Own the patched runsc artifact and bind recovery identity

tools/install-to-host

@@ -18,7 +18,7 @@ elif [ "$#" -ne 0 ]; then
     exit 2
 fi
 
-for command in cargo install readelf; do
+for command in cargo cmp install readelf; do
     command -v "$command" >/dev/null 2>&1 || {
         printf '%s\n' "install-to-host: $command is required" >&2
         exit 1
@@ -27,6 +27,7 @@ done
 
 cd "$root"
 tools/materialize-fuser
+tools/materialize-runsc --build
 cargo build \
     --release \
     --locked \
@@ -58,4 +59,17 @@ if readelf -l "$sandbox_init" | grep -q 'Requesting program interpreter' ||
 fi
 install -m 755 "$sandbox_init" "$install_dir/lazaret-sandbox-init"
 
+runsc_build_id=904ab3c9bd4c99a27181076f2c9ea2fecc041db5a728c999540d6664174d2cd4
+runsc_name="lazaret-runsc-$runsc_build_id"
+runsc_source="$root/.lazaret/bin/$runsc_name"
+runsc_destination="$install_dir/$runsc_name"
+if [[ -e "$runsc_destination" ]]; then
+    cmp --silent "$runsc_source" "$runsc_destination" || {
+        printf '%s\n' "install-to-host: immutable runsc destination differs: $runsc_destination" >&2
+        exit 1
+    }
+else
+    install -m 755 "$runsc_source" "$runsc_destination"
+fi
+
 printf '%s\n' "Installed Lazaret in $install_dir"

tools/materialize-runsc

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "$0")/.." && pwd)"
+revision=9f8f6c917885d9ef3d84c17280939c012dea0dfe
+archive_checksum=9d96426115f1bf54ef09ba41964c73dc3c809743519c8442016b8dd3fce0889d
+patch_file="$root/patches/gvisor-9f8f6c917-directory-handles.patch"
+patch_checksum=541420eece9ec7efbef156bdb726744ead6b4d991d41c5560f4fdfe83fb2357a
+bazel_version=8.3.1
+module_lock="$root/patches/gvisor-9f8f6c917-MODULE.bazel.lock"
+module_checksum=8402c7beb4baf2c666f4b78e400ea3f15514b56117598c2cb5411d6a35208d34
+build_id=904ab3c9bd4c99a27181076f2c9ea2fecc041db5a728c999540d6664174d2cd4
+archive="$root/.lazaret/cache/gvisor-$revision.tar.gz"
+source="$root/.lazaret/vendor/gvisor-$build_id"
+binary="$root/.lazaret/bin/lazaret-runsc-$build_id"
+mode=source
+
+if [[ "${1:-}" == "--build" && $# -eq 1 ]]; then
+    mode=build
+elif [[ "${1:-}" == "--test" && $# -eq 1 ]]; then
+    mode=test
+elif [[ $# -ne 0 ]]; then
+    printf '%s\n' 'usage: tools/materialize-runsc [--build|--test]' >&2
+    exit 2
+fi
+
+fail() {
+    printf 'materialize-runsc: %s\n' "$*" >&2
+    exit 1
+}
+
+for command in curl make patch sha256sum tar; do
+    command -v "$command" >/dev/null 2>&1 || fail "$command is required"
+done
+
+[[ -f "$patch_file" ]] || fail "missing patch: $patch_file"
+[[ "$(sha256sum "$patch_file" | cut -d ' ' -f 1)" == "$patch_checksum" ]] ||
+    fail 'patch checksum mismatch'
+[[ -f "$module_lock" ]] || fail "missing module lock: $module_lock"
+[[ "$(sha256sum "$module_lock" | cut -d ' ' -f 1)" == "$module_checksum" ]] ||
+    fail 'module lock checksum mismatch'
+
+stamp="$revision $archive_checksum $patch_checksum $bazel_version $module_checksum $build_id"
+if [[ ! -f "$source/.lazaret-materialization" ]]; then
+    mkdir -p "$root/.lazaret/cache" "$root/.lazaret/vendor"
+    if [[ ! -f "$archive" ]]; then
+        partial="$archive.partial.$$"
+        trap 'rm -f "$partial"' EXIT
+        curl --fail --location --output "$partial" \
+            "https://codeload.github.com/google/gvisor/tar.gz/$revision"
+        [[ "$(sha256sum "$partial" | cut -d ' ' -f 1)" == "$archive_checksum" ]] ||
+            fail 'downloaded archive checksum mismatch'
+        mv "$partial" "$archive"
+        trap - EXIT
+    fi
+    [[ "$(sha256sum "$archive" | cut -d ' ' -f 1)" == "$archive_checksum" ]] ||
+        fail 'cached archive checksum mismatch'
+    temporary="$(mktemp -d "$root/.lazaret/vendor/.gvisor-$build_id.XXXXXX")"
+    trap 'rm -rf "$temporary"' EXIT
+    tar -xzf "$archive" -C "$temporary"
+    extracted="$temporary/gvisor-$revision"
+    [[ -d "$extracted" ]] || fail 'archive has an unexpected root directory'
+    patch --directory="$extracted" --strip=1 --batch --forward <"$patch_file"
+    [[ "$(tr -d '\n' <"$extracted/.bazelversion")" == "$bazel_version" ]] ||
+        fail 'Bazel version mismatch'
+    install -m 0644 "$module_lock" "$extracted/MODULE.bazel.lock"
+    printf '%s\n' "$stamp" >"$extracted/.lazaret-materialization"
+    [[ ! -e "$source" ]] || fail 'immutable source destination already exists without a valid stamp'
+    mv "$extracted" "$source"
+    trap - EXIT
+elif [[ "$(tr -d '\n' <"$source/.lazaret-materialization")" != "$stamp" ]]; then
+    fail 'materialized source identity mismatch'
+fi
+
+if [[ "$mode" == test ]]; then
+    make -C "$source" test TARGETS=//pkg/sentry/fsimpl/gofer:gofer_test
+fi
+if [[ "$mode" != source ]]; then
+    make -C "$source" build TARGETS=//runsc:runsc
+    built="$source/bazel-bin/runsc/runsc_/runsc"
+    [[ -x "$built" ]] || fail 'canonical build did not produce runsc'
+    version_output="$($built --version 2>&1)"
+    [[ "$version_output" == $'runsc version 0.0.0\nspec: 1.2.1' ]] ||
+        fail 'built runsc reports an unexpected version'
+    mkdir -p "$root/.lazaret/bin"
+    if [[ ! -e "$binary" ]]; then
+        temporary_binary="$root/.lazaret/bin/.lazaret-runsc-$build_id.$$"
+        trap 'rm -f "$temporary_binary"' EXIT
+        install -m 0755 "$built" "$temporary_binary"
+        mv "$temporary_binary" "$binary"
+        trap - EXIT
+    fi
+    [[ -x "$binary" ]] || fail 'materialized runsc is not executable'
+    sha256sum "$binary" >"$binary.sha256"
+    printf '%s\n' "$binary"
+fi

tools/verify

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 set -euo pipefail
 "$(dirname "$0")/materialize-fuser" --test-dependencies
+"$(dirname "$0")/materialize-runsc"
 exec uv run --python '>=3.11' --no-project --offline --no-python-downloads --no-cache python3 "$(dirname "$0")/lazaret_verify.py" "$@"