194 lines
8.9 KiB
Bash
Executable File
194 lines
8.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Hermetic suite for the fleet/bin/mosaic launcher (T110 / P5-RM-009).
|
|
#
|
|
# Arms cover the plan acceptance: split-home shipped-first positive, typed
|
|
# failure on missing candidates, stale-worktree non-precedence, OFF
|
|
# pass-through, and secure-descriptor refusal on the untrusted $HOME
|
|
# fallback. No network, no real npm install, no node package build: the
|
|
# "shipped mosaic" is a stub script and getent is PATH-stubbed (set
|
|
# GETENT_STUB=fail to make the passwd lookup fail, exercising the guarded
|
|
# $HOME fallback).
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
|
|
LAUNCHER="$SCRIPT_DIR/mosaic"
|
|
|
|
fail() {
|
|
echo "FAIL: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
[ -f "$LAUNCHER" ] || fail "missing launcher"
|
|
[ -x "$LAUNCHER" ] || fail "launcher is not executable"
|
|
bash -n "$LAUNCHER" || fail "launcher fails bash -n"
|
|
|
|
WORK=$(mktemp -d)
|
|
cleanup() { rm -rf "$WORK"; }
|
|
trap cleanup EXIT
|
|
|
|
REAL_HOME="$WORK/real-home"
|
|
SEAT_HOME="$WORK/seat-home"
|
|
STUB_BIN="$WORK/stub-bin"
|
|
mkdir -p "$REAL_HOME/.npm-global/bin" "$SEAT_HOME" "$STUB_BIN"
|
|
|
|
cat >"$REAL_HOME/.npm-global/bin/mosaic" <<'SH'
|
|
#!/bin/sh
|
|
echo "0.0.0-shipped-stub"
|
|
SH
|
|
chmod +x "$REAL_HOME/.npm-global/bin/mosaic"
|
|
|
|
# PATH-stubbed getent: reports the real home for the current uid, unless
|
|
# GETENT_STUB=fail is in the launcher environment (exercises the guarded
|
|
# $HOME fallback path).
|
|
cat >"$STUB_BIN/getent" <<SH
|
|
#!/bin/sh
|
|
if [ "\${GETENT_STUB:-}" = "fail" ]; then exit 2; fi
|
|
if [ "\$1" = "passwd" ]; then
|
|
echo "stub:x:$(id -u):$(id -g):stub:$REAL_HOME:/bin/sh"
|
|
exit 0
|
|
fi
|
|
exit 2
|
|
SH
|
|
chmod +x "$STUB_BIN/getent"
|
|
|
|
run_launcher() { # run_launcher <home> [VAR=value ...] -- [args...]
|
|
local home="$1"; shift
|
|
[ "${1:-}" = "--" ] && shift
|
|
env -i PATH="$STUB_BIN:/usr/bin:/bin" HOME="$home" TERM="${TERM:-dumb}" "$LAUNCHER" "$@"
|
|
}
|
|
|
|
# A1 — acceptance 1: split-home positive. HOME is an empty seat home; the
|
|
# shipped mosaic resolves through the passwd real home.
|
|
out="$(printf '' | run_launcher "$SEAT_HOME" -- --version)"
|
|
[ "$out" = "0.0.0-shipped-stub" ] || fail "A1 split-home positive: got '$out', want shipped stub version"
|
|
|
|
# A3 — acceptance 3: a stale worktree build is NEVER consulted without the
|
|
# explicit opt-in, even when a worktree exists on disk.
|
|
WT="$WORK/stale-wt"
|
|
mkdir -p "$WT/packages/mosaic/dist"
|
|
printf 'console.log("0.0.0-stale-worktree")\n' >"$WT/packages/mosaic/dist/cli.js"
|
|
out="$(printf '' | run_launcher "$SEAT_HOME" -- --version)"
|
|
[ "$out" = "0.0.0-shipped-stub" ] || fail "A3 stale worktree regained precedence without opt-in: got '$out'"
|
|
|
|
# A2 (opt-in healthy) — explicit MOSAIC_CLI_WORKTREE reaches the worktree.
|
|
out="$(printf '' | env MOSAIC_CLI_WORKTREE="$WT" HOME="$SEAT_HOME" PATH="$STUB_BIN:/usr/bin:/bin" "$LAUNCHER" --version)"
|
|
[ "$out" = "0.0.0-stale-worktree" ] || fail "A2 opt-in worktree not used: got '$out'"
