1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
//! The existing Linux `rch-build` shell ABI has an owned-group supervisor.
//! Configured scopes add cgroup containment without changing the receipt ABI.
//! Other protocol users (cancellation, recovery, GC) only load functions; non-Linux
//! launches retain the caller's legacy path.
//!
//! A scoped child needs the same identity/policy implementation as its parent.
//! The quoted heredoc passes these exact sources as data, without installing a
//! launcher on the worker or resolving a mutable script from a source checkout.
//! Load that single literal copy for the supervisor and pass the same bytes to
//! the child. Duplicating it inline exhausts Linux's per-argument limit after
//! the surrounding execution/ownership/SSH layers quote the launch program.
/// The heredoc lives in a function body, not inside `$(...)`: bash 3.2 (macOS
/// `/bin/sh`) scans a substitution's heredoc for the closing paren and fails on
/// the first `pattern)` arm, which made every script that embeds this protocol
/// a syntax error on macOS workers. Keep this `concat!` to string literals and
/// `include_str!` lines only: `tests/remote_scoped_launch.py` re-assembles it.
/// Only the compile-time literal is evaluated. Policy, environment, arguments
/// and stdin never supply program text to the bootstrap.
pub const REMOTE_PROCESS_IDENTITY_SCRIPT: &str = concat!(
"rch_scope_launch_source() { command cat <<'RCH_SCOPED_LAUNCH_SOURCE_104'\n",
include_str!("remote_process.sh"),
"\n",
include_str!("remote_scoped_launch.sh"),
"\nRCH_SCOPED_LAUNCH_SOURCE_104\n",
"}\n",
"rch_launch_source=$(rch_scope_launch_source) || exit 125\n",
"command eval \"$rch_launch_source\" || exit 125\n",
"\nif [ \"$0\" = rch-build ]; then\n",
" rch_launch_platform=$(uname -s) || { printf '\\n%s_IDENTITY_UNAVAILABLE\\n' \"$3\" >&2; exit 125; }\n",
" if [ \"$rch_launch_platform\" = Linux ]; then\n",
" rch_scope_launch_supervise \"$@\"\n",
" exit $?\n",
" fi\n",
" rch_scope_launch_select || { printf '\\n%s_IDENTITY_UNAVAILABLE\\n' \"$3\" >&2; exit 125; }\n",
" if [ -n \"$rch_launch_slice\" ]; then\n",
" rch_scope_launch_supervise \"$@\"\n",
" exit $?\n",
" fi\n",
"fi\n",
);
#[cfg(test)]
mod tests {
use super::REMOTE_PROCESS_IDENTITY_SCRIPT;
/// Workers run this under their own `sh`: dash on Linux, bash 3.2 on
/// macOS. A parse error here breaks every remote launch, cancellation,
/// recovery and cleanup script on that worker.
#[test]
fn protocol_parses_under_the_system_sh() {
let output = std::process::Command::new("/bin/sh")
.args(["-n", "-c", REMOTE_PROCESS_IDENTITY_SCRIPT])
.output()
.expect("run /bin/sh -n");
assert!(
output.status.success(),
"{}",
String::from_utf8_lossy(&output.stderr)
);
}
#[test]
fn quoted_protocol_fits_linux_single_argument_limit() {
// TransferPipeline shell-quotes this script and adds its legacy tail.
// Keep space for that tail, the payload, and enclosing launch wrappers.
let quoted = shell_escape::escape(REMOTE_PROCESS_IDENTITY_SCRIPT.into());
assert!(quoted.len() < 110_000);
for source in [
include_str!("remote_process.sh"),
include_str!("remote_scoped_launch.sh"),
] {
assert!(
!source
.lines()
.any(|line| line == "RCH_SCOPED_LAUNCH_SOURCE_104")
);
}
}
#[test]
fn nested_transport_quoting_keeps_room_for_the_payload() {
// The tracked command is nested under durable execution, source
// activity and the login shell. A one-quote check misses amplification
// of quotes and backslashes before exec reaches the worker protocol.
let mut script = REMOTE_PROCESS_IDENTITY_SCRIPT.to_owned();
for _ in 0..4 {
script = format!(
"exec /bin/sh -c {} rch-transport",
shell_escape::unix::escape(script.into())
);
}
assert!(
script.len() < 110_000,
"nested script is {} bytes",
script.len()
);
}
}