| 1 | package release |
| 2 | |
| 3 | import ( |
| 4 | "errors" |
| 5 | "os" |
| 6 | "path/filepath" |
| 7 | "sync" |
| 8 | "testing" |
| 9 | ) |
| 10 | |
| 11 | func ptr(ch string, digest string) *ChannelPointer { |
| 12 | return &ChannelPointer{App: "km", Channel: ch, Version: "v1", Digest: digest} |
| 13 | } |
| 14 | |
| 15 | func TestRatchetArmsPerChannel(t *testing.T) { |
| 16 | r := NewDigestRatchet(t.TempDir(), nil, false) |
| 17 | if err := r.Admit("bab", ptr("stable", "")); err != nil { |
| 18 | t.Fatalf("a fresh box refused a legacy pointer: %v", err) |
| 19 | } |
| 20 | if err := r.Admit("bab", ptr("stable", dA)); err != nil { |
| 21 | t.Fatal(err) |
| 22 | } |
| 23 | if err := r.Admit("bab", ptr("stable", "")); !errors.Is(err, ErrPointerWithoutDigests) { |
| 24 | t.Fatalf("after digests: %v, want ErrPointerWithoutDigests", err) |
| 25 | } |
| 26 | if err := r.Admit("bab", ptr("beta", "")); err != nil { |
| 27 | t.Fatalf("another channel is not ratcheted: %v", err) |
| 28 | } |
| 29 | if err := r.Admit("cdf", ptr("stable", "")); err != nil { |
| 30 | t.Fatalf("another account is not ratcheted: %v", err) |
| 31 | } |
| 32 | } |
| 33 | |
| 34 | func TestRatchetSurvivesARestart(t *testing.T) { |
| 35 | dir := t.TempDir() |
| 36 | if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr("stable", dA)); err != nil { |
| 37 | t.Fatal(err) |
| 38 | } |
| 39 | if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr("stable", "")); !errors.Is(err, ErrPointerWithoutDigests) { |
| 40 | t.Fatalf("a new process forgot the mark: %v", err) |
| 41 | } |
| 42 | } |
| 43 | |
| 44 | func TestRequireRefusesEveryPointerWithoutDigests(t *testing.T) { |
| 45 | r := NewDigestRatchet(t.TempDir(), nil, true) |
| 46 | if err := r.Admit("bab", ptr("never-seen", "")); !errors.Is(err, ErrPointerWithoutDigests) { |
| 47 | t.Fatalf("require on, fresh channel: %v", err) |
| 48 | } |
| 49 | if err := r.Admit("bab", ptr("never-seen", dA)); err != nil { |
| 50 | t.Fatal(err) |
| 51 | } |
| 52 | } |
| 53 | |
| 54 | func TestRequirePointerDigestReadsTheFlag(t *testing.T) { |
| 55 | for v, want := range map[string]bool{"": false, "0": false, "off": false, "1": true, "true": true, "ON": true, "yes": true} { |
| 56 | got := RequirePointerDigest(func(k string) string { |
| 57 | if k == RequirePointerDigestEnv { |
| 58 | return v |
| 59 | } |
| 60 | return "" |
| 61 | }) |
| 62 | if got != want { |
| 63 | t.Errorf("%q: %v, want %v", v, got, want) |
| 64 | } |
| 65 | } |
| 66 | } |
| 67 | |
| 68 | // Review Focus 3. |
| 69 | func TestRatchetMarksNestedAndFlatChannels(t *testing.T) { |
| 70 | r := NewDigestRatchet(t.TempDir(), nil, false) |
| 71 | if err := r.Admit("bab", ptr("canary", dA)); err != nil { |
| 72 | t.Fatal(err) |
| 73 | } |
| 74 | if err := r.Admit("bab", ptr("canary/x", "")); err != nil { |
| 75 | t.Fatalf("marking canary refused canary/x: %v", err) |
| 76 | } |
| 77 | if err := r.Admit("bab", ptr("canary/x", dA)); err != nil { |
| 78 | t.Fatalf("canary/x could not be marked beside canary: %v", err) |
| 79 | } |
| 80 | if err := r.Admit("bab", ptr("canary/x", "")); !errors.Is(err, ErrPointerWithoutDigests) { |
| 81 | t.Fatalf("canary/x not ratcheted: %v", err) |
| 82 | } |
| 83 | } |
| 84 | |
| 85 | // Review Focus 4, Astra I1 #4: a mark that cannot be persisted fails closed. |
| 86 | // The pointer that carried digests is refused (nothing installs or extracts |
| 87 | // on it), the process remembers the channel at once, and a mark another |
| 88 | // process wrote is still honoured. |
| 89 | func TestRatchetFailsClosedWhenTheMarkCannotBePersisted(t *testing.T) { |
| 90 | ro := filepath.Join(t.TempDir(), "ro") |
