Stabilize owned Windows fence fixtures before pinning ACLs

Author: CompleteDotTech

.github/workflows/test.yml

@@ -46,6 +46,14 @@ jobs:
           python -m unittest discover -s tests -p "test_paper_pilot_phase_cutover_guarded_v2_trustees.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-fence-trustees.log"
           grep -Eq '^Ran 14 tests in ' "$RUNNER_TEMP/windows-fence-trustees.log"
           grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-fence-trustees.log"
+      - name: Run the twelve owned-fixture ACL stabilization cases (eight contract, four native)
+        if: always()
+        shell: bash
+        run: |
+          set -o pipefail
+          python -m unittest discover -s tests -p "test_windows_fixture_acl.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-fixture-acl.log"
+          grep -Eq '^Ran 12 tests in ' "$RUNNER_TEMP/windows-fixture-acl.log"
+          grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-fixture-acl.log"
       - name: Run the ten strict signed-head DACL fence cases (five contract, five native)
         if: always()
         shell: bash
@@ -54,13 +62,13 @@ jobs:
           python -m unittest discover -s tests -p "test_paper_pilot_phase_cutover_guarded_v2_strict_dacl.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-fence-strict-dacl.log"
           grep -Eq '^Ran 10 tests in ' "$RUNNER_TEMP/windows-fence-strict-dacl.log"
           grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-fence-strict-dacl.log"
-      - name: Run the sixteen diagnostics-tool sanitization, trace and cleanup cases
+      - name: Run the eighteen diagnostics-tool sanitization, trace and cleanup cases
         if: always()
         shell: bash
         run: |
           set -o pipefail
           python -m unittest discover -s tests -p "test_windows_fence_diagnostics.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-fence-diagnostics-tests.log"
-          grep -Eq '^Ran 16 tests in ' "$RUNNER_TEMP/windows-fence-diagnostics-tests.log"
+          grep -Eq '^Ran 18 tests in ' "$RUNNER_TEMP/windows-fence-diagnostics-tests.log"
           grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-fence-diagnostics-tests.log"
       - name: Sanitized Windows trustee serialization diagnostics
         if: always()

MANIFEST.json

@@ -3,12 +3,12 @@
   "hash_algorithm": "SHA-256",
   "manifest_self_excluded": true,
   "source_only": true,
-  "file_count": 707,
+  "file_count": 709,
   "files": [
     {
       "path": ".github/workflows/test.yml",
-      "bytes": 3120,
-      "sha256": "a0b3ff6080fc9e7212219d25ee9432462ea3057902d5cc786156fb7f85f08c90"
+      "bytes": 3588,
+      "sha256": "6b5dfbc1cbdf7e6fad4da3f51eec30bef6514a32809701047f61b7d8391fec89"
     },
     {
       "path": ".gitignore",
@@ -2632,23 +2632,23 @@
     },
     {
       "path": "tests/test_paper_pilot_phase_cutover_guarded_v2.py",
-      "bytes": 12838,
-      "sha256": "a4baf7de9c979aa89ff31c496b9a8e727f94119f823d357e9dfa789ad12cf2f4"
+      "bytes": 13300,
+      "sha256": "f7c72b60e3e0de9fc2b5dc14056ce88dd27d2db8a82157c07250f088049f30c7"
     },
     {
       "path": "tests/test_paper_pilot_phase_cutover_guarded_v2_simulated_acl.py",
-      "bytes": 32224,
-      "sha256": "bcb5f16b7052094082fa235b74e3950fab2263f53b777f7c9ea8b7b468beb01f"
+      "bytes": 46860,
+      "sha256": "eec4d28a522f207bcd28ccf5a1ffcaaaf526144d07c0bd551ef717e9ad6deb72"
     },
     {
       "path": "tests/test_paper_pilot_phase_cutover_guarded_v2_strict_dacl.py",
-      "bytes": 16130,
-      "sha256": "831a973dbb4a10ee4b593ecf66c08bb57fdf0983c5950742b544db078f278c69"
+      "bytes": 18172,
+      "sha256": "f714325983bec8b08ced75008a9e4c22cc59b76a0e3524ee720f621f8ca7b154"
     },
     {
       "path": "tests/test_paper_pilot_phase_cutover_guarded_v2_trustees.py",
-      "bytes": 18071,
-      "sha256": "387a304dd08056ab73feb4e34df7beb34dfaf21d2cfdfdc0c4803c45181adaf9"
+      "bytes": 18461,
+      "sha256": "13ac20e781fb6580636252871137743a834af56dbe2f031f2208550b94d70611"
     },
     {
       "path": "tests/test_paper_pilot_phase_cutover_guarded_v4.py",
@@ -2957,8 +2957,13 @@
     },
     {
       "path": "tests/test_windows_fence_diagnostics.py",
-      "bytes": 17143,
-      "sha256": "0157f4e5132d2ad64075b214f7b220b3c2841544f7909d5ae3098bdf23c3d5a7"
+      "bytes": 20559,
+      "sha256": "c99e5d60eb8deb0bb20f1a5b64d6888f7f7134841ba3016f6991266e9498bab4"
+    },
+    {
+      "path": "tests/test_windows_fixture_acl.py",
+      "bytes": 11278,
+      "sha256": "704d60ecffa1aa3ad6146d20ad8da719db7ad9b34ad52cc48979323add43a546"
     },
     {
       "path": "tools/build_schemas.py",
@@ -3037,8 +3042,13 @@
     },
     {
       "path": "tools/windows_fence_diagnostics.py",
-      "bytes": 19626,
-      "sha256": "3b6e5db6ebfa189dd6e4b74b033e6d10dd7fdd552d5002dc306e011252f6b730"
+      "bytes": 21532,
+      "sha256": "9dabba98d9af2c92b77231e597194204c5a3918c214b319736a2d8ccad371471"
+    },
+    {
+      "path": "tools/windows_fixture_acl.py",
+      "bytes": 4355,
+      "sha256": "e435337541de6216b0f1634da1a0e36a36915d2897414db80ba5b17cad7272f6"
     },
     {
       "path": "tools/windows_image_ocr.ps1",

tests/test_paper_pilot_phase_cutover_guarded_v2.py

@@ -18,6 +18,7 @@
 
 from src import paper_pilot_phase_cutover_guarded_v2 as guarded
 from src.paper_pilot_phase_cutover import _current_sid
+from tools import windows_fixture_acl
 from trace_gc.budget import RunBudget
 
 
@@ -74,6 +75,12 @@ def setUp(self):
             (self.old / "budget.sqlite3").read_bytes()).hexdigest()
         for name in ("source-stage.lock", "phase-stage.lock"):
             (self.root / name).write_bytes(b"0")
+        # The fixture ACL is made explicit, protected and verified before any pin is taken, so
+        # nothing depends on what the temporary parent happens to pass down.
+        windows_fixture_acl.stabilize_owned_fixture(
+            self.base, [("parent", self.root), ("state", self.old)]
+            + [("file:" + name, self.old / name) for name in sorted(guarded.NAMES)],
+            read=guarded.directory_dacl_sddl)
         self.parent_acl_sha = hashlib.sha256(
             guarded.directory_dacl_sddl(self.root).encode()).hexdigest()
         self.file_acl_sha = {name: hashlib.sha256(