tend/internal/deploy/release.go

// SPDX-License-Identifier: AGPL-3.0-only

package deploy

import (
	"archive/tar"
	"compress/gzip"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"regexp"
	"sort"
	"strings"

	"gamertan.com/tend/internal/config"
	"gamertan.com/tend/internal/packager"
)

const maxArtifactSize int64 = 512 << 20

func prepareRelease(cfg config.Config, artifact, expected, approved string) (string, error) {
	if err := checkArtifact(artifact, expected, approved); err != nil {
		return "", err
	}
	if err := ensureTree(cfg.Deployment.Root); err != nil {
		return "", err
	}
	releases := filepath.Join(cfg.Deployment.Root, "releases")
	release := filepath.Join(releases, "sha256-"+expected)
	if info, err := os.Lstat(release); err == nil {
		if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
			return "", errors.New("existing release is not a directory")
		}
		if err := validateRelease(cfg, release); err != nil {
			return "", err
		}
		return release, nil
	} else if !os.IsNotExist(err) {
		return "", err
	}
	stage := filepath.Join(releases, ".tend-stage-"+expected)
	if err := os.Mkdir(stage, 0o700); err != nil {
		return "", err
	}
	ok := false
	defer func() {
		if !ok {
			_ = os.RemoveAll(stage)
		}
	}()
	if err := extractArtifact(artifact, stage); err != nil {
		return "", err
	}
	if err := validateRelease(cfg, stage); err != nil {
		return "", err
	}
	if err := os.Chmod(stage, 0o755); err != nil {
		return "", err
	}
	if err := os.Rename(stage, release); err != nil {
		return "", err
	}
	ok = true
	return release, nil
}

func inspectArtifact(cfg config.Config, artifact, expected, approved string) error {
	if err := checkArtifact(artifact, expected, approved); err != nil {
		return err
	}
	stage, err := os.MkdirTemp("", "tend-inspect-")
	if err != nil {
		return err
	}
	defer os.RemoveAll(stage)
	if err := extractArtifact(artifact, stage); err != nil {
		return err
	}
	return validateRelease(cfg, stage)
}
func checkArtifact(artifact, expected, approved string) error {
	if expected != approved || len(expected) != 64 {
		return errors.New("artifact digest was not explicitly approved")
	}
	if _, err := hex.DecodeString(expected); err != nil {
		return errors.New("artifact digest is not hexadecimal")
	}
	if !filepath.IsAbs(artifact) || filepath.Clean(artifact) != artifact {
		return errors.New("artifact path must be a clean absolute path")
	}
	info, err := os.Lstat(artifact)
	if err != nil {
		return err
	}
	if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Size() > maxArtifactSize {
		return errors.New("artifact must be a bounded regular file")
	}
	actual, err := fileSHA(artifact)
	if err != nil {
		return err
	}
	if actual != expected {
		return errors.New("artifact digest does not match")
	}
	return nil
}

func ensureTree(root string) error {
	if os.Geteuid() != 0 && strings.HasPrefix(root, "/opt/") {
		return errors.New("deployment under /opt requires root")
	}
	if err := rejectSymlinkAncestors(root); err != nil {
		return err
	}
	if err := os.MkdirAll(filepath.Join(root, "releases"), 0o755); err != nil {
		return err
	}
	return rejectSymlinkAncestors(filepath.Join(root, "releases"))
}
func rejectSymlinkAncestors(path string) error {
	clean := filepath.Clean(path)
	parts := strings.Split(strings.TrimPrefix(clean, string(filepath.Separator)), string(filepath.Separator))
	current := string(filepath.Separator)
	for _, part := range parts {
		current = filepath.Join(current, part)
		info, err := os.Lstat(current)
		if os.IsNotExist(err) {
			continue
		}
		if err != nil {
			return err
		}
		if info.Mode()&os.ModeSymlink != 0 {
			return fmt.Errorf("symlink ancestor refused: %s", current)
		}
		if !info.IsDir() {
			return fmt.Errorf("non-directory ancestor refused: %s", current)
		}
	}
	return nil
}

