676 lines
40 KiB
JavaScript
676 lines
40 KiB
JavaScript
// Row 210 (#1707, design section 8): host.run over a scratch sshd on 127.0.0.1 that this test starts,
|
|
// with keys this test makes and a fake sudo that records its argv and runs the command as the test
|
|
// user. Nothing runs as root and nothing reaches another host.
|
|
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { execFileSync, spawn } from 'node:child_process';
|
|
import { createServer } from 'node:net';
|
|
import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
|
|
import { tmpdir, userInfo } from 'node:os';
|
|
import { join } from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { Credentials, parseHostKey } from '../src/credentials.mjs';
|
|
import { addKey, hostExecutor, runHost, sshArgs, startTime, sweepRunDir, quote, remoteCommand } from '../src/host-run.mjs';
|
|
import { fixture } from './spec-fixtures.mjs';
|
|
import { HUMAN_YES, hostGrantRecord, hostRecord } from './host-fixtures.mjs';
|
|
import { Broker, ORGANIZATION_KEYS } from '../src/broker.mjs';
|
|
import { Store } from '../src/store.mjs';
|
|
import { hostGrant } from '../src/host-grant.mjs';
|
|
import { startBroker } from '../src/runtime.mjs';
|
|
import { businessDoc, rolesCopy, systemFor, writeJson } from '../../organization/tests/helpers.mjs';
|
|
|
|
import { ephemeralRange, installSleepStub, pickPort, startScratchSshd } from './scratch-sshd.mjs';
|
|
|
|
const SSHD = '/usr/bin/sshd';
|
|
const REPO = fileURLToPath(new URL('../../../', import.meta.url));
|
|
const USER = userInfo().username;
|
|
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
|
|
const keygen = (file, ...extra) => execFileSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', 'test', ...extra, '-f', file]);
|
|
const pubLine = (file) => readFileSync(file + '.pub', 'utf8').trim().split(' ').slice(0, 2).join(' ');
|
|
// Every pid whose argv names `text`, with its argv and environment. ssh-agent makes itself
|
|
// non-dumpable, so its environ reads as null. Its environment is the PATH runHost passes.
|
|
const readOrNull = (file) => {
|
|
try {
|
|
return readFileSync(file, 'utf8');
|
|
} catch {
|
|
return null;
|
|
}
|
|
};
|
|
function procsNaming(text) {
|
|
const out = [];
|
|
for (const pid of readdirSync('/proc').filter((p) => /^\d+$/.test(p))) {
|
|
const cmdline = readOrNull(`/proc/${pid}/cmdline`);
|
|
if (cmdline?.includes(text)) out.push({ pid: Number(pid), cmdline, environ: readOrNull(`/proc/${pid}/environ`) });
|
|
}
|
|
return out;
|
|
}
|
|
async function until(fn, ms = 5000) {
|
|
const end = Date.now() + ms;
|
|
while (!fn()) {
|
|
if (Date.now() > end) return false;
|
|
await sleep(20);
|
|
}
|
|
return true;
|
|
}
|
|
|
|
|
|
// A scratch sshd. ForceCommand puts the fake sudo first on PATH and hands the command to /bin/sh, so
|
|
// the remote side parses the command line the way a real host's POSIX shell does.
|
|
async function sshd(t, dir, options) {
|
|
if (!existsSync(SSHD)) throw new Error(`${SSHD} is missing: the executor tests need it and fail, never skip`);
|
|
keygen(join(dir, 'hostkey'));
|
|
keygen(join(dir, 'otherhost'));
|
|
keygen(join(dir, 'user'));
|
|
writeFileSync(join(dir, 'authorized_keys'), readFileSync(join(dir, 'user.pub')), { mode: 0o600 });
|
|
mkdirSync(join(dir, 'fake'));
|
|
installSleepStub(dir);
|
|
writeFileSync(
|
|
join(dir, 'fake', 'sudo'),
|
|
`#!/bin/sh\n'${process.execPath}' -e 'require("fs").appendFileSync(process.argv[1], JSON.stringify(process.argv.slice(2)) + "\\n")' '${dir}/argv.json' "$@"\nshift 2\nexec "$@"\n`,
|
|
);
|
|
chmodSync(join(dir, 'fake', 'sudo'), 0o755);
|
|
// A remote command that prints ssh's pin refusal text and exits 255 (N3).
|
|
writeFileSync(join(dir, 'fake', 'fail255'), '#!/bin/sh\necho "Host key verification failed." >&2\nexit 255\n', { mode: 0o755 });
|
|
writeFileSync(join(dir, 'wrap.sh'), `#!/bin/sh\nPATH=${dir}/fake:/usr/bin:/bin; export PATH\nexec /bin/sh -c "$SSH_ORIGINAL_COMMAND"\n`);
|
|
chmodSync(join(dir, 'wrap.sh'), 0o755);
|
|
return startScratchSshd(t, dir, [
|
|
'ListenAddress 127.0.0.1', `HostKey ${dir}/hostkey`,
|
|
`AuthorizedKeysFile ${dir}/authorized_keys`, `PidFile ${dir}/sshd.pid`,
|
|
'UsePAM no', 'StrictModes no', 'PasswordAuthentication no', 'KbdInteractiveAuthentication no',
|
|
`ForceCommand ${dir}/wrap.sh`,
|
|
], options);
|
|
}
|
|
|
|
|
|
test('row 280: an occupied TCP port is attempted, refused, and retried with our sshd', async t => {
|
|
const dir = mkdtempSync(join(tmpdir(), 'sshd280-'));
|
|
t.after(() => rmSync(dir, { recursive: true, force: true }));
|
|
const server = createServer(socket => socket.end());
|
|
await new Promise((resolve, reject) => {
|
|
server.once('error', reject);
|
|
server.listen(0, '127.0.0.1', resolve);
|
|
});
|
|
t.after(() => new Promise(resolve => server.close(resolve)));
|
|
const occupied = server.address().port;
|
|
const port = await sshd(t, dir, { firstPort: occupied });
|
|
assert.match(readFileSync(join(dir, 'sshd-0.conf'), 'utf8'), new RegExp(`^Port ${occupied}\\n`));
|
|
assert.equal(readFileSync(join(dir, 'sshd-0.log'), 'utf8').includes(`Server listening on 127.0.0.1 port ${occupied}.`), false);
|
|
