Enum Action 

pub enum Action {
    WriteFile {
        path: PathBuf,
        content: String,
        sudo: bool,
    },
    RemoveFile {
        path: PathBuf,
        sudo: bool,
        still_referenced_by: Option<PathBuf>,
    },
    EnsureBlock {
        path: PathBuf,
        content: String,
        sudo: bool,
        pf_order: bool,
        requires: Option<PathBuf>,
    },
    RemoveBlock {
        path: PathBuf,
        sudo: bool,
    },
    Run {
        argv: Vec<String>,
        sudo: bool,
        skip_if: Option<Probe>,
    },
    RunIfPresent {
        probe: Probe,
        argv: Vec<String>,
        sudo: bool,
    },
    RevokeBindCapability {
        binary: PathBuf,
    },
    GrantBindCapability {
        binary: PathBuf,
    },
    EnablePf {
        pf_conf: PathBuf,
        token: PathBuf,
    },
    ReleasePf {
        pf_conf: PathBuf,
        token: PathBuf,
    },
    GenerateCa {
        cert: PathBuf,
        key: PathBuf,
    },
    TrustCa {
        path: PathBuf,
    },
    UntrustCa {
        path: PathBuf,
        sudo: bool,
    },
    Note,
}

One action in a plan.

Variants

WriteFile

Replace a file pitchfork owns entirely.

Fields

path: PathBuf

content: String

sudo: bool

RemoveFile

Delete a file pitchfork wrote.

The file’s managed header is checked first: --undo must never delete a root-owned file that somebody else put there under a name we happen to use.

Fields

path: PathBuf

sudo: bool

still_referenced_by: Option<PathBuf>

A file that must no longer reference this one before it is removed.

The mirror of EnsureBlock’s requires. apply continues past a failed step, so a RemoveBlock that did not go through would otherwise be followed by the deletion of the file that block names, leaving /etc/pf.conf pointing at a missing anchor — the same broken reference, arrived at from the undo side.

EnsureBlock

Insert or replace a marked block inside a file pitchfork shares.

Fields

path: PathBuf

content: String

sudo: bool

pf_order: bool

Place the block where pf’s rule ordering requires, rather than at the end of the file.

requires: Option<PathBuf>

A file the block’s content refers to, which must exist before the block is written.

apply runs every step, continuing past one that failed, so that a single refusal does not abandon the independent work either side of it. That is wrong for a block that names another file: splicing load anchor ... from "<path>" into /etc/pf.conf after the write of <path> failed leaves a dangling reference in a shared system file, which breaks every later pfctl -f including the one at boot. Naming the prerequisite here turns that into a clean failure of this step instead.

RemoveBlock

Remove pitchfork’s marked block from a shared file.

Fields

path: PathBuf

sudo: bool

Run

Run a command.

Fields

argv: Vec<String>

sudo: bool

skip_if: Option<Probe>

A probe that succeeds when this action has already taken effect. Without one the action is assumed safe to repeat.

RunIfPresent

Run a command only when a probe shows the state is actually ours to revert.

--undo runs against whatever the machine looks like now, which is not necessarily what setup left behind. Reverting a proxy URL somebody else configured, or stripping capabilities pitchfork never granted, would damage unrelated system state.

Fields

probe: Probe

Probe whose success means there is something of ours to revert.

argv: Vec<String>

sudo: bool

RevokeBindCapability

Drop cap_net_bind_service from a binary’s file capabilities.

Its own action because setcap -r clears the whole set: whether that is safe depends on what else is on the file, which has to be read first.

Fields

binary: PathBuf

GrantBindCapability

Add cap_net_bind_service to a binary’s file capabilities.

Its own action for the same reason as the revoke: setcap writes the whole set, so cap_net_bind_service=+ep alone silently drops anything else the file carried. What is already there has to be read first.

Fields

binary: PathBuf

EnablePf

Enable pf with pfctl -Ef, loading pf_conf, and keep the reference token it returns in token.

pf is shared. Apple’s stock pf.conf asks every component to enable it with -E and release it with -X <token>, so that it goes off only once nothing holds it. Without the token undo could only leave pf on for good, or switch it off under whoever else needs it.

Fields

pf_conf: PathBuf

token: PathBuf

ReleasePf

Reload pf_conf and release the reference EnablePf kept in token.

One step with the enable’s resource, so a re-run that still uses pf does not release it only to take it again.

Fields

pf_conf: PathBuf

token: PathBuf

GenerateCa

Generate the local CA pair the supervisor would otherwise create on its first HTTPS start, so it exists to be trusted. Skipped when it does.

Fields

cert: PathBuf

key: PathBuf

TrustCa

Install the CA into the system trust store, in this process.

Fields

path: PathBuf

UntrustCa

Remove the CA from the system trust store.

Skipped when that certificate is not trusted, which is the probe that lets undo queue it unconditionally: an earlier setup may have installed the generated CA even though a custom certificate is configured now.

Fields

path: PathBuf

sudo: bool

Note

Nothing to do; the line exists to explain why.

Trait Implementations

impl Clone for Action

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Action

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Action

impl PartialEq for Action

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Action