ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Own the patched runsc artifact and bind recovery identity

Browse source
This commit is contained in:
ms2k 2026-07-26 18:01:03 +09:00
commit 2c420012bd
1 changed files with 1967 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

40
crates/lazaret-core/tests/schema_records.rs
View file

@ -11,8 +11,9 @@ use lazaret_core::identity::{
HostPidLocator, IdMapDigest, InodeId, MountId, MountIdentity, NamespaceIdentity,
NetworkSidecarId, PidfsDeviceId, PidfsInodeId, PidfsProcessAuthorityV1, PidfsProcessIdentityV1,
PolicyId, PrepareOperationId, PreparedArtifactId, ProcessStartTimeTicks, ProtocolCredentialId,
ReadinessFingerprint, RequestDigest, RequestId, SandboxId, SelectedManifestDigest,
SessionAnchorId, SessionId, SourceIdentity, StreamDigest, TrustManifestDigest,
ReadinessFingerprint, RequestDigest, RequestId, RunscBuildId, RunscDigest, SandboxId,
SelectedManifestDigest, SessionAnchorId, SessionId, SourceIdentity, StreamDigest,
TrustManifestDigest,
};
use lazaret_core::network::readiness_fingerprint as derive_readiness_fingerprint;
use lazaret_core::protocol::{BootstrapWaitOutcome, BootstrapWaitRequest};
@ -27,6 +28,33 @@ struct SchemaCorpus {
digest: Sha256,
}
#[test]
fn sandbox_ownership_decodes_records_without_runsc_identity() {
#[derive(Serialize)]
struct LegacySandboxOwnership {
container_id: Option<ContainerId>,
runtime_root: Option<HostPath>,
runtime_root_identity: Option<MountIdentity>,
bundle_digest: Option<BundleDigest>,
host_coordinator: PersistedHostProcessOwnership,
runtime_supervisor: PersistedHostProcessOwnership,
attached_runsc: PersistedHostProcessOwnership,
}
let encoded = postcard::to_stdvec(&LegacySandboxOwnership {
container_id: None,
runtime_root: None,
runtime_root_identity: None,
bundle_digest: None,
host_coordinator: PersistedHostProcessOwnership::unassigned(),
runtime_supervisor: PersistedHostProcessOwnership::unassigned(),
attached_runsc: PersistedHostProcessOwnership::unassigned(),
})
.unwrap();
let decoded = postcard::from_bytes::<SandboxOwnership>(&encoded).unwrap();
assert!(decoded.attached_runsc.is_unassigned());
}
impl SchemaCorpus {
fn insert(&mut self, name: &'static str, encoded: &[u8]) -> bool {
self.digest.update(name.len().to_be_bytes());
@ -529,7 +557,13 @@ fn complete_ownership(role: ParticipantRole, state: ParticipantState) -> Partici
bundle_digest: Some(BundleDigest::new(opaque(43))),
host_coordinator: owned_process(30),
runtime_supervisor: owned_process(21),
attached_runsc: owned_process(44),
attached_runsc: PersistedHostProcessOwnership::Runsc {
build_id: RunscBuildId::new(opaque(44)),
digest: RunscDigest::new(opaque(45)),
process: RunscProcessOwnership::Committed(HostProcessIdentity::pidfs_v1(process(
44,
))),
},
}),
ParticipantRole::Publication => ParticipantOwnership::Publication(PublicationOwnership {
staged_socket_path: Some(HostPath::new(b"staged-socket".to_vec())),