ra8-firmware 0.1.0
Bare-metal firmware for the Renesas RA8 family (RA8D2 / RA8P1)
Loading...
Searching...
No Matches
python_lock_policy_uv_cache_release_contracts.py
Go to the documentation of this file.
1# SPDX-License-Identifier: MIT
2# Copyright (c) 2026 Brighton Sikarskie
3"""Reviewed release/runtime fixtures for the uv cache policy checker."""
4
5from __future__ import annotations
6
7
8def _provisioner_action_expected_bodies() -> dict[str, str]:
9 """Return reviewed provisioner check/apply action bodies."""
10 return {
11 "uv_bootstrap": r"""
12 uv_bootstrap() {
13 /usr/bin/python3 -B -I -S "${ROOT}/scripts/dev/bootstrap_uv.py" \
14 --cache-root "${UV_CACHE_ROOT}" "$@"
15 }
16""",
17 "uv_bootstrap_apply": r"""
18 uv_bootstrap_apply() {
19 as_root /usr/bin/python3 -B -I -S "${ROOT}/scripts/dev/bootstrap_uv.py" \
20 --cache-root "${UV_CACHE_ROOT}" "$@"
21 }
22""",
23 "uv_bootstrap_apply_run": r"""
24 uv_bootstrap_apply_run() {
25 local project_environment="$1"
26 shift
27 if [ -n "${project_environment}" ]; then
28 as_root env UV_PROJECT_ENVIRONMENT="${project_environment}" UV_PYTHON_DOWNLOADS=never \
29 /usr/bin/python3 -B -I -S "${ROOT}/scripts/dev/bootstrap_uv.py" \
30 --cache-root "${UV_CACHE_ROOT}" --run "$@"
31 else
32 as_root env UV_PYTHON_DOWNLOADS=never \
33 /usr/bin/python3 -B -I -S "${ROOT}/scripts/dev/bootstrap_uv.py" \
34 --cache-root "${UV_CACHE_ROOT}" --run "$@"
35 fi
36 }
37""",
38 "uv_cache_modes_current": r"""
39 uv_cache_modes_current() {
40 uv_bootstrap --check-cache-modes >/dev/null 2>&1
41 }
42""",
43 "uv_cache_check": r"""
44 uv_cache_check() {
45 local status=0
46 if uv_bootstrap --verify-cache >/dev/null; then
47 return 0
48 else
49 status=$?
50 fi
51 if [ "${status}" -eq 2 ]; then
52 printf ' ... %-11s %s -> %s\n' uv-cache restricted 'shared (planned)'
53 return 2
54 fi
55 echo "error: authenticated uv cache check failed" >&2
56 return "${status}"
57 }
58""",
59 }
60
61
62PYTHON_BYTECODE_NEGATIVE_CONTROL_CONTRACT = r"""
63 assert_python_bytecode_negative_control() {
64 local tmp="$1" helper
65 RA8_BYTECODE_STATUS=0 /usr/bin/python3 -I -S "${tmp}/scripts/dev/bootstrap_uv.py"
66 helper="$(find "${tmp}/scripts/dev/__pycache__" -type f \
67 -name 'residue_helper*.pyc' -print -quit 2>/dev/null || true)"
68 if [ -z "${helper}" ]; then
69 echo "error: bytecode-residue negative control did not create helper pyc" >&2
70 return 1
71 fi
72 }
73"""
74
75
76PYTHON_SELFTEST_TMP_CONTRACTS = {
77 "python_selftest_tmp_identity": r"""
78 python_selftest_tmp_identity() {
79 stat -Lc '%d:%i' -- "$1"
80 }
81""",
82 "python_selftest_suite_is_safe": r"""
83 python_selftest_suite_is_safe() {
84 local target="$1" identity="$2" suffix root
85 root="$(cd -P /tmp && pwd)" || return 1
86 suffix="${target#"$root/ra8-python-bytecode-selftest."}"
87 [ "$root" = /tmp ] && [ ! -L "$root" ] && [ -d "$root" ] &&
88 [ "$(stat -Lc '%u:%a' -- "$root")" = "0:1777" ] &&
89 [ "$target" = "$root/ra8-python-bytecode-selftest.$suffix" ] &&
90 [[ "$suffix" =~ ^[0-9a-f]{32}$ ]] && [ ! -L "$target" ] &&
91 [ -d "$target" ] && [ "$(python_selftest_tmp_identity "$target")" = "$identity" ] &&
92 [ "$(stat -Lc '%u:%a' -- "$target")" = "$(id -u):700" ]
93 }
94""",
95 "python_selftest_tmp_is_safe": r"""
96 python_selftest_tmp_is_safe() {
97 local parent="$1" parent_identity="$2" target="$3" identity="$4"
98 python_selftest_suite_is_safe "$parent" "$parent_identity" &&
99 [ "$target" = "$parent/work" ] && [ ! -L "$target" ] && [ -d "$target" ] &&
100 [ "$(python_selftest_tmp_identity "$target")" = "$identity" ] &&