|
|
|
|
# A2b (opt-in unhealthy) — absent dist falls back to shipped with a warning.
|
|
out2="$(printf '' | env MOSAIC_CLI_WORKTREE="$WORK/empty-wt" HOME="$SEAT_HOME" PATH="$STUB_BIN:/usr/bin:/bin" "$LAUNCHER" --version 2>/dev/null)"
|
|
[ "$out2" = "0.0.0-shipped-stub" ] || fail "A2b unhealthy worktree fallback output: '$out2'"
|
|
err2="$(printf '' | env MOSAIC_CLI_WORKTREE="$WORK/empty-wt" HOME="$SEAT_HOME" PATH="$STUB_BIN:/usr/bin:/bin" "$LAUNCHER" --version 2>&1 >/dev/null)"
|
|
case "$err2" in *"absent or unreadable"*|*"health check"*) ;; *) fail "A2b unhealthy worktree fallback warning missing: '$err2'" ;; esac
|
|
|
|
# A4 — OFF pass-through: worktree opt-in is ignored when OFF is set.
|
|
out="$(printf '' | env MOSAIC_FLEET_CLI_OFF=1 MOSAIC_CLI_WORKTREE="$WT" HOME="$SEAT_HOME" PATH="$STUB_BIN:/usr/bin:/bin" "$LAUNCHER" --version)"
|
|
[ "$out" = "0.0.0-shipped-stub" ] || fail "A4 OFF did not force pass-through: got '$out'"
|
|
|
|
# A5 — acceptance 4: typed failure when no candidate exists (passwd lookup
|
|
# fails, seat home carries no npm prefix). Expect 127 + documented message.
|
|
set +e
|
|
err="$(printf '' | env GETENT_STUB=fail HOME="$SEAT_HOME" PATH="$STUB_BIN:/usr/bin:/bin" "$LAUNCHER" --version 2>&1 >/dev/null)"
|
|
rc=$?
|
|
set -e
|
|
[ "$rc" = "127" ] || fail "A5 typed failure rc: got $rc, want 127"
|
|
case "$err" in *"no runnable CLI"*) ;; *) fail "A5 typed failure message missing: '$err'" ;; esac
|
|
|
|
# A6 — secure descriptor traversal, ABSOLUTE symlink plant (corrected per
|
|
# rev-code-02 B3: the symlink points at $PLANT/.npm-global so the candidate
|
|
# resolves EXACTLY to the planted executable). passwd lookup fails and a
|
|
# symlink-planted $HOME/.npm-global is refused without execution.
|
|
PLANT="$WORK/planted-target"
|
|
mkdir -p "$PLANT/.npm-global/bin"
|
|
cat >"$PLANT/.npm-global/bin/mosaic" <<SH
|
|
#!/bin/sh
|
|
touch "$WORK/planted-sentinel"
|
|
echo "0.0.0-planted"
|
|
SH
|
|
chmod +x "$PLANT/.npm-global/bin/mosaic"
|
|
ln -s "$PLANT/.npm-global" "$SEAT_HOME/.npm-global"
|
|
set +e
|
|
err="$(printf '' | env GETENT_STUB=fail HOME="$SEAT_HOME" PATH="$STUB_BIN:/usr/bin:/bin" "$LAUNCHER" --version 2>&1)"
|
|
rc=$?
|
|
set -e
|
|
[ "$rc" = "127" ] || fail "A6 planted descriptor was followed (rc $rc, out '$err')"
|
|
case "$err" in *"symlink component"*) ;; *) fail "A6 refusal diagnostic missing: '$err'" ;; esac
|
|
[ ! -e "$WORK/planted-sentinel" ] || fail "A6 planted mosaic EXECUTED"
|
|
|
|
# A6b — mutation control (rev-code-02 B3): a copy of the launcher with the
|
|
# descriptor guard bypassed MUST execute the plant under the identical hostile
|
|
# arm. If the mutant stays clean, the plant path is wrong and A6 proves
|
|
# nothing.
|
|
MUTANT="$WORK/mutant-mosaic"
|
|
sed 's/if fallback_candidate_usable "\$home_candidate"; then/if true; then/' "$LAUNCHER" >"$MUTANT"
|
|
chmod +x "$MUTANT"
|
|
[ "$(grep -c 'if true; then' "$MUTANT")" -eq 1 ] || fail "A6b mutant not created (guard call not replaced)"
|
|
set +e
|
|
mout="$(printf '' | env GETENT_STUB=fail HOME="$SEAT_HOME" PATH="$STUB_BIN:/usr/bin:/bin" "$MUTANT" --version 2>&1)"
|
|
mrc=$?
