gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Lock installer input state

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 09:48:28 -04:00
parent 1ffd05f0e1
commit ba4e5e6677
5 changed files with 3239 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+3 -3
View File
@@ -39,10 +39,10 @@ __pycache__/
/config/firefox/chrome/panama-theme.css
/config/firefox/chrome/panama-theme.css.tmp
# Build products of the Vicinae extension. The source is the repository's; the
# dependency tree and the bundle it produces are machine state, rebuilt by
# `panama apps`.
# Build products of the Vicinae extension. The source and reviewed lockfile are
# in the repository; the dependency tree and bundle are machine state.
/config/local/share/vicinae/extensions/*/node_modules/
/config/local/share/vicinae/extensions/*/dist/
/config/local/share/vicinae/extensions/*/build/
/config/local/share/vicinae/extensions/*/package-lock.json
!/config/local/share/vicinae/extensions/panama-search/package-lock.json
config/local/share/vicinae/extensions/panama-search/package-lock.json
Generated
+3058
View File
File diff suppressed because it is too large Load Diff
install
+52 -21
View File
@@ -89,36 +89,56 @@ STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/panama"
PACKAGES_HASH="$STATE_DIR/packages-hash"
hash_packages() {
local file relative size
local file relative size fixed_input digest
{
find "$PANAMA_PATH/setup/packages" -maxdepth 1 -type f -print0
printf '%s\0' \
"$PANAMA_PATH/setup/scripts/install-packages" \
"$PANAMA_PATH/setup/lib/artifact-provenance"
find "$PANAMA_PATH/setup/provenance" -type f -print0
} | LC_ALL=C sort -z | while IFS= read -r -d '' file; do
relative="${file#"$PANAMA_PATH"/}"
size="$(wc -c <"$file")"
printf '%s\0%s\0' "$relative" "$size"
cat -- "$file"
printf '\0'
done | sha256sum | cut -d' ' -f1
for fixed_input in \
"$PANAMA_PATH/setup/scripts/install-packages" \
"$PANAMA_PATH/setup/lib/artifact-provenance"; do
[[ -f "$fixed_input" && ! -L "$fixed_input" && -r "$fixed_input" ]] || return 1
done
digest="$(
{
find "$PANAMA_PATH/setup/packages" -maxdepth 1 -type f -print0 || exit 1
printf '%s\0' \
"$PANAMA_PATH/setup/scripts/install-packages" \
"$PANAMA_PATH/setup/lib/artifact-provenance" || exit 1
find "$PANAMA_PATH/setup/provenance" -type f -print0 || exit 1
} | LC_ALL=C sort -z | while IFS= read -r -d '' file; do
relative="${file#"$PANAMA_PATH"/}"
size="$(wc -c <"$file")" || exit 1
printf '%s\0%s\0' "$relative" "$size" || exit 1
cat -- "$file" || exit 1
printf '\0' || exit 1
done | sha256sum | cut -d' ' -f1
)" || return 1
printf '%s\n' "$digest"
}
packages_needed() {
local current_hash recorded_hash
(( FORCE_PACKAGES )) && return 0
(( UPGRADE )) || return 0
[[ -r "$PACKAGES_HASH" ]] || return 0
[[ "$(hash_packages)" != "$(cat "$PACKAGES_HASH")" ]]
current_hash="$(hash_packages)" || return 2
recorded_hash="$(cat "$PACKAGES_HASH")" || return 2
[[ "$current_hash" != "$recorded_hash" ]]
}
# Written only after the stage succeeds, mirroring the rule panama-migrate
# documents for its markers: a step that did not complete has not happened, and
# recording it as done hides it forever.
record_packages_hash() {
local temporary_hash
mkdir -p "$STATE_DIR"
hash_packages >"$PACKAGES_HASH"
temporary_hash="$(mktemp "$STATE_DIR/.packages-hash.XXXXXX")" || return 1
if hash_packages >"$temporary_hash"; then
mv -f -- "$temporary_hash" "$PACKAGES_HASH"
else
rm -f -- "$temporary_hash"
return 1
fi
}
# Repository trust is checked before the installer can reach its bootstrap DNF.
@@ -322,14 +342,25 @@ for stage in "${STAGES[@]}"; do
script="$PANAMA_PATH/setup/scripts/$stage"
[[ -x "$script" ]] || continue
printf '\n=== %s ===\n' "$stage"
if [[ "$stage" == install-packages ]] && ! packages_needed; then
echo "The package lists have not changed since the last run; skipping."
echo "Run with --packages to install them anyway."
continue
if [[ "$stage" == install-packages ]]; then
package_state_status=0
packages_needed || package_state_status=$?
if (( package_state_status == 1 )); then
echo "The package lists have not changed since the last run; skipping."
echo "Run with --packages to install them anyway."
continue
elif (( package_state_status != 0 )); then
failed+=("$stage")
printf '!!! %s could not read its tracked installation inputs\n' "$stage" >&2
continue
fi
fi
if "$script"; then
if [[ "$stage" == install-packages ]]; then
record_packages_hash
if ! record_packages_hash; then
failed+=("$stage")
printf '!!! %s could not record its tracked installation inputs\n' "$stage" >&2
fi
fi
else
stage_status=$?
tests/setup/launcher-search-contract
+21 -5
View File
@@ -55,6 +55,7 @@ fi
# ── The extension ────────────────────────────────────────────────────────────
manifest="$extension/package.json"
lockfile="$extension/package-lock.json"
if [[ ! -f "$manifest" ]]; then
note 'the panama-search extension has no manifest'
else
@@ -76,6 +77,15 @@ else
fi
fi
if [[ ! -f "$lockfile" ]]; then
note 'the panama-search extension has no package-lock.json, so npm ci cannot install a fresh clone'
elif git -C "$repo_dir" check-ignore -q "$lockfile" 2>/dev/null; then
note 'the panama-search package-lock.json is ignored, so a fresh clone cannot use npm ci'
elif ! git -C "$repo_dir" ls-files --error-unmatch -- \
'config/local/share/vicinae/extensions/panama-search/package-lock.json' >/dev/null 2>&1; then
note 'the panama-search package-lock.json is not tracked, so a fresh clone cannot use npm ci'
fi
# ── One engine, written twice ────────────────────────────────────────────────
#
# The script command and the extension both have to know where a search goes.
@@ -124,23 +134,29 @@ trap 'rm -rf -- "$fixture_root"' EXIT
mkdir -p "$fixture_root/config/local/share/vicinae/scripts" \
"$fixture_root/config/local/share/vicinae/extensions/panama-search/src" \
"$fixture_root/bin"
printf '{"name":"panama-search","dependencies":{"left-pad":"1.3.0"}}\n' \
>"$fixture_root/config/local/share/vicinae/extensions/panama-search/package.json"
printf '{"lockfileVersion":3,"packages":{}}\n' \
>"$fixture_root/config/local/share/vicinae/extensions/panama-search/package-lock.json"
lockfile="$fixture_root/config/local/share/vicinae/extensions/panama-search/package-lock.json"
fixture_extension="$fixture_root/config/local/share/vicinae/extensions/panama-search"
cp -- "$manifest" "$fixture_extension/package.json"
cp -- "$lockfile" "$fixture_extension/package-lock.json"
cmp -s -- "$lockfile" "$fixture_extension/package-lock.json" \
|| note 'the fresh-clone fixture did not consume the repository package-lock.json'
sed -i 's/"dependencies": {/"dependencies": {"fixture-mismatch": "1.0.0",/' \
"$fixture_extension/package.json"
lockfile="$fixture_extension/package-lock.json"
lock_before="$fixture_root/package-lock.before"
cp -- "$lockfile" "$lock_before"
repository_lock_sha256="$(sha256sum -- "$lock_before" | awk '{ print $1 }')"
cat >"$fixture_root/bin/npm" <<'EOF'
#!/usr/bin/env bash
printf '%s\n' "$*" >>"${NPM_LOG:?}"
[[ "${1:-}" == ci ]] || exit 64
[[ "$(sha256sum -- package-lock.json | awk '{ print $1 }')" == "${NPM_EXPECTED_LOCK_SHA256:?}" ]] || exit 65
exit 1
EOF
chmod +x "$fixture_root/bin/npm"
stage_status=0
stage_output="$(PATH="$fixture_root/bin:$PATH" PANAMA_PATH="$fixture_root" \
VICINAE_DATA_DIR="$fixture_root/vicinae-data" NPM_LOG="$fixture_root/npm.log" \
NPM_EXPECTED_LOCK_SHA256="$repository_lock_sha256" \
bash "$stage" 2>&1)" || stage_status=$?