101 [ "$(stat -Lc '%u:%a' -- "$target")" = "$(id -u):700" ]
102 }
103""",
104 "python_selftest_tmp_cleanup": r"""
105 python_selftest_tmp_cleanup() {
106 local parent="$1" parent_identity="$2" target="$3" identity="$4"
107 python_selftest_tmp_is_safe "$parent" "$parent_identity" "$target" "$identity" || return 1
108 rm -rf -- "$target" || return 1
109 [ ! -e "$target" ] && [ ! -L "$target" ]
110 }
111""",
112 "python_selftest_suite_cleanup": r"""
113 python_selftest_suite_cleanup() {
114 local target="$1" identity="$2"
115 python_selftest_suite_is_safe "$target" "$identity" || return 1
116 rm -rf -- "$target" || return 1
117 [ ! -e "$target" ] && [ ! -L "$target" ]
118 }
119""",
120 "python_selftest_pending_cleanup": r"""
121 python_selftest_pending_cleanup() {
122 local target="$1" identity="$2" suffix root
123 if [ -n "$identity" ]; then
124 python_selftest_suite_cleanup "$target" "$identity"
125 return
126 fi
127 root="$(cd -P /tmp && pwd)" || return 1
128 suffix="${target#"$root/ra8-python-bytecode-selftest."}"
129 [ "$root" = /tmp ] && [ "$(stat -Lc '%u:%a' -- "$root")" = "0:1777" ] &&
130 [ "$target" = "$root/ra8-python-bytecode-selftest.$suffix" ] &&
131 [[ "$suffix" =~ ^[0-9a-f]{32}$ ]] || return 1
132 if [ -e "$target" ] || [ -L "$target" ]; then
133 [ ! -L "$target" ] && [ -d "$target" ] &&
134 [ "$(stat -Lc '%u:%a' -- "$target")" = "$(id -u):700" ] || return 1
135 rmdir -- "$target" || return 1
136 fi
137 [ ! -e "$target" ] && [ ! -L "$target" ]
138 }
139""",
140 "python_selftest_suite_candidate": r"""
141 python_selftest_suite_candidate() {
142 local destination="$1" suffix candidate attempt
143 for ((attempt = 0; attempt < 20; ++attempt)); do
144 suffix="$(od -An -N16 -tx1 /dev/urandom | tr -d '[:space:]')" || return 1
145 [[ "$suffix" =~ ^[0-9a-f]{32}$ ]] || return 1
146 candidate="/tmp/ra8-python-bytecode-selftest.$suffix"
147 if [ ! -e "$candidate" ] && [ ! -L "$candidate" ]; then
148 printf -v "$destination" '%s' "$candidate"
149 return 0
150 fi
151 done
152 return 1
153 }
154""",
155 "python_selftest_allocation_signal": r"""
156 python_selftest_allocation_signal() {
157 local status="$1"
158 trap - EXIT HUP INT TERM
159 python_selftest_pending_cleanup "$suite" "$suite_identity" || exit 1
160 exit "$status"
161 }
162""",
163 "python_selftest_allocation_signal_child": r"""
164 python_selftest_allocation_signal_child() {
165 local phase="$1" suite="$2" suite_identity="" root suffix
166 [[ "${BASH_SUBSHELL:-0}" == "0" &&
167 ("$phase" == "precreate" || "$phase" == "created") ]] || return 1
168 root="$(cd -P /tmp && pwd)" || return 1
169 suffix="${suite#"$root/ra8-python-bytecode-selftest."}"
170 [[ "$root" == /* && ! -L "$root" && "$(stat -Lc '%u:%a' -- "$root")" == "0:1777" &&
171 "$suite" == "$root/ra8-python-bytecode-selftest.$suffix" &&
172 "$suffix" =~ ^[0-9a-f]{32}$ && ! -e "$suite" && ! -L "$suite" ]] || return 1
173 trap 'python_selftest_pending_cleanup "${suite}" "${suite_identity}"' EXIT
174 trap 'python_selftest_allocation_signal 143' TERM
175 [[ "$phase" != "precreate" ]] || kill -TERM "$$"
176 (umask 077 && mkdir -m 0700 -- "$suite") || return 1
177 [[ "$phase" != "created" ]] || kill -TERM "$$"
178 return 99
179 }
180""",
181 "python_selftest_allocation_signal_case": r"""
182 python_selftest_allocation_signal_case() {
183 local phase="$1" suite="" suite_identity="" status
184 python_selftest_suite_candidate suite || return 1
185 if /bin/bash -p -- "$0" --selftest-python-allocation-signal "$phase" "$suite"; then
186 status=0
187 else
188 status=$?
