Login
Stage A on scratch: receipt service, launcher, confined daemon
Login
Context

For the Migration plan, as the maintainer asked before any live switch. The tar holds the record, the harness, and the two scripts/ programs for the maintainer's strict review; those are not committed.

Check Result
Receipts through the launcher's /receipt route Asked as boss (setup), as a user holding o2, and anonymously. Each answer equals Fossil's own record: the sender, the receipt and row numbers, and capabilities matching fullcap().
The console Answers, listing the two runs as ended. Its other paths still pass through to today's page (the temporary exception E6).
Writes from the receipt service's sandbox A probe put in place of receipts, under the same policy, was refused opening the repository for writing and refused creating a file beside it (read-only file system). It could read, which is intended.
The network from the receipt service's sandbox Refused at Fossil's own port, which answered 200 on the host.
An agent's sandbox, started by the confined daemon Started as uid 1000. The repositories' directory and file were absent, a read was refused, and no /proc/*/root path reached the repository. Ended exited 0.
The daemon's own view A probe in place of its program, under the same daemon policy, found the repositories absent and no /proc/*/root path to them, and started an agent sandbox inside.
An unsandboxed run Refused by the node: "this node runs only sandboxed processes".

One point is observed, not explained. From the daemon's namespace, another process's /proc/PID/root is refused even for a process of the same account. That was tried directly, but the kernel's reason has not been pinned down. On the live host the daemon also runs as an account of its own, which refuses it by file permissions.

What scratch cannot show:

Rollback point: the extroot's ocx2-cgi is one link. Pointing it back at the release's own ocx2 restores today's page.

After Slowpen's source review (Oct 29)

Each finding was checked against the source and fixed in the two uncommitted programs. The record is in scripts-for-review-2.tar, which supersedes the first review copy.

Finding Fix Tried on scratch
The launcher could wait forever on a stalled service Connect and identity write bounded at 2 s A listener that never accepts: 503 after 2 s
/receipt/ and /receipt/x still ran the old direct code The launcher reads the path as the CGI does All three paths reach the service
A database lock stalled every receipt request SQLite waits nothing; the service retries in Crystal, at most 2 s One repository locked: it answered unavailable after 2.0 s, while another answered at once
The CGI sandbox kept capabilities --cap-drop ALL Inside: CapEff 0. The only inherited descriptors are 0 to 3, 3 being the service. No cookie, no nonce, the repository's name only, no repository files, no network.

Not changed, as they are the maintainer's files:

Attachments: