amadan

carlos / platform Public

WIP claim Plan 14 track E checkpoint 41 (not for merge)

Claim-mode relocation materializer refusal, with unit and root tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Paul Campbell pushed by claude 87fefd8d66f89d1726a65a9b0691469fd6091ca9 parent c8b0284
4 files changed, +219 −1
  • internal/host/plan14_generation_relocation_linux_test.go +164 −0
  • internal/host/plan14_generation_relocation_root_linux_test.go +50 −0
  • internal/host/relocationinstall.go +3 −0
  • internal/provision/testdata/plan14-root-reads-e.tsv +2 −1

CI passed — run details

CI log 
=== gate ===
go: downloading github.com/aws/aws-sdk-go-v2 v1.44.0
go: downloading github.com/aws/aws-sdk-go-v2/config v1.32.6
go: downloading github.com/aws/aws-sdk-go-v2/service/sns v1.43.0
go: downloading github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.68.0
go: downloading github.com/aws/aws-sdk-go-v2/service/ec2 v1.324.0
go: downloading github.com/superfly/ltx v0.5.1
go: downloading github.com/aws/aws-sdk-go-v2/service/acm v1.45.0
go: downloading github.com/oschwald/maxminddb-golang v1.13.1
go: downloading golang.org/x/crypto v0.52.0
go: downloading github.com/aws/aws-sdk-go-v2/service/iam v1.58.2
go: downloading github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.37.0
go: downloading github.com/aws/aws-sdk-go-v2/service/route53 v1.64.1
go: downloading github.com/benbjohnson/litestream v0.5.14
go: downloading github.com/aws/smithy-go v1.28.1
go: downloading golang.org/x/sys v0.46.0
go: downloading github.com/aws/aws-sdk-go-v2/service/s3 v1.105.0
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.19.6
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.45.6
go: downloading modernc.org/sqlite v1.55.0
go: downloading github.com/klauspost/compress v1.18.0
go: downloading github.com/pion/logging v0.2.4
go: downloading github.com/aws/aws-sdk-go-v2/service/sesv2 v1.66.6
go: downloading github.com/pion/stun/v3 v3.0.1
go: downloading github.com/pion/turn/v4 v4.1.4
go: downloading github.com/aws/aws-sdk-go-v2/service/costexplorer v1.67.5
go: downloading golang.org/x/net v0.55.0
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16
go: downloading github.com/aws/aws-sdk-go-v2/service/signin v1.0.4
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.30.8
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40
go: downloading github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.38
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40
go: downloading github.com/pierrec/lz4/v4 v4.1.22
go: downloading github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40
go: downloading github.com/pion/transport/v3 v3.0.8
go: downloading github.com/pion/dtls/v3 v3.0.7
go: downloading github.com/prometheus/client_golang v1.17.0
go: downloading golang.org/x/sync v0.21.0
go: downloading github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.18
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/lmittmann/tint v1.1.3
go: downloading github.com/pion/randutil v0.1.0
go: downloading github.com/pion/transport/v4 v4.0.1
go: downloading github.com/prometheus/common v0.45.0
go: downloading github.com/prometheus/procfs v0.12.0
go: downloading github.com/beorn7/perks v1.0.1
go: downloading google.golang.org/protobuf v1.36.10
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/prometheus/client_model v0.5.0
go: downloading github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0
go: downloading github.com/wlynxg/anet v0.0.5
go: downloading golang.org/x/text v0.37.0
go: downloading modernc.org/libc v1.74.1
go: downloading modernc.org/memory v1.11.0
go: downloading github.com/google/uuid v1.6.0
go: downloading modernc.org/mathutil v1.7.1
go: downloading github.com/dustin/go-humanize v1.0.1
go: downloading github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	353.203s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.091s