189 fi
190 [[ "$status" == "143" ]] || return 1
191 [[ ! -e "$suite" && ! -L "$suite" ]]
192 }
193""",
194 "python_selftest_replacement_refusal": r"""
195 python_selftest_replacement_refusal() {
196 local parent="$1" parent_identity="$2" target="$3" old_identity="$4" saved
197 saved="$parent/original"
198 python_selftest_tmp_is_safe "$parent" "$parent_identity" "$target" "$old_identity" || return 1
199 mv -- "$target" "$saved"
200 mkdir -m 0700 -- "$target"
201 if python_selftest_tmp_cleanup "$parent" "$parent_identity" "$target" "$old_identity"; then
202 echo "error: replaced bytecode selftest root passed cleanup binding" >&2
203 return 1
204 fi
205 rmdir -- "$target"
206 mv -- "$saved" "$target"
207 python_selftest_tmp_is_safe "$parent" "$parent_identity" "$target" "$old_identity"
208 }
209""",
210}
211
212
213def python_bytecode_invocation_contract() -> str:
214 """Return the reviewed bytecode invocation selftest body."""
215 return r"""
216 python_bytecode_invocation_selftest() {
217 local suite="$1" suite_identity="$2" tmp="$3" identity="$4"
218 local status expected_status case_name
219 as_root() { "$@"; }
220 for case_name in bootstrap apply run-empty run-project; do
221 for expected_status in 0 37; do
222 python_selftest_tmp_is_safe "$suite" "$suite_identity" "$tmp" "$identity" || return 1
223 rm -rf -- "${tmp}/scripts/dev/__pycache__"
224 status=0
225 case "${case_name}" in
226 bootstrap)
227 set +e
228 RA8_BYTECODE_STATUS="${expected_status}" ROOT="${tmp}" \
229 UV_CACHE_ROOT="${tmp}/cache" uv_bootstrap --probe
230 status=$?
231 set -e
232 ;;
233 apply)
234 set +e
235 RA8_BYTECODE_STATUS="${expected_status}" ROOT="${tmp}" \
236 UV_CACHE_ROOT="${tmp}/cache" uv_bootstrap_apply --probe
237 status=$?
238 set -e
239 ;;
240 run-empty)
241 set +e
242 RA8_BYTECODE_STATUS="${expected_status}" ROOT="${tmp}" \
243 UV_CACHE_ROOT="${tmp}/cache" \
244 uv_bootstrap_apply_run "" --probe
245 status=$?
246 set -e
247 ;;
248 run-project)
249 set +e
250 RA8_BYTECODE_STATUS="${expected_status}" ROOT="${tmp}" \
251 UV_CACHE_ROOT="${tmp}/cache" \
252 uv_bootstrap_apply_run "${tmp}/project-env" --probe
253 status=$?
254 set -e
255 ;;
256 esac
257 if [ "${status}" -ne "${expected_status}" ] ||
258 find "${tmp}/scripts/dev" \‍( -type d -name __pycache__ -o \
259 -type f \‍( -name '*.pyc' -o -name '*.pyo' \‍) \‍) -print -quit | grep -q .; then
260 echo "error: ${case_name}/${expected_status} bytecode-residue selftest failed" >&2
261 return 1
262 fi
263 done
264 done
265 }
266"""
267
268
269PYTHON_NO_BYTECODE_RESIDUE_CONTRACT = r"""
270 python_no_bytecode_residue_selftest() {
271 (
272 local suite="" suite_identity="" tmp identity status expected_status case_name
273 python_selftest_allocation_signal_case precreate || return 1
274 python_selftest_allocation_signal_case created || return 1
275 python_selftest_suite_candidate suite || return 1
276 trap 'python_selftest_pending_cleanup "${suite}" "${suite_identity}"' EXIT
277 (umask 077 && mkdir -m 0700 -- "$suite") || return 1
278 suite_identity="$(python_selftest_tmp_identity "$suite")"
279 python_selftest_suite_is_safe "$suite" "$suite_identity" || return 1
280 tmp="$suite/work"
281 mkdir -m 0700 -- "$tmp"
282 identity="$(python_selftest_tmp_identity "$tmp")"
283 python_selftest_tmp_is_safe "$suite" "$suite_identity" "$tmp" "$identity" || return 1
284 python_selftest_replacement_refusal "$suite" "$suite_identity" "$tmp" "$identity"
285 mkdir -p "${tmp}/scripts/dev"
286 printf 'VALUE = 1\n' >"${tmp}/scripts/dev/residue_helper.py"
287 cat >"${tmp}/scripts/dev/bootstrap_uv.py" <<'PY'
288import os
289import sys
290from pathlib import Path
291
292sys.path.insert(0, str(Path(__file__).parent))
293import residue_helper
294
295raise SystemExit(int(os.environ.get("RA8_BYTECODE_STATUS", "0")))
296PY
297 python_bytecode_invocation_selftest "$suite" "$suite_identity" "$tmp" "$identity" ||
298 return 1
299 assert_python_bytecode_negative_control "${tmp}"
300 python_selftest_tmp_cleanup "$suite" "$suite_identity" "$tmp" "$identity" || return 1
301 python_selftest_suite_cleanup "$suite" "$suite_identity" || return 1
302 trap - EXIT
303 )
304 }
305"""
306
307
308def _release_tmp_root_contract() -> str:
309 """Return one reviewed release-tool temporary-directory contract part."""
