208 lines
11 KiB
Python
208 lines
11 KiB
Python
#!/usr/bin/env python3
|
|
"""Verify already-installed immutable runtime only; fresh revision-3 approval required."""
|
|
import argparse
|
|
import hashlib
|
|
import importlib.util
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import pwd
|
|
import shutil
|
|
import signal
|
|
import stat
|
|
import sys
|
|
import time
|
|
|
|
DIGEST = 'f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
|
|
RUNTIME_MODULE = '19b5fb687288bbc836978b0251599dc1e4d1593e8b5efee85a6abb6a7f388412'
|
|
REHEARSAL_MODULE = '192f654cad4a5f065c7faa5e35b03493297a472e8d7fe641be2c42c5fb00dcc3'
|
|
STAGE = Path('/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017')
|
|
STORE = Path('/home/tegwick/.helixforge-factory/runtimes')
|
|
DESTINATION = STORE/DIGEST
|
|
DURABLE_RECEIPT = Path(str(STAGE)+'.receipt.json')
|
|
ENV = {'HOME':'/home/tegwick','PATH':'/usr/bin:/bin','LANG':'C.UTF-8','PYTHONDONTWRITEBYTECODE':'1'}
|
|
|
|
|
|
def require(value, code):
|
|
if not value: raise ValueError(code)
|
|
|
|
|
|
def file_digest(path):
|
|
with path.open('rb') as source:return hashlib.file_digest(source,'sha256').hexdigest()
|
|
|
|
|
|
def protected(path, *, directory=False, mode=None):
|
|
s=path.lstat()
|
|
require(not stat.S_ISLNK(s.st_mode) and s.st_uid==1000 and s.st_gid==1000,'path_ownership')
|
|
require(stat.S_ISDIR(s.st_mode) if directory else stat.S_ISREG(s.st_mode),'path_type')
|
|
require(not stat.S_IMODE(s.st_mode)&0o022,'path_write_mode')
|
|
if mode is not None:require(stat.S_IMODE(s.st_mode)==mode,'path_exact_mode')
|
|
return s
|
|
|
|
|
|
def identify(supervisor):
|
|
require(os.getuid()==1000 and os.getgid()==1000 and pwd.getpwuid(1000).pw_name=='tegwick','account_identity')
|
|
for p in (Path('/home/tegwick'),Path('/home/tegwick/.helixforge-factory'),STORE):
|
|
protected(p,directory=True,mode=0o700 if p!=Path('/home/tegwick') else 0o750)
|
|
protected(STORE/'.install.lock',mode=0o600)
|
|
code,output=supervisor.run(['/usr/local/bin/kubectl','get','nodes','-o','json'],20,capture=True,label='node-read')
|
|
require(code==0,'node_readback')
|
|
nodes=json.loads(output)['items']
|
|
require(len(nodes)==1 and any(a['address']=='92.205.62.239' for a in nodes[0]['status']['addresses'])
|
|
and any(c['type']=='Ready' and c['status']=='True' for c in nodes[0]['status']['conditions']),'node_identity')
|
|
require(shutil.disk_usage(STORE).free >= 2*1024**3,'disk_headroom')
|
|
mem=dict(x.split(':',1) for x in Path('/proc/meminfo').read_text().splitlines())
|
|
require(int(mem['MemAvailable'].split()[0])*1024>=1024**3,'memory_headroom')
|
|
require(os.getloadavg()[0]<=2*(os.cpu_count() or 1),'load_headroom')
|
|
read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]]
|
|
a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)]
|
|
require(1-(d[3]+d[4])/sum(d)<=0.85,'cpu_headroom')
|
|
|
|
|
|
def runtime_reader():
|
|
p=STAGE/'runtime.py';protected(p,mode=0o600)
|
|
require(file_digest(p)==RUNTIME_MODULE,'runtime_reader_pin')
|
|
spec=importlib.util.spec_from_file_location('approved_runtime_reader',p)
|
|
module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def expired(signum, frame):
|
|
raise TimeoutError('bounded_stage_deadline')
|
|
|
|
|
|
def rehearse_phase(supervision):
|
|
from rein_aharness import owner_rehearsal
|
|
require(Path(owner_rehearsal.__file__).resolve().is_relative_to(DESTINATION)
|
|
and file_digest(Path(owner_rehearsal.__file__))==REHEARSAL_MODULE,'rehearsal_source_pin')
|
|
require(owner_rehearsal.SYSTEM_RO_BINDS==('/usr','/bin','/lib','/lib64','/etc/resolv.conf','/etc/ssl/certs')
|
|
and all(Path(p).exists() for p in owner_rehearsal.SYSTEM_RO_BINDS),'frozen_system_bind_contract')
|
|
signal.signal(signal.SIGALRM,expired);signal.alarm(240)