assert.notEqual(port, occupied);
|
|
assert.ok([1, 2, 3, 4].some(n => existsSync(join(dir, `sshd-${n}.log`)) &&
|
|
readFileSync(join(dir, `sshd-${n}.log`), 'utf8').includes(`Server listening on 127.0.0.1 port ${port}.`)));
|
|
});
|
|
|
|
test('row 280: every injected picker sample is unprivileged and outside the ephemeral range', () => {
|
|
const [lo, hi] = ephemeralRange();
|
|
for (const sample of [0, 0.25, 0.5, 0.6384, 0.75, 0.999999]) {
|
|
const port = pickPort(() => sample);
|
|
assert.ok(port >= 1024 && port <= 65535);
|
|
assert.ok(port < lo || port > hi, `sample ${sample}: ${port} inside ${lo}-${hi}`);
|
|
}
|
|
});
|
|
|
|
const GRANT = [['true'], ['false'], ['echo'], ['sleep'], ['head'], ['cat'], ['systemctl', 'status']];
|
|
async function hostFixture(t, { commands = GRANT, reviewerHosts, wrongHostKey = false, coderWeb2 = false } = {}) {
|
|
const dir = mkdtempSync(join(tmpdir(), 'h210-'));
|
|
t.after(() => rmSync(dir, { recursive: true, force: true }));
|
|
const port = await sshd(t, dir);
|
|
const keyFile = join(dir, 'user');
|
|
const credentials = new Credentials({
|
|
references: { 'demo/coder': { 'host.web1': { file: keyFile, rotateBy: '2099-01-01' } } },
|
|
dataRoot: join(dir, 'data'),
|
|
});
|
|
t.after(() => credentials.close());
|
|
const root = join(dir, 'run');
|
|
const executor = hostExecutor({ credentials, root });
|
|
const entry = { address: '127.0.0.1', port, user: USER, hostKeys: [pubLine(join(dir, wrongHostKey ? 'otherhost' : 'hostkey'))] };
|
|
const authority = { withinRole: ['message.send', 'record.write'], crossRole: [] };
|
|
const f = await fixture(t, { roles: { coder: { definition: 'coder', authority } } });
|
|
// Row 234 (#1740, r6 X4): host.run reads store records, so the hosts and grants are fixtures there.
|
|
for (const host of ['web1', 'web2']) hostRecord(f.store, { host, entry });
|
|
hostGrantRecord(f.store, { agent: 'coder', host: 'web1', commands });
|
|
if (coderWeb2) hostGrantRecord(f.store, { agent: 'coder', host: 'web2', commands });
|
|
for (const [host, g] of Object.entries(reviewerHosts ?? {})) hostGrantRecord(f.store, { agent: 'reviewer', host, commands: g.commands });
|
|
const approve = async (argv, stdin, host = 'web1') => {
|
|
const d = await f.raise({ action: 'host.sudo', target: host, argv, ...(stdin !== undefined ? { stdin } : {}) });
|
|
f.call(f.human, 'decision.resolve', { id: d.id, choice: 'yes' });
|
|
return d.id;
|
|
};
|
|
const run = (args, cap = f.coder) => f.broker.requestHost(cap, { verb: 'host.run', args }, executor);
|
|
const call = async (argv, { stdin, timeout } = {}) =>
|
|
run({ host: 'web1', argv, ...(stdin !== undefined ? { stdin } : {}), ...(timeout ? { timeout } : {}), decision: await approve(argv, stdin) });
|
|
const events = () =>
|
|
f.store.all("SELECT kind, body FROM events WHERE business='demo' ORDER BY seq").map((e) => ({ kind: e.kind, ...JSON.parse(e.body) }));
|
|
const argvSeen = () => (existsSync(join(dir, 'argv.json')) ? readFileSync(join(dir, 'argv.json'), 'utf8').trim().split('\n').map((l) => JSON.parse(l)) : []);
|
|
const key = parseHostKey(readFileSync(keyFile, 'utf8'));
|
|
return { ...f, dir, root, port, entry, keyFile, key, credentials, executor, approve, run, call, events, argvSeen };
|
|
}
|
|
const refusesWith = async (p, code) => assert.rejects(p, (e) => (assert.equal(e.code, code), true));
|
|
|
|
test('the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips', () => {
|
|
for (const bin of [SSHD, '/usr/bin/ssh', '/usr/bin/ssh-agent', '/usr/bin/ssh-add', '/usr/bin/ssh-keygen', '/usr/bin/setpriv'])
|
|
assert.ok(existsSync(bin), `${bin} is missing`);
|
|
});
|
|
|
|
test('T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs', (t) => {
|
|
const root = mkdtempSync(join(tmpdir(), 'h210-'));
|
|
const store = new Store(root);
|
|
t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
|
|
const chiefAuthority = JSON.parse(readFileSync(join(REPO, 'roles', 'chief-of-staff.json'), 'utf8')).authority;
|
|
const businesses = {
|
|
demo: {
|
|
id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, definitions: {},
|
|
roles: { chief: { definition: 'chief-of-staff', authority: chiefAuthority } }, projects: {},
|
|
},
|
|
};
|
|
const calls = [];
|
|
const b = new Broker({ store, businesses, organization: (...a) => (calls.push(a), { ok: true }) });
|
|
const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
|
|
const chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
|
|
b.request(chief, { verb: 'role.claim' });
|
|
const revision = 'a'.repeat(64);
|
|
const hosts = { web1: { address: '10.0.0.5', port: 22, user: 'admin', hostKeys: ['ssh-ed25519 AAAA'] } };
|
|
assert.equal(ORGANIZATION_KEYS.includes('hosts'), false);
|
|
assert.throws(() => b.request(chief, { verb: 'organization.set', args: { revision, hosts } }), /invalid-request/);
|
|
assert.throws(() => b.request(human, { verb: 'limits.set', args: { revision, hosts } }), /invalid-request/);
|
|
assert.throws(() => b.request(human, { verb: 'instances.set', args: { revision, instance: 'chief', op: 'change', hosts } }), /invalid-request/);
|
|
assert.equal(calls.length, 0);
|
|
// Controls: the same calls without hosts reach the writer.
