Restore green CI and fix VMM, lifecycle and tenant isolation bugs

.github/workflows/ci.yml

@@ -119,15 +119,15 @@ jobs:
 
       - name: Clippy
         working-directory: ${{ matrix.workspace }}
-        run: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --locked --workspace --all-targets -- -D warnings
 
       - name: Check
         working-directory: ${{ matrix.workspace }}
-        run: cargo check --workspace --all-targets
+        run: cargo check --locked --workspace --all-targets
 
       - name: Test (non-KVM unit tests)
         working-directory: ${{ matrix.workspace }}
-        run: cargo test --workspace
+        run: cargo test --locked --workspace
 
       - name: Test lifecycle soak supervisor
         if: matrix.workspace == 'orch'
@@ -139,7 +139,7 @@ jobs:
         if: matrix.workspace == 'vmm'
         working-directory: ${{ matrix.workspace }}
         run: >-
-          cargo check --workspace --all-targets
+          cargo check --locked --workspace --all-targets
           --features vmm-core/kvm
           --features vmm-core/boot
           --features vmm-memory-backend/kvm
@@ -149,7 +149,7 @@ jobs:
         if: matrix.workspace == 'vmm'
         working-directory: ${{ matrix.workspace }}
         run: >-
-          cargo clippy --workspace --all-targets
+          cargo clippy --locked --workspace --all-targets
           --features vmm-core/kvm
           --features vmm-core/boot
           --features vmm-memory-backend/kvm

orch/Cargo.toml

@@ -5,6 +5,7 @@ members = ["crates/tarit-types", "crates/tarit-vmm-client", "crates/tarit-store"
 [workspace.package]
 version = "0.1.2"
 edition = "2021"
+rust-version = "1.95"
 license = "AGPL-3.0-or-later"
 
 [workspace.dependencies]

orch/README.md

@@ -173,8 +173,8 @@ The client subcommands share three global flags: `--base-url <URL>` (env `TARIT_
 | `taritd vm get <id>` | Show one VM record. |
 | `taritd vm delete <id>` | Stop and remove a VM. |
 | `taritd vm pause <id>`, `taritd vm resume <id>` | Pause or resume a VM. |
-| `taritd vm snapshot <id> [--diff]` | Snapshot a VM; prints `path` and `host_id`. |
-| `taritd restore <snapshot_path>` | Restore a VM from a snapshot file. |
+| `taritd vm snapshot <id> [--diff]` | Snapshot a VM; prints the opaque `snapshot_id`. |
+| `taritd restore <snapshot_id>` | Restore a VM from a snapshot handle. |
 | `taritd exec <id> <command...>` | Run a command in the VM over `POST /v1/execute`; exits with the command's exit code. |
 | `taritd image build --oci <OCI_REF> --name <NAME[:TAG]> [--size <MIB>]` | Build and register a rootfs image; size defaults to 1024 MiB and bounds OCI unpack work. |
 | `taritd image ls` | List registered images. |

orch/crates/tarit-fleet/src/lib.rs

@@ -3588,6 +3588,23 @@ fn fleet_error_from_postgres(error: tokio_postgres::Error) -> FleetError {
     }
 }
 
+/// Whether every connection the fleet pool opens for `database_url` uses TLS
+/// or stays on a local Unix socket. tokio-postgres defaults to
+/// `sslmode=prefer`, which silently falls back to plaintext TCP.
+pub fn database_url_requires_tls(database_url: &str) -> Result<bool, FleetError> {
+    let mut cfg = PoolConfig::new();
+    cfg.url = Some(database_url.to_string());
+    let pg = cfg
+        .get_pg_config()
+        .map_err(|e| FleetError::Config(e.to_string()))?;
+    let unix_sockets_only = pg.get_hostaddrs().is_empty()
+        && pg
+            .get_hosts()
+            .iter()
+            .all(|host| matches!(host, tokio_postgres::config::Host::Unix(_)));
+    Ok(pg.get_ssl_mode() == tokio_postgres::config::SslMode::Require || unix_sockets_only)
+}
+
 fn make_rustls_connector() -> Result<MakeRustlsConnect, FleetError> {
     let mut roots = RootCertStore::empty();
     roots.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
@@ -3793,6 +3810,31 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn database_url_tls_requirement_rejects_plaintext_fallback() {
+        for url in [
+            "postgres://u:p@db.example:5432/tarit?sslmode=require",
+            "host=db.example dbname=tarit sslmode=require",
+            "postgres://u@%2Frun%2Fpostgresql/tarit",
+            "host=/run/postgresql dbname=tarit sslmode=disable",
+            "dbname=tarit",
+        ] {
+            assert!(database_url_requires_tls(url).unwrap(), "{url}");
+        }
+        for url in [
+            "postgres://u:p@db.example:5432/tarit",
+            "postgres://u:p@db.example:5432/tarit?sslmode=prefer",
+            "postgres://u:p@db.example:5432/tarit?sslmode=disable",
+            "host=/run/postgresql,db.example dbname=tarit",
+            "host=/run/postgresql hostaddr=10.0.0.5 dbname=tarit",
+        ] {
+            assert!(!database_url_requires_tls(url).unwrap(), "{url}");
+        }
+        assert!(
+            database_url_requires_tls("postgres://db.example/tarit?sslmode=verify-full").is_err()
+        );
+    }
+
     #[test]
     fn fleet_schema_defines_share_constraints() {
         assert!(FLEET_SCHEMA.contains("CREATE TABLE IF NOT EXISTS fleet_shares"));

orch/crates/tarit-types/src/lib.rs

@@ -872,6 +872,10 @@ fn default_exec_timeout_ms() -> u64 {
     30_000
 }
 
+/// Largest accepted `ExecuteRequest::timeout_ms` (one hour). A command holds
+/// its VM's operation gate for its whole budget, so the budget must be bounded.
+pub const MAX_EXEC_TIMEOUT_MS: u64 = 3_600_000;
+
 /// Status of an async execution job.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]

orch/crates/taritd/Cargo.toml

@@ -2,6 +2,7 @@
 name = "taritd"
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
 license.workspace = true
 
 [features]