feat: release Dever 0.1.5 with direct workers and long transactions

test/dever-process-tests/execution.rs

@@ -0,0 +1,85 @@
+#[path = "../dever-tests/tests/support/process.rs"]
+mod process;
+#[path = "../dever-tests/tests/support/temp.rs"]
+mod temp;
+
+use std::fs;
+use std::process::Command;
+
+#[test]
+fn runtime_assets_have_no_sandbox_executables() {
+    assert!(dever_process::asset_executable("lib/ld-linux-x86-64.so.2"));
+    assert!(dever_process::asset_executable("lib/ld-linux-aarch64.so.1"));
+    assert!(!dever_process::asset_executable("bin/bwrap"));
+    assert!(!dever_process::asset_executable("bin/guard"));
+    assert!(!dever_process::asset_executable("lib/libc.so.6"));
+}
+
+#[cfg(target_os = "linux")]
+#[test]
+fn direct_child_keeps_the_container_namespace_and_explicit_paths() {
+    let directory = temp::TemporaryDirectory::new();
+    let input = directory.path().join("input");
+    fs::write(&input, "trusted input").unwrap();
+    let mut command = Command::new(std::env::current_exe().unwrap());
+    command.env("DEVER_TEST_AMBIENT", "must not reach the child");
+    dever_process::configure(&mut command);
+    command
+        .args(["--ignored", "--exact", "direct_child_probe"])
+        .env("DEVER_TEST_INPUT", &input)
+        .env(
+            "DEVER_TEST_MOUNT",
+            fs::read_link("/proc/self/ns/mnt").unwrap(),
+        );
+    assert!(
+        process::status(&mut command, std::time::Duration::from_secs(5))
+            .unwrap()
+            .success()
+    );
+    assert_eq!(fs::read(input).unwrap(), b"trusted output");
+}
+
+#[cfg(target_os = "linux")]
+#[test]
+fn process_group_observes_exit_before_reaping_the_leader() {
+    let mut command = Command::new(std::env::current_exe().unwrap());
+    dever_process::configure(&mut command);
+    let mut child = command
+        .args(["--ignored", "--exact", "direct_child_probe"])
+        .env("DEVER_TEST_WAIT", "1")
+        .spawn()
+        .unwrap();
+    let group = dever_process::ProcessGroup::pin(child.id()).unwrap();
+    assert!(!group.exited().unwrap());
+    group.terminate().unwrap();
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(2);
+    while !group.exited().unwrap() && std::time::Instant::now() < deadline {
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    let exited = group.exited().unwrap();
+    drop(group);
+    assert!(
+        !process::wait(&mut child, std::time::Duration::from_secs(2))
+            .unwrap()
+            .success()
+    );
+    assert!(exited);
+}
+
+#[cfg(target_os = "linux")]
+#[test]
+#[ignore = "internal direct-process probe"]
+fn direct_child_probe() {
+    if std::env::var_os("DEVER_TEST_WAIT").is_some() {
+        std::thread::sleep(std::time::Duration::from_secs(2));
+        return;
+    }
+    assert!(std::env::var_os("DEVER_TEST_AMBIENT").is_none());
+    assert_eq!(
+        fs::read_link("/proc/self/ns/mnt").unwrap().as_os_str(),
+        std::env::var_os("DEVER_TEST_MOUNT").unwrap()
+    );
+    let path = std::env::var_os("DEVER_TEST_INPUT").unwrap();
+    assert_eq!(fs::read(&path).unwrap(), b"trusted input");
+    fs::write(path, "trusted output").unwrap();
+}