Compose cold-start resources under Runtime Supervisor ownership

crates/lazaret-state-anchor/tests/authority.rs

@@ -2,13 +2,22 @@ use std::collections::BTreeMap;
 use std::ffi::OsString;
 use std::fs;
 use std::os::unix::ffi::OsStringExt;
+use std::os::unix::fs::MetadataExt;
 use std::path::PathBuf;
 use std::sync::atomic::{AtomicU64, Ordering};
 
 use lazaret_core::configuration::{
     ConfigurationLoadRequest, SandboxLayoutV1, load_trusted_configuration,
 };
-use lazaret_state_anchor::{ProtectedRuntimeFiles, StateAnchorLayout};
+use lazaret_core::identity::{
+    DeviceId, HostPath, IdMapDigest, InodeId, PolicyId, PreparedArtifactId, SelectedManifestDigest,
+    SourceIdentity,
+};
+use lazaret_core::records::{ArtifactState, PreparedArtifact};
+use lazaret_state_anchor::{
+    ProtectedRuntimeFiles, RuntimeStateAnchorAuthority, StateAnchorLaunchAuthority,
+    StateAnchorLayout,
+};
 
 static SEQUENCE: AtomicU64 = AtomicU64::new(0);
 
@@ -48,6 +57,45 @@ fn replaced_runtime_root_is_refused_before_runtime_file_write() {
     assert!(!replacement_files.join("hosts").exists());
 }
 
+#[test]
+fn inherited_runtime_authority_accepts_only_the_exact_prepared_lower() {
+    let tree = TestTree::new();
+    let configuration = configuration(&tree);
+    let layout = StateAnchorLayout::create(&configuration).unwrap();
+    let lower = tree.path.join("prepared-lower");
+    fs::create_dir(&lower).unwrap();
+    let metadata = lower.metadata().unwrap();
+    let artifact = PreparedArtifact {
+        prepared_artifact_id: PreparedArtifactId::new([8; 32]),
+        source_identity: SourceIdentity::new(b"fixture".to_vec()),
+        selected_manifest_digest: SelectedManifestDigest::new([9; 32]),
+        policy_id: PolicyId::new([10; 32]),
+        id_map_digest: IdMapDigest::new([11; 32]),
+        path: HostPath::new(lower.as_os_str().as_encoded_bytes().to_vec()),
+        device: DeviceId::new(metadata.dev()),
+        inode: InodeId::new(metadata.ino()),
+        state: ArtifactState::Available,
+    };
+    let launch = StateAnchorLaunchAuthority::capture(&layout, &artifact).unwrap();
+    let expected = launch.expected_lower();
+    RuntimeStateAnchorAuthority::from_inherited(
+        launch.lower_fd(),
+        launch.persistent_anchor_fd(),
+        launch.runtime_anchor_fd(),
+        expected,
+    )
+    .unwrap();
+    assert!(
+        RuntimeStateAnchorAuthority::from_inherited(
+            launch.lower_fd(),
+            launch.persistent_anchor_fd(),
+            launch.runtime_anchor_fd(),
+            (expected.0, expected.1 + 1),
+        )
+        .is_err()
+    );
+}
+
 struct TestTree {
     path: PathBuf,
 }