Bootstrap verified Rust implementation workspace
This commit is contained in:
parent
08ce2aca24
commit
b438dd5201
32 changed files with 1646 additions and 0 deletions
5
.gitignore
vendored
5
.gitignore
vendored
|
|
@ -7,9 +7,14 @@ storage/
|
|||
|
||||
# Rust & Cargo
|
||||
/target/
|
||||
docs/protocol/states/
|
||||
**/*.rs.bk
|
||||
cargo-uninstall.log
|
||||
|
||||
# Python verification tooling
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
|
||||
# Containers & Podman/Docker build
|
||||
.container-cache/
|
||||
*.tar
|
||||
|
|
|
|||
42
Cargo.lock
generated
Normal file
42
Cargo.lock
generated
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
# This file is automatically @generated by Cargo.
|
||||
# It is not intended for manual editing.
|
||||
version = 4
|
||||
|
||||
[[package]]
|
||||
name = "lazaret-client"
|
||||
version = "0.0.0"
|
||||
dependencies = [
|
||||
"lazaret-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "lazaret-core"
|
||||
version = "0.0.0"
|
||||
|
||||
[[package]]
|
||||
name = "lazaret-escalation-client"
|
||||
version = "0.0.0"
|
||||
dependencies = [
|
||||
"lazaret-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "lazaret-host-coordinator"
|
||||
version = "0.0.0"
|
||||
dependencies = [
|
||||
"lazaret-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "lazaret-network-sidecar"
|
||||
version = "0.0.0"
|
||||
dependencies = [
|
||||
"lazaret-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "lazaret-runtime-supervisor"
|
||||
version = "0.0.0"
|
||||
dependencies = [
|
||||
"lazaret-core",
|
||||
]
|
||||
30
Cargo.toml
Normal file
30
Cargo.toml
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
[workspace]
|
||||
members = [
|
||||
"crates/lazaret-client",
|
||||
"crates/lazaret-core",
|
||||
"crates/lazaret-escalation-client",
|
||||
"crates/lazaret-host-coordinator",
|
||||
"crates/lazaret-network-sidecar",
|
||||
"crates/lazaret-runtime-supervisor",
|
||||
]
|
||||
resolver = "3"
|
||||
|
||||
[workspace.package]
|
||||
version = "0.0.0"
|
||||
edition = "2024"
|
||||
rust-version = "1.90"
|
||||
license = "Apache-2.0"
|
||||
|
||||
[workspace.lints.rust]
|
||||
unsafe_code = "forbid"
|
||||
unused = { level = "deny", priority = -1 }
|
||||
|
||||
[workspace.lints.clippy]
|
||||
all = { level = "deny", priority = -1 }
|
||||
pedantic = { level = "deny", priority = -1 }
|
||||
|
||||
[profile.release]
|
||||
codegen-units = 1
|
||||
lto = "thin"
|
||||
panic = "abort"
|
||||
strip = "symbols"
|
||||
16
crates/lazaret-client/Cargo.toml
Normal file
16
crates/lazaret-client/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
[package]
|
||||
name = "lazaret-client"
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
rust-version.workspace = true
|
||||
license.workspace = true
|
||||
|
||||
[[bin]]
|
||||
name = "lazaret"
|
||||
path = "src/main.rs"
|
||||
|
||||
[dependencies]
|
||||
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
3
crates/lazaret-client/src/main.rs
Normal file
3
crates/lazaret-client/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
fn main() {
|
||||
let _ = lazaret_core::PROTOCOL_NAME;
|
||||
}
|
||||
9
crates/lazaret-core/Cargo.toml
Normal file
9
crates/lazaret-core/Cargo.toml
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
[package]
|
||||
name = "lazaret-core"
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
rust-version.workspace = true
|
||||
license.workspace = true
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
13
crates/lazaret-core/src/lib.rs
Normal file
13
crates/lazaret-core/src/lib.rs
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
#![doc = "Shared production interfaces for Lazaret processes."]