310 return r"""
311 release_tmp_reset() {
312 RELEASE_TMP_DIR=""
313 RELEASE_TMP_IDENTITY=""
314 RELEASE_TMP_OWNER_UID=""
315 RELEASE_TMP_ROOT=""
316 RELEASE_TMP_ROOT_IDENTITY=""
317 RELEASE_TMP_ALLOCATION_PENDING=0
318 }
319
320 release_tmp_identity() {
321 stat -Lc '%d:%i' -- "$1"
322 }
323
324 release_tmp_root_is_safe() {
325 local root="$1" identity="$2" canonical
326 canonical="$(cd -P /tmp && pwd)" || return 1
327 [[ "$root" == "$canonical" && "$root" == /* && ! -L "$root" && -d "$root" &&
328 "$(release_tmp_identity "$root")" == "$identity" &&
329 "$(stat -Lc '%u:%a' -- "$root")" == "0:1777" ]]
330 }
331
332 release_tmp_is_safe() {
333 local suffix
334 suffix="${RELEASE_TMP_DIR#"$RELEASE_TMP_ROOT/ra8-tool-install."}"
335 release_tmp_root_is_safe "$RELEASE_TMP_ROOT" "$RELEASE_TMP_ROOT_IDENTITY" &&
336 [[ "$RELEASE_TMP_DIR" == "$RELEASE_TMP_ROOT/ra8-tool-install.$suffix" &&
337 "$suffix" =~ ^[0-9a-f]{32}$ && "$RELEASE_TMP_OWNER_UID" =~ ^[0-9]+$ &&
338 ! -L "$RELEASE_TMP_DIR" && -d "$RELEASE_TMP_DIR" &&
339 "$(release_tmp_identity "$RELEASE_TMP_DIR")" == "$RELEASE_TMP_IDENTITY" &&
340 "$(stat -Lc '%u:%a' -- "$RELEASE_TMP_DIR")" == "$RELEASE_TMP_OWNER_UID:700" ]]
341 }
342"""
343
344
345def _release_tmp_cleanup_contract() -> str:
346 """Return one reviewed release-tool temporary-directory contract part."""
347 return r"""
348 release_tmp_pending_cleanup() {
349 local suffix
350 suffix="${RELEASE_TMP_DIR#"$RELEASE_TMP_ROOT/ra8-tool-install."}"
351 [[ "$RELEASE_TMP_ALLOCATION_PENDING" == "1" && -z "$RELEASE_TMP_IDENTITY" &&
352 "$RELEASE_TMP_OWNER_UID" =~ ^[0-9]+$ ]] &&
353 release_tmp_root_is_safe "$RELEASE_TMP_ROOT" "$RELEASE_TMP_ROOT_IDENTITY" &&
354 [[ "$RELEASE_TMP_DIR" == "$RELEASE_TMP_ROOT/ra8-tool-install.$suffix" &&
355 "$suffix" =~ ^[0-9a-f]{32}$ ]] || return 1
356 if [[ -e "$RELEASE_TMP_DIR" || -L "$RELEASE_TMP_DIR" ]]; then
357 [[ ! -L "$RELEASE_TMP_DIR" && -d "$RELEASE_TMP_DIR" &&
358 "$(stat -Lc '%u:%a' -- "$RELEASE_TMP_DIR")" == "$RELEASE_TMP_OWNER_UID:700" ]] ||
359 return 1
360 rmdir -- "$RELEASE_TMP_DIR" || return 1
361 fi
362 [[ ! -e "$RELEASE_TMP_DIR" && ! -L "$RELEASE_TMP_DIR" ]] || return 1
363 release_tmp_reset
364 }
365
366 release_tmp_cleanup_owned() {
367 if [[ "$RELEASE_TMP_ALLOCATION_PENDING" == "1" ]]; then
368 release_tmp_pending_cleanup
369 return
370 fi
371 release_tmp_is_safe || return 1
372 rm -rf -- "$RELEASE_TMP_DIR" || return 1
373 [[ ! -e "$RELEASE_TMP_DIR" && ! -L "$RELEASE_TMP_DIR" ]] || return 1
374 release_tmp_reset
375 }
376
377 release_tmp_exit() {
378 local status=$?