|
|
b.request(chief, { verb: 'organization.set', args: { revision, models: {} } });
|
|
b.request(human, { verb: 'limits.set', args: { revision, models: {} } });
|
|
b.request(human, { verb: 'instances.set', args: { revision, instance: 'chief', op: 'change', launch: true } });
|
|
// organization.set reaches the writer as limits.set (broker.mjs:1379).
|
|
assert.deepEqual(calls.map((c) => c[1]), ['limits.set', 'limits.set', 'instances.set']);
|
|
});
|
|
|
|
test('T4: the value check takes one unencrypted ed25519 key and nothing else', () => {
|
|
const dir = mkdtempSync(join(tmpdir(), 'h210-'));
|
|
try {
|
|
keygen(join(dir, 'good'));
|
|
execFileSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', 'secret-pass', '-f', join(dir, 'enc')]);
|
|
execFileSync('ssh-keygen', ['-q', '-t', 'rsa', '-b', '2048', '-N', '', '-f', join(dir, 'rsa')]);
|
|
const good = readFileSync(join(dir, 'good'), 'utf8');
|
|
// Two keys: the same blob with nkeys set to 2.
|
|
const lines = good.trim().split('\n');
|
|
const blob = Buffer.from(lines.slice(1, -1).join(''), 'base64');
|
|
// magic (15), cipher "none" (4+4), kdf "none" (4+4), empty kdfoptions (4), then nkeys.
|
|
blob.writeUInt32BE(2, 15 + 8 + 8 + 4);
|
|
const pem = (b) => [lines[0], ...b.toString('base64').match(/.{1,70}/g), lines.at(-1)].join('\n') + '\n';
|
|
// One check each: a field renamed in place, so every other check still passes. Offsets: magic 15,
|
|
// cipher name 19, kdf name 27, nkeys 35, public type 47, private section 98, its type 110.
|
|
const renamed = (at, text) => {
|
|
const copy = Buffer.from(lines.slice(1, -1).join(''), 'base64');
|
|
copy.write(text, at, 'latin1');
|
|
return pem(copy);
|
|
};
|
|
const write = (name, text) => (writeFileSync(join(dir, name), text, { mode: 0o600 }), join(dir, name));
|
|
const load = (file, service = 'host.web1') =>
|
|
new Credentials({ references: { 'demo/coder': { [service]: { file, rotateBy: '2099-01-01' } } }, dataRoot: join(dir, 'data') });
|
|
const ok = load(join(dir, 'good'));
|
|
assert.match(ok.status()[0].fingerprint, /^SHA256:/);
|
|
assert.equal(ok.status()[0].publicKey, pubLine(join(dir, 'good')));
|
|
ok.close();
|
|
for (const file of [
|
|
join(dir, 'enc'),
|
|
join(dir, 'rsa'),
|
|
write('two', pem(blob)),
|
|
write('cipher', renamed(19, 'aes1')),
|
|
write('kdf', renamed(27, 'bcry')),
|
|
write('public-type', renamed(47, 'ssh-ed25518')),
|
|
write('private-type', renamed(110, 'ssh-ed25518')),
|
|
write('crlf', good.replaceAll('\n', '\r\n')),
|
|
write('token', 'fake_gitea_token_0123456789\n'),
|
|
])
|
|
assert.throws(() => load(file), /credential-format/, file);
|
|
assert.throws(() => load(join(dir, 'good'), 'gitea'), /credential-format/);
|
|
} finally {
|
|
rmSync(dir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
test('T5 to T8: registry, grant, argv shape and allowlist refusals', async (t) => {
|
|
const f = await hostFixture(t, { reviewerHosts: { web2: { commands: [['true']] } } });
|
|
await refusesWith(f.run({ host: 'web9', argv: ['true'] }), 'host-unknown');
|
|
await refusesWith(f.run({ host: 'web2', argv: ['true'] }), 'host-not-granted');
|
|
for (const argv of [[], ['a\0'], ['a'.repeat(4097)], Array(257).fill('true'), ['bin/true'], [7], 'true'])
|
|
await refusesWith(f.run({ host: 'web1', argv }), 'invalid-request');
|
|
await refusesWith(f.run({ host: 'web1', argv: ['true'], stdin: 'x'.repeat(65537) }), 'invalid-request');
|
|
await refusesWith(f.run({ host: 'web1', argv: ['true'], timeout: 901 }), 'invalid-request');
|
|
await refusesWith(f.run({ host: 'web1', argv: ['systemctl'] }), 'command-not-granted');
|
|
await refusesWith(f.run({ host: 'web1', argv: ['systemctl', 'restart', 'nginx'] }), 'command-not-granted');
|
|
await refusesWith(f.run({ host: 'web1', argv: ['ls'] }), 'command-not-granted');
|
|
// N1: the raise refuses the same way, so the human is never asked about a call host.run refuses.
|
|
assert.throws(() => f.raise({ action: 'host.sudo', target: 'web2', argv: ['true'] }), /host-not-granted/);
|
|
assert.throws(() => f.raise({ action: 'host.sudo', target: 'web1', argv: ['ls'] }), /command-not-granted/);
|
|
assert.equal(f.store.get("SELECT count(*) AS n FROM decisions WHERE action='host.sudo'").n, 0);
|
|
// Granted prefixes run, a longer argv too.
