76 lines
4.5 KiB
Markdown
76 lines
4.5 KiB
Markdown
# Milestone 16 evidence: private systemd peer transport
|
|
|
|
Recorded 2026-10-27T22:42:48+02:00 on the native
|
|
`x86_64-unknown-linux-gnu` development host. This is **implementation and
|
|
synthetic evidence, not systemd acceptance**. On 2026-10-28, the user reported a
|
|
successful manual check and explicitly directed that M16 be considered done.
|
|
The check's environment, commands, source identity, and transport coverage were
|
|
not supplied. PLANS.md records user-directed acceptance; this report does not
|
|
claim a passing disposable-VM run or independently close M16-R2.
|
|
|
|
## Source and protocol basis
|
|
|
|
The existing adapter connected only with `zbus::Connection::system()`. That
|
|
cannot reach systemd where no system D-Bus daemon exists. Official systemd
|
|
[source](https://github.com/systemd/systemd/blob/main/src/shared/bus-util.c)
|
|
shows root `systemctl` connecting to `unix:path=/run/systemd/private` and
|
|
checking peer credentials. Its [manual](https://www.freedesktop.org/software/systemd/man/latest/systemd.html)
|
|
calls this an internal interface; compatibility across systemd releases is
|
|
not guaranteed. Pinned [zbus 5.19.0](https://docs.rs/zbus/5.19.0/zbus/connection/struct.Builder.html)
|
|
provides `p2p` and EXTERNAL-authentication support.
|
|
|
|
The adapter now selects the system bus first and falls back to the private
|
|
socket only for a missing/refused/disconnected bus endpoint during connection
|
|
setup, before any restart request. Permission, handshake and timeout failures
|
|
do not trigger fallback. The private path checks peer UID 0; method calls omit
|
|
the bus destination; its `JobRemoved` stream uses a local peer match without
|
|
`org.freedesktop.DBus` owner monitoring. The system-bus path retains its
|
|
destination and owner-change watch. Both preserve `Subscribe` before
|
|
`RestartUnit`, canonical unit identity, the shared deadline, job matching and
|
|
conservative submission uncertainty. No retry follows a possibly submitted
|
|
restart. Application backup/confirmation/runtime/applied logic is unchanged.
|
|
|
|
## Checks, review, and gap
|
|
|
|
An independent GPT-6-Luna/high reviewer found M16-R1 (P2): private socket
|
|
permission errors were reduced to `RequestFailed`. A separate GPT-6-Luna/high
|
|
repairer changed the production builder error mapping to preserve
|
|
`PermissionDenied` and added a focused synthetic assertion. The reviewer
|
|
rechecked and closed R1. M16-R2 (P2) remains open: synthetic tests do not
|
|
execute the production private peer branch end to end. An attempted local zbus
|
|
UnixStream peer fixture failed at peer credential access with `EPERM` in the
|
|
sandbox; later fixture variants did not establish a successful protocol path.
|
|
Those experiments were removed from the test tree. They are not evidence that
|
|
real systemd rejects the implementation. No host private socket was accessed.
|
|
|
|
Pinned `rustc`/Cargo 1.97.1, rustfmt 1.9.0, and Clippy 0.1.97 were verified.
|
|
On the repaired inputs, from the repository root:
|
|
|
|
- `cargo test --locked --lib service::dbus::tests -- --test-threads=1`: 16 passed.
|
|
- `cargo fmt --all -- --check`: exit 0.
|
|
- `cargo clippy --locked --all-targets -- -D warnings`: exit 0.
|
|
- `cargo test --locked`: 367 passed, 3 explicitly ignored, 0 failed, including 2 documentation tests. Selected Docker/VM suites were not run.
|
|
- `cargo build --locked --release`: exit 0.
|
|
- `git diff --check`: exit 0.
|
|
|
|
Base commit: `fe7e3d61c22108acba5c4a86480254a12e089a53`. Dirty inputs and
|
|
SHA256 at validation:
|
|
|
|
- `Cargo.toml`: `807d08cc43b4c3f986134b7aa5b051fd2f0966fab95ac01d861c65f173c77caa`
|
|
- `Cargo.lock`: `6a929bb72d90da16b5ca7d209566e31a611d1ddcd5817ee778d7e9fe25b10c2e`
|
|
- `src/service/dbus.rs`: `d1ed34dd8a46d2495299c776176d7d5f6cfa9b6abb29ec84b6045e74bdffeb26`
|
|
- `docs/DEPENDENCIES.md`: `1db85ecd3f892e3f42f1220eb7627cfd423406e46e5024bdf6599a647f07be1f`
|
|
- `docs/TESTING.md`: `7ecab091999b50964b1641772a4cfc370639507b9c6621a058829a54b0f71325`
|
|
|
|
Native release artifact `target/release/wireguard-admin` SHA256:
|
|
`64c2851431ec406901e76dc866a05abd630a0e71adfd4efc16d3b44ea3c72b73`.
|
|
|
|
The prior disposable Debian VM was stopped before guest installation and has
|
|
no verified guest marker or running systemd acceptance environment, per
|
|
[`VM_ACCEPTANCE.md`](../VM_ACCEPTANCE.md). No private-socket or system-bus
|
|
restart was run in a disposable VM as part of the recorded checks. This gap
|
|
remains despite the later user-directed acceptance. A future independent check
|
|
would use a disposable VM with synthetic WireGuard configuration to cover both
|
|
transport paths, job completion, and full runtime matching, with exact
|
|
source/artifact identity. Production must not be used to fill the gap.
|