|
|
# Keep the frozen owner launch contract; use its supported Runner seam.
|
|
def bounded_run(argv,timeout):
|
|
require(argv[0]=='/usr/bin/bwrap' and '--die-with-parent' not in argv,'bwrap_runner_contract')
|
|
return supervision_request(supervision,[argv[0],'--die-with-parent',*argv[1:]],timeout,label=Path(argv[-2]).name)[0]
|
|
try:steps=owner_rehearsal.rehearse(DESTINATION,run=bounded_run,bwrap_bin='/usr/bin/bwrap')
|
|
finally:signal.alarm(0)
|
|
require([x.name for x in steps]==['rein-aharness','glas-harness','claude'],'rehearsal_steps')
|
|
report={x.name:x.exit_code for x in steps}
|
|
print(json.dumps({'status':'rehearsed' if all(x.ok for x in steps) else 'rehearsal_failed','steps':report,
|
|
'model_calls':0,'credential_reads':False,'owner_configuration_read':False},sort_keys=True))
|
|
return 0 if all(x.ok for x in steps) else 1
|
|
|
|
|
|
def supervision_module():
|
|
spec=importlib.util.spec_from_file_location('approved_process_supervision',STAGE/'process_supervision.py')
|
|
module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def supervision_request(directory,argv,timeout,*,label):
|
|
return supervision_module().request(directory,argv,timeout,label=label)
|
|
|
|
|
|
def phase(supervisor, argv, timeout):
|
|
code,output=supervisor.run(argv,timeout,capture=True,label='rehearsal-phase')
|
|
try:result=json.loads(output)
|
|
except Exception:raise ValueError('phase_receipt_unavailable') from None
|
|
return code,result
|
|
|
|
|
|
def public_snapshot():
|
|
p=STAGE/'supervision'/'public-journal.json'
|
|
if not p.exists():return {'status':'unavailable'}
|
|
protected(p,mode=0o600);require(p.stat().st_size<=65536,'journal_bound')
|
|
return json.loads(p.read_text())
|
|
|
|
|
|
def persist(fd,receipt):
|
|
# The descriptor remains bound to the one exclusively created public receipt.
|
|
data=(json.dumps(receipt,sort_keys=True)+'\n').encode()
|
|
require(len(data)<=65536,'durable_receipt_bound')
|
|
require(os.fstat(fd).st_size==0,'durable_receipt_already_written')
|
|
with os.fdopen(os.dup(fd),'wb') as stream:stream.write(data);stream.flush();os.fsync(stream.fileno())
|
|
|
|
|
|
def main():
|
|
parser=argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument('--stage-inode',type=int)
|
|
parser.add_argument('--phase',choices=('rehearse',))
|
|
parser.add_argument('--supervision-dir')
|
|
args=parser.parse_args()
|
|
if args.phase:
|
|
require(args.supervision_dir==str(STAGE/'supervision'),'supervision_path')
|
|
return rehearse_phase(args.supervision_dir)
|
|
receipt={'proposal_id':'REINAH-WP-0008-T07-install-f599-r1','revision':3,'status':'failed',
|
|
'model_calls':0,'credential_reads':False,'owner_configuration_read':False,
|
|
'renewal_or_catalog_or_queue_mutation':False,'install_calls':0,'destination':str(DESTINATION),
|
|
'durable_public_receipt':str(DURABLE_RECEIPT)}
|
|
identity=None;supervisor=None;quiescent=False;receipt_fd=None;durable=False
|
|
try:
|
|
observed=protected(STAGE,directory=True,mode=0o700)
|
|
require(observed.st_ino==args.stage_inode and observed.st_dev==2049,'stage_identity')
|
|
identity=observed
|
|
require(not DURABLE_RECEIPT.exists() and not DURABLE_RECEIPT.is_symlink(),'receipt_already_present')
|
|
os.nice(19)
|
|
supervisor=supervision_module().Supervisor(STAGE/'supervision')
|
|
identify(supervisor);protected(DESTINATION,directory=True)
|
|
require({p.name for p in STAGE.iterdir()}=={'runtime.py','verify-installed.py','process_supervision.py','supervision'},'stage_inventory')
|
|