|
|
await f.call(['systemctl', 'status']);
|
|
assert.equal((await f.call(['echo', 'hi', 'there'])).stdout, 'hi there\n');
|
|
assert.deepEqual(f.argvSeen(), [['-n', '--', 'systemctl', 'status'], ['-n', '--', 'echo', 'hi', 'there']]);
|
|
const refused = f.events().filter((e) => e.kind === 'action.refused' && e.verb === 'host.run').map((e) => e.code);
|
|
assert.ok(refused.includes('host-unknown') && refused.includes('command-not-granted'));
|
|
});
|
|
|
|
test('T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once', async (t) => {
|
|
const f = await hostFixture(t, { coderWeb2: true });
|
|
await refusesWith(f.run({ host: 'web1', argv: ['true'] }), 'decision-required');
|
|
const other = await f.approve(['echo', 'a']);
|
|
await refusesWith(f.run({ host: 'web1', argv: ['echo', 'b'], decision: other }), 'decision-mismatch');
|
|
const stdin = await f.approve(['cat'], 'one');
|
|
await refusesWith(f.run({ host: 'web1', argv: ['cat'], stdin: 'two', decision: stdin }), 'decision-mismatch');
|
|
await refusesWith(f.run({ host: 'web1', argv: ['cat'], decision: stdin }), 'decision-mismatch');
|
|
const host = await f.approve(['true'], undefined, 'web2');
|
|
await refusesWith(f.run({ host: 'web1', argv: ['true'], decision: host }), 'decision-mismatch');
|
|
const once = await f.approve(['cat'], 'one');
|
|
assert.equal((await f.run({ host: 'web1', argv: ['cat'], stdin: 'one', decision: once })).stdout, 'one');
|
|
await refusesWith(f.run({ host: 'web1', argv: ['cat'], stdin: 'one', decision: once }), 'decision-consumed');
|
|
// An unresolved decision doesn't run.
|
|
const open = (await f.raise({ action: 'host.sudo', target: 'web1', argv: ['true'] })).id;
|
|
await refusesWith(f.run({ host: 'web1', argv: ['true'], decision: open }), 'decision-not-approved');
|
|
// The human sees host, user, each argv element and all of stdin, appended by the broker.
|
|
const q = f.store.get('SELECT question FROM decisions WHERE id=?', once).question;
|
|
assert.ok(q.includes(`Host web1, ${USER} at 127.0.0.1 port ${f.port}`), q);
|
|
assert.ok(q.includes('argv: "cat"'), q);
|
|
assert.ok(q.endsWith('stdin: "one"'), q);
|
|
assert.throws(() => f.raise({ action: 'host.sudo', target: 'web1', argv: ['cat'], stdin: 'x'.repeat(4096) }), /invalid-request/);
|
|
assert.throws(() => f.raise({ action: 'host.sudo', target: 'web9', argv: ['cat'] }), /host-unknown/);
|
|
assert.throws(() => f.raise({ action: 'deploy', argv: ['cat'] }), /invalid-request/);
|
|
assert.equal(f.store.get("SELECT class FROM decisions WHERE id=?", once).class, 'gated');
|
|
});
|
|
|
|
test('T10, T11: argv reaches sudo unchanged after sudo -n --', async (t) => {
|
|
const f = await hostFixture(t);
|
|
const argv = ['true', 'a b', "it's", '"q"', '$(touch x)', '`id`', 'a;b', 'line\nbreak', '*', '?[a]', '$HOME', '\\'];
|
|
assert.equal((await f.call(argv)).exit, 0);
|
|
assert.deepEqual(f.argvSeen(), [['-n', '--', ...argv]]);
|
|
assert.equal(existsSync(join(f.dir, 'x')), false);
|
|
assert.equal(quote("it's"), "'it'\\''s'");
|
|
assert.equal(remoteCommand(['a b']), "sudo -n -- 'a b'");
|
|
});
|
|
|
|
test('T12, T13: exit code passes through, the timeout kills the group, output is capped', async (t) => {
|
|
const f = await hostFixture(t);
|
|
assert.equal((await f.call(['false'])).exit, 1);
|
|
const began = Date.now();
|
|
const slow = await f.call(['sleep', '30'], { timeout: 1 });
|
|
// D6: the timeout answers signal. ssh exits 255 on SIGTERM, which the result can't tell from a remote 255.
|
|
assert.equal(slow.signal, 'SIGTERM');
|
|
assert.ok(Date.now() - began < 10000);
|
|
const big = await f.call(['head', '-c', '2097152', '/dev/zero']);
|
|
assert.equal(Buffer.byteLength(big.stdout), 1024 * 1024);
|
|
assert.deepEqual(big.truncated, { stdout: true, stderr: false });
|
|
});
|
|
|
|
test('T14: a host key not in the registry refuses and nothing runs', async (t) => {
|
|
const f = await hostFixture(t, { wrongHostKey: true });
|
|
await refusesWith(f.call(['true']), 'host-key-mismatch');
|
|
assert.deepEqual(f.argvSeen(), []);
|
|
});
|
|
|
|
// Row 234 (#1740, r6 G18, duckworth-0081 B2): hosts.check's `list` goes through runHost with the record's
|
|
// pinned keys. A stub `list` on the scratch sshd's PATH records each run.
|
|
test('G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host', async (t) => {
|
|
const f = await hostFixture(t);
|
|
writeFileSync(join(f.dir, 'fake', 'list'), `#!/bin/sh\necho "$@" >> '${f.dir}/list.log'\n`, { mode: 0o755 });
|
|
const configDir = join(f.dir, 'cfg');
|
|
const keyDir = join(configDir, 'secrets', 'hosts', 'demo', 'web1');
|
|
mkdirSync(keyDir, { recursive: true, mode: 0o700 });
|
|
for (const d of [join(configDir, 'secrets'), join(configDir, 'secrets', 'hosts'), join(configDir, 'secrets', 'hosts', 'demo'), keyDir]) chmodSync(d, 0o700);
|
|
writeFileSync(join(keyDir, 'installer'), readFileSync(f.keyFile), { mode: 0o600 });
|
|
const hg = hostGrant({ configDir, runRoot: f.root });
|
|
const record = { address: '127.0.0.1', port: f.port, user: 'jarvis', hostKeys: [pubLine(join(f.dir, 'otherhost'))] };
|
|
await refusesWith(hg.check('demo', 'web1', record), 'host-key-mismatch');
|
|
assert.equal(existsSync(join(f.dir, 'list.log')), false);
|
|
// Control: with the right pin the same command reaches the stub.
|
|
const out = await runHost({ root: f.root, hostId: 'web1', entry: f.entry, key: f.key, timeout: 10, command: 'list jarvis' });
|
|
assert.equal(out.exit, 0);
|
|
assert.equal(readFileSync(join(f.dir, 'list.log'), 'utf8'), 'jarvis\n');
|
|
});
|
|
|
|
test('N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message', async (t) => {
|
|
const f = await hostFixture(t, { commands: [['fail255']] });
|
|
const out = await f.call(['fail255']);
|
|
assert.equal(out.exit, 255);
|
|
assert.match(out.stderr, /Host key verification failed/);
|
|
assert.deepEqual(f.argvSeen(), [['-n', '--', 'fail255']]);
|
|
// A closed port: ssh's message reaches the agent from the run dir's log.
|
|
const closed = await runHost({ root: f.root, hostId: 'web1', entry: { ...f.entry, port: 1 }, key: f.key, argv: ['true'], stdin: '', timeout: 10 });
|
|
assert.equal(closed.exit, 255);
|
|
assert.match(closed.stderr, /port 1: Connection refused/);
|
|
});
|
|
|
|
test('T15: ssh reads no config file and no user known_hosts', async (t) => {
|
|
// ssh finds ~/.ssh from the passwd entry, not $HOME, and the test may not write the real home, so
|
|
// the options are checked here and the call runs with an alias no user file holds (BUILD.md).
|
|
const args = sshArgs({ hostId: 'web1', address: '10.0.0.5', port: 22, user: 'admin', dir: '/r' });
|
|
assert.deepEqual(args.slice(0, 2), ['-F', '/dev/null']);
|
|
assert.deepEqual(args.slice(3, 5), ['-E', '/r/ssh.log']);
|
|
for (const o of ['StrictHostKeyChecking=yes', 'UserKnownHostsFile=/r/known_hosts', 'GlobalKnownHostsFile=/dev/null',
|
|
'HostKeyAlias=mosaic-host-web1', 'BatchMode=yes', 'IdentitiesOnly=yes', 'ForwardAgent=no', 'ProxyCommand=none', 'ControlMaster=no'])
|
|
assert.ok(args.includes(o), o);
|
|
assert.deepEqual(args.slice(-4), ['-l', 'admin', '--', '10.0.0.5']);
|
|
const f = await hostFixture(t);
|
|
assert.equal((await f.call(['true'])).exit, 0);
|
|
});
|
|
|
|
test('T16, T17: key material in output or stdin refuses credential-leak, and no event holds it', async (t) => {
|
|
const f = await hostFixture(t, { commands: [['cat']] });
|
|
const line = f.key.text.split('\n')[2];
|
|
writeFileSync(join(f.dir, 'one-line'), line + '\n');
|
|
writeFileSync(join(f.dir, 'seed-hex'), f.key.seed.toString('hex') + '\n');
|
|
for (const file of [f.keyFile, join(f.dir, 'one-line'), join(f.dir, 'seed-hex')]) await refusesWith(f.call(['cat', file]), 'credential-leak');
|
|
const ran = f.argvSeen().length;
|
|
await refusesWith(f.call(['cat'], { stdin: 'x' + line }), 'credential-leak');
|
|
assert.equal(f.argvSeen().length, ran, 'nothing ran for a stdin leak');
|
|
const text = JSON.stringify(f.events());
|
|
for (const needle of [line, f.key.seed.toString('hex')]) assert.equal(text.includes(needle), false);
|
|
const failed = f.events().filter((e) => e.action === 'host.sudo' && e.phase === 'completed');
|
|
assert.ok(failed.every((e) => e.outcome === 'failed' && e.code === 'credential-leak'));
|
|
});
|
|
|
|
test('T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after', async (t) => {
|
|
const f = await hostFixture(t);
|
|
const first = f.call(['sleep', '3']);
|
|
assert.ok(await until(() => f.argvSeen().length === 1), 'fake sudo started');
|
|
const procs = procsNaming(f.root);
|
|
assert.ok(procs.length >= 2, 'ssh-agent and ssh name the run dir');
|
|
const needles = [...f.key.needles, f.key.text];
|
|
assert.ok(procs.some((p) => p.environ !== null), 'ssh environ read');
|
|
for (const p of procs) for (const n of needles) assert.equal(p.cmdline.includes(n) || (p.environ ?? '').includes(n), false);
|
|
// host-busy refuses before the decision is spent, so it still runs after.
|
|
const held = await f.approve(['true']);
|
|
await refusesWith(f.run({ host: 'web1', argv: ['true'], decision: held }), 'host-busy');
|
|
assert.equal((await first).exit, 0);
|
|
assert.equal((await f.run({ host: 'web1', argv: ['true'], decision: held })).exit, 0);
|
|
// Success, a refusal, a timeout and a thrown error each leave no run dir and no process.