|
||||
|
||||
pub const PROTOCOL_NAME: &str = "lazaret";
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::PROTOCOL_NAME;
|
||||
|
||||
#[test]
|
||||
fn protocol_name_is_stable() {
|
||||
assert_eq!(PROTOCOL_NAME, "lazaret");
|
||||
}
|
||||
}
|
||||
16
crates/lazaret-escalation-client/Cargo.toml
Normal file
16
crates/lazaret-escalation-client/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
[package]
|
||||
name = "lazaret-escalation-client"
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
rust-version.workspace = true
|
||||
license.workspace = true
|
||||
|
||||
[[bin]]
|
||||
name = "lazaret-escalation-client"
|
||||
path = "src/main.rs"
|
||||
|
||||
[dependencies]
|
||||
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
3
crates/lazaret-escalation-client/src/main.rs
Normal file
3
crates/lazaret-escalation-client/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
fn main() {
|
||||
let _ = lazaret_core::PROTOCOL_NAME;
|
||||
}
|
||||
16
crates/lazaret-host-coordinator/Cargo.toml
Normal file
16
crates/lazaret-host-coordinator/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
[package]
|
||||
name = "lazaret-host-coordinator"
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
rust-version.workspace = true
|
||||
license.workspace = true
|
||||
|
||||
[[bin]]
|
||||
name = "lazaret-host-coordinator"
|
||||
path = "src/main.rs"
|
||||
|
||||
[dependencies]
|
||||
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
3
crates/lazaret-host-coordinator/src/main.rs
Normal file
3
crates/lazaret-host-coordinator/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
fn main() {
|
||||
let _ = lazaret_core::PROTOCOL_NAME;
|
||||
}
|
||||
16
crates/lazaret-network-sidecar/Cargo.toml
Normal file
16
crates/lazaret-network-sidecar/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
[package]
|
||||
name = "lazaret-network-sidecar"
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
rust-version.workspace = true
|
||||
license.workspace = true
|
||||
|
||||
[[bin]]
|
||||
name = "lazaret-network-sidecar"
|
||||
path = "src/main.rs"
|
||||
|
||||
[dependencies]
|
||||
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
3
crates/lazaret-network-sidecar/src/main.rs
Normal file
3
crates/lazaret-network-sidecar/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
fn main() {
|
||||
let _ = lazaret_core::PROTOCOL_NAME;
|
||||
}
|
||||
16
crates/lazaret-runtime-supervisor/Cargo.toml
Normal file
16
crates/lazaret-runtime-supervisor/Cargo.toml
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
[package]
|
||||
name = "lazaret-runtime-supervisor"
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
rust-version.workspace = true
|
||||
license.workspace = true
|
||||
|
||||
[[bin]]
|
||||
name = "lazaret-runtime-supervisor"
|
||||
path = "src/main.rs"
|
||||
|
||||
[dependencies]
|
||||
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
3
crates/lazaret-runtime-supervisor/src/main.rs
Normal file
3
crates/lazaret-runtime-supervisor/src/main.rs
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
fn main() {
|
||||
let _ = lazaret_core::PROTOCOL_NAME;
|
||||
}
|
||||
24
deny.toml
Normal file
24
deny.toml
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
[advisories]
|
||||
yanked = "deny"
|
||||
|
||||
[bans]
|
||||
multiple-versions = "deny"
|
||||
wildcards = "deny"
|
||||
|
||||
[licenses]
|
||||
allow = [
|
||||
"Apache-2.0",
|
||||
"BSD-2-Clause",
|
||||
"BSD-3-Clause",
|
||||
"ISC",
|
||||
"MIT",
|
||||
"Unicode-3.0",
|
||||
"Zlib",
|
||||
]
|
||||
confidence-threshold = 0.93
|
||||
unused-allowed-license = "allow"
|
||||
|
||||
[sources]
|
||||
unknown-git = "deny"
|
||||
unknown-registry = "deny"
|
||||
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
||||
11
docs/development.md
Normal file
11
docs/development.md
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
# Development and verification
|
||||
|
||||
The Cargo workspace separates shared production logic from process entry points. `lazaret-core` is the initial library boundary. The `lazaret` Client, `lazaret-host-coordinator`, `lazaret-runtime-supervisor`, `lazaret-network-sidecar`, and `lazaret-escalation-client` executables are thin binary packages; process behavior belongs in libraries so it can be verified without invoking private binary internals.
|
||||
|
||||
`support/work-packages.toml` is the dependency authority. `support/model-refinements.toml` assigns every modeled action and configured property to production packages and verification levels. `support/external-tools.toml` fixes the baseline host and tool contracts, including whether an unavailable capability fails or skips a level. `docs/implementation-dependencies.md` is generated from the package registry.
