jschoubben
1f0fb85128
The mechanism was leaking into every module. Code of one's own meant a container and therefore an image; a script meant a service and a unit somebody else had to install. One intent — run this and keep it running — expressed two unrelated ways, with the hosting chosen before anything could be declared. A daemon names a bundle and a command. The host fetches it, refuses it unless it hashes to what was declared, unpacks it where the mesh keeps such things, writes the unit and puts it in the state asked for. The unit is the mesh's, generated whole and saying so, because an edit that survives until the next declaration and then vanishes is worse than one that is refused. Its identity is the bytes AND how it is run: two daemons from one bundle differing only in their command are different daemons, and tracking the digest alone would call the second unchanged and leave the first running. The unit is rendered deterministically for the same reason — environment from a map would be written in Go's iteration order, so every apply would see a different unit and restart an unchanged daemon for ever. restart-on is honoured as a service's is: a running process does not re-read its configuration, so replacing a file and finding the daemon already up leaves the machine behaving as before while every check passes. A full-host shape, not a portable one: it needs a process supervisor to install into. It does NOT need a container runtime, which is the point. Two guards caught this properly and both were updated deliberately rather than silenced: the vocabulary count, which exists because every addition widens what a compromised control plane can express, and the shape test that catches a kind the language has and a host cannot apply — added after `network` did exactly that. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx
73 lines
2.3 KiB
Go
73 lines
2.3 KiB
Go
package declaration
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func aDaemon() *Daemon {
|
|
return &Daemon{
|
|
ID: "server", Type: TypeDaemon, Name: "greeter",
|
|
Source: "https://store.invalid/greeter/daemon",
|
|
Digest: "sha256:" + strings.Repeat("a", 64),
|
|
Run: []string{"node", "index.js"},
|
|
}
|
|
}
|
|
|
|
// A daemon is part of the vocabulary, or a declaration carrying one is refused whole.
|
|
func TestADaemonIsSomethingTheHostSpeaks(t *testing.T) {
|
|
var found bool
|
|
for _, kind := range Vocabulary() {
|
|
if kind == TypeDaemon {
|
|
found = true
|
|
}
|
|
}
|
|
if !found {
|
|
t.Fatal("a daemon cannot be declared, so a module that declares one is refused")
|
|
}
|
|
if newOf(TypeDaemon) == nil {
|
|
t.Fatal("the decoder has no daemon, so one would be refused as an unknown kind")
|
|
}
|
|
}
|
|
|
|
// **Pinned by digest, like everything else that crosses a network.** A bundle fetched by a
|
|
// reference somebody can repoint is not pinned, and it is the one thing on a machine that would
|
|
// then be running code nobody reviewed.
|
|
func TestADaemonsBundleMustBePinned(t *testing.T) {
|
|
for _, bad := range []string{"", "latest", "sha256:short", strings.Repeat("a", 64)} {
|
|
d := aDaemon()
|
|
d.Digest = bad
|
|
if problems := d.validate("a daemon", false); len(problems) == 0 {
|
|
t.Fatalf("a daemon pinned by %q was accepted", bad)
|
|
}
|
|
}
|
|
}
|
|
|
|
// What to run is named, never inferred. Guessing an entrypoint from which files are present makes
|
|
// a daemon change what it runs when somebody adds a file.
|
|
func TestADaemonMustSayWhatToRun(t *testing.T) {
|
|
d := aDaemon()
|
|
d.Run = nil
|
|
if problems := d.validate("a daemon", false); len(problems) == 0 {
|
|
t.Fatal("a daemon with no command was accepted")
|
|
}
|
|
}
|
|
|
|
// Its name becomes a unit name and a path, so a separator in it would write somewhere nobody meant.
|
|
func TestADaemonsNameCannotEscapeItsUnit(t *testing.T) {
|
|
for _, bad := range []string{"", "../escape", "two words", "a/b"} {
|
|
d := aDaemon()
|
|
d.Name = bad
|
|
if problems := d.validate("a daemon", false); len(problems) == 0 {
|
|
t.Fatalf("a daemon called %q was accepted", bad)
|
|
}
|
|
}
|
|
}
|
|
|
|
// And a well-formed one is accepted, or the tests above prove only that everything is refused.
|
|
func TestAWellFormedDaemonIsAccepted(t *testing.T) {
|
|
if problems := aDaemon().validate("a daemon", false); len(problems) != 0 {
|
|
t.Fatalf("a well-formed daemon was refused: %v", problems)
|
|
}
|
|
}
|