|
|
await refusesWith(f.call(['cat', f.keyFile]), 'credential-leak');
|
|
await f.call(['sleep', '30'], { timeout: 1 });
|
|
await assert.rejects(
|
|
runHost({ root: f.root, hostId: 'web1', entry: { ...f.entry, hostKeys: null }, key: f.key, argv: ['true'], stdin: '', timeout: 5 }),
|
|
);
|
|
assert.deepEqual(readdirSync(f.root), []);
|
|
assert.ok(await until(() => procsNaming(f.root).length === 0, 2000));
|
|
});
|
|
|
|
test('T21: revoke kills the call in flight, and the next call refuses', async (t) => {
|
|
const f = await hostFixture(t);
|
|
const slow = f.call(['sleep', '30']);
|
|
assert.ok(await until(() => f.argvSeen().length === 1));
|
|
f.credentials.revoke('demo/coder', 'host.web1');
|
|
await refusesWith(slow, 'credential-unavailable');
|
|
await refusesWith(f.call(['true']), 'credential-unavailable');
|
|
assert.ok(await until(() => procsNaming(f.root).length === 0, 2000));
|
|
});
|
|
|
|
test('T22: events carry host, address, user and argv in clear, and sizes and hashes only', async (t) => {
|
|
const f = await hostFixture(t);
|
|
await f.call(['cat'], { stdin: 'secret-ish stdin' });
|
|
const [requested, completed] = f.events().filter((e) => e.action === 'host.sudo' && e.phase);
|
|
assert.deepEqual(
|
|
{ host: requested.host, address: requested.address, user: requested.user, argv: requested.argv, stdinBytes: requested.stdinBytes },
|
|
{ host: 'web1', address: '127.0.0.1', user: USER, argv: ['cat'], stdinBytes: 16 },
|
|
);
|
|
assert.match(requested.stdinSha256, /^[0-9a-f]{64}$/);
|
|
assert.equal(completed.outcome, 'ran');
|
|
assert.equal(completed.stdoutBytes, 16);
|
|
assert.match(completed.stdoutSha256, /^[0-9a-f]{64}$/);
|
|
assert.equal(JSON.stringify(f.events()).includes('secret-ish stdin'), false);
|
|
});
|
|
|
|
test('T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known', () => {
|
|
const files = readdirSync(join(REPO, 'packages')).flatMap((pkg) => {
|
|
const src = join(REPO, 'packages', pkg, 'src');
|
|
return existsSync(src) ? readdirSync(src).filter((n) => n.endsWith('.mjs')).map((n) => `packages/${pkg}/src/${n}`) : [];
|
|
});
|
|
const code = (file) => readFileSync(join(REPO, file), 'utf8').split('\n').filter((l) => !/^\s*(\/\/|\*)/.test(l)).join('\n');
|
|
const lists = files.filter((file) => !file.endsWith('organization/src/vocabulary.mjs') &&
|
|
/\[\s*['"]gitea['"]\s*,\s*['"]vikunja['"]\s*\]/.test(code(file)));
|
|
assert.deepEqual(lists, []);
|
|
const uses = files.filter((file) => /credentials\.(use|useFor)\(/.test(code(file))).sort();
|
|
assert.deepEqual(uses, ['packages/bus/src/host-run.mjs', 'packages/bus/src/runtime.mjs', 'packages/tasks/src/adapter.mjs']);
|
|
});
|
|
|
|
test('T25: no role definition lists host.sudo while it is a hard wait', () => {
|
|
const dir = join(REPO, 'roles');
|
|
for (const name of readdirSync(dir).filter((n) => n.endsWith('.json'))) {
|
|
const role = JSON.parse(readFileSync(join(dir, name), 'utf8'));
|
|
const authority = role.authority ?? {};
|
|
for (const list of [authority.withinRole ?? [], authority.crossRole ?? []]) assert.equal(list.includes('host.sudo'), false, name);
|
|
}
|
|
});
|
|
|
|
test('T27: the bus child dying takes ssh and ssh-agent with it', async (t) => {
|
|
const f = await hostFixture(t);
|
|
// A separate bus child runs one call; the test SIGKILLs it while fake sudo sleeps.
|
|
const script = join(f.dir, 'child.mjs');
|
|
const src = new URL('../src/', import.meta.url).href;
|
|
writeFileSync(script, `
|
|
import { Credentials } from '${src}credentials.mjs';
|
|
import { hostExecutor } from '${src}host-run.mjs';
|
|
const credentials = new Credentials({ references: { 'demo/coder': { 'host.web1': { file: ${JSON.stringify(f.keyFile)}, rotateBy: '2099-01-01' } } }, dataRoot: ${JSON.stringify(join(f.dir, 'data'))} });
|
|
const executor = hostExecutor({ credentials, root: ${JSON.stringify(join(f.dir, 'run2'))} });
|
|
await executor.run({ business: 'demo', role: 'coder' }, 'web1', ${JSON.stringify(f.entry)}, { argv: ['sleep', '60'], stdin: '', timeout: 120 });
|
|
`);
|
|
const child = spawn(process.execPath, [script], { stdio: 'ignore' });
|
|
t.after(() => child.kill('SIGKILL'));
|
|
assert.ok(await until(() => f.argvSeen().length === 1, 10000), 'fake sudo started');
|
|
const [run] = readdirSync(join(f.dir, 'run2'));
|
|
const pids = readFileSync(join(f.dir, 'run2', run, 'pids'), 'utf8').trim().split('\n').map((l) => Number(l.split(' ')[0]));
|
|
assert.equal(pids.length, 3);
|
|
assert.equal(pids[0], child.pid);
|
|
child.kill('SIGKILL');
|
|
assert.ok(await until(() => pids.slice(1).every((p) => !existsSync(`/proc/${p}`)), 2000), 'ssh and ssh-agent are gone');
|
|
// The next start sweeps the dir.
|
|
assert.deepEqual(sweepRunDir(join(f.dir, 'run2')).removed, [run]);
|
|
assert.deepEqual(readdirSync(join(f.dir, 'run2')), []);
|
|
});
|
|
|
|
test('T27: ssh-add -t drops the key from an agent the test keeps alive', async (t) => {
|
|
const dir = mkdtempSync(join(tmpdir(), 'h210-'));
|
|
t.after(() => rmSync(dir, { recursive: true, force: true }));
|
|
keygen(join(dir, 'k'));
|
|
const sock = join(dir, 'a.sock');
|
|
const agent = spawn('ssh-agent', ['-D', '-a', sock], { stdio: 'ignore' });
|
|
t.after(() => agent.kill('SIGKILL'));
|
|
assert.ok(await until(() => existsSync(sock)));
|
|
// A failed list names its cause: when each step ran on the monotonic clock (hrtime) and on
|
|
// /proc/uptime (CLOCK_BOOTTIME, which ssh-agent's lifetime counts in whole seconds), and
|
|
// whether the agent and its socket were still there.
|
|
const marks = [];
|
|
const mark = (name) => marks.push({ name, ns: process.hrtime.bigint(), uptime: readFileSync('/proc/uptime', 'utf8').split(' ')[0] });
|
|
const timing = () => {
|
|
const at = (m) => `${m.name} +${(Number(m.ns - marks[0].ns) / 1e6).toFixed(1)} ms (hrtime ${(Number(m.ns % 1_000_000_000n) / 1e9).toFixed(4)} s into its second, uptime ${m.uptime})`;
|
|
const alive = agent.exitCode === null && agent.signalCode === null;
|
|
return `${marks.map(at).join('; ')}; agent ${alive ? 'alive' : `gone (${agent.exitCode ?? agent.signalCode})`}, socket ${existsSync(sock) ? 'present' : 'missing'}`;
|
|
};
|
|
// ssh-agent sets a key's death to the whole second of CLOCK_BOOTTIME at the add plus the
|
|
// lifetime, and drops it once that whole second is reached. So `-t N` keeps a key between N - 1
|
|
// and N seconds: `-t 1` added just before a second boundary was gone within milliseconds (#453).
|
|
// `-t 2` keeps it at least 1 s, and the sleep waits past the 2 s ceiling.
|
|
mark('addKey start');
|
|
await addKey(sock, readFileSync(join(dir, 'k'), 'utf8'), 2);
|
|
mark('addKey resolved');
|
|
const list = (name) => {
|
|
mark(name);
|
|
try {
|
|
return execFileSync('ssh-add', ['-l'], { env: { PATH: '/usr/bin:/bin', SSH_AUTH_SOCK: sock }, encoding: 'utf8' });
|
|
} catch (e) {
|
|
return e.stdout;
|
|
}
|
|
};
|
|
const first = list('first list');
|
|
assert.match(first, /SHA256:/, `first list got ${JSON.stringify(first)}: ${timing()}`);
|
|
await sleep(3500);
|
|
const second = list('second list');
|
|
assert.match(second, /no identities/, `second list got ${JSON.stringify(second)}: ${timing()}`);
|
|
});
|
|
|
|
// The test's own limit makes a hung addKey (M37a, M37b) fail in seconds, not at the batch timeout.
|
|
test('N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running', { timeout: 10000 }, async (t) => {
|
|
const dir = mkdtempSync(join(tmpdir(), 'h210-'));
|
|
t.after(() => rmSync(dir, { recursive: true, force: true }));
|
|
keygen(join(dir, 'k'));
|
|
const text = readFileSync(join(dir, 'k'), 'utf8');
|
|
// An agent socket that accepts and never answers.
|
|
const closed = [];
|
|
const server = createServer((c) => c.resume().on('close', () => closed.push(Date.now())));
|
|
const sock = join(dir, 'a.sock');
|
|
await new Promise((r) => server.listen(sock, r));
|
|
t.after(() => server.close());
|
|
const began = Date.now();
|
|
await refusesWith(addKey(sock, text, 1, { limitMs: 300 }), 'host-failed');
|
|
assert.ok(Date.now() - began < 2000);
|
|
const controller = new AbortController();
|
|
setTimeout(() => controller.abort(), 100);
|
|
await refusesWith(addKey(sock, text, 1, { limitMs: 60000, signal: controller.signal }), 'credential-unavailable');
|
|
// Both ssh-add processes are gone: the socket saw each connection close.
|
|
assert.ok(await until(() => closed.length === 2), `closed ${closed.length}`);
|
|
});
|
|
|
|
test('T27: the start sweep keeps a live bus dir and kills only a matching live process', async (t) => {
|
|
const root = mkdtempSync(join(tmpdir(), 'h210-run-'));
|
|
t.after(() => rmSync(root, { recursive: true, force: true }));
|
|
chmodSync(root, 0o700);
|
|
const dead = spawn('true');
|
|
await new Promise((r) => dead.on('close', r));
|
|
const make = (name, lines) => {
|
|
mkdirSync(join(root, name), { mode: 0o700 });
|
|
writeFileSync(join(root, name, 'pids'), lines.map((l) => l.join(' ') + '\n').join(''));
|
|
return join(root, name);
|
|
};
|
|
// A dir whose bus is gone, with a planted live process that names it.
|
|
const gone = join(root, 'h-aaaaaa');
|
|
const planted = spawn('/bin/sh', ['-c', 'sleep 60; :', gone], { stdio: 'ignore', detached: true });
|
|
t.after(() => { try { process.kill(planted.pid, 'SIGKILL'); } catch {} });
|
|
await until(() => startTime(planted.pid) !== null);
|
|
make('h-aaaaaa', [[dead.pid, 'x'], [planted.pid, startTime(planted.pid)]]);
|
|
// A dir whose bus is alive.
|
|
make('h-bbbbbb', [[process.pid, startTime(process.pid)]]);
|
|
// A dir whose bus is gone and whose recorded pid is alive but with another start time.
|
|
const other = join(root, 'h-cccccc');
|
|
const decoy = spawn('/bin/sh', ['-c', 'sleep 60; :', other], { stdio: 'ignore', detached: true });
|
|
t.after(() => { try { process.kill(decoy.pid, 'SIGKILL'); } catch {} });
|
|
await until(() => startTime(decoy.pid) !== null);
|
|
make('h-cccccc', [[dead.pid, 'x'], [decoy.pid, '1']]);
|
|
assert.deepEqual(sweepRunDir(root).removed.sort(), ['h-aaaaaa', 'h-cccccc']);
|
|
assert.ok(await until(() => planted.exitCode !== null || planted.signalCode !== null, 2000), 'planted process killed');
|
|
assert.equal(existsSync(`/proc/${decoy.pid}`), true, 'decoy kept');
|
|
assert.deepEqual(readdirSync(root), ['h-bbbbbb']);
|
|
writeFileSync(join(root, 'stray'), '');
|
|
assert.throws(() => sweepRunDir(root), /credential-file/);
|
|
});
|
|
|
|
test('T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start', async (t) => {
|
|
const root = mkdtempSync(join(tmpdir(), 'h210-'));
|
|
t.after(() => rmSync(root, { recursive: true, force: true }));
|
|
const rolesDir = rolesCopy(root);
|
|
writeJson(join(root, 'businesses/demo.json'), businessDoc(root, 'demo'));
|
|
mkdirSync(join(root, 'data'), { mode: 0o700 });
|
|
const run = join(root, 'secrets', 'run');
|
|
mkdirSync(join(run, 'h-dddddd'), { recursive: true, mode: 0o700 });
|
|
chmodSync(join(root, 'secrets'), 0o700);
|
|
const dead = spawn('true');
|
|
await new Promise((r) => dead.on('close', r));
|
|
writeFileSync(join(run, 'h-dddddd', 'pids'), `${dead.pid} x\n`);
|
|
const demo = {
|
|
id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
|
|
roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder: { authority: { withinRole: ['message.send'], crossRole: [] }, credentials: {} } },
|
|
};
|
|
const start = () => startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } });
|
|
const bus = await start();
|
|
try {
|
|
assert.deepEqual(readdirSync(run), []);
|
|
} finally {
|
|
await bus.close();
|
|
}
|
|
writeFileSync(join(run, 'stray'), '');
|
|
// A bus that starts anyway is closed, so a failure here ends the file instead of holding it open.