func extractArtifact(artifact, stage string) error {
	file, err := os.Open(artifact)
	if err != nil {
		return err
	}
	defer file.Close()
	gz, err := gzip.NewReader(file)
	if err != nil {
		return err
	}
	defer gz.Close()
	tr := tar.NewReader(io.LimitReader(gz, maxArtifactSize))
	files := 0
	var total int64
	for {
		header, err := tr.Next()
		if errors.Is(err, io.EOF) {
			break
		}
		if err != nil {
			return err
		}
		clean := filepath.Clean(filepath.FromSlash(header.Name))
		parts := strings.Split(clean, string(filepath.Separator))
		if len(parts) == 1 && header.Typeflag == tar.TypeDir {
			continue
		}
		if len(parts) != 2 || parts[0] != "bundle" || parts[1] == "" || parts[1] == "." || parts[1] == ".." {
			return fmt.Errorf("unsafe archive path %q", header.Name)
		}
		if header.Typeflag != tar.TypeReg || header.Size < 0 {
			return errors.New("archive may contain only regular files")
		}
		files++
		total += header.Size
		if files > 16 || total > maxArtifactSize {
			return errors.New("artifact exceeds extraction bounds")
		}
		target := filepath.Join(stage, parts[1])
		mode := os.FileMode(0o644)
		if !strings.HasSuffix(parts[1], ".json") && parts[1] != "SHA256SUMS" {
			mode = 0o755
		}
		out, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode)
		if err != nil {
			return err
		}
		if _, err := io.CopyN(out, tr, header.Size); err != nil {
			_ = out.Close()
			return err
		}
		// OpenFile modes are filtered through the caller's umask. Tend is
		// commonly invoked by a root account with umask 0077, while release
		// binaries must remain executable by their dedicated service users.
		// Reapply the validated, name-derived mode explicitly before the file
		// becomes part of an immutable release.
		if err := out.Chmod(mode); err != nil {
			_ = out.Close()
			return err
		}
		if err := out.Sync(); err != nil {
			_ = out.Close()
			return err
		}
		if err := out.Close(); err != nil {
			return err
		}
	}
	if files < 5 {
		return errors.New("artifact is incomplete")
	}
	return nil
}

func validateRelease(cfg config.Config, release string) error {
	manifestPath := filepath.Join(release, "RELEASE.json")
	b, err := os.ReadFile(manifestPath)
	if err != nil {
		return err
	}
	dec := json.NewDecoder(strings.NewReader(string(b)))
	dec.DisallowUnknownFields()
	var manifest packager.Manifest
	if err := dec.Decode(&manifest); err != nil {
		return err
	}
	var trailing any
	if err := dec.Decode(&trailing); !errors.Is(err, io.EOF) {
		return errors.New("release manifest contains trailing data")
	}
	if manifest.SchemaVersion != 1 || manifest.Service != cfg.Service.Name || manifest.Binary != cfg.Build.Binary || manifest.GOOS != "linux" || manifest.GOARCH != "amd64" || manifest.CGOEnabled {
		return errors.New("release manifest does not match configuration")
	}
	if matched, _ := regexp.MatchString(`^[0-9a-f]{40}$`, manifest.Commit); !matched {
		return errors.New("release manifest commit is invalid")
	}
	binary := filepath.Join(release, cfg.Build.Binary)
	sum, err := fileSHA(binary)
	if err != nil {
		return err
	}
	if sum != manifest.BinarySHA256 {
		return errors.New("release binary digest does not match manifest")
	}
	if err := verifySums(release); err != nil {
		return err
	}
	entries, err := os.ReadDir(release)
	if err != nil {
		return err
	}
	allowed := map[string]bool{cfg.Build.Binary: true, "BUILDINFO.json": true, "RELEASE.json": true, "SBOM.spdx.json": true, "SHA256SUMS": true}
	if len(entries) != len(allowed) {
		return errors.New("release contains unexpected files")
	}
	for _, entry := range entries {
		if !allowed[entry.Name()] || !entry.Type().IsRegular() {
			return fmt.Errorf("unexpected release entry %s", entry.Name())
		}
	}
	return nil
}
func verifySums(release string) error {
	b, err := os.ReadFile(filepath.Join(release, "SHA256SUMS"))
	if err != nil {
		return err
	}
	lines := strings.Split(strings.TrimSpace(string(b)), "\n")
	if len(lines) != 4 {
		return errors.New("SHA256SUMS must cover four release files")
	}
	seen := map[string]bool{}
	for _, line := range lines {
		fields := strings.Fields(line)
		if len(fields) != 2 || len(fields[0]) != 64 {
			return errors.New("malformed SHA256SUMS")
		}
		name := fields[1]
		if filepath.Base(name) != name || seen[name] {
			return errors.New("unsafe or duplicate checksum entry")
		}
		seen[name] = true
		actual, err := fileSHA(filepath.Join(release, name))
		if err != nil {
			return err
		}
		if actual != fields[0] {
			return fmt.Errorf("checksum mismatch for %s", name)
		}
	}
	required := []string{"BUILDINFO.json", "RELEASE.json", "SBOM.spdx.json"}
	sort.Strings(required)
	for _, name := range required {
		if !seen[name] {
			return fmt.Errorf("checksum omitted %s", name)
		}
	}
	return nil
}
func fileSHA(path string) (string, error) {
	f, err := os.Open(path)
	if err != nil {
		return "", err
	}
	defer f.Close()
	h := sha256.New()
	if _, err := io.Copy(h, f); err != nil {
		return "", err
	}
	return hex.EncodeToString(h.Sum(nil)), nil
}