|
||||
|
||||
Run `tools/verify-v1`, `tools/verify-v2`, `tools/verify-v3`, `tools/verify-v4`, or `tools/verify-v5`. Each higher level includes the lower levels. V1 is host-local and includes format, Clippy, tests, dependency policy, registry drift, and both TLC models. Physical suites register commands in `support/integration-tests.toml`; an empty level is an explicit skip. A registered scenario may skip only when every missing capability has `policy = "skip"` in the external-tool manifest.
|
||||
|
||||
Normal verification is offline: Cargo receives `--offline` and cargo-deny receives `--frozen`. `tools/dev refresh-advisories` is the explicit online operation that updates the local RustSec database and then verifies advisories offline. The zero-third-party baseline still runs cargo-deny bans, license, and source checks on every verification.
|
||||
|
||||
Run `tools/dev generate` after changing the work-package registry. `tools/dev generate --check` fails when the committed dependency view differs.
|
||||
159
docs/implementation-dependencies.md
Normal file
159
docs/implementation-dependencies.md
Normal file
|
|
@ -0,0 +1,159 @@
|
|||
# Implementation dependencies
|
||||
|
||||
Generated from `support/work-packages.toml`; do not edit this file directly.
|
||||
|
||||
| Package | Deliverable | Depends on | Verification |
|
||||
| --- | --- | --- | --- |
|
||||
| `IP-00` | Repository scaffold and verification | — | V1, V2, V3, V4, V5 |
|
||||
| `IP-01` | Typed schema and protocol records | `IP-00` | V1 |
|
||||
| `IP-02` | Trusted-host configuration | `IP-00`, `IP-01` | V1, V2 |
|
||||
| `IP-03` | Linux primitives | `IP-00`, `IP-01` | V1, V2 |
|
||||
| `IP-04` | Ignored-workspace contract | `IP-00` | V1, V2, V5 |
|
||||
| `IP-10` | Domain Store | `IP-01`, `IP-02`, `IP-03` | V1, V2, V4 |
|
||||
| `IP-11` | Storage Catalog | `IP-01`, `IP-02`, `IP-03` | V1, V2, V4 |
|
||||
| `IP-12` | OCI transport and layer preparer | `IP-02`, `IP-03`, `IP-11` | V1, V2, V4 |
|
||||
| `IP-13` | State Anchor | `IP-02`, `IP-03`, `IP-10`, `IP-11`, `IP-12` | V1, V2, V4 |
|
||||
| `IP-14` | Derived network policy | `IP-01`, `IP-02` | V1 |
|
||||
| `IP-15` | Protocol cryptography and codecs | `IP-01`, `IP-02`, `IP-03` | V1, V2 |
|
||||
| `IP-16` | OCI specification and runsc command builder | `IP-01`, `IP-02`, `IP-03` | V1 |
|
||||
| `IP-20` | Ignored-workspace router and Git Sentry | `IP-02`, `IP-03`, `IP-04`, `IP-10` | V1, V2, V4, V5 |
|
||||
| `IP-21` | Runtime Supervisor and runsc ownership | `IP-03`, `IP-13`, `IP-16` | V2, V3, V4 |
|
||||
| `IP-22` | Network installation and connectivity helper | `IP-03`, `IP-10`, `IP-14`, `IP-21` | V2, V3, V4 |
|
||||
| `IP-23` | Host-private control face | `IP-02`, `IP-10`, `IP-15` | V1, V2 |
|
||||
| `IP-24` | Escalation mailbox and execution | `IP-03`, `IP-10`, `IP-15`, `IP-23` | V1, V2, V3, V4 |
|
||||
| `IP-30` | Core Host Coordinator lifecycle | `IP-10`, `IP-11`, `IP-12`, `IP-13`, `IP-14`, `IP-15`, `IP-16`, `IP-21`, `IP-22`, `IP-23` | V1, V2, V3 |
|
||||
