|
|
|
|
@@ -7,20 +7,22 @@ import { fileURLToPath } from 'node:url'
|
|
|
|
|
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Keyless publish-path rehearsal. It packs the package and workspace peers, installs those exact
|
|
|
|
|
* tarballs in an external plain-Node consumer, and lets npm resolve the registry Landlock launcher
|
|
|
|
|
* plus its platform package. No tsx, path mapping, or workspace resolution can hide missing files,
|
|
|
|
|
* dependency errors, or lost executable modes.
|
|
|
|
|
* Keyless publish-path rehearsal. It packs the provider, its workspace peers, and the current
|
|
|
|
|
* repository's Landlock entry/platform packages, then installs those exact tarballs in an external
|
|
|
|
|
* plain-Node consumer. No registry copy, tsx, path mapping, or workspace resolution can hide
|
|
|
|
|
* missing files, dependency errors, or lost executable modes.
|
|
|
|
|
*
|
|
|
|
|
* The installed launcher must match the host architecture, remain executable, and either confine a
|
|
|
|
|
* real process with bwrap disabled or fail closed on a non-enforcing kernel. Skips off Linux or
|
|
|
|
|
* before `pnpm run build`; launcher byte provenance belongs to its upstream release pipeline.
|
|
|
|
|
* before the harness and native packages are built.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
const packageDir = fileURLToPath(new URL('..', import.meta.url))
|
|
|
|
|
const repoRoot = fileURLToPath(new URL('../../../..', import.meta.url))
|
|
|
|
|
const nativeDir = join(repoRoot, 'native/landlock-run')
|
|
|
|
|
const sourceLauncher = join(nativeDir, 'packages', `linux-${process.arch}`, 'bin', 'landlock-run')
|
|
|
|
|
|
|
|
|
|
/** The closure the consumer needs: the package and its transitive `@deepseek-ai` peers; the launcher family arrives from the registry. */
|
|
|
|
|
/** The harness closure the consumer needs; native tarballs are packed through their mode-preserving release script. */
|
|
|
|
|
const WORKSPACE_CLOSURE = [
|
|
|
|
|
'packages/sandbox/sandbox-local',
|
|
|
|
|
'packages/sandbox/sandbox',
|
|
|
|
|
@@ -36,6 +38,8 @@ const E_MACHINE = { x64: 62, arm64: 183 }[process.arch as 'x64' | 'arm64']
|
|
|
|
|
const packable = process.platform === 'linux'
|
|
|
|
|
&& E_MACHINE !== undefined
|
|
|
|
|
&& existsSync(join(packageDir, 'lib', 'index.js'))
|
|
|
|
|
&& existsSync(join(nativeDir, 'packages/entry/lib/index.js'))
|
|
|
|
|
&& existsSync(sourceLauncher)
|
|
|
|
|
|
|
|
|
|
let consumerDir = ''
|
|
|
|
|
let workDir = ''
|
|
|
|
|
@@ -57,7 +61,20 @@ describe.skipIf(!packable)('sandbox-local: packed-tarball distribution (publish-
|
|
|
|
|
consumerDir = mkdtempSync(join(tmpdir(), 'dsh-packed-consumer-'))
|
|
|
|
|
workDir = mkdtempSync(join(tmpdir(), 'dsh-packed-work-'))
|
|
|
|
|
|
|
|
|
|
// Pack each closure member with the exact bytes publish would upload.
|
|
|
|
|
const nativePackDest = join(packDest, 'native')
|
|
|
|
|
const nativePack = spawnSync('node', ['./scripts/pack-release.mjs', nativePackDest, '--current-platform-only'], {
|
|
|
|
|
cwd: nativeDir,
|
|
|
|
|
encoding: 'utf8',
|
|
|
|
|
timeout: 120_000,
|
|
|
|
|
})
|
|
|
|
|
expect(nativePack.status, `native pack failed:\n${nativePack.stdout}\n${nativePack.stderr}`).toBe(0)
|
|
|
|
|
|
|
|
|
|
const nativeTarballs = readFileSync(join(nativePackDest, 'publish-order.txt'), 'utf8')
|
|
|
|
|
.trim()
|
|
|
|
|
.split('\n')
|
|
|
|
|
.map(tarball => join(nativePackDest, tarball))
|
|
|
|
|
|
|
|
|
|
// Pack each harness closure member with the exact bytes publish would upload.
|
|
|
|
|
const tarballs: string[] = []
|
|
|
|
|
for (const pkg of WORKSPACE_CLOSURE) {
|
|
|
|
|
const pack = spawnSync('pnpm', ['pack', '--pack-destination', packDest], {
|
|
|
|
|
@@ -69,6 +86,7 @@ describe.skipIf(!packable)('sandbox-local: packed-tarball distribution (publish-
|
|
|
|
|
const lines = pack.stdout.trim().split('\n')
|
|
|
|
|
tarballs.push(lines[lines.length - 1] as string)
|
|
|
|
|
}
|
|
|
|
|
tarballs.push(...nativeTarballs)
|
|
|
|
|
|
|
|
|
|
// Peer ranges resolve to the tarballs; Cordis is pinned to their peer range. Do not omit optional
|
|
|
|
|
// dependencies because the launcher selects its OS/CPU package through one.
|
|
|
|
|
@@ -124,12 +142,13 @@ describe.skipIf(!packable)('sandbox-local: packed-tarball distribution (publish-
|
|
|
|
|
await Promise.all([consumerDir, workDir].filter(Boolean).map(dir => rm(dir, { recursive: true, force: true })))
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
it('installs the registry launcher for this host: present, EXECUTABLE, right ELF arch', () => {
|
|
|
|
|
it('installs this checkout\'s launcher for the host: present, executable, byte-identical, and right ELF arch', () => {
|
|
|
|
|
const installed = join(consumerDir, 'node_modules', `node-addon-landlock-run-linux-${process.arch}`, 'bin', 'landlock-run')
|
|
|
|
|
expect(existsSync(installed), 'platform package missing from the installed tree').toBe(true)
|
|
|
|
|
// A tarball or extraction step that strips the mode bit would leave the
|
|
|
|
|
// probe failing exactly like a non-enforcing kernel — assert it apart.
|
|
|
|
|
expect(() => { accessSync(installed, constants.X_OK) }, 'installed launcher is not executable').not.toThrow()
|
|
|
|
|
expect(readFileSync(installed), 'installed launcher bytes').toEqual(readFileSync(sourceLauncher))
|
|
|
|
|
expect(readFileSync(installed).readUInt16LE(18), 'ELF e_machine').toBe(E_MACHINE)
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
|
Hypatia May