ok  	github.com/carlosframework/platform/cmd/moveprobe	92.257s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.710s
ok  	github.com/carlosframework/platform/internal/activator	234.732s
ok  	github.com/carlosframework/platform/internal/agentsock	0.017s
ok  	github.com/carlosframework/platform/internal/alerting	0.005s
ok  	github.com/carlosframework/platform/internal/analytics	0.020s
ok  	github.com/carlosframework/platform/internal/appconfig	2.368s
ok  	github.com/carlosframework/platform/internal/apperr	0.072s
ok  	github.com/carlosframework/platform/internal/applog	0.133s
ok  	github.com/carlosframework/platform/internal/awsinv	0.004s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.005s
ok  	github.com/carlosframework/platform/internal/boxid	0.665s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.008s
ok  	github.com/carlosframework/platform/internal/caps	0.011s
ok  	github.com/carlosframework/platform/internal/certwarm	0.005s
ok  	github.com/carlosframework/platform/internal/cgroup	0.701s
ok  	github.com/carlosframework/platform/internal/changelog	0.318s
ok  	github.com/carlosframework/platform/internal/clamd	0.055s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	368.512s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.992s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.009s
ok  	github.com/carlosframework/platform/internal/dbverify	0.004s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.003s
ok  	github.com/carlosframework/platform/internal/docsite	0.005s
ok  	github.com/carlosframework/platform/internal/domains	2.167s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	26.559s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.124s
ok  	github.com/carlosframework/platform/internal/gate	1.654s
ok  	github.com/carlosframework/platform/internal/genselect	0.015s
ok  	github.com/carlosframework/platform/internal/geo	0.015s
ok  	github.com/carlosframework/platform/internal/geoip	0.029s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.156s
ok  	github.com/carlosframework/platform/internal/host	138.718s
ok  	github.com/carlosframework/platform/internal/hostactors	0.482s
ok  	github.com/carlosframework/platform/internal/hostbox	2.427s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.539s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.005s
ok  	github.com/carlosframework/platform/internal/hostexec	5.356s
ok  	github.com/carlosframework/platform/internal/hostfence	0.033s
ok  	github.com/carlosframework/platform/internal/hostfiles	11.000s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.013s
ok  	github.com/carlosframework/platform/internal/hostguard	1.028s
ok  	github.com/carlosframework/platform/internal/hostops	1.450s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.004s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.002s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.452s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.135s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.004s
ok  	github.com/carlosframework/platform/internal/infraview	0.006s
ok  	github.com/carlosframework/platform/internal/instancectl	1.826s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.740s
ok  	github.com/carlosframework/platform/internal/instancefs	0.006s
ok  	github.com/carlosframework/platform/internal/instancekey	0.006s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.009s
ok  	github.com/carlosframework/platform/internal/layout	1.428s
ok  	github.com/carlosframework/platform/internal/lease	9.496s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.008s
ok  	github.com/carlosframework/platform/internal/ledger	0.022s
ok  	github.com/carlosframework/platform/internal/mail	0.171s
ok  	github.com/carlosframework/platform/internal/maintenance	0.090s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.541s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.079s