|
|
await assert.rejects(async () => { const again = await start(); await again.close(); }, /credential-file/);
|
|
});
|
|
|
|
// Row 234 (#1740, duckworth-0079 M3, r6 X4 first bullet): host.run takes a grant record only behind the
|
|
// Approve record check. Each case breaks one part of it. The refusals come before the executor, so none
|
|
// needs sshd. The control passes the check and stops at host-not-configured.
|
|
test('M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant', async (t) => {
|
|
const f = await fixture(t, { roles: { coder: { definition: 'coder', authority: { withinRole: ['message.send'], crossRole: [] } } } });
|
|
const entry = { address: '10.0.0.5', port: 22, user: 'admin', hostKeys: ['ssh-ed25519 AAAA'] };
|
|
for (const host of ['web1', 'web2']) hostRecord(f.store, { host, entry });
|
|
const run = (cap = f.coder, host = 'web1') => f.broker.requestHost(cap, { verb: 'host.run', args: { host, argv: ['true'] } }, null);
|
|
const commands = [['true']];
|
|
const cases = {
|
|
'no record': null,
|
|
unresolved: { close: null },
|
|
'resolved no': { close: { ...HUMAN_YES, choice: 'no' } },
|
|
withdrawn: { close: { op: 'withdrawn', by: 'jason', via: 'cli' } },
|
|
'an arbiter': { close: { ...HUMAN_YES, by: 'reviewer', via: 'broker' } },
|
|
'the tester': { close: { ...HUMAN_YES, by: 'tester' } },
|
|
'an agent': { close: { ...HUMAN_YES, by: 'coder', via: 'broker' } },
|
|
'not via cli': { close: { ...HUMAN_YES, via: 'web' } },
|
|
'consumed as grant.host-enroll': { spend: 'grant.host-enroll' },
|
|
unspent: { spend: null },
|
|
'not a credential.mint': { action: 'deploy' },
|
|
'no grant in the raise': { grant: null },
|
|
'a host-enroll grant': { grant: { method: 'host-enroll' } },
|
|
'a grant for another agent': { grant: { agent: 'reviewer' } },
|
|
'a grant for another host': { grant: { host: 'web2' } },
|
|
};
|
|
for (const [name, opts] of Object.entries(cases)) {
|
|
f.store.run('DELETE FROM host_grants');
|
|
if (opts) hostGrantRecord(f.store, { agent: 'coder', host: 'web1', commands, ...opts });
|
|
await refusesWith(run(), 'host-not-granted').catch((e) => assert.fail(`${name}: ${e.message}`));
|
|
}
|
|
f.store.run('DELETE FROM host_grants');
|
|
hostGrantRecord(f.store, { agent: 'coder', host: 'web1', commands });
|
|
await refusesWith(run(), 'host-not-configured');
|
|
// The record is per agent: the reviewer holds none on web1, and web9 has no host record.
|
|
await refusesWith(run(f.reviewer), 'host-not-granted');
|
|
await refusesWith(run(f.coder, 'web9'), 'host-unknown');
|
|
// The host.sudo raise takes the same check (N1).
|
|
f.store.run('DELETE FROM host_grants');
|
|
hostGrantRecord(f.store, { agent: 'coder', host: 'web1', commands, spend: null });
|
|
assert.throws(() => f.raise({ action: 'host.sudo', target: 'web1', argv: ['true'] }), /host-not-granted/);
|
|
});
|
|
|
|
// Row 234 (#1740, M3, r6 X4 third bullet): at start each host_grants record gives Credentials a store
|
|
// reference to host.<id>, so a restart finds the key the grant executor wrote.
|
|
test('M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key', async (t) => {
|
|
const root = mkdtempSync(join(tmpdir(), 'h234-'));
|
|
t.after(() => rmSync(root, { recursive: true, force: true }));
|
|
const rolesDir = rolesCopy(root);
|
|
mkdirSync(join(root, 'data'), { mode: 0o700 });
|
|
mkdirSync(join(root, 'secrets', 'agents'), { recursive: true, mode: 0o700 });
|
|
chmodSync(join(root, 'secrets'), 0o700);
|
|
const demo = {
|
|
id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
|
|
roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder: { authority: { withinRole: ['message.send'], crossRole: [] }, credentials: {} } },
|
|
};
|
|
const start = () => startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } });
|
|
const hostKeys = (bus) => bus.credentials.status().filter((c) => c.service.startsWith('host.'));
|
|
let bus = await start();
|
|
assert.deepEqual(hostKeys(bus), []);
|
|
await bus.close();
|
|
const store = new Store(join(root, 'data'));
|
|
hostRecord(store, { host: 'web1', entry: { address: '10.0.0.5', port: 22, user: 'admin', hostKeys: ['ssh-ed25519 AAAA'] } });
|
|
hostGrantRecord(store, { agent: 'coder', host: 'web1', commands: [['true']], rotateBy: '2099-02-03' });
|
|
store.close();
|
|
bus = await start();
|
|
try {
|
|
assert.deepEqual(hostKeys(bus).map(({ instance, service, date, state }) => ({ instance, service, date, state })), [
|
|
{ instance: 'demo/coder', service: 'host.web1', date: '2099-02-03', state: 'not-issued' },
|
|
]);
|
|
} finally {
|
|
await bus.close();
|
|
}
|
|
const dir = join(root, 'secrets', 'agents', 'demo', 'coder');
|
|
mkdirSync(dir, { recursive: true, mode: 0o700 });
|
|
chmodSync(join(root, 'secrets', 'agents', 'demo'), 0o700);
|
|
keygen(join(dir, 'host.web1'));
|
|
bus = await start();
|
|
try {
|
|
const [key] = hostKeys(bus);
|
|
assert.equal(key.publicKey, pubLine(join(dir, 'host.web1')));
|
|
assert.notEqual(key.state, 'not-issued');
|
|
} finally {
|
|
await bus.close();
|
|
}
|
|
});
|