| 91 | if err := os.MkdirAll(ro, 0o555); err != nil { |
| 92 | t.Fatal(err) |
| 93 | } |
| 94 | if os.Geteuid() == 0 { |
| 95 | t.Skip("root can write a 0555 directory") |
| 96 | } |
| 97 | other := t.TempDir() |
| 98 | if err := NewDigestRatchet(other, nil, false).Admit("bab", ptr("stable", dA)); err != nil { |
| 99 | t.Fatal(err) |
| 100 | } |
| 101 | r := NewDigestRatchet(ro, []string{other}, false) |
| 102 | if err := r.Admit("bab", ptr("beta", dA)); !errors.Is(err, ErrRatchetUnpersisted) { |
| 103 | t.Fatalf("an unpersisted mark admitted the pointer: %v", err) |
| 104 | } |
| 105 | if err := r.Admit("bab", ptr("beta", "")); !errors.Is(err, ErrPointerWithoutDigests) { |
| 106 | t.Fatalf("the same process forgot the channel it just saw with digests: %v", err) |
| 107 | } |
| 108 | if err := r.Admit("bab", ptr("stable", "")); !errors.Is(err, ErrPointerWithoutDigests) { |
| 109 | t.Fatalf("the other process's mark was not honoured: %v", err) |
| 110 | } |
| 111 | } |
| 112 | |
| 113 | func TestANilRatchetAdmitsEverything(t *testing.T) { |
| 114 | var r *DigestRatchet |
| 115 | if err := r.Admit("bab", ptr("stable", "")); err != nil { |
| 116 | t.Fatal(err) |
| 117 | } |
| 118 | } |
| 119 | |
| 120 | func TestRatchetDirs(t *testing.T) { |
| 121 | if RootRatchetDir("/opt/carlos") != "/opt/carlos/pointer-digests" || EdgeRatchetDir("/data") != "/data/pointer-digests" { |
| 122 | t.Fatal("ratchet dirs moved") |
| 123 | } |
| 124 | } |
| 125 | |
| 126 | func TestSharedRatchetIsOnePerDirectory(t *testing.T) { |
| 127 | d := t.TempDir() |
| 128 | if SharedDigestRatchet(d, nil, false) != SharedDigestRatchet(d, nil, false) { |
| 129 | t.Fatal("two calls for the same directory built two ratchets") |
| 130 | } |
| 131 | } |
| 132 | |
| 133 | // Astra I3 #7: lookups that widen require race with Admit's read on the one |
| 134 | // shared object. Run under -race; with a plain bool field the detector fails it. |
| 135 | func TestSharedRatchetLookupAndAdmitAreRaceFree(t *testing.T) { |
| 136 | d := t.TempDir() |
| 137 | legacy := &ChannelPointer{App: "km", Channel: "stable", Version: "v1"} |
| 138 | var wg sync.WaitGroup |
| 139 | for i := 0; i < 16; i++ { |
| 140 | wg.Add(1) |
| 141 | go func(i int) { |
| 142 | defer wg.Done() |
| 143 | for j := 0; j < 200; j++ { |
| 144 | r := SharedDigestRatchet(d, nil, i%2 == 0) |
| 145 | _ = r.Admit("bab", legacy) |
| 146 | } |
| 147 | }(i) |
| 148 | } |
| 149 | wg.Wait() |
| 150 | if err := SharedDigestRatchet(d, nil, false).Admit("bab", legacy); !errors.Is(err, ErrPointerWithoutDigests) { |
| 151 | t.Fatalf("require, widened by a lookup, was lost: %v", err) |
| 152 | } |
| 153 | } |
| 154 | |
| 155 | // Astra r1 #5: "foo" and "foo.digests/bar" are both valid channel names; with |
| 156 | // a suffix only on the last segment the first one's mark file is the path the |
| 157 | // second needs as a directory. The flat, escaped mark gives each its own file, |
| 158 | // in either order. |
| 159 | func TestRatchetMarksCollidingChannelNamesInEitherOrder(t *testing.T) { |
| 160 | for _, order := range [][2]string{{"foo", "foo.digests/bar"}, {"foo.digests/bar", "foo"}} { |
| 161 | if !ValidChannel(order[0]) || !ValidChannel(order[1]) { |
| 162 | t.Fatalf("%q or %q is not a valid channel", order[0], order[1]) |
| 163 | } |
| 164 | dir := t.TempDir() |
| 165 | r := NewDigestRatchet(dir, nil, false) |
| 166 | if err := r.Admit("bab", ptr(order[0], dA)); err != nil { |
| 167 | t.Fatalf("%v: marking %q: %v", order, order[0], err) |
| 168 | } |
| 169 | if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr(order[1], "")); err != nil { |
| 170 | t.Fatalf("%v: marking %q made %q read as marked: %v", order, order[0], order[1], err) |
| 171 | } |
| 172 | if err := r.Admit("bab", ptr(order[1], dA)); err != nil { |
| 173 | t.Fatalf("%v: %q could not be marked beside %q: %v", order, order[1], order[0], err) |
| 174 | } |
| 175 | for _, ch := range order { |
| 176 | if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr(ch, "")); !errors.Is(err, ErrPointerWithoutDigests) { |
| 177 | t.Fatalf("%v: %q not ratcheted after a restart: %v", order, ch, err) |
| 178 | } |
| 179 | } |
| 180 | } |
| 181 | } |
| 182 | |
| 183 | // A mark must be a regular file: a directory where the mark belongs is not a |
| 184 | // mark, and not an absence either. Writing the mark over it fails, so the |
| 185 | // pointer with digests is refused as unpersisted rather than taking the |
| 186 | // directory for a durable mark. |
| 187 | func TestRatchetRefusesWhenTheMarkIsADirectory(t *testing.T) { |
| 188 | dir := t.TempDir() |
| 189 | if err := os.MkdirAll(markPath(dir, "bab", "km", "stable"), 0o755); err != nil { |
| 190 | t.Fatal(err) |
| 191 | } |
| 192 | err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr("stable", "")) |
| 193 | if !errors.Is(err, ErrPointerWithoutDigests) { |
| 194 | t.Fatalf("a directory at the mark path admitted a legacy pointer: %v", err) |
| 195 | } |
| 196 | if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr("stable", dA)); !errors.Is(err, ErrRatchetUnpersisted) { |
| 197 | t.Fatalf("a directory at the mark path was taken for a durable mark: %v", err) |
| 198 | } |
| 199 | } |
| 200 | |
| 201 | func TestRatchetMarkPathIsFlatAndEscaped(t *testing.T) { |
| 202 | got := markPath("/d", "bab", "km", "canary/x") |
| 203 | if want := filepath.Join("/d", "bab", "km", "canary%2Fx.digests"); got != want { |
| 204 | t.Fatalf("markPath = %q, want %q", got, want) |
| 205 | } |
| 206 | } |
| 207 | |
| 208 | // Astra r1 #1: a mark directory this process cannot read is not "no mark". |
| 209 | // A fresh ratchet (a restarted process, nothing in memory) must refuse a |
| 210 | // legacy pointer whether the unreadable directory is its own or another |
| 211 | // process's. |
| 212 | func TestRatchetFailsClosedWhenAMarkDirCannotBeRead(t *testing.T) { |
| 213 | if os.Geteuid() == 0 { |
| 214 | t.Skip("root reads a 0000 directory") |
| 215 | } |
| 216 | for _, which := range []string{"own", "also"} { |
| 217 | t.Run(which, func(t *testing.T) { |
| 218 | locked, open := t.TempDir(), t.TempDir() |
| 219 | if err := NewDigestRatchet(locked, nil, false).Admit("bab", ptr("stable", dA)); err != nil { |
| 220 | t.Fatal(err) |
| 221 | } |
| 222 | acctDir := filepath.Join(locked, "bab") |
| 223 | if err := os.Chmod(acctDir, 0); err != nil { |
| 224 | t.Fatal(err) |
| 225 | } |
| 226 | t.Cleanup(func() { _ = os.Chmod(acctDir, 0o755) }) |
| 227 | var r *DigestRatchet |
| 228 | if which == "own" { |
| 229 | r = NewDigestRatchet(locked, []string{open}, false) |
| 230 | } else { |
| 231 | r = NewDigestRatchet(open, []string{locked}, false) |
| 232 | } |
| 233 | if err := r.Admit("bab", ptr("stable", "")); !errors.Is(err, ErrPointerWithoutDigests) { |
| 234 | t.Fatalf("an unreadable %s mark dir admitted a legacy pointer: %v", which, err) |
| 235 | } |
| 236 | // Control: with the directory readable again, the same answer |
| 237 | // comes from the mark itself, and an unmarked channel elsewhere |
| 238 | // is still admitted. |
| 239 | if err := os.Chmod(acctDir, 0o755); err != nil { |
| 240 | t.Fatal(err) |
| 241 | } |
| 242 | if err := NewDigestRatchet(open, nil, false).Admit("bab", ptr("stable", "")); err != nil { |
| 243 | t.Fatalf("control: an empty readable dir refused a legacy pointer: %v", err) |
| 244 | } |
| 245 | }) |
| 246 | } |
| 247 | } |
| 248 | |
amadan