ok  	github.com/carlosframework/platform/internal/metrics	0.006s
ok  	github.com/carlosframework/platform/internal/moves	21.694s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.797s
ok  	github.com/carlosframework/platform/internal/objstore	0.179s
ok  	github.com/carlosframework/platform/internal/ops	0.174s
ok  	github.com/carlosframework/platform/internal/park	0.220s
ok  	github.com/carlosframework/platform/internal/privatefile	0.003s
ok  	github.com/carlosframework/platform/internal/provision	30.172s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.008s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	4.743s
ok  	github.com/carlosframework/platform/internal/relay	7.289s
ok  	github.com/carlosframework/platform/internal/release	21.934s
ok  	github.com/carlosframework/platform/internal/rollout	3.816s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.004s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.007s
ok  	github.com/carlosframework/platform/internal/rootstate	0.027s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.301s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	11.811s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.752s
ok  	github.com/carlosframework/platform/internal/status	0.041s
ok  	github.com/carlosframework/platform/internal/steering	0.007s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.231s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.006s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.572s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
go: downloading github.com/ncruces/go-strftime v1.0.0
--- shard 1 of 5 ---
cross-compiling darwin/amd64
go: downloading github.com/ncruces/go-strftime v1.0.0
--- shard 2 of 5 ---
cross-compiling linux/arm64
--- shard 3 of 5 ---
cross-compiling windows/amd64
go: downloading github.com/ncruces/go-strftime v1.0.0
--- shard 4 of 5 ---
cross-compiling windows/arm64
go: downloading github.com/ncruces/go-strftime v1.0.0
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.024s
=== RUN   TestT4StorageProbeMinio
2026/10/14 21:31:30 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DE82C65985822B, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.022s
minio contract: PASS
diff --git a/internal/host/plan14_generation_relocation_linux_test.go b/internal/host/plan14_generation_relocation_linux_test.go
new file mode 100644
index 000000000..ae42eb991
--- /dev/null
+++ b/internal/host/plan14_generation_relocation_linux_test.go
@@ -0,0 +1,164 @@
+//go:build linux
+
+package host
+
+import (
+ "bytes"
+ "context"
+ "errors"
+ "net"
+ "os"
+ "path/filepath"
+ "runtime"
+ "testing"
+
+ "github.com/carlosframework/platform/internal/hostclaim"
+
+ "github.com/carlosframework/platform/internal/release"
+)
+
+func TestPlan14GenerationRelocationDefaultMaterializer(t *testing.T) {
+ for _, mode := range []string{"fresh", "staged", "damaged", "already-live", "claims-off"} {
+ t.Run(mode, func(t *testing.T) {
+ f := newInstallFixture(t, nil)
+ f.cfg.materialize = nil
+ f.cfg.verifyLive = nil
+ f.cfg.ReleasePub = hsPub
+ f.cfg.Ratchet = hsRatchet(t)
+ platform := runtime.GOOS + "-" + runtime.GOARCH
+ artifact := []byte("signed relocation artifact")
+ if err := release.Ship(t.Context(), f.claims, "acct", release.Manifest{App: "app", Version: "v1", Kind: "binary", Artifacts: map[string]release.Artifact{platform: {}}}, map[string][]byte{platform: artifact}); err != nil {
+ t.Fatal(err)
+ }
+ if err := release.Promote(t.Context(), f.claims, hsPriv, "acct", "app", "canary/x", "v1"); err != nil {
+ t.Fatal(err)
+ }
+ path := release.VersionPath(f.r.OptDir, "acct", "v1", "app")
+ if err := os.Remove(path); err != nil {
+ t.Fatal(err)
+ }
+ if mode == "staged" || mode == "damaged" || mode == "already-live" {
+ // This positive control verifies the exact signed fixture independently
