Publish curated Unraid-AppOps-Gateway source from 5f1a0fc2fdd07082637995b2c8b4514a1ecbbbb8

backend/tests/test_runner_specialization_child_boundary.py

@@ -0,0 +1,160 @@
+from __future__ import annotations
+
+import hashlib
+import os
+import shutil
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from test_runner_fleet_specialize import specialize  # noqa: F401
+
+
+def test_child_fixed_failure_is_finite_and_does_not_echo_exception(specialize, monkeypatch, capsys):
+    def fail():
+        raise specialize.RunnerFleetSpecializeError("runner_fleet_specialization_entrypoint_untrusted")
+    monkeypatch.setattr(specialize, "_apply_from_fixed_script", fail)
+    assert specialize._main(["--apply-fixed", "--confirm", specialize.CONFIRMATION]) == 1
+    captured = capsys.readouterr()
+    assert captured.out == ""
+    assert captured.err == "APPOPS_SPECIALIZATION_FAILURE:runner_fleet_specialization_entrypoint_untrusted\n"
+
+
+@pytest.mark.parametrize("private", ["token-secret", "runner_fleet_specialization_arbitrary_secret",
+                                      "runner_fleet_specialization_entrypoint_untrusted\nsecret"])
+def test_unknown_child_details_are_redacted(specialize, monkeypatch, capsys, private):
+    def fail():
+        raise specialize.RunnerFleetSpecializeError(private)
+    monkeypatch.setattr(specialize, "_apply_from_fixed_script", fail)
+    assert specialize._main(["--apply-fixed", "--confirm", specialize.CONFIRMATION]) == 1
+    assert capsys.readouterr().err == "APPOPS_SPECIALIZATION_FAILURE:runner_fleet_specialization_script_execution_failed\n"
+    assert specialize.public_specialization_failure(RuntimeError(private)) == "runner_fleet_specialization_script_execution_failed"
+
+
+@pytest.mark.parametrize("fault", [None, "stdout", "multiline", "secret", "code-prefix", "exit", "too-large", "unknown"])
+def test_parent_adopts_only_exact_single_finite_envelope(specialize, fault):
+    code = "runner_fleet_specialization_entrypoint_untrusted"
+    result = SimpleNamespace(returncode=1, stdout="", stderr=f"APPOPS_SPECIALIZATION_FAILURE:{code}\n")
+    if fault == "stdout":
+        result.stdout = "sensitive log"
+    elif fault == "multiline":
+        result.stderr += "secret\n"
+    elif fault == "secret":
+        result.stderr = "secret-value"
+    elif fault == "code-prefix":
+        result.stderr = f"{code}\n"
+    elif fault == "exit":
+        result.returncode = 137
+    elif fault == "too-large":
+        result.stderr = "x" * 257
+    elif fault == "unknown":
+        result.stderr = "APPOPS_SPECIALIZATION_FAILURE:runner_fleet_specialization_not_reviewed\n"
+    assert specialize._script_failure_code(result) == (code if fault is None else "runner_fleet_specialization_script_execution_failed")
+
+
+@pytest.mark.skipif(os.name != "posix" or os.geteuid() != 0 or shutil.which("bash") is None,
+                    reason="real POSIX root Bash parent proof in isolated Linux qualification")
+@pytest.mark.parametrize("deny", [False, True])
+def test_real_bash_parent_identity_and_child_error_propagation_with_stub_only(
+    specialize, monkeypatch, tmp_path, deny,
+):
+    # Source-identical Bash structure with only its fixed executor redirected to
+    # this sandbox's stub. Never call apply, deploy, Docker, native APIs or journals.