379 trap - EXIT HUP INT TERM
380 release_tmp_cleanup_owned || exit 1
381 exit "$status"
382 }
383
384 release_tmp_signal() {
385 local status="$1"
386 trap - EXIT HUP INT TERM
387 release_tmp_cleanup_owned || exit 1
388 exit "$status"
389 }
390
391 install_release_tmp_traps() {
392 trap release_tmp_exit EXIT
393 trap 'release_tmp_signal 129' HUP
394 trap 'release_tmp_signal 130' INT
395 trap 'release_tmp_signal 143' TERM
396 }
397"""
398
399
400def _release_tmp_allocation_contract() -> str:
401 """Return one reviewed release-tool temporary-directory contract part."""
402 return r"""
403 release_tmp_allocation_checkpoint() {
404 local phase="$1"
405 [[ -n "$RELEASE_TMP_CHECKPOINT_MODE" ]] || return 0
406 [[ "$RELEASE_TMP_CHECKPOINT_MODE" == "precreate" ||
407 "$RELEASE_TMP_CHECKPOINT_MODE" == "created" ]] || return 1
408 [[ "$RELEASE_TMP_CHECKPOINT_MODE" == "$phase" ]] || return 0
409 [[ "${BASH_SUBSHELL:-0}" == "0" ]] || return 1
410 printf '%s\n' "$RELEASE_TMP_DIR"
411 kill -TERM "$$"
412 return 1
413 }
414
415 release_tmp_begin() {
416 local suffix candidate attempt
417 [[ -z "$RELEASE_TMP_DIR" && -z "$RELEASE_TMP_IDENTITY" &&
418 -z "$RELEASE_TMP_OWNER_UID" && -z "$RELEASE_TMP_ROOT" &&
419 -z "$RELEASE_TMP_ROOT_IDENTITY" && "$RELEASE_TMP_ALLOCATION_PENDING" == "0" ]] ||
420 return 1
421 RELEASE_TMP_ROOT="$(cd -P /tmp && pwd)" || return 1
422 RELEASE_TMP_ROOT_IDENTITY="$(release_tmp_identity "$RELEASE_TMP_ROOT")" || return 1
423 RELEASE_TMP_OWNER_UID="$(id -u)" || return 1
424 release_tmp_root_is_safe "$RELEASE_TMP_ROOT" "$RELEASE_TMP_ROOT_IDENTITY" || return 1
425 for ((attempt = 0; attempt < 20; ++attempt)); do
426 suffix="$(od -An -N16 -tx1 /dev/urandom | tr -d '[:space:]')" || return 1
427 [[ "$suffix" =~ ^[0-9a-f]{32}$ ]] || return 1
428 candidate="$RELEASE_TMP_ROOT/ra8-tool-install.$suffix"
429 if [[ ! -e "$candidate" && ! -L "$candidate" ]]; then
430 RELEASE_TMP_DIR="$candidate"
431 break
432 fi
433 done
434 [[ -n "$RELEASE_TMP_DIR" ]] || return 1
435 RELEASE_TMP_ALLOCATION_PENDING=1
436 install_release_tmp_traps
437 release_tmp_allocation_checkpoint precreate
438 (umask 077 && mkdir -m 0700 -- "$RELEASE_TMP_DIR") || return 1
439 release_tmp_allocation_checkpoint created
440 RELEASE_TMP_IDENTITY="$(release_tmp_identity "$RELEASE_TMP_DIR")" || return 1
441 release_tmp_is_safe || return 1
442 RELEASE_TMP_ALLOCATION_PENDING=0
443 }
444"""
445
446
447def _release_tmp_signal_contract() -> str:
448 """Return one reviewed release-tool temporary-directory contract part."""
449 return r"""
450 release_tmp_path_is_absent() {
451 local target="$1" root suffix identity
452 root="$(cd -P /tmp && pwd)" || return 1
453 identity="$(release_tmp_identity "$root")" || return 1
454 suffix="${target#"$root/ra8-tool-install."}"
455 release_tmp_root_is_safe "$root" "$identity" &&
456 [[ "$target" == "$root/ra8-tool-install.$suffix" &&
457 "$suffix" =~ ^[0-9a-f]{32}$ && ! -e "$target" && ! -L "$target" ]]
458 }
459
460 release_tmp_signal_case() {
461 local phase="$1" output status
462 if output="$(/bin/bash -p -- "$0" --selftest-release-tmp-signal "$phase")"; then
463 status=0
464 else
465 status=$?