| `IP-31` | Non-interactive Client CLI | `IP-02`, `IP-16`, `IP-23`, `IP-30` | V1, V3 |
|
||||
| `IP-40` | Minimal non-interactive runtime slice | `IP-30`, `IP-31` | V3 |
|
||||
| `IP-32` | Recovery and prepared-artifact GC | `IP-30`, `IP-40` | V1, V2, V4 |
|
||||
| `IP-33` | Session Terminal engine | `IP-10`, `IP-21`, `IP-23`, `IP-30`, `IP-40` | V1, V2, V4 |
|
||||
| `IP-34` | Interactive Client CLI | `IP-31`, `IP-33` | V1, V3 |
|
||||
| `IP-35` | State inspection and reset | `IP-10`, `IP-13`, `IP-20`, `IP-32` | V1, V2, V4 |
|
||||
| `IP-41` | Workspace, Git, and persistence slice | `IP-20`, `IP-32`, `IP-40` | V3, V5 |
|
||||
| `IP-42` | Interactive and multi-session slice | `IP-33`, `IP-34`, `IP-40` | V3 |
|
||||
| `IP-43` | Host-escalation slice | `IP-24`, `IP-34`, `IP-42` | V3 |
|
||||
| `IP-44` | Durability and hostile-failure gate | `IP-32`, `IP-35`, `IP-40`, `IP-41`, `IP-42`, `IP-43` | V4 |
|
||||
| `IP-45` | Release qualification | `IP-44` | V5 |
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
IP_00["IP-00 Repository scaffold and verification"]
|
||||
IP_01["IP-01 Typed schema and protocol records"]
|
||||
IP_02["IP-02 Trusted-host configuration"]
|
||||
IP_03["IP-03 Linux primitives"]
|
||||
IP_04["IP-04 Ignored-workspace contract"]
|
||||
IP_10["IP-10 Domain Store"]
|
||||
IP_11["IP-11 Storage Catalog"]
|
||||
IP_12["IP-12 OCI transport and layer preparer"]
|
||||
IP_13["IP-13 State Anchor"]
|
||||
IP_14["IP-14 Derived network policy"]
|
||||
IP_15["IP-15 Protocol cryptography and codecs"]
|
||||
IP_16["IP-16 OCI specification and runsc command builder"]
|
||||
IP_20["IP-20 Ignored-workspace router and Git Sentry"]
|
||||
IP_21["IP-21 Runtime Supervisor and runsc ownership"]
|
||||
IP_22["IP-22 Network installation and connectivity helper"]
|
||||
IP_23["IP-23 Host-private control face"]
|
||||
IP_24["IP-24 Escalation mailbox and execution"]
|
||||
IP_30["IP-30 Core Host Coordinator lifecycle"]
|
||||
IP_31["IP-31 Non-interactive Client CLI"]
|
||||
IP_40["IP-40 Minimal non-interactive runtime slice"]
|
||||
IP_32["IP-32 Recovery and prepared-artifact GC"]
|
||||
IP_33["IP-33 Session Terminal engine"]
|
||||
IP_34["IP-34 Interactive Client CLI"]
|
||||
IP_35["IP-35 State inspection and reset"]
|
||||
IP_41["IP-41 Workspace, Git, and persistence slice"]
|
||||
IP_42["IP-42 Interactive and multi-session slice"]
|
||||
IP_43["IP-43 Host-escalation slice"]
|
||||
IP_44["IP-44 Durability and hostile-failure gate"]
|
||||
IP_45["IP-45 Release qualification"]
|
||||
IP_00 --> IP_01
|
||||
IP_00 --> IP_02
|
||||
IP_01 --> IP_02
|
||||
IP_00 --> IP_03
|
||||
IP_01 --> IP_03
|
||||
IP_00 --> IP_04
|
||||
IP_01 --> IP_10
|
||||
IP_02 --> IP_10
|
||||
IP_03 --> IP_10
|
||||
IP_01 --> IP_11
|
||||
IP_02 --> IP_11
|
||||
IP_03 --> IP_11
|
||||
IP_02 --> IP_12
|
||||
IP_03 --> IP_12
|
||||
IP_11 --> IP_12
|
||||
IP_02 --> IP_13
|
||||
IP_03 --> IP_13
|
||||
IP_10 --> IP_13
|
||||
IP_11 --> IP_13
|
||||
IP_12 --> IP_13
|
||||
IP_01 --> IP_14
|
||||
IP_02 --> IP_14
|
||||
IP_01 --> IP_15
|
||||