+ // of the relocation install, whose default materializer is under test.
+ rt, err := relocationRecord(t.Context(), f.r.DataDir, f.claims, f.read())
+ if err != nil {
+ t.Fatal(err)
+ }
+ held := rt.Route
+ held.HoldOp = f.read().Claim.Op.ID
+ if _, err := release.StageHeldVerified(t.Context(), f.claims, hsPub, f.cfg.Ratchet, f.r.OptDir, held, "v1", offProofGate(t)); err != nil {
+ t.Fatal(err)
+ }
+ }
+ if mode == "already-live" {
+ f.cfg.materialize = f.materialize
+ if _, err := f.install(); err != nil {
+ t.Fatal(err)
+ }
+ f.cfg.materialize = nil
+ }
+ if mode == "damaged" {
+ if err := os.WriteFile(path, []byte("retained inode"), 0755); err != nil {
+ t.Fatal(err)
+ }
+ }
+ if mode == "claims-off" {
+ t.Setenv("CARLOS_HOST_CLAIM", "")
+ }
+ var before []byte
+ var identity os.FileInfo
+ if mode != "fresh" && mode != "claims-off" {
+ var err error
+ before, err = os.ReadFile(path)
+ if err != nil {
+ t.Fatal(err)
+ }
+ identity, err = os.Stat(path)
+ if err != nil {
+ t.Fatal(err)
+ }
+ }
+ receipt, err := f.install()
+ if mode == "already-live" || mode == "claims-off" {
+ if err != nil || receipt.JournalSHA256 == "" {
+ t.Fatalf("verified legacy/live install: %+v %v", receipt, err)
+ }
+ got, err := os.ReadFile(path)
+ if err != nil || !bytes.Equal(got, artifact) {
+ t.Fatalf("installed artifact: %q %v", got, err)
+ }
+ return
+ }
+ if !errors.Is(err, errHeldReleaseUnavailable) {
+ t.Errorf("unsupported root relocation must refuse before materializing: %+v %v", receipt, err)
+ }
+ if receipt.JournalSHA256 != "" {
+ t.Error("unsupported relocation returned completion")
+ }
+ if _, err := os.Lstat(release.LiveLink(f.r.OptDir, buildHost)); !errors.Is(err, os.ErrNotExist) {
+ t.Errorf("relocation published live: %v", err)
+ }
+ if mode == "fresh" {
+ if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
+ t.Errorf("relocation staged without root pins: %v", err)
+ }
+ } else {
+ got, err := os.ReadFile(path)
+ after, statErr := os.Stat(path)
+ if err != nil || statErr != nil || !bytes.Equal(before, got) || !os.SameFile(identity, after) {
+ t.Errorf("retained artifact changed: %q %v %v", got, err, statErr)
+ }
+ }
+ journal, pathErr := relocationInstallPath(f.r.DataDir, f.read().Claim.Op.ID)
+ if pathErr != nil {
+ t.Fatal(pathErr)
+ }
+ if _, err := os.Stat(journal); !errors.Is(err, os.ErrNotExist) {
+ t.Errorf("refusal wrote completion journal: %v", err)
+ }
+ requests, err := filepath.Glob(filepath.Join(release.HeldStageDir(f.r.DataDir), "*"))
+ if err != nil || len(requests) != 0 {
+ t.Fatalf("unsupported operation queued legacy relay: %v %v", requests, err)
+ }
+ })
+ }
+}
+
+func TestPlan14GenerationRelocationRelayRefusal(t *testing.T) {
+ for _, action := range []string{heldReleaseStage, heldReleasePublish} {
+ for _, kind := range []string{hostclaim.KindRelocating, hostclaim.KindMoving, hostclaim.KindLanding, hostclaim.KindRestoring} {
+ t.Run(action+"/"+kind, func(t *testing.T) {
+ f := newHRFixture(t)
+ f.set(func(f *hrFixture) {
+ f.claim.Op.Kind = hostclaim.KindRelocating
+ f.claim.Op.Phase = hostclaim.PhaseInstalled
+ f.claim.Op.Journal = map[string]string{"install_stamp": "7", "install_release": "v7"}
+ f.rec.Move = nil
+ f.row.Status = "relocating"
+ })
+ f.root.Authenticate = func(context.Context, net.Conn) (StopPeer, error) { return hrPeer, nil }
+ client := newHeldReleaseRootClient(serveClaimRoot(t, f.root))
+ q := f.request(action)
+ q.Kind = kind
+ if _, err := client.HeldRelease(t.Context(), q); err == nil {
+ t.Fatal("unsupported relocation granted through root relay")
+ }
+ if _, err := os.Stat(release.VersionPath(f.opt, "bab", "v7", "app")); !errors.Is(err, os.ErrNotExist) {
+ t.Fatalf("root staged unsupported relocation: %v", err)
+ }
+ if _, err := os.Lstat(release.LiveLink(f.opt, p1Host)); !errors.Is(err, os.ErrNotExist) {