466 fi
467 [[ "$status" == "143" && "$output" != *$'\n'* ]] || return 1
468 release_tmp_path_is_absent "$output"
469 }
470
471 release_tmp_signal_child() {
472 local phase="$1"
473 [[ "${BASH_SUBSHELL:-0}" == "0" &&
474 ("$phase" == "precreate" || "$phase" == "created") ]] || return 1
475 RELEASE_TMP_CHECKPOINT_MODE="$phase"
476 : "$RELEASE_TMP_CHECKPOINT_MODE"
477 release_tmp_begin
478 return 99
479 }
480"""
481
482
483def _release_tmp_refusal_contract() -> str:
484 """Return one reviewed release-tool temporary-directory contract part."""
485 return r"""
486 release_tmp_replacement_refusal() {
487 local kind="$1" original="$RELEASE_TMP_DIR" saved refused preserved=0
488 local identity="$RELEASE_TMP_IDENTITY" owner="$RELEASE_TMP_OWNER_UID"
489 local root="$RELEASE_TMP_ROOT" root_identity="$RELEASE_TMP_ROOT_IDENTITY"
490 saved="$original.saved"
491 release_tmp_is_safe && [[ ! -e "$saved" && ! -L "$saved" ]] || return 1
492 mv -- "$original" "$saved" || return 1
493 case "$kind" in
494 directory) mkdir -m 0700 -- "$original" || return 1 ;;
495 symlink) ln -s -- "$saved" "$original" || return 1 ;;
496 *) return 1 ;;
497 esac
498 if release_tmp_cleanup_owned; then refused=0; else refused=1; fi
499 case "$kind" in
500 directory)
501 [[ ! -L "$original" && -d "$original" ]] && preserved=1
502 rmdir -- "$original" || return 1
503 ;;
504 symlink)
505 [[ -L "$original" && "$(readlink -- "$original")" == "$saved" ]] && preserved=1
506 rm -- "$original" || return 1
507 ;;
508 esac
509 mv -- "$saved" "$original" || return 1
510 RELEASE_TMP_DIR="$original"
511 RELEASE_TMP_IDENTITY="$identity"
512 RELEASE_TMP_OWNER_UID="$owner"
513 RELEASE_TMP_ROOT="$root"
514 RELEASE_TMP_ROOT_IDENTITY="$root_identity"
515 RELEASE_TMP_ALLOCATION_PENDING=0
516 : "$RELEASE_TMP_ALLOCATION_PENDING"
517 release_tmp_is_safe && [[ "$refused" == "1" && "$preserved" == "1" ]]
518 }
519
520 release_tmp_wrong_owner_refusal() {
521 local path refused
522 [[ "$(id -u)" == "0" ]] || return 0
523 release_tmp_begin || return 1
524 path="$RELEASE_TMP_DIR"
525 chown 65534 "$path" || return 1
526 if release_tmp_cleanup_owned; then refused=0; else refused=1; fi
527 chown 0 "$path" || return 1
528 release_tmp_is_safe || return 1
529 release_tmp_cleanup_owned || return 1
530 trap - EXIT HUP INT TERM
531 release_tmp_path_is_absent "$path" && [[ "$refused" == "1" ]]
532 }
533"""
534
535
536def _release_tmp_selftest_contract() -> str:
537 """Return one reviewed release-tool temporary-directory contract part."""
538 return r"""
539 release_tmp_contract_selftest() {
540 local tmp original_identity original_path refused
541 release_tmp_wrong_owner_refusal || return 1
542 release_tmp_signal_case precreate || return 1
543 release_tmp_signal_case created || return 1
544 TMPDIR="/definitely-not-a-release-temp-parent"
545 export TMPDIR
546 release_tmp_begin || return 1
547 original_path="$RELEASE_TMP_DIR"
548 original_identity="$RELEASE_TMP_IDENTITY"
549 [[ "$original_path" != "$TMPDIR/"* ]] || return 1
550 release_tmp_replacement_refusal directory || return 1
551 release_tmp_replacement_refusal symlink || return 1
552
553 RELEASE_TMP_IDENTITY="0:0"
554 if release_tmp_cleanup_owned; then refused=0; else refused=1; fi
555 RELEASE_TMP_IDENTITY="$original_identity"
556 [[ "$refused" == "1" ]] || return 1
557
558 RELEASE_TMP_DIR="$original_path/forged"
559 if release_tmp_cleanup_owned; then refused=0; else refused=1; fi
560 RELEASE_TMP_DIR="$original_path"
561 [[ "$refused" == "1" ]] || return 1
562
563 chmod 0755 "$original_path"
564 if release_tmp_cleanup_owned; then refused=0; else refused=1; fi
565 chmod 0700 "$original_path"
566 [[ "$refused" == "1" ]] || return 1
567
568 unset TMPDIR
569 tmp="$original_path"
570 release_tmp_cleanup_owned || return 1
571 trap - EXIT HUP INT TERM
572 release_tmp_path_is_absent "$tmp"
573 }
574"""
575
576
577def provisioner_release_tmp_contract() -> str:
578 """Return the reviewed release-tool temporary-directory lifecycle."""
