feat(local_socket): Unix core — Listen/Dial, runtime dir resolution, secure cleanup - #6
Open
four-bytes-robby wants to merge 5 commits into
Open
feat(local_socket): Unix core — Listen/Dial, runtime dir resolution, secure cleanup#6four-bytes-robby wants to merge 5 commits into
four-bytes-robby wants to merge 5 commits into
Conversation
…secure cleanup (#1)
…oRuntimeDir (#1) RemoveOnClose replaced by KeepOnClose with inverted meaning. The opt-in default meant Listen -> Close -> Listen returned ErrAlreadyInUse unless the caller set two options, so no service could restart on default settings. It also diverged from Go, whose UnixListener unlinks a socket it created, and from Rust interprocess, where name release is part of local-socket semantics. ReclaimStale stays opt-in. The rule is asymmetric on purpose: remove what this process created, never touch what it did not. Criterion 1.4 was never exercised - the test skipped itself whenever /run/user/$UID existed, which is every systemd host. The candidate chain is now injectable, and the test covers an empty set, a set where every candidate fails validation, and the assertion that nothing is written into a rejected directory. - KeepOnClose replaces RemoveOnClose; SetUnlinkOnClose(!KeepOnClose) - TestCloseRemovesSocketByDefault asserts restart with zero options - TestKeepOnCloseLeavesSocket covers the opt-out and its ErrAlreadyInUse - docs/ARCHITECTURE.md, docs/TESTING.md, HISTORY.md updated - 28 tests, no skips, gofmt/vet clean, -race green on Linux
… gate (#1) peer_darwin.go called syscall.Getpeereid, which exists in no Go standard library on any platform. The darwin build never compiled - a fact provable from Linux in one second, and missed because nothing cross-compiled. Replaced with the actual macOS primitive: GetsockoptXucred(fd, SOL_LOCAL, LOCAL_PEERCRED) from golang.org/x/sys. struct xucred carries a UID and a group list but no PID, so PeerIdentity.PID stays zero on Darwin, as already documented. This adds golang.org/x/sys as the package's single dependency. The 'standard library only' constraint in issue #1 does not survive contact with a platform primitive the standard library does not expose, and x/sys is the canonical source maintained by the Go team. Cross-compilation is now part of the documented local gate. It needs no hardware, costs a second, and catches the entire class. Compiling is not testing - but a platform file that does not compile is not a testing gap, it is a broken build. - CONTRIBUTE.md, AGENTS.md: GOOS=darwin/windows build in the gate - docs/TESTING.md: criterion 1.14 restated honestly - HISTORY.md: the defect and its cause recorded
golang.org/x/sys v0.47.0 declares 'go 1.25.0', so a 1.24 toolchain cannot build this module. Declaring 1.24 while depending on it was a floor the project could not honour - it happened to build here only because the local toolchain is newer. go.mod, AGENTS.md, GUIDELINES.md and HISTORY.md now agree on 1.25.
The maintainer has no macOS hardware, so the darwin path cross-compiles and vets cleanly but has never executed. Rather than let the platform table imply coverage, name exactly what is unverified: peerCred via getsockopt(SOL_LOCAL, LOCAL_PEERCRED), the Darwin-only $TMPDIR precedence step, and mode enforcement on APFS. A green cross-compile proves the code exists and type-checks, not that it behaves. - README: verification column plus a section on the gap - ROADMAP: Linux checked, macOS runtime listed as blocked - CONTRIBUTE: where a platform cannot be run, say so in the PR
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1
Phase 1 of
interprocess-go: thelocal_socketpackage on Linux and macOS. 1380 lines, 28 tests, no skips.Acceptance criteria
All 14 from
docs/TESTING.mdPhase 1 pass, except 1.14 which is partial — see below.The five load-bearing ones each have a named test:
TestValidateRuntimeDir,TestExplicitRuntimeDirValidated,TestTMPDIRIgnoredOnLinuxErrNoRuntimeDirTestNoValidCandidateReturnsErrNoRuntimeDir(two subtests)TestStaleCleanupRefusesRegularFile,TestStaleCleanupRefusesSymlinkCloseunblocksAcceptTestCloseUnblocksAcceptTestPeerIdentityThree defects found and fixed during review
RemoveOnClosewas opt-in.Listen→Close→ListenreturnedErrAlreadyInUseunless the caller set two options, so no service could restart on default settings. Replaced byKeepOnClosewith inverted meaning, so the zero value releases the socket.ReclaimStalestays opt-in on purpose — remove what this process created, never touch what it did not.Criterion 1.4 was never exercised. The test skipped itself whenever
/run/user/$UIDexisted, which is every systemd host. The candidate chain is now injectable and covers an empty set, a set where every candidate fails validation, and the assertion that nothing is written into a rejected directory.The macOS build never compiled.
peer_darwin.gocalledsyscall.Getpeereid, which exists in no Go standard library on any platform. Replaced withunix.GetsockoptXucred(fd, SOL_LOCAL, LOCAL_PEERCRED). Cross-compilation is now part of the documented local gate — it needs no hardware and catches this whole class.Known gap
darwin/arm64anddarwin/amd64cross-compile and vet cleanly;peerCred, the Darwin$TMPDIRprecedence step and APFS mode enforcement have never executed. Stated in README, ROADMAP and CONTRIBUTE rather than implied as covered.Local gate
Adds
golang.org/x/sysas the single dependency, and raises the minimum to Go 1.25 (x/sys v0.47.0 declaresgo 1.25.0).