|
|
set -e
|
|
[ "$mrc" = "0" ] || fail "A6b mutant did not execute the plant (rc $mrc, out '$mout') - A6 proves nothing"
|
|
[ -e "$WORK/planted-sentinel" ] || fail "A6b mutant ran but sentinel absent - plant path wrong, A6 proves nothing"
|
|
|
|
# A7 — relative-HOME hostile arm (rev-code-02 B2): a relative HOME whose name
|
|
# is a symlink in the launcher CWD must be refused outright, never resolved
|
|
# against the working directory.
|
|
CWD_SANDBOX="$WORK/cwd-sandbox"
|
|
REL_PLANT="$WORK/relative-plant"
|
|
mkdir -p "$CWD_SANDBOX" "$REL_PLANT/.npm-global/bin"
|
|
cat >"$REL_PLANT/.npm-global/bin/mosaic" <<SH
|
|
#!/bin/sh
|
|
touch "$WORK/relative-sentinel"
|
|
echo "0.0.0-relative-planted"
|
|
SH
|
|
chmod +x "$REL_PLANT/.npm-global/bin/mosaic"
|
|
ln -s "$REL_PLANT" "$CWD_SANDBOX/relative-home"
|
|
set +e
|
|
rout="$(cd "$CWD_SANDBOX" && printf '' | env GETENT_STUB=fail HOME="relative-home" PATH="$STUB_BIN:/usr/bin:/bin" "$LAUNCHER" --version 2>&1)"
|
|
rrc=$?
|
|
set -e
|
|
[ "$rrc" = "127" ] || fail "A7 relative HOME was followed (rc $rrc, out '$rout')"
|
|
case "$rout" in *"relative path"*) ;; *) fail "A7 relative-refusal diagnostic missing: '$rout'" ;; esac
|
|
[ ! -e "$WORK/relative-sentinel" ] || fail "A7 relative plant EXECUTED"
|
|
|
|
# A7b — mutation control for the absolute-shape check: the same mutant (guard
|
|
# bypassed) MUST execute the relative plant under the identical arm.
|
|
set +e
|
|
rmout="$(cd "$CWD_SANDBOX" && printf '' | env GETENT_STUB=fail HOME="relative-home" PATH="$STUB_BIN:/usr/bin:/bin" "$MUTANT" --version 2>&1)"
|
|
rmrc=$?
|
|
set -e
|
|
[ "$rmrc" = "0" ] || fail "A7b mutant did not execute the relative plant (rc $rmrc, out '$rmout') - A7 proves nothing"
|
|
[ -e "$WORK/relative-sentinel" ] || fail "A7b mutant ran but relative sentinel absent - arm wrong, A7 proves nothing"
|
|
|
|
# A8 — parent-escape hostile arm (rev-code-02 delta, B2 remains): an absolute
|
|
# HOME containing a literal '..' component must be refused by the
|
|
# parent-escape check — the traversal would otherwise land on a planted tree
|
|
# OUTSIDE the seat home with no symlink involved.
|
|
ESC_BASE="$WORK/escape-base"
|
|
ESC_TARGET="$WORK/escape-target"
|
|
mkdir -p "$ESC_BASE" "$ESC_TARGET/.npm-global/bin"
|
|
cat >"$ESC_TARGET/.npm-global/bin/mosaic" <<SH
|
|
#!/bin/sh
|
|
touch "$WORK/escape-sentinel"
|
|
echo "0.0.0-escape-planted"
|
|
SH
|
|
chmod +x "$ESC_TARGET/.npm-global/bin/mosaic"
|
|
set +e
|
|
eout="$(printf '' | env GETENT_STUB=fail HOME="$ESC_BASE/../escape-target" PATH="$STUB_BIN:/usr/bin:/bin" "$LAUNCHER" --version 2>&1)"
|
|
erc=$?
|
|
set -e
|
|
[ "$erc" = "127" ] || fail "A8 parent-escape HOME was followed (rc $erc, out '$eout')"
|
|
case "$eout" in *"parent-escape component"*) ;; *) fail "A8 parent-escape diagnostic missing: '$eout'" ;; esac
|
|
[ ! -e "$WORK/escape-sentinel" ] || fail "A8 escape plant EXECUTED"
|
|
|
|
# A8b — mutation control: the guard-bypassed copy MUST execute the parent-
|
|
# escape plant under the identical arm (sentinel present, rc 0), proving the
|
|
# parent-escape check is what stands.
|
|
set +e
|
|
emout="$(printf '' | env GETENT_STUB=fail HOME="$ESC_BASE/../escape-target" PATH="$STUB_BIN:/usr/bin:/bin" "$MUTANT" --version 2>&1)"
|
|
emrc=$?
|
|
set -e
|
|
[ "$emrc" = "0" ] || fail "A8b mutant did not execute the escape plant (rc $emrc, out '$emout') - A8 proves nothing"
|
|
[ -e "$WORK/escape-sentinel" ] || fail "A8b mutant ran but escape sentinel absent - arm wrong, A8 proves nothing"
|
|
|
|
echo "mosaic launcher suite: all arms passed"
|