579 return (
580 f"{_release_tmp_root_contract()}\n\n"
581 f"{_release_tmp_cleanup_contract()}\n\n"
582 f"{_release_tmp_allocation_contract()}\n\n"
583 f"{_release_tmp_signal_contract()}\n\n"
584 f"{_release_tmp_refusal_contract()}\n\n"
585 f"{_release_tmp_selftest_contract()}"
586 )
587
588
589def _provisioner_report_expected_bodies() -> dict[str, str]:
590 """Return reviewed reporting and contract-test bodies."""
591 return {
592 "uv_cache_apply_report": r"""
593 uv_cache_apply_report() {
594 local modes_current="$1"
595 if [ "${modes_current}" -eq 0 ]; then
596 printf ' ... %-11s %s -> %s\n' uv-cache restricted shared
597 fi
598 }
599""",
600 "uv_cache_check_scenario_selftest": r"""
601 uv_cache_check_scenario_selftest() {
602 local expected_status="$1" expected_output="$2" message="$3"
603 status=0
604 calls=()
605 if uv_cache_check >"${output_file}" 2>&1; then
606 status=0
607 else
608 status=$?
609 fi
610 output="$(<"${output_file}")"
611 if [ "${status}" -ne "${expected_status}" ] ||
612 [ "${output}" != "${expected_output}" ] ||
613 [ "${calls[*]}" != "--verify-cache" ]; then
614 echo "error: uv cache check ${message} selftest failed" >&2
615 return 1
616 fi
617 }
618""",
619 "assert_python_bytecode_negative_control": PYTHON_BYTECODE_NEGATIVE_CONTROL_CONTRACT,
620 **PYTHON_SELFTEST_TMP_CONTRACTS,
621 "python_bytecode_invocation_selftest": python_bytecode_invocation_contract(),
622 "python_no_bytecode_residue_selftest": PYTHON_NO_BYTECODE_RESIDUE_CONTRACT,
623 }
624
625
626def provisioner_expected_bodies() -> dict[str, str]:
627 """Return every reviewed provisioner semantic body."""
628 return {
629 **_provisioner_action_expected_bodies(),
630 **_provisioner_report_expected_bodies(),
631 }
632
633
634def provisioner_dispatch() -> tuple[str, ...]:
635 """Return the exact production selftest dispatch sequence."""
636 return (
637 'if [ "${1:-}" = "--selftest-release-tmp-signal" ]; then',
638 '[[ "$#" == "2" ]] || exit 1',
639 "load_release_selftest_helper || exit 1",
640 'release_tmp_signal_child "$2"',
641 'elif [ "${1:-}" = "--selftest-python-allocation-signal" ]; then',
642 '[[ "$#" == "3" ]] || exit 1',
643 "load_release_selftest_helper || exit 1",
644 'python_selftest_allocation_signal_child "$2" "$3"',
645 'elif [ "${1:-}" = "--selftest-uv-cache-contract" ]; then',
646 "load_release_selftest_helper || exit 1",
647 "uv_cache_contract_selftest",
648 "else",
649 'main "$@"',
650 "fi",
651 )
652
653
654def provisioner_mutations() -> tuple[tuple[str, str], ...]:
655 """Return load-bearing mutations for the provisioner contract."""
656 return _provisioner_action_mutations() + _python_selftest_mutations() + _release_tmp_mutations()
657
658
659def _provisioner_action_mutations() -> tuple[tuple[str, str], ...]:
660 """Return release-action and reporting mutations."""