[[ "$stage_status" -eq 0 ]] \
|| note "the Vicinae stage returned $stage_status for a lockfile mismatch instead of remaining nonfatal"
tests/setup/update-command-contract
+105 -25
View File
@@ -40,6 +40,20 @@ STAGE_NAMES=(install-packages link-dotfiles link-skills link-user change-setting
link-vicinae-scripts setup-server link-server setup-identity
install-hardware)
copy_hash_inputs() {
local root="$1" source relative
while IFS= read -r -d '' source; do
relative="${source#"$repo_dir"/}"
mkdir -p "$(dirname "$root/$relative")"
cp -- "$source" "$root/$relative"
done < <(
find "$repo_dir/setup/packages" -maxdepth 1 -type f -print0
find "$repo_dir/setup/provenance" -type f -print0
)
mkdir -p "$root/setup/lib"
cp -- "$repo_dir/setup/lib/artifact-provenance" "$root/setup/lib/artifact-provenance"
}
# A PANAMA_PATH that looks enough like the real one for install to run, and
# records what it was asked to do instead of doing it.
build_fixture() {
@@ -51,10 +65,7 @@ build_fixture() {
cp "$installer" "$root/install"
: >"$root/bin/ascii"
printf 'base-package\n' >"$root/setup/packages/core-packages"
printf 'artifact provenance\n' >"$root/setup/lib/artifact-provenance"
printf 'reviewed installer inputs\n' >"$root/setup/provenance/installers.conf"
printf 'reviewed key\n' >"$root/setup/provenance/keys/fixture.asc"
copy_hash_inputs "$root"
local stage
for stage in "${STAGE_NAMES[@]}"; do
@@ -134,6 +145,20 @@ run_install() {
return "$status"
}
run_hash() {
local root="$1"
sed -n '/^hash_packages() {/,/^}$/p' "$root/install" >"$root/hash-only"
printf 'set -uo pipefail\nhash_packages\n' >>"$root/hash-only"
PANAMA_PATH="$root" bash "$root/hash-only" 2>"$root/hash-only.err"
}
assert_hash_failure() {
local root="$1" description="$2" status=0 digest
digest="$(run_hash "$root")" || status=$?
[[ "$status" -ne 0 && -z "$digest" ]] \
|| note "$description produced a digest instead of failing closed"
}
# ── 1. The interview never runs on an upgrade ────────────────────────────────
build_fixture "$tmp/a"
@@ -197,6 +222,19 @@ done
# ── 3. The packages hash gates the stage, and a failure does not record it ───
package_inputs=()
while IFS= read -r -d '' input; do
package_inputs+=("${input#"$repo_dir"/}")
done < <(find "$repo_dir/setup/packages" -maxdepth 1 -type f -print0)
provenance_inputs=()
while IFS= read -r -d '' input; do
provenance_inputs+=("${input#"$repo_dir"/}")
done < <(find "$repo_dir/setup/provenance" -type f -print0)
(( ${#package_inputs[@]} > 0 )) \
|| note 'the current repository has no top-level package input to exercise'
(( ${#provenance_inputs[@]} > 0 )) \
|| note 'the current repository has no provenance input to exercise'
# Second run, nothing changed: the stage must be skipped.
install_status=0
ran_again="$(run_install "$tmp/a" --upgrade)" || install_status=$?
@@ -213,33 +251,75 @@ ran_forced="$(run_install "$tmp/a" --upgrade --packages)" || install_status=$?
