Believe a hand-over only signed by the mesh, and give it through no link (hq issue 356, review)

Two holes the review proved. The ask's subject proved nothing — a responder can reach it through a reply — so the engine now verifies the mesh's signature over a fixed context with the key it verifies declarations with, before reading anything, and refuses an ask for another node, expired, good too long, without a nonce, or replayed. And the apply followed a link the hand-over had refused: a component swapped for a link after the record carried root's chmod and chown to its target. A handed-over directory must now still resolve to itself, and is changed only through one descriptor opened from / with no link followed (fchmod, fchown). Tests for the reply guard, the run loop's hook, the fallback renewal on proof and a non-regular fallback; 27 checks each removed in turn, each failing a test.

cmd/mesh-host/found_test.go

@@ -143,24 +143,25 @@ func TestAHandOverIsRefusedForEveryPathThatIsNotTheFoundDirectory(t *testing.T)
 	}}); err != nil {
 		t.Fatal(err)
 	}
-	refused := map[string]string{
-		"a relative path":               "found",
-		"a path with ..":                dir + "/x/../found",
-		"a doubled separator":           dir + "//found",
-		"a trailing separator":          found + "/",
-		"a directory not used as found": filepath.Join(dir, "other"),
-		"a link at the path":            linked,
-		"a link in the path":            through,
-		"a file":                        file,
-		"a directory that is gone":      gone,
+	// Each refused by its own check, which the reason names.
+	refused := map[string][2]string{
+		"a relative path":               {"found", "not one"},
+		"a path with ..":                {dir + "/x/../found", "as the engine states it"},
+		"a doubled separator":           {dir + "//found", "as the engine states it"},
+		"a trailing separator":          {found + "/", "as the engine states it"},
+		"a directory not used as found": {filepath.Join(dir, "other"), "not a directory this machine uses as found"},
+		"a link at the path":            {linked, "is a link"},
+		"a link in the path":            {through, "reached through a link"},
+		"a file":                        {file, "is not a directory on this machine"},
+		"a directory that is gone":      {gone, "cannot be read on this machine"},
 	}
-	for name, path := range refused {
-		said, err := handOverFound(statePath, path, "jo")
+	for name, c := range refused {
+		said, err := handOverFound(statePath, c[0], "jo")
 		if err == nil || said != "" {
-			t.Fatalf("%s (%s) was handed over: %q", name, path, said)
+			t.Fatalf("%s (%s) was handed over: %q", name, c[0], said)
 		}
-		if !strings.Contains(err.Error(), "nothing was handed over") {
-			t.Fatalf("%s's refusal does not say nothing was handed over: %v", name, err)
+		if !strings.Contains(err.Error(), "nothing was handed over") || !strings.Contains(err.Error(), c[1]) {
+			t.Fatalf("%s's refusal does not say %q and that nothing was handed over: %v", name, c[1], err)
 		}
 	}
 	if all, err := store.LoadHandedOver(statePath); err != nil || len(all) != 0 {

cmd/mesh-host/witnessing_test.go

@@ -5,6 +5,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -17,6 +18,12 @@ import (
 func TestOnlyAnAccountUnderThisBuildProvesIt(t *testing.T) {
 	state := filepath.Join(t.TempDir(), "state.json")
 	t.Setenv("MESH_HOST_LIBEXEC", t.TempDir())
+	// Never the machine's own engine placed by hand: proving renews it (issue 356).
+	fallback := filepath.Join(t.TempDir(), "nox-mesh-host")
+	if err := os.WriteFile(fallback, []byte("a stale engine placed by hand"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(upgrade.FallbackVar, fallback)
 	var said []string
 	p := &proving{statePath: state, version: "2.0", say: func(s string) { said = append(said, s) }}
 
@@ -29,6 +36,9 @@ func TestOnlyAnAccountUnderThisBuildProvesIt(t *testing.T) {
 		if !unproved(state, "2.0") {
 			t.Fatalf("%+v proved this build", r)
 		}
+		if got, _ := os.ReadFile(fallback); string(got) != "a stale engine placed by hand" {
+			t.Fatalf("%+v renewed the engine placed by hand", r)
+		}
 	}
 	p.heard(link.Report{Host: "2.0", Declared: "abc"})
 	if unproved(state, "2.0") {
@@ -37,6 +47,23 @@ func TestOnlyAnAccountUnderThisBuildProvesIt(t *testing.T) {
 	if got, _ := upgrade.ReadKnownGood(upgrade.KnownGoodPath(state)); got != "2.0" {
 		t.Fatalf("known-good is %q", got)
 	}
+	// **Proved, the engine placed by hand becomes this build** (issue 356): the command on the machine's PATH is
+	// the engine that runs it, and that is said.
+	self, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	want, _ := os.ReadFile(self)
+	if got, _ := os.ReadFile(fallback); len(want) == 0 || string(got) != string(want) {
+		t.Fatalf("the engine placed by hand was not renewed to this build (%d bytes, want %d)", len(got), len(want))
+	}
+	renewed := false
+	for _, s := range said {
+		renewed = renewed || strings.Contains(s, "renewed the engine placed by hand at "+fallback)
+	}
+	if !renewed {
+		t.Fatalf("the renewal was not said: %q", said)
+	}
 }
 
 // Every verdict that stands is said, and a reconcile that has one says it unasked.