, "docker tag") || strings.HasPrefix(c, "docker push")):
+			firstPush = i
+		case strings.HasPrefix(c, "systemctl") && strings.Contains(c, "reload"):
+			reloaded = i
+		case strings.HasPrefix(c, "docker info"):
+			confirmed = i
+		}
+	}
+	if firstPush < 0 || reloaded < 0 || confirmed < 0 || !(reloaded < confirmed && confirmed < firstPush) {
+		t.Errorf("the trust was not written (%d) and confirmed (%d) before the first tag or push (%d): %v",
+			reloaded, confirmed, firstPush, runtime.commands)
+	}
+	if fmt.Sprint(result.RegistryTrusted) != "[192.0.2.10:5100 anchor.internal:5100]" {
+		t.Errorf("the result says it trusted %v", result.RegistryTrusted)
+	}
+}
+
+// Preflight asks, without writing, what would stop the trust from taking at step 7.
+func TestPreflightRefusesARuntimeThatCouldNotTakeTheTrust(t *testing.T) {
+	proc := t.TempDir()
+	was := procRoot
+	procRoot = proc
+	t.Cleanup(func() { procRoot = was })
+	if err := os.MkdirAll(filepath.Join(proc, "42"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	unit := func(load, active string) Runner {
+		return func(_ context.Context, name string, args ...string) (string, error) {
+			return "LoadState=" + load + "\nActiveState=" + active + "\nMainPID=42\n", nil
+		}
+	}
+	cmdline := func(args ...string) {
+		if err := os.WriteFile(filepath.Join(proc, "42", "cmdline"), []byte(strings.Join(args, "\x00")+"\x00"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	cmdline("/usr/bin/dockerd", "-H", "fd://")
+
+	for _, c := range []struct {
+		name, file string
+		run        Runner
+		flag       bool
+		refused    string
+	}{
+		{"a runtime that can take it", `{"data-root":"/srv/docker"}`, unit("loaded", "active"), false, ""},
+		{"no file yet", "", unit("loaded", "active"), false, ""},
+		{"a file that is not an object", `["not", "an", "object"]`, unit("loaded", "active"), false, "not a JSON object"},
+		{"a runtime systemd does not run", `{}`, unit("not-found", "inactive"), false, "not-found and inactive"},
+		{"a runtime with the flag", `{}`, unit("loaded", "active"), true, "--insecure-registry=10.0.0.1:5000"},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			o, _, _ := trustSetup(t, c.file)
+			if c.flag {
+				cmdline("/usr/bin/dockerd", "--insecure-registry=10.0.0.1:5000")
+				defer cmdline("/usr/bin/dockerd", "-H", "fd://")
+			}
+			before, _ := os.ReadFile(runtimeConfig)
+			err := RuntimeWillTakeTheTrust(context.Background(), o, c.run, func(string) {})
+			switch {
+			case c.refused == "" && err != nil:
+				t.Errorf("refused: %v", err)
+			case c.refused != "" && (err == nil || !strings.Contains(err.Error(), c.refused)):
+				t.Errorf("wanted a refusal naming %q, got %v", c.refused, err)
+			}
+			if after, _ := os.ReadFile(runtimeConfig); string(after) != string(before) {
+				t.Error("preflight wrote the runtime's file")
+			}
+		})
+	}
+}