grep -qx 'install-packages' <<<"$ran_forced" \
|| note '--packages did not force install-packages to run'
# A changed list brings the stage back.
printf 'another-package\n' >>"$tmp/a/setup/packages/core-packages"
install_status=0
ran_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
[[ "$install_status" -eq 0 ]] \
|| note "install --upgrade failed after a package-list change with status $install_status"
grep -qx 'install-packages' <<<"$ran_changed" \
|| note 'a changed package list did not bring install-packages back'
# The package stage consumes more than package lists. Each reviewed input must
# independently invalidate a recorded package state so an upgrade cannot keep
# using a stale trust or installer policy.
for state_input in \
'setup/scripts/install-packages installer adapter' \
'setup/lib/artifact-provenance provenance helper' \
'setup/provenance/installers.conf installer provenance' \
'setup/provenance/keys/fixture.asc provenance key'; do
read -r relative label <<<"$state_input"
printf 'changed %s\n' "$label" >>"$tmp/a/$relative"
# Every current package and provenance member is part of the state definition.
# Dynamically discovering them makes this fail when a new reviewed input is
# added but omitted from hash_packages.
for relative in "${package_inputs[@]}" "${provenance_inputs[@]}" \
'setup/scripts/install-packages' 'setup/lib/artifact-provenance'; do
printf 'changed %s\n' "$relative" >>"$tmp/a/$relative"
install_status=0
ran_input_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
[[ "$install_status" -eq 0 ]] \
|| note "install --upgrade failed after a $label change with status $install_status"
|| note "install --upgrade failed after changing $relative with status $install_status"
grep -qx 'install-packages' <<<"$ran_input_changed" \
|| note "a changed $label did not bring install-packages back"
|| note "a changed $relative did not bring install-packages back"
done
# A path-only change must invalidate state even when the file bytes are exact.
for relative in "${package_inputs[0]:-}" "${provenance_inputs[0]:-}"; do
[[ -n "$relative" ]] || continue
build_fixture "$tmp/path-rename"
run_install "$tmp/path-rename" --upgrade >/dev/null
mv -- "$tmp/path-rename/$relative" "$tmp/path-rename/$relative.renamed"
install_status=0
ran_renamed="$(run_install "$tmp/path-rename" --upgrade)" || install_status=$?
[[ "$install_status" -eq 0 ]] \
|| note "install --upgrade failed after renaming $relative with status $install_status"
grep -qx 'install-packages' <<<"$ran_renamed" \
|| note "renaming $relative without changing bytes did not bring install-packages back"
done
# Fixed hash inputs must not silently disappear or degrade into a directory or
# link. An unreadable package input also proves a failed content read cannot be
# hidden by the final digest command.
for fixed_input in setup/scripts/install-packages setup/lib/artifact-provenance; do
for case_name in missing directory symlink unreadable; do
case_root="$tmp/hash-${fixed_input//\//-}-$case_name"
build_fixture "$case_root"
fixed_path="$case_root/$fixed_input"
case "$case_name" in
missing) rm -- "$fixed_path" ;;
directory) rm -- "$fixed_path"; mkdir -- "$fixed_path" ;;
symlink)
printf 'untrusted target\n' >"$case_root/untrusted-target"
rm -- "$fixed_path"
ln -s "$case_root/untrusted-target" "$fixed_path"
;;
unreadable) chmod 000 "$fixed_path" ;;
esac
assert_hash_failure "$case_root" "$fixed_input $case_name"
done
done
read_failure_root="$tmp/hash-package-read-failure"
build_fixture "$read_failure_root"
chmod 000 "$read_failure_root/${package_inputs[0]}"
assert_hash_failure "$read_failure_root" "${package_inputs[0]} unreadable"
# A hash failure is an installer failure, not a reason to skip the package
# stage and retain a stale stamp.
build_fixture "$tmp/hash-failure"
run_install "$tmp/hash-failure" --upgrade >/dev/null
cp -- "$tmp/hash-failure/state/panama/packages-hash" "$tmp/hash-failure/stamp-before"
rm -- "$tmp/hash-failure/setup/lib/artifact-provenance"
install_status=0
ran_hash_failure="$(run_install "$tmp/hash-failure" --upgrade)" || install_status=$?
[[ "$install_status" -ne 0 ]] \
|| note 'a failed package-state hash returned success'
grep -qx 'install-packages' <<<"$ran_hash_failure" \
&& note 'a failed package-state hash still ran install-packages'
cmp -s -- "$tmp/hash-failure/stamp-before" "$tmp/hash-failure/state/panama/packages-hash" \
|| note 'a failed package-state hash wrote a new packages-hash stamp'
# A failing stage must not record the hash, or the failure is hidden forever.
build_fixture "$tmp/c" 1
install_status=0