novox/mesh-host
18
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

F-host 2, ENG-5: the bootstrap's one-off push credential goes to distribution's account, mode 0600, only once the node-engine made that account and its state directory, so the holder's program can read it (review of issue 1966)

Browse Source 
The owner is the account the manifest names for the directory that holds the file; the bootstrap no longer makes that
directory itself, and a run that reaches it first is refused naming what it waits on.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
This commit is contained in:
jschoubben
2026-11-04 16:24:14 +01:00
parent 9740238ec9
commit 20614822df
3 changed files with 103 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/bootstrap/trust_test.go
+30 -5
View File
@@ -9,6 +9,7 @@ import (
"path/filepath"
"regexp"
"strings"
"syscall"
"testing"
"time"
@@ -227,8 +228,29 @@ func TestARangeTheRuntimeTrustsCoversAnAddressInIt(t *testing.T) {
// moving the trust after the push, or dropping it, fails this test.
func TestNothingIsPushedToTheRegistryBeforeTheRuntimeTrustsIt(t *testing.T) {
o, runtime, sys := trustSetup(t, `{"data-root":"/srv/docker"}`)
o.Catalogue = catalogueWith(t, RegistryModule, upstreamRegistryManifest)
// The holder's state directory and its account, as distribution's manifest declares them (ENG-5).
stateDir := filepath.Join(t.TempDir(), "registry")
o.Catalogue = catalogueWith(t, RegistryModule, strings.Replace(upstreamRegistryManifest,
`{"id": "state", "type": "directory", "path": "/var/lib/mesh/registry", "mode": "0700"}`,
`{"id": "account", "type": "user", "name": "distribution"},
{"id": "state", "type": "directory", "path": "`+stateDir+`", "mode": "0700", "owner": "distribution"}`, 1))
o.Registry = "192.0.2.10:5100"
asked, was := []string{}, lookupAccount
lookupAccount = func(name string) (int, int, error) {
asked = append(asked, name)
return os.Getuid(), os.Getgid(), nil
}
t.Cleanup(func() { lookupAccount = was })
o.PushCredentialFile = filepath.Join(stateDir, "bootstrap-push")
// Before the node-engine made distribution's state directory, nothing is written: the program could not read it.
if _, err := WritePushCredential(o.Catalogue, o.PushCredentialFile); err == nil {
t.Errorf("the push credential was written before its holder's state directory existed")
} else if _, err := os.Stat(stateDir); err == nil {
t.Errorf("the bootstrap made the holder's state directory itself")
}
if err := os.Mkdir(stateDir, 0o700); err != nil {
t.Fatal(err)
}
pushed := false
mesh := aMeshThatAgrees(nil)
@@ -266,7 +288,6 @@ func TestNothingIsPushedToTheRegistryBeforeTheRuntimeTrustsIt(t *testing.T) {
var result Result
// And the one-off credential for the holders' first images (ENG-5): written once, mode 0600, one line of 64 hex digits,
// named in the result and never put in it.
o.PushCredentialFile = filepath.Join(t.TempDir(), "registry", "bootstrap-push")
published, err := RegistryAndPublish(context.Background(), o, d, sys,
controlPlane{container: "temp-mesh-controller", run: run, timeout: time.Second}, held, &result, func(string) {})
if err != nil {
@@ -293,13 +314,17 @@ func TestNothingIsPushedToTheRegistryBeforeTheRuntimeTrustsIt(t *testing.T) {
}
if raw, err := os.ReadFile(o.PushCredentialFile); err != nil || !regexp.MustCompile(`^[0-9a-f]{64}\n$`).Match(raw) {
t.Errorf("the push credential is %q (%v)", raw, err)
} else if st, _ := os.Stat(o.PushCredentialFile); st.Mode().Perm() != 0o600 {
t.Errorf("the push credential is mode %v", st.Mode().Perm())
} else if st, _ := os.Stat(o.PushCredentialFile); st.Mode().Perm() != 0o600 ||
int(st.Sys().(*syscall.Stat_t).Uid) != os.Getuid() || int(st.Sys().(*syscall.Stat_t).Gid) != os.Getgid() {
t.Errorf("the push credential is mode %v, owner %d:%d", st.Mode().Perm(), st.Sys().(*syscall.Stat_t).Uid, st.Sys().(*syscall.Stat_t).Gid)
}
if fmt.Sprint(asked) != "[distribution distribution]" {
t.Errorf("the push credential's owner was asked as %v, not the account distribution's state directory names", asked)
}
if result.PushCredentialFile != o.PushCredentialFile {
t.Errorf("the result names %q", result.PushCredentialFile)
}
if again, err := MintPushCredential(o.PushCredentialFile, nil); err != nil || again.Token() == "" {
if again, err := MintPushCredential(o.PushCredentialFile, os.Getuid(), os.Getgid()); err != nil || again.Token() == "" {
t.Errorf("a credential of an earlier run was not replaced: %v", err)
} else if again.Forget(); again.Token() != "" {
t.Errorf("a forgotten credential still holds its token")