git-launcher: scrub checkout before launch

Author: h4x3rotab

git-launcher/README.md

@@ -131,7 +131,7 @@ no shell expansion in the parse step.
 | --- | --- |
 | `REPO_URL` | Git URL of the upstream workload repo (`https://…` or `git@…`). |
 | `COMMIT_SHA` | **Full** 40-hex SHA-1 or 64-hex SHA-256. Branches, tags, and short SHAs are rejected. |
-| `WORK_DIR` | Local directory used as the checkout. Created if missing. Reused on subsequent runs as long as the existing clone's `origin` URL matches `REPO_URL`. |
+| `WORK_DIR` | Local directory used as the checkout. Created if missing. Reused on subsequent runs as long as the existing clone's `origin` URL matches `REPO_URL`. Scrubbed before each launch; keep mutable app state outside this directory. |
 
 ### Optional
 
@@ -178,8 +178,9 @@ audited alongside `COMMIT_SHA`.
 
 * Will: clone fresh if `WORK_DIR` is empty; reuse the existing clone otherwise
   (after asserting that its `origin` URL matches `REPO_URL`).
-* Will: `git fetch --tags --prune origin`, then `git checkout --detach $SHA`,
-  then `git rev-parse HEAD` and assert it equals `COMMIT_SHA`.
+* Will: `git fetch --tags --prune origin`, `git checkout --detach $SHA`,
+  `git reset --hard $SHA`, `git clean -ffdx`, then `git rev-parse HEAD` and
+  assert it equals `COMMIT_SHA`.
 * Will not: fall back to a branch, tag, or `HEAD` if the commit is missing.
   A missing commit is a hard failure.
 * Will not: accept short SHAs. A truncated SHA could resolve ambiguously if
@@ -198,10 +199,13 @@ directory is reused only if it is already a git checkout whose `origin` exactly
 matches `REPO_URL`.
 
 Every boot still runs the same verification path: fetch from `origin`, detach
-checkout to `COMMIT_SHA`, then assert `git rev-parse HEAD == COMMIT_SHA`.
-Persistent state is therefore only a cache. It does not decide what runs. If
-the volume is empty, the launcher reclones. If the volume is non-empty but not a
-git checkout, or if it points at a different origin, startup fails.
+checkout to `COMMIT_SHA`, reset tracked files, remove untracked files with
+`git clean -ffdx`, then assert `git rev-parse HEAD == COMMIT_SHA`. The checkout
+volume is therefore a source cache only. It must not hold application state,
+SQLite databases, uploaded files, or build artefacts that the workload expects
+to survive; put those in a separate workload-owned volume. If the volume is
+empty, the launcher reclones. If the volume is non-empty but not a git checkout,
+or if it points at a different origin, startup fails.
 
 ## Example
 

git-launcher/VERIFY.md

@@ -42,8 +42,9 @@ flowchart LR
    the workload code *and* its entry point `entrypoint.sh`; no separate
    install/run command audit is needed.
 4. **Spot-check runtime logs.** `phala logs --cvm-id <id>` should show
-   `HEAD verified: <COMMIT_SHA>` and `exec in <dir>: bash entrypoint.sh`.
-   Logs are corroborating only; the trust root is steps 1–3.
+   `scrubbing checkout`, `HEAD verified: <COMMIT_SHA>`, and
+   `exec in <dir>: bash entrypoint.sh`. Logs are corroborating only; the
+   trust root is steps 1–3.
 
 If all four line up, the bytes executing in the TEE are exactly the
 upstream commit you audited, produced by an audited launcher.
@@ -263,12 +264,13 @@ phala logs --cvm-id <id> -n 200
 ```
 
 Default-mode output should include these lines (the launcher logs `mode`
-during config summary, then the checkout/verify lines, then the `exec`
+during config summary, then the checkout/scrub/verify lines, then the `exec`
 line, so they appear in this order):
 
 ```
 [git-launcher] mode:     default (workload repo entrypoint.sh)
 [git-launcher] checking out <COMMIT_SHA>
+[git-launcher] scrubbing checkout
 [git-launcher] HEAD verified: <COMMIT_SHA>
 [git-launcher] exec in <WORK_DIR>[/<REPO_SUBDIR>]: bash entrypoint.sh
 ```

git-launcher/bin/git-launcher

@@ -41,6 +41,7 @@ Required keys:
                  Branches, tags, and short SHAs are rejected.
   WORK_DIR       Local directory used as the checkout. Created if missing.
                  Reused across runs if it already contains a clone of REPO_URL.
+                 Scrubbed before each launch; keep mutable app state elsewhere.
 
 Optional keys:
   REPO_SUBDIR       Path inside the repo to cd into before running the entry
@@ -206,6 +207,10 @@ ensure_repo_at_commit() {
     die "git checkout