+ t.Fatalf("root published unsupported relocation: %v", err)
+ }
+ entries, err := os.ReadDir(f.receipts)
+ if err != nil || len(entries) != 0 {
+ t.Fatalf("root receipted unsupported relocation: %v %v", entries, err)
+ }
+ f.sel.mu.Lock()
+ defer f.sel.mu.Unlock()
+ if len(f.sel.selected) != 0 {
+ t.Fatalf("unsupported relocation selected work: %v", f.sel.selected)
+ }
+ })
+ }
+ }
+}
diff --git a/internal/host/plan14_generation_relocation_root_linux_test.go b/internal/host/plan14_generation_relocation_root_linux_test.go
new file mode 100644
index 000000000..bf8644030
--- /dev/null
+++ b/internal/host/plan14_generation_relocation_root_linux_test.go
@@ -0,0 +1,50 @@
+//go:build linux && rootrunner
+
+package host
+
+import (
+ "os"
+ "os/exec"
+ "path/filepath"
+ "syscall"
+ "testing"
+)
+
+func TestPlan14GenerationRelocationUIDRootRunner(t *testing.T) {
+ dir := generationRootRunnerDir(t)
+ binary, err := os.Executable()
+ if err != nil {
+ t.Fatal(err)
+ }
+ raw, err := os.ReadFile(binary)
+ if err != nil {
+ t.Fatal(err)
+ }
+ installed := filepath.Join(dir, "runner.test")
+ if err := os.WriteFile(installed, raw, 0755); err != nil {
+ t.Fatal(err)
+ }
+ scratch := filepath.Join(dir, "service")
+ if err := os.Mkdir(scratch, 0700); err != nil {
+ t.Fatal(err)
+ }
+ if err := os.Chown(scratch, 65534, 65534); err != nil {
+ t.Fatal(err)
+ }
+ cmd := exec.CommandContext(t.Context(), installed, "-test.run=^TestPlan14GenerationRelocationUIDPayload$", "-test.v", "-test.timeout=1m")
+ cmd.Dir = scratch
+ cmd.Env = []string{"PATH=/usr/bin:/bin", "HOME=" + scratch, "TMPDIR=" + scratch, "PLAN14_E41_UID=1"}
+ cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534, Groups: []uint32{}}}
+ if out, err := cmd.CombinedOutput(); err != nil {
+ t.Fatalf("service UID relocation: %v\n%s", err, out)
+ } else {
+ t.Log(string(out))
+ }
+}
+
+func TestPlan14GenerationRelocationUIDPayload(t *testing.T) {
+ if os.Getenv("PLAN14_E41_UID") != "1" || os.Geteuid() != 65534 {
+ t.Fatal("invoke through TestPlan14GenerationRelocationUIDRootRunner")
+ }
+ TestPlan14GenerationRelocationDefaultMaterializer(t)
+}
diff --git a/internal/host/relocationinstall.go b/internal/host/relocationinstall.go
index 689f1dae1..ae08ebdb5 100644
--- a/internal/host/relocationinstall.go
+++ b/internal/host/relocationinstall.go
@@ -490,6 +490,9 @@ func (a ClaimAssembly) relocationInstall(cfg RelocationAssemblyConfig) func(cont
}
if materialize == nil {
materialize = func(ctx context.Context, s release.Store, optDir string, rt registry.Route, version string, proof *release.ProofGate, work hostwrite.Work, guard func(func() error) error) (*release.Manifest, error) {
+ if hostwrite.Enabled(os.Getenv) {
+ return nil, errHeldReleaseUnavailable
+ }
return release.MaterializeHeldUnder(ctx, s, cfg.ReleasePub, cfg.Ratchet, optDir, rt, version, proof, work, guard)
}
}
diff --git a/internal/provision/testdata/plan14-root-reads-e.tsv b/internal/provision/testdata/plan14-root-reads-e.tsv
index 509af3c84..c5d803639 100644
--- a/internal/provision/testdata/plan14-root-reads-e.tsv
+++ b/internal/provision/testdata/plan14-root-reads-e.tsv
@@ -54,7 +54,7 @@ internal/release/roothistory_replace.go replacementReconstruction authority E1 S
internal/release/signedhead.go StageSignedHead authority E1 Canonical route is supplied by the root unit verifier. Verifies signed channel, digest ratchet and manifest/artifact before staging; unavailable pin census never authorizes restaging differing bytes. Fixtures: TestPlan14Incident20261006WithLedger and TestPlan14SignedNamedRecoveryAuthority. registry:Account@202,registry:Account@302,registry:Account@403,registry:App@214,registry:App@415,registry:Channel@222,registry:Host@434 ca02f04e55556ba0233dfa0848b0c533a9d9aa06cad6abd33cfd2968b3bd838a
