Documentation
¶
Overview ¶
Package accountcheck owns short-lived, private native checks in a dedicated re-exec process. The daemon never becomes a subreaper. A crash without the exact durable stopped proof leaves custody unknown and never grants capacity.
Index ¶
- Constants
- Variables
- func AvailabilityArguments(model string) ([]string, error)
- func CustodyStopped(stateRoot string, worker processcontain.Identity, binding accounts.Binding) bool
- func Run(ctx context.Context, executable string, cfg Config, admit func(Ref) error) ([]byte, error)
- func RunWorker(ctx context.Context, path string, input io.Reader, output io.Writer) (err error)
- func ValidateCollectionDirectory(root *os.Root, intent CollectionIntent) error
- func ValidateCollectionIntent(intent CollectionIntent) error
- func ValidateCollectionInventory(parent *os.Root) (bool, error)
- func WithConfigurationFence(stateRoot string, binding accounts.Binding, install func() error) error
- func WithCredentialFence(stateRoot string, binding accounts.Binding, install func() error) error
- func WritersStoppedForBinding(stateRoot string, binding accounts.Binding) bool
- type CollectionIntent
- type Collector
- type Config
- type CustodyReference
- type Ref
- type Stopped
Constants ¶
const CollectionDirectory = "check-gc"
const CollectionSchemaVersion = 1
const ModeAuthStatus = "auth-status"
const ModeAvailability = "availability"
const SchemaVersion = 2
const StoppedFile = "stopped.json"
const WorkerFile = "worker.json"
Variables ¶
var ErrCustodyUnknown = errors.New("account check writer custody is unknown")
Functions ¶
func AvailabilityArguments ¶
func CustodyStopped ¶
func CustodyStopped(stateRoot string, worker processcontain.Identity, binding accounts.Binding) bool
CustodyStopped checks the exact owner incarnation from a persisted permit. A missing or foreign proof never becomes true through PID/PGID disappearance.
func Run ¶
Run starts a blocked owned worker, durably records its creation identity, and lets admit persist/revalidate authority before any native exec is allowed.
func RunWorker ¶
RunWorker is called only by the dedicated internal account-check re-exec. Admission arrives via stdin after the daemon persisted exact worker custody.
func ValidateCollectionDirectory ¶
func ValidateCollectionDirectory(root *os.Root, intent CollectionIntent) error
ValidateCollectionDirectory checks surviving inventory against the external intent. Missing listed entries are expected during a partial deletion.
func ValidateCollectionIntent ¶
func ValidateCollectionIntent(intent CollectionIntent) error
ValidateCollectionIntent also serves the independent downgrade inventory guard. Inactive garbage uses the existing Worker2 capability, without a new execution or proof schema.
func ValidateCollectionInventory ¶
ValidateCollectionInventory independently guards GC-only state during native admission, history transfer, activation and rollback. The parent is an already-validated private accounts directory. A true result means it contains collection state requiring the existing Worker2 reader capability.
func WithConfigurationFence ¶ added in v0.16.0
Configuration reuse is independent from the native credential worker lock. Global cohort replacement takes config -> credential locks in that order.
func WithCredentialFence ¶ added in v0.16.0
WithCredentialFence shares the native worker's generation lock. The lock excludes live auth/status, refresh and availability workers through install; a retained check directory without a stopped proof never blocks a launch.
func WritersStoppedForBinding ¶
WritersStoppedForBinding refuses transfer while any retained check for this credential generation lacks an exact stopped-writer proof. A genuinely absent check inventory is safe; malformed or unsafe custody fails closed.
Types ¶
type CollectionIntent ¶
type CollectionIntent struct {
SchemaVersion int `json:"schema_version"`
Ref Ref `json:"ref"`
Stopped Stopped `json:"stopped"`
Files []collectionFile `json:"files"`
}
CollectionIntent is deletion authority only. It never grants native admission or stopped-writer proof. It survives outside a partially deleted directory.
type Collector ¶
type Collector struct {
// contains filtered or unexported fields
}
Collector runs bounded work on the existing recovery owner, without a timer or goroutine. Its directory cursors make progress even beyond admission's inventory limit; reaching EOF starts a fresh pass on the next Step.
func NewCollector ¶
func (*Collector) Step ¶
func (c *Collector) Step(retained []CustodyReference) (int, error)
Step preserves live, referenced, malformed and incomplete custody. The same nonblocking credential flock used by Run prevents collecting an admission while its worker is waiting on this owner. Lock inodes are never removed.
type CustodyReference ¶
type CustodyReference struct {
Binding accounts.Binding
Worker processcontain.Identity
}
CustodyReference is supplied by the serialized recovery owner from both its memory and the checked durable journal. A zero Worker retains the whole credential generation, including checks not yet admitted to a permit.
Source Files