661 return (
662 (
663 "uv_bootstrap() {\n /usr/bin/python3 -B -I -S",
664 "uv_bootstrap() {\n /usr/bin/python3 -I -S",
665 ),
666 (
667 "uv_bootstrap_apply() {\n as_root /usr/bin/python3 -B -I -S",
668 "uv_bootstrap_apply() {\n as_root /usr/bin/python3 -I -S",
669 ),
670 (
671 'if [ -n "${project_environment}" ]; then\n'
672 ' as_root env UV_PROJECT_ENVIRONMENT="${project_environment}" '
673 "UV_PYTHON_DOWNLOADS=never \\\n"
674 " /usr/bin/python3 -B -I -S",
675 'if [ -n "${project_environment}" ]; then\n'
676 ' as_root env UV_PROJECT_ENVIRONMENT="${project_environment}" '
677 "UV_PYTHON_DOWNLOADS=never \\\n"
678 " /usr/bin/python3 -I -S",
679 ),
680 (
681 " else\n as_root env UV_PYTHON_DOWNLOADS=never \\\n"
682 " /usr/bin/python3 -B -I -S",
683 " else\n as_root env UV_PYTHON_DOWNLOADS=never \\\n"
684 " /usr/bin/python3 -I -S",
685 ),
686 ("uv_bootstrap --verify-cache >/dev/null", "uv_bootstrap --ensure >/dev/null"),
687 ("uv_bootstrap_apply --ensure >/dev/null", "uv_bootstrap --ensure >/dev/null"),
688 (
689 'uv_bootstrap_apply_run "" --no-config pip check',
690 "uv_bootstrap_apply --no-config pip check",
691 ),
692 ('if [ "${modes_current}" -eq 0 ]; then', 'if [ "${modes_current}" -eq 1 ]; then'),
693 ('uv_cache_apply_report "${cache_modes_current}"', ": # report removed"),
694 ("if uv_cache_check; then", "if uv_bootstrap --ensure; then"),
695 ("uv_cache_contract_selftest\n", ": # selftest removed\n"),
696 )
697
698
699def _release_tmp_mutations() -> tuple[tuple[str, str], ...]:
700 """Return load-bearing privileged temporary-root mutations."""
701 return (
702 (
703 "unset PYTHONHOME PYTHONPATH RA8_TOOL_VENV TMPDIR",
704 "unset PYTHONHOME PYTHONPATH RA8_TOOL_VENV",
705 ),
706 (
707 'release_tmp_root_is_safe() {\n local root="$1" identity="$2" canonical',
708 'release_tmp_root_is_safe() {\n local root="$1" identity="$2" canonical\n'
709 " return 0",
710 ),
711 (
712 '"$(release_tmp_identity "$RELEASE_TMP_DIR")" == "$RELEASE_TMP_IDENTITY"',
713 "true",
714 ),
715 (
716 'rmdir -- "$RELEASE_TMP_DIR" || return 1',
717 'rm -rf -- "$RELEASE_TMP_DIR" || return 1',
718 ),
719 (" release_tmp_is_safe || return 1\n rm -rf", " true\n rm -rf"),
720 (
721 " release_tmp_allocation_checkpoint precreate\n"
722 ' (umask 077 && mkdir -m 0700 -- "$RELEASE_TMP_DIR") || return 1\n'
723 " release_tmp_allocation_checkpoint created",
724 ' mkdir -m 0700 -- "$RELEASE_TMP_DIR"',
725 ),
726 (
727 ' TMPDIR="/definitely-not-a-release-temp-parent"',
728 ' TMPDIR="$RELEASE_TMP_ROOT"',
729 ),
730 (
731 " release_tmp_signal_case precreate || return 1\n"
732 " release_tmp_signal_case created || return 1",
733 " true",
734 ),
735 (
736 " release_tmp_wrong_owner_refusal || return 1",
737 " true",
738 ),
739 (
740 " release_tmp_replacement_refusal directory || return 1\n"
741 " release_tmp_replacement_refusal symlink || return 1",
742 " true",
743 ),
744 (
745 '[[ -L "$original" && "$(readlink -- "$original")" == "$saved" ]] && preserved=1',
746 "preserved=1",
747 ),
748 (" release_tmp_contract_selftest || return 1", " true"),
749 )
750
751
752def _python_selftest_mutations() -> tuple[tuple[str, str], ...]:
753 """Return safe-allocation and residue-proof mutations."""
754 return (
755 (
756 " python_selftest_suite_candidate suite || return 1\n"
757 ' trap \'python_selftest_pending_cleanup "${suite}" '
758 '"${suite_identity}"\' EXIT\n'
759 ' (umask 077 && mkdir -m 0700 -- "$suite") || return 1',
760 ' suite="$(mktemp -d)"',
761 ),
762 (
763 "python_selftest_tmp_identity() {\n stat -Lc '%d:%i' -- \"$1\"",
764 "python_selftest_tmp_identity() {\n printf '0:0\\n'",
765 ),
766 (
767 " python_selftest_allocation_signal_case precreate || return 1\n"
768 " python_selftest_allocation_signal_case created || return 1",
769 " true",
770 ),
771 (
772 'python_selftest_suite_is_safe "$target" "$identity" || return 1',
773 "true",
774 ),
775 (
776 'python_selftest_replacement_refusal "$suite" "$suite_identity" "$tmp" "$identity"',
777 ": # replacement refusal removed",
778 ),
779 (
780 ' mv -- "$target" "$saved"\n mkdir -m 0700 -- "$target"',
781 ' rmdir -- "$target"\n mkdir -m 0700 -- "$target"',
782 ),
783 (
784 'python_selftest_tmp_cleanup "$suite" "$suite_identity" "$tmp" "$identity" || return 1',
785 'rm -rf -- "$tmp"',
786 ),
787 )