internal/rootstate/link_linux.go ReadTrustedLink authority A,E1 Checks the full root-owned parent chain before descriptor-based live-link reading. Fixture: TestPlan14TrustedLiveLink; privileged acceptance remains required. file:Open@156 90f8e8de4e2c71f07b5d749cbe4bb1c1dfa426576a82138823449f56fc9ec5ab
internal/rootstate/link_linux.go directory.readLink authority A,E1 Pins the symlink inode with O_PATH and checks owner/type/link count before readlinkat. Fixture: TestPlan14TrustedLiveLink. file:Fstat@356,file:Openat@183,file:Readlinkat@554 a8559fe63dce48830916004ecfe7fbbe5d419568c7daf7a3073cf1b5bb12c3d7
-@coverage internal/host 224a569675197b714ee2f78cdefd72a2d3efa3e74fd9d95f78a49bcdd2a3b8e8
+@coverage internal/host a3d2a70992e618d74a200881b9a04489b3d5dd233e0e0184c6ad8e68a39e548b
@coverage internal/release 2bb546a86c1ab49b02e424eb0b366b46776857a1249baa2d6fb61ead4209d6bd
@coverage internal/rootstate a773d6dbc0e4150e0054f7a94d0e1493c88d0d57f4f4530138b3427e2c217bc5
internal/release/roothistory_status.go RootHistory.MigrationStatus authority E1 Exact completion binds the accepted authorization digest from durable private history to enrolled-root signed readback. Pending originals, changed evidence and canonical sources cannot supply retirement completion. Fixtures: TestPlan14HistoryReconstructionCompletion, TestPlan14HistoryRetirementCompletion, TestPlan14ReadReconstructionCompletion, TestPlan14ReadRetirementCompletion, TestPlan14RecoveryRetirementProductionCallback, TestPlan14RootHistoryReconstructionCrash, TestPlan14HistoryRetirementProcessCrash. file:Read@1062,file:Read@3891 f0ab7ad2d2d70f8c22ebfd575f5a1c6931f7eba30ccdba80ad43d0efffc88154
@@ -352,3 +352,4 @@ internal/activator/backend_exec.go ExecBackend.spawnInCgroupGated authority E2 E
internal/activator/backend_exec.go ExecBackend.startSidecarUnitFrom authority E2 E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence. registry:Host@1073,registry:Host@1540,registry:Host@1615,registry:Host@1761,registry:Host@1874,registry:Host@1929,registry:Host@992,whole:Route@1495,whole:Route@1656,whole:Route@1964,whole:Route@247,whole:Route@752,whole:Route@838,whole:Route@896 02104c3d98041c64e8b31a1a732baf302f81b848bb223b690f9bb2195a35041a
internal/activator/containment.go ExecBackend.spawnInCgroupAtTier authority E2 E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence. registry:Host@1098,registry:Host@543,registry:Host@625,registry:Host@756,registry:Host@812,registry:Host@911,whole:Route@312,whole:Route@441 99fa73504a1418a92bb3cfb2d89a34b2de4346ec7635ce5bee9044343d7b2eca
internal/activator/containment.go ExecBackend.startRole authority E2 E40: claim-enabled raw backend refuses unsupported direct, placed and legacy-control launches before spawn. Claims-off body unchanged. TestPlan14GenerationBackendDirectBoundary, TestPlan14GenerationBackendControlBoundary, TestPlan14GenerationBackendAuxiliaryBoundary; each guard has an independent behavioral mutation. Agent-side refusal is not root reservation or containment evidence. registry:Host@312,registry:Host@459,registry:Host@573,registry:Host@835,registry:Host@899,whole:Route@334,whole:Route@539,whole:Route@724 cd68c5f7705f207659124dc3302d9977987a70cfbdec5a92ffe24262caf2256f
+internal/host/relocationinstall.go ClaimAssembly.relocationInstall authority B2,C,E2 Existing root inventory and installation obligations remain B2,C; E41: default relocation materializer refuses claim-mode direct stage/publication until a root-reserved relay exists. Claims-off body unchanged; already-live verified releases remain readable. TestPlan14GenerationRelocationDefaultMaterializer and TestPlan14GenerationRelocationRelayRefusal. Positive root relocation remains open. file:Read@6045,registry:DBPath@6324,registry:HoldOp@9706,registry:Status@9693,whole:Route@13446,whole:Route@13571,whole:Route@14300,whole:Route@3422,whole:Route@3471,whole:Route@815,whole:Route@9688,whole:Route@9812 f4eca0dac7b1b0dd43b701114e30f177cc21350851a50e95b3cc2c336e2d3c1c