require(runtime_reader().runtime_digest(DESTINATION)==DIGEST,'installed_complete_digest')
|
|
receipt['installed_complete_digest_verified']=True
|
|
receipt['phase']='offline_rehearsal'
|
|
code,result=phase(supervisor,[str(DESTINATION/'bin/python3'),'-I','-B',str(STAGE/'verify-installed.py'),'--phase','rehearse','--supervision-dir',str(STAGE/'supervision')],260)
|
|
receipt['rehearsal']=result;require(code==0 and result['status']=='rehearsed','rehearsal_failed')
|
|
require(runtime_reader().runtime_digest(DESTINATION)==DIGEST,'post_rehearsal_complete_digest')
|
|
receipt['post_rehearsal_complete_digest_verified']=True
|
|
receipt['status']='installed_runtime_offline_rehearsal_verified'
|
|
except Exception as exc:
|
|
receipt['failure_type']=type(exc).__name__
|
|
if isinstance(exc,ValueError) and str(exc).replace('_','').isalnum():receipt['failure_code']=str(exc)
|
|
finally:
|
|
if supervisor is not None:
|
|
try:
|
|
receipt['process_supervision']=supervisor.close();quiescent=True
|
|
except Exception:
|
|
receipt['process_supervision']={'quiescent':False,'status':'cleanup_unverified'}
|
|
receipt['status']='failed'
|
|
if identity is not None:
|
|
try:receipt['public_job_journal']=public_snapshot()
|
|
except Exception:receipt['public_job_journal']={'status':'unavailable_or_invalid'};receipt['status']='failed'
|
|
receipt['launcher_status']=[]
|
|
jobs=receipt.get('process_supervision',{}).get('jobs',receipt.get('public_job_journal',{}).get('jobs',[]))
|
|
for name in ('rein-aharness','glas-harness','claude'):
|
|
found=[j for j in jobs if j['label']==name]
|
|
receipt['launcher_status'].append({'name':name,'status':found[0]['status'] if len(found)==1 else 'not_started_or_unverified',
|
|
'exit_code':found[0]['returncode'] if len(found)==1 else None})
|
|
receipt['owned_staging_removed']=False;receipt['cleanup_status']='pending'
|
|
receipt['native_receipt_scope']='immutable precleanup checkpoint; final cleanup outcome in local execution receipt'
|
|
receipt['durable_receipt_before_cleanup']=True
|
|
try:
|
|
receipt_fd=os.open(DURABLE_RECEIPT,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
|
|
persist(receipt_fd,receipt)
|
|
directory_fd=os.open(DURABLE_RECEIPT.parent,os.O_RDONLY|os.O_DIRECTORY)
|
|
try:os.fsync(directory_fd)
|
|
finally:os.close(directory_fd)
|
|
durable=True
|
|
except Exception:
|
|
receipt['status']='failed';receipt['durable_receipt_before_cleanup']=False
|
|
if quiescent and durable:
|
|
try:
|
|
current=protected(STAGE,directory=True,mode=0o700)
|
|
require((current.st_dev,current.st_ino)==(identity.st_dev,identity.st_ino),'cleanup_stage_identity')
|
|
require({p.name for p in STAGE.iterdir()} <= {'runtime.py','verify-installed.py','process_supervision.py','supervision'},'cleanup_unexpected_stage_member')
|
|
shutil.rmtree(STAGE)
|
|
receipt['owned_staging_removed']=not STAGE.exists() and not STAGE.is_symlink()
|
|
receipt['cleanup_status']='removed_after_durable_receipt_and_quiescence'
|
|
except Exception:receipt['cleanup_status']='failed';receipt['status']='failed'
|
|
else:
|
|
receipt['cleanup_status']='retained_for_quiescence_or_receipt_review'
|
|
if receipt_fd is not None:os.close(receipt_fd)
|
|
print(json.dumps(receipt,sort_keys=True))
|
|
return 0 if receipt['status']=='installed_runtime_offline_rehearsal_verified' else 1
|
|
|
|
|
|
if __name__=='__main__':
|
|
try:raise SystemExit(main())
|
|
except Exception as exc:
|
|
print(json.dumps({'status':'failed','failure_type':type(exc).__name__,'private_diagnostics_suppressed':True}))
|
|
raise SystemExit(1) from None
|