Bind production cold start to installed Lazaret authorities

crates/lazaret-host-coordinator/src/sandbox_init.rs

@@ -0,0 +1,38 @@
+use std::ffi::{OsStr, OsString};
+
+pub const PRIVATE_SANDBOX_INIT_ROLE: &str = "--lazaret-private-sandbox-init-v1";
+
+#[must_use]
+pub fn is_private_sandbox_init_role(arguments: &[OsString]) -> bool {
+    arguments.len() == 1 && arguments[0] == OsStr::new(PRIVATE_SANDBOX_INIT_ROLE)
+}
+
+#[must_use]
+pub fn dispatch_private_sandbox_init(arguments: &[OsString]) -> bool {
+    if !is_private_sandbox_init_role(arguments) {
+        return false;
+    }
+    loop {
+        std::thread::park();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn private_role_dispatch_is_exact_and_closed() {
+        assert!(is_private_sandbox_init_role(&[OsString::from(
+            PRIVATE_SANDBOX_INIT_ROLE
+        )]));
+        assert!(!is_private_sandbox_init_role(&[]));
+        assert!(!is_private_sandbox_init_role(&[
+            OsString::from(PRIVATE_SANDBOX_INIT_ROLE),
+            OsString::from("extra"),
+        ]));
+        assert!(!is_private_sandbox_init_role(&[OsString::from(
+            "--private-sandbox-init"
+        )]));
+    }
+}