+    source_root = Path(__file__).resolve().parents[2]
+    state = tmp_path / "state"
+    state.mkdir(mode=0o700)
+    stub = tmp_path / "readonly_stub.py"
+    shell = (source_root / "scripts/upgrade_ci_runner_fleet_specialized.sh").read_text()
+    shell = shell.replace('/opt/gitea-deploy/runner_fleet_specialize.py', str(stub))
+    approved = hashlib.sha256(shell.encode()).hexdigest()
+    stub.write_text(
+        "import sys\nfrom pathlib import Path\n"
+        + "sys.path.insert(0," + repr(str(source_root / "ops/gitea-deploy-broker")) + ")\n"
+        + "import runner_fleet_specialize as f\n"
+        + "f.SPECIALIZED_STATE_ROOT=Path(" + repr(str(state)) + ")\n"
+        + "f._APPROVED_SCRIPT_SHA256=" + repr("0" * 64 if deny else approved) + "\n"
+        + "if not f._authorized_script_parent():\n"
+        + " print('APPOPS_SPECIALIZATION_FAILURE:runner_fleet_specialization_entrypoint_untrusted',file=sys.stderr)\n"
+        + " sys.exit(1)\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(specialize, "ROOT", tmp_path)
+    monkeypatch.setattr(specialize, "SPECIALIZED_STATE_ROOT", state)
+    monkeypatch.setattr(specialize, "SPECIALIZED_STATE_PATH", state / "specialized.json")
+    monkeypatch.setattr(specialize, "_ensure_state_root", lambda: None)
+    if deny:
+        with pytest.raises(specialize.RunnerFleetSpecializeError,
+                           match="^runner_fleet_specialization_entrypoint_untrusted$"):
+            specialize._run_approved_shell_script(shell.encode())
+    else:
+        specialize._run_approved_shell_script(shell.encode())
+    assert list(state.iterdir()) == []
+
+
+@pytest.mark.parametrize("controllers,accepted", [
+    (["cpu", "memory", "pids"], True),
+    (["cpuset", "cpu", "io", "memory", "hugetlb", "pids"], True),
+    (["cpuset", "cpu", "io", "memory", "hugetlb", "pids", "foreign"], False),
+])
+@pytest.mark.parametrize("boundary", ["snapshot", "ensure", "journal"])
+def test_observed_hugetlb_inventory_and_legacy_records_remain_finite(
+    specialize, monkeypatch, tmp_path, controllers, accepted, boundary,
+):
+    if boundary == "snapshot":
+        snapshot = {"exists": False, "rootSubtreeControllers": controllers,
+                    "safeToStartDind": True}
+        monkeypatch.setattr(specialize, "inspect_host_cgroup_family", lambda: snapshot)
+        read = specialize._cgroup_family_snapshot
+        expected = snapshot
+        error = "cgroup_inventory_invalid"
+    elif boundary == "ensure":
+        result = {"created": True, "rootSubtreeBefore": controllers}
+        monkeypatch.setattr(specialize, "ensure_host_cgroup_family", lambda **kwargs: result)
+        def read():
+            return specialize._ensure_cgroup_family_details(allow_existing=False)
+        expected = result
+        error = "cgroup_family_result_invalid"
+    else:
+        # Actual schema-v3 parser, including absent legacy-DinD state and its
+        # unchanged provenance, validates both historical and current inventories.
+        backup = specialize._SPECIALIZED_BACKUP_ROOT / "specialized-finite-fixture"
+        journal = {
+            "schemaVersion": 3, "status": "in_progress", "stage": "prepared",
+            "sourceScriptSha256": specialize._APPROVED_SCRIPT_SHA256,
+            "sourceRevision": "a" * 40, "sourceTree": "b" * 40,
+            "createdAt": "2026-10-10T00:00:00Z", "updatedAt": "2026-10-10T00:00:00Z",
+            "backupDirectory": str(backup), "baseComposeSha256": "c" * 64,
+            "baseComposeModelSha256": "d" * 64, "specializedComposeSha256": "e" * 64,
+            "legacyTopology": "v1", "originalRegistrations": [], "originalContainers": [],
+            "originalDind": {"present": False, "running": False, "restartPolicy": "no", "imageId": None},
+            "guardFiles": [], "guardMarkers": {}, "cgroupCreated": False,
+            "cgroupEnsurePending": False, "cgroupFamilyInitiallyPresent": False,
+            "cgroupRootSubtree": controllers, "newRegistrationIds": {},
+            "imageManifestSha256": None, "buildProbe": None,
+        }
+        monkeypatch.setattr(specialize, "_read_json_file", lambda *args, **kwargs: journal)
+        monkeypatch.setattr(specialize, "_trusted_directory", lambda path: None)
+        read = specialize._read_journal
+        expected = journal
+        error = "journal_invalid"
+    if accepted:
+        assert read() == expected
+    else:
+        with pytest.raises(specialize.RunnerFleetSpecializeError, match=error):
+            read()
+
+
+@pytest.mark.parametrize("suffix", ["cgroup_inventory_invalid", "cgroup_inventory_unavailable",
+                                     "identity_adoption_rejected", "legacy_config_missing"])
+def test_new_finite_prejournal_failure_codes_cross_both_boundaries(specialize, monkeypatch, capsys, suffix):
+    code = "runner_fleet_specialization_" + suffix
+    def fail():
+        raise specialize.RunnerFleetSpecializeError(code)
+    monkeypatch.setattr(specialize, "_apply_from_fixed_script", fail)
+    assert specialize._main(["--apply-fixed", "--confirm", specialize.CONFIRMATION]) == 1
+    captured = capsys.readouterr()
+    assert captured.out == ""
+    result = SimpleNamespace(returncode=1, stdout=captured.out, stderr=captured.err)
+    assert specialize._script_failure_code(result) == code
+    assert specialize.public_specialization_failure(specialize.RunnerFleetSpecializeError(code)) == code