audit 3: a restore is ended by its Resync, and half an archive is refused

The restore manifest was consumed as soon as its version was checked, before store.Open and the Resync; a start that failed in between left a data directory the next start took for an ordinary one (M1). openData now runs CheckRestore, store.Open, the Resync, and only then ConsumeRestore. A truncated archive had nothing to refuse it: the manifest is the first entry, so a download cut short or a tar stopped by a damaged block was a restore on half a database. Every archive now ends with data/contents.json, the size and SHA-256 of each data/ file (deploy files are the operator's to edit), and CheckRestore compares /data with it before the database is opened, then renames it contents.checked.json so a start after a failed one does not compare again unless the manifest changed. Tests: a start whose Resync fails, then a start that resyncs and consumes; an archive cut in the database, before the deploy files and in its last entry (refused, database untouched, no -wal); a damaged key named; the record's names confined to data/; the domain import of a cut plain export, a cut and an altered .spde (refused, nothing created). e2e on the test server: full_backup_restore now also sees contents.json in the archive and gone after the first start, through the real entrypoint and daemons (all pass, 762 s); go vet + go test of 24 packages pass there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 09:53:46 +03:00
parent 68b3a7b23f
commit 8e3241ef98
13 changed files with 785 additions and 101 deletions
@@ -281,6 +281,37 @@ func parseTrustedProxies(raw string) []*net.IPNet {
 	return nets
 }

+// openData opens the database the panel runs on. When a backup was unpacked
+// into /data, the restore guard comes first (architecture.md § Persistence):
+// the manifest's version must match this binary and the archive must have
+// been unpacked whole before the database is touched, so neither schema skew
+// nor half an archive can corrupt the restored state. That first start then
+// runs resync, and only after it the manifest is consumed: a start that fails
+// on the way leaves it, and the next start is a restore again (audit
+// 2026-10-12, M1). Without a manifest it is an ordinary start.
+func openData(cfg config, resync func(*store.Store) error) (st *store.Store, restored bool, err error) {
+	restored, err = backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
+	if err != nil {
+		return nil, false, err
+	}
+	st, err = store.Open(cfg.dbPath)
+	if err != nil {
+		return nil, false, err
+	}
+	if restored {
+		log.Printf("restore manifest accepted; regenerating mail-path maps from SQLite")
+		if err := resync(st); err != nil {
+			_ = st.Close()
+			return nil, false, err
+		}
+		if err := backup.ConsumeRestore(cfg.manifestPath); err != nil {
+			_ = st.Close()
+			return nil, false, err
+		}
+	}
+	return st, restored, nil
+}
+
 // run starts the panel's three roles and blocks until a shutdown signal or the
 // first fatal error from any role. A signal triggers a clean stop of all
 // roles; a role error cancels the others and is returned so the process exits
@@ -297,31 +328,18 @@ func run() error {

 	log.Printf("starting selfpost panel %s", buildinfo.Version)

-	// Restore version guard (architecture.md § Persistence): if a backup was
-	// extracted into /data, its manifest version must match this binary before we
-	// touch the database, so schema/format skew between versions cannot corrupt
-	// the restored state. A match consumes the manifest; its absence is the
-	// normal (non-restore) case.
-	restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
-	if err != nil {
-		return err
-	}
-
 	// One database handle shared by every role. The store serialises writes
 	// (MaxOpenConns(1)), so the HTTP panel, the journal-milter and the tailer
 	// can all use it without stepping on each other under WAL.
-	st, err := store.Open(cfg.dbPath)
+	st, restored, err := openData(cfg, func(st *store.Store) error {
+		return resyncAfterRestore(cfg, st, false)
+	})
 	if err != nil {
 		return err
 	}
 	defer st.Close()

-	if restored {
-		log.Printf("restore manifest accepted; regenerating mail-path maps from SQLite")
-		if err := resyncAfterRestore(cfg, st, false); err != nil {
-			return err
-		}
-	} else if cfg.dmarcEnabled {
+	if !restored && cfg.dmarcEnabled {
 		ms := newMailStack(cfg, st)
 		ms.pf.SetReloadHook(func() error { return nil })
 		if err := ms.DMARC.Resync(); err != nil {
@@ -0,0 +1,184 @@
+package main
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/backup"
+	"github.com/mixeme/selfpost/internal/buildinfo"
+	"github.com/mixeme/selfpost/internal/store"
+)
+
+// A restore that goes wrong half way must leave the operator where they
+// started: the archive is refused before the database is opened, and a start
+// that fails after the guard is a restore again the next time (audit
+// 2026-10-12, M1 and stage 3).
+
+// A start that fails after the guard - here its Resync - leaves the manifest,
+// so the next start is a restore again and runs the Resync the failed one did
+// not finish. The failed start had the database open, so its files are no
+// longer the archive's; the next start does not compare them again.
+func TestARestoreStartThatFailsIsARestoreAgain(t *testing.T) {
+	target := t.TempDir()
+	extract(t, archiveOf(t, seedPanelProject(t)), target)
+	cfg := panelConfig(t, target)
+
+	broken := errors.New("postfix reload failed")
+	if _, _, err := openData(cfg, func(*store.Store) error { return broken }); !errors.Is(err, broken) {
+		t.Fatalf("a start whose Resync failed = %v, want that failure", err)
+	}
+	if _, err := os.Stat(cfg.manifestPath); err != nil {
+		t.Fatalf("the failed start consumed the manifest: %v", err)
+	}
+
+	mapPath := filepath.Join(cfg.dataDir, "postfix", "sender_login_maps")
+	if err := os.WriteFile(mapPath, []byte("stale map\n"), 0o640); err != nil {
+		t.Fatalf("write stale map: %v", err)
+	}
+	st, restored, err := openData(cfg, testResync(cfg))
+	if err != nil {
+		t.Fatalf("the start after a failed one: %v", err)
+	}
+	st.Close()
+	if !restored {
+		t.Fatal("the start after a failed one did not take the data directory for a restore")
+	}
+	if got, _ := os.ReadFile(mapPath); string(got) != "@"+restoreDomain+" shop\n" {
+		t.Errorf("sender map = %q: the second start did not run the Resync", got)
+	}
+	for _, name := range []string{backup.ManifestName, backup.ContentsName, "contents.checked.json"} {
+		if _, err := os.Stat(filepath.Join(cfg.dataDir, name)); !os.IsNotExist(err) {
+			t.Errorf("%s is still there after the restore start succeeded (stat err = %v)", name, err)
+		}
+	}
+
+	st, restored, err = openData(cfg, func(*store.Store) error {
+		t.Error("an ordinary start ran the restore Resync")
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("the ordinary start after the restore: %v", err)
+	}
+	st.Close()
+	if restored {
+		t.Error("the start after a finished restore took it for a restore again")
+	}
+}
+
+// An archive unpacked in part - a download cut short, a tar stopped by a
+// damaged block - is refused before the database is opened, with a message
+// that says so, and nothing in the directory is changed: the database the
+// archive left is as it left it, and the manifest is there for the next try.
+func TestAnArchiveUnpackedInPartIsRefused(t *testing.T) {
+	archive := archiveOf(t, seedPanelProject(t))
+	dbSize := entrySize(t, archive, backup.DataArchivePrefix+"selfpost.db")
+	for _, c := range []struct {
+		name string
+		cut  string
+		at   int64
+	}{
+		{"in the database", backup.DataArchivePrefix + "selfpost.db", dbSize / 2},
+		{"before the deploy files", backup.ComposeFileName, 0},
+		{"in its last entry", backup.DataArchivePrefix + backup.ContentsName, 10},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			target := t.TempDir()
+			extractCut(t, archive, target, c.cut, c.at)
+			cfg := panelConfig(t, target)
+			before, err := os.ReadFile(cfg.dbPath)
+			if err != nil {
+				t.Fatalf("the cut archive left no database: %v", err)
+			}
+
+			_, _, err = openData(cfg, func(*store.Store) error {
+				t.Error("a refused restore ran its Resync")
+				return nil
+			})
+			if err == nil || !strings.Contains(err.Error(), "not unpacked whole") {
+				t.Fatalf("the start on an archive cut %s = %v, want it refused as unpacked in part", c.name, err)
+			}
+
+			if after, _ := os.ReadFile(cfg.dbPath); !bytes.Equal(before, after) {
+				t.Error("the refused start changed the database")
+			}
+			for _, side := range []string{"-wal", "-shm", "-journal"} {
+				if _, err := os.Stat(cfg.dbPath + side); !os.IsNotExist(err) {
+					t.Errorf("selfpost.db%s exists: the refused start opened the database", side)
+				}
+			}
+			if _, err := os.Stat(cfg.manifestPath); err != nil {
+				t.Errorf("the refused start removed the manifest: %v", err)
+			}
+		})
+	}
+}
+
+// A file the archive holds and the data directory holds otherwise - damaged
+// on the way, or unpacked from another archive - is refused by its name.
+func TestADamagedRestoredFileIsRefusedByName(t *testing.T) {
+	target := t.TempDir()
+	extract(t, archiveOf(t, seedPanelProject(t)), target)
+	cfg := panelConfig(t, target)
+
+	key := filepath.Join(cfg.dataDir, "opendkim", "keys", restoreDomain, "selfpost.private")
+	f, err := os.OpenFile(key, os.O_WRONLY|os.O_APPEND, 0)
+	if err != nil {
+		t.Fatalf("open key: %v", err)
+	}
+	f.WriteString("x")
+	f.Close()
+
+	_, _, err = openData(cfg, func(*store.Store) error {
+		t.Error("a refused restore ran its Resync")
+		return nil
+	})
+	want := "data/opendkim/keys/" + restoreDomain + "/selfpost.private"
+	if err == nil || !strings.Contains(err.Error(), want) {
+		t.Fatalf("the start on a damaged key = %v, want a refusal naming %s", err, want)
+	}
+}
+
+// archiveOf takes a full backup of a seeded project for this binary's version.
+func archiveOf(t *testing.T, deployRoot string) []byte {
+	t.Helper()
+	dataDir := filepath.Join(deployRoot, "data")
+	var archive bytes.Buffer
+	if err := backup.Create(&archive, backup.Params{
+		DataDir:    dataDir,
+		DBPath:     filepath.Join(dataDir, "selfpost.db"),
+		Version:    buildinfo.Version,
+		DeployRoot: deployRoot,
+	}); err != nil {
+		t.Fatalf("create backup: %v", err)
+	}
+	return archive.Bytes()
+}
+
+// entrySize is the size of the archive's entry name.
+func entrySize(t *testing.T, archive []byte, name string) int64 {
+	t.Helper()
+	gz, err := gzip.NewReader(bytes.NewReader(archive))
+	if err != nil {
+		t.Fatalf("gzip: %v", err)
+	}
+	tr := tar.NewReader(gz)
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			t.Fatalf("the archive has no %s", name)
+		}
+		if err != nil {
+			t.Fatalf("read the archive: %v", err)
+		}
+		if hdr.Name == name {
+			return hdr.Size
+		}
+	}
+}
@@ -27,7 +27,8 @@ import (
 // below stubs that story out — the archive is downloaded from a running panel
 // through /backup, unpacked the way `tar -xzf` unpacks it, and a second panel
 // is started on the result through the same startup sequence run() uses:
-// CheckRestore, store.Open, newPanel, Start.
+// openData (CheckRestore, store.Open, Resync, ConsumeRestore), newPanel,
+// Start.

 const (
 	restorePassword = "correct-horse-battery"
@@ -171,22 +172,17 @@ func TestResyncAfterRestoreHealsDriftedMaps(t *testing.T) {
 		t.Fatalf("write manifest: %v", err)
 	}

-	restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
-	if err != nil {
-		t.Fatalf("CheckRestore: %v", err)
-	}
-	if !restored {
-		t.Fatal("CheckRestore did not report a restore")
-	}
+	// A record of no files: this test is about the maps, and the files it
+	// seeded were never in an archive.
+	writeContents(t, dataDir, backup.Contents{Format: backup.FormatContents})

-	st, err := store.Open(cfg.dbPath)
+	st, restored, err := openData(cfg, testResync(cfg))
 	if err != nil {
-		t.Fatalf("open store: %v", err)
+		t.Fatalf("open the restored data: %v", err)
 	}
 	defer st.Close()
-
-	if err := resyncAfterRestore(cfg, st, true); err != nil {
-		t.Fatalf("resync after restore: %v", err)
+	if !restored {
+		t.Fatal("the start did not take the data directory for a restore")
 	}

 	got, err := os.ReadFile(mapPath)
@@ -326,28 +322,17 @@ func bootPanel(t *testing.T, deployRoot string) http.Handler {
 	t.Helper()
 	cfg := panelConfig(t, deployRoot)

-	restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
+	st, restored, err := openData(cfg, testResync(cfg))
 	if err != nil {
 		t.Fatalf("the panel refused to start on %s: %v", deployRoot, err)
 	}
+	t.Cleanup(func() { _ = st.Close() })
 	if restored {
 		if _, err := os.Stat(cfg.manifestPath); err == nil {
 			t.Errorf("the restore manifest was not consumed, so the next start is gated by it too")
 		}
 	}

-	st, err := store.Open(cfg.dbPath)
-	if err != nil {
-		t.Fatalf("open the restored database: %v", err)
-	}
-	t.Cleanup(func() { _ = st.Close() })
-
-	if restored {
-		if err := resyncAfterRestore(cfg, st, true); err != nil {
-			t.Fatalf("resync after restore: %v", err)
-		}
-	}
-
 	panel, err := newPanel(cfg, st)
 	if err != nil {
 		t.Fatalf("build the panel: %v", err)
@@ -417,6 +402,15 @@ func downloadBackup(t *testing.T, h http.Handler, session *http.Cookie, password
 // extract unpacks a backup archive into dir, as `tar -xzf` does onto the project
 // directory before the image is started.
 func extract(t *testing.T, archive []byte, dir string) {
+	t.Helper()
+	extractCut(t, archive, dir, "", 0)
+}
+
+// extractCut unpacks the archive as extract does, except that the stream ends
+// cutAt bytes into the entry named cut: that entry is written as far as the
+// stream went and nothing after it is, which is what tar leaves of a download
+// cut short or a damaged block. An empty cut unpacks the whole archive.
+func extractCut(t *testing.T, archive []byte, dir, cut string, cutAt int64) {
 	t.Helper()
 	gz, err := gzip.NewReader(bytes.NewReader(archive))
 	if err != nil {
@@ -426,6 +420,9 @@ func extract(t *testing.T, archive []byte, dir string) {
 	for {
 		hdr, err := tr.Next()
 		if err == io.EOF {
+			if cut != "" {
+				t.Fatalf("the archive has no entry %s to cut", cut)
+			}
 			break
 		}
 		if err != nil {
@@ -436,6 +433,10 @@ func extract(t *testing.T, archive []byte, dir string) {
 			t.Fatalf("the archive escapes the directory it is extracted into: %q", hdr.Name)
 		}
 		path := filepath.Join(dir, name)
+		var body io.Reader = tr
+		if hdr.Name == cut {
+			body = io.LimitReader(tr, cutAt)
+		}

 		switch hdr.Typeflag {
 		case tar.TypeDir:
@@ -450,7 +451,7 @@ func extract(t *testing.T, archive []byte, dir string) {
 			if err != nil {
 				t.Fatalf("create %s: %v", path, err)
 			}
-			if _, err := io.Copy(f, tr); err != nil {
+			if _, err := io.Copy(f, body); err != nil {
 				f.Close()
 				t.Fatalf("write %s: %v", path, err)
 			}
@@ -458,6 +459,28 @@ func extract(t *testing.T, archive []byte, dir string) {
 				t.Fatalf("close %s: %v", path, err)
 			}
 		}
+		if hdr.Name == cut {
+			return
+		}
+	}
+}
+
+// testResync is the Resync a restore start runs, without reloading daemons
+// the test does not have.
+func testResync(cfg config) func(*store.Store) error {
+	return func(st *store.Store) error { return resyncAfterRestore(cfg, st, true) }
+}
+
+// writeContents writes the record of an archive's files into dataDir, as the
+// archive's last entry would have.
+func writeContents(t *testing.T, dataDir string, c backup.Contents) {
+	t.Helper()
+	body, err := json.Marshal(c)
+	if err != nil {
+		t.Fatalf("marshal contents: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dataDir, backup.ContentsName), body, 0o600); err != nil {
+		t.Fatalf("write contents: %v", err)
 	}
 }