IP_02 --> IP_15
|
||||
IP_03 --> IP_15
|
||||
IP_01 --> IP_16
|
||||
IP_02 --> IP_16
|
||||
IP_03 --> IP_16
|
||||
IP_02 --> IP_20
|
||||
IP_03 --> IP_20
|
||||
IP_04 --> IP_20
|
||||
IP_10 --> IP_20
|
||||
IP_03 --> IP_21
|
||||
IP_13 --> IP_21
|
||||
IP_16 --> IP_21
|
||||
IP_03 --> IP_22
|
||||
IP_10 --> IP_22
|
||||
IP_14 --> IP_22
|
||||
IP_21 --> IP_22
|
||||
IP_02 --> IP_23
|
||||
IP_10 --> IP_23
|
||||
IP_15 --> IP_23
|
||||
IP_03 --> IP_24
|
||||
IP_10 --> IP_24
|
||||
IP_15 --> IP_24
|
||||
IP_23 --> IP_24
|
||||
IP_10 --> IP_30
|
||||
IP_11 --> IP_30
|
||||
IP_12 --> IP_30
|
||||
IP_13 --> IP_30
|
||||
IP_14 --> IP_30
|
||||
IP_15 --> IP_30
|
||||
IP_16 --> IP_30
|
||||
IP_21 --> IP_30
|
||||
IP_22 --> IP_30
|
||||
IP_23 --> IP_30
|
||||
IP_02 --> IP_31
|
||||
IP_16 --> IP_31
|
||||
IP_23 --> IP_31
|
||||
IP_30 --> IP_31
|
||||
IP_30 --> IP_40
|
||||
IP_31 --> IP_40
|
||||
IP_30 --> IP_32
|
||||
IP_40 --> IP_32
|
||||
IP_10 --> IP_33
|
||||
IP_21 --> IP_33
|
||||
IP_23 --> IP_33
|
||||
IP_30 --> IP_33
|
||||
IP_40 --> IP_33
|
||||
IP_31 --> IP_34
|
||||
IP_33 --> IP_34
|
||||
IP_10 --> IP_35
|
||||
IP_13 --> IP_35
|
||||
IP_20 --> IP_35
|
||||
IP_32 --> IP_35
|
||||
IP_20 --> IP_41
|
||||
IP_32 --> IP_41
|
||||
IP_40 --> IP_41
|
||||
IP_33 --> IP_42
|
||||
IP_34 --> IP_42
|
||||
IP_40 --> IP_42
|
||||
IP_24 --> IP_43
|
||||
IP_34 --> IP_43
|
||||
IP_42 --> IP_43
|
||||
IP_32 --> IP_44
|
||||
IP_35 --> IP_44
|
||||
IP_40 --> IP_44
|
||||
IP_41 --> IP_44
|
||||
IP_42 --> IP_44
|
||||
IP_43 --> IP_44
|
||||
IP_44 --> IP_45
|
||||
```
|
||||
4
rust-toolchain.toml
Normal file
4
rust-toolchain.toml
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
[toolchain]
|
||||
channel = "1.90.0"
|
||||
components = ["clippy", "rustfmt"]
|
||||
profile = "minimal"
|
||||
128
support/external-tools.toml
Normal file
128
support/external-tools.toml
Normal file
|
|
@ -0,0 +1,128 @@
|
|||
schema = 1
|
||||
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||
|
||||
[[command]]
|
||||
id = "python"
|
||||
program = "python3"
|
||||
args = ["--version"]
|
||||
version_pattern = '^Python 3\.(1[1-9]|[2-9][0-9])\.'
|
||||
policy = "fail"
|
||||
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Python 3.11 or newer is required for repository verification."
|
||||
|
||||
[[command]]
|
||||
id = "rustc"
|
||||
program = "rustc"
|
||||
args = ["--version"]
|
||||
version_pattern = '^rustc 1\.90\.0 '
|
||||
policy = "fail"
|
||||
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
|
||||
|
||||
[[command]]
|
||||
id = "cargo"
|
||||
program = "cargo"
|
||||
args = ["--version"]
|
||||
version_pattern = '^cargo 1\.90\.0 '
|
||||
policy = "fail"
|
||||
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
|
||||
|
||||
[[command]]
|
||||
id = "cargo-deny"
|
||||
program = "cargo-deny"
|
||||
args = ["--version"]
|
||||
version_pattern = '^cargo-deny 0\.20\.2$'
|
||||
policy = "fail"
|
||||
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Install cargo-deny 0.20.2 with its locked dependency graph."
|
||||
|
||||
[[command]]
|
||||
id = "git"
|
||||
program = "git"
|
||||
args = ["--version"]
|
||||
version_pattern = '^git version 2\.'
|
||||
policy = "fail"
|
||||
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Git 2.x is required for generated-file drift checks."
|
||||
|
||||
[[command]]
|
||||
id = "tlc"
|
||||
program = "tlc"
|
||||
args = ["-h"]
|
||||
version_pattern = 'Version 2\.19 '
|
||||
accepted_exit_codes = [0, 1]
|
||||
policy = "fail"
|
||||
levels = ["V1", "V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Install the TLC 2.19 launcher on PATH."
|
||||
|
||||
[[command]]
|
||||
id = "runsc"
|
||||
program = "runsc"
|
||||
args = ["--version"]
|
||||
version_pattern = '^runsc version release-20260622\.0\nspec: 1\.2\.1$'
|
||||
policy = "skip"
|
||||
levels = ["V3", "V4", "V5"]
|
||||
diagnostic = "The selected composition is qualified on runsc release-20260622.0."
|
||||
|
||||
[[command]]
|
||||
id = "fuse-overlayfs"
|
||||
program = "fuse-overlayfs"
|
||||
args = ["--version"]
|
||||
version_pattern = '^fusermount3 version: 3\.18\.2\nfuse-overlayfs: version 1\.16\nFUSE library version 3\.18\.2\nusing FUSE kernel interface version 7\.45$'
|
||||
policy = "skip"
|
||||
levels = ["V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Install the qualified fuse-overlayfs 1.16 and FUSE 3.18.2 stack."
|
||||
|
||||
[[command]]
|
||||
id = "slirp4netns"
|
||||
program = "slirp4netns"
|
||||
args = ["--version"]
|
||||
version_pattern = '^slirp4netns version 1\.3\.1\ncommit: .+\nlibslirp: 4\.9\.1\nSLIRP_CONFIG_VERSION_MAX: 6\nlibseccomp: 2\.6\.0$'
|
||||
policy = "skip"
|
||||
levels = ["V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Install the qualified slirp4netns 1.3.1 and libslirp 4.9.1 stack."
|
||||
|
||||
[[feature]]
|
||||
id = "linux-x86_64"
|
||||
probe = "linux-x86_64"
|
||||
policy = "skip"
|
||||
levels = ["V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Physical and composition suites currently support Linux x86_64."
|
||||
|
||||
[[feature]]
|
||||
id = "kernel"
|
||||
probe = "kernel-at-least"
|
||||
minimum = "6.8"
|
||||
policy = "skip"
|
||||
levels = ["V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Linux 6.8 or newer supplies the qualified namespace and pidfd baseline."
|
||||
|
||||
[[feature]]
|
||||
id = "user-namespaces"
|
||||
probe = "user-namespace"
|
||||
program = "unshare"
|
||||
sysctl_path = "/proc/sys/user/max_user_namespaces"
|
||||
policy = "skip"
|
||||
levels = ["V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Enable functional unprivileged user namespace creation for physical runtime tests."
|
||||
|
||||
[[feature]]
|
||||
id = "subordinate-ids"
|
||||
probe = "subordinate-ids"
|
||||
minimum_count = 65536
|
||||
uidmap_program = "newuidmap"
|
||||
gidmap_program = "newgidmap"
|
||||
unshare_program = "unshare"
|
||||
policy = "skip"
|
||||
levels = ["V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Configure usable 65,536-ID subordinate UID/GID ranges and mapping helpers for the current user."
|
||||
|
||||
[[feature]]
|
||||
id = "fuse-device"
|
||||
probe = "open-character-device"
|
||||
path = "/dev/fuse"
|
||||
access = "read-write"
|
||||
policy = "skip"
|
||||
levels = ["V2", "V3", "V4", "V5"]
|
||||
diagnostic = "Expose an openable read-write /dev/fuse device to run physical filesystem suites."
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue