Documentation
¶
Overview ¶
Package runner executes `specd verify` task commands under a pluggable isolation backend. The Runner interface separates policy (env scrubbing, shell selection, timeout — owned by the cmd/verify caller) from mechanism (how the process is actually isolated and observed). The default shRunner reproduces specd's historical, non-sandboxed `shell -c command` execution exactly; other backends (e.g. bwrap, container) implement the same interface for stronger isolation.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type RunResult ¶
RunResult is the raw outcome of an execution, before it is folded into a VerificationRecord. It is presentation- and persistence-free.
type RunSpec ¶
type RunSpec struct {
Root string // working directory
Shell string // shell binary, e.g. "sh"
Command string // command passed to `shell -c`
Env []string // exact environment (already scrubbed)
Timeout time.Duration // hard wall-clock budget
Stdin []byte // optional bytes fed to the process's stdin (nil = none)
}
RunSpec is the fully-resolved description of one verify execution. The caller (cmd/verify) owns policy — env scrubbing, NUL rejection, shell selection — and hands the Runner a ready-to-execute spec. Runners must not re-derive policy; they only decide *how* the process is isolated.
type Runner ¶
Runner executes a verify command under some isolation backend. Name reports the sandbox identity recorded as evidence ("none" for the default shell runner; "bwrap"/"container" for the isolating backends added in a later wave). A Runner performs no state IO and renders nothing.
func SelectRunner ¶
SelectRunner resolves a sandbox name to a Runner, failing closed. The default ("none"/"") returns the historical shell runner. Any isolating backend whose underlying tool is absent from PATH is a hard error rather than a silent fallback — a verify run that asked for isolation must never quietly execute unisolated. The verify command surfaces the error and refuses to run.
Source Files