fix: release Dever 0.1.6 with shared runtime assets and unbounded workers

test/dever-cli-tests/shared_toolchain_extensions.rs

@@ -144,6 +144,116 @@ fn signed_extension_preparation_is_shared_immutable_and_concurrent() {
     assert_eq!(source.requests.load(Ordering::Relaxed), 1);
 }
 
+#[test]
+fn signed_resources_cross_machine_roots_without_sharing_the_cache() {
+    let (root, layout, manager, key) = machine();
+    release(&layout, &key, "1.0.0");
+    let version = manager.install_requested("1.0.0").unwrap();
+    let mut daemon = TestDaemon::start(&layout);
+    let client = Layout::new(root.path().join("client"));
+    client.initialize().unwrap();
+    fs::copy(
+        layout.state().join("trusted-release-key"),
+        client.state().join("trusted-release-key"),
+    )
+    .unwrap();
+    let source = layout.versions().join(version.as_str());
+    let manifest: ReleaseManifest =
+        serde_json::from_slice(&fs::read(source.join("manifest.json")).unwrap()).unwrap();
+    for path in manifest
+        .artifacts
+        .iter()
+        .map(|artifact| artifact.path.as_str())
+        .chain(["manifest.json", "manifest.sig"])
+    {
+        let destination = client.downloads().join(version.as_str()).join(path);
+        fs::create_dir_all(destination.parent().unwrap()).unwrap();
+        fs::copy(source.join(path), destination).unwrap();
+    }
+    MachineManager::new(client.clone())
+        .install_requested(version.as_str())
+        .unwrap();
+    fs::hard_link(layout.service_socket(), client.service_socket()).unwrap();
+    fs::copy(layout.service_token(), client.service_token()).unwrap();
+    let resources = SignedResources::load(&client, &version).unwrap();
+    let extension = id(Ecosystem::Pip);
+    let logical = logical_path(&extension);
+    assert!(
+        resources
+            .read_shared(&logical)
+            .unwrap_err()
+            .contains("not installed")
+    );
+    assert!(!layout.extensions().exists());
+    let source = Source::new(false);
+    prepare_extension_with(&layout, &version, &extension, &source).unwrap();
+    assert_eq!(resources.read_shared(&logical).unwrap(), b"1.0.0");
+    assert_eq!(resources.read_shared(&logical).unwrap(), b"1.0.0");
+    assert_eq!(source.requests.load(Ordering::Relaxed), 1);
+    assert!(!client.extensions().exists());
+    assert!(
+        resources
+            .read(&logical)
+            .unwrap_err()
+            .contains("not installed")
+    );
+    assert!(
+        resources
+            .read_shared(&logical_path(&id(Ecosystem::Npm)))
+            .unwrap_err()
+            .contains("not installed")
+    );
+    assert!(
+        resources
+            .read_shared("../../state/service-token")
+            .unwrap_err()
+            .contains("does not declare")
+    );
+    let path = SignedResources::load(&layout, &version)
+        .unwrap()
+        .path(&logical)
+        .unwrap();
+    fs::write(&path, b"other").unwrap();
+    assert!(
+        resources
+            .read_shared(&logical)
+            .unwrap_err()
+            .contains("integrity")
+    );
+    daemon.stop();
+    assert!(resources.read_shared(&logical).is_err());
+}
+
+#[test]
+fn signed_resource_ipc_rejects_unbound_receipts_catalogs_and_paths() {
+    let (_root, layout, manager, key) = machine();
+    release(&layout, &key, "1.0.0");
+    let version = manager.install_requested("1.0.0").unwrap();
+    prepare_extension_with(&layout, &version, &id(Ecosystem::Pip), &Source::new(false)).unwrap();
+    let _daemon = TestDaemon::start(&layout);
+    let token = fs::read_to_string(layout.service_token()).unwrap();
+    let catalog = hex(&Sha256::digest(
+        fs::read(layout.versions().join("1.0.0/manifest.json")).unwrap(),
+    ));
+    let request = serde_json::json!({"version":"1.0.0", "catalog":catalog,
+        "extension":id(Ecosystem::Pip), "artifact":{"sha256":hex(&Sha256::digest(b"1.0.0")), "bytes":5}});
+    for field in ["catalog", "artifact", "extension", "path"] {
+        let mut invalid = request.clone();
+        invalid[field] = match field {
+            "catalog" => serde_json::json!("0".repeat(64)),
+            "artifact" => serde_json::json!({"sha256":"0".repeat(64),"bytes":u64::MAX}),
+            "extension" => serde_json::Value::Null,
+            _ => serde_json::json!("../../state/service-token"),
+        };
+        let result = raw_operation(
+            &layout,
+            token.trim(),
+            serde_json::json!({"resource_get":invalid}),
+        );
+        assert_eq!(result["ok"], false, "{field}: {result}");
+    }
+}
+
 #[test]
 fn update_prepares_only_installed_extensions_and_preserves_active_on_failure() {
     let (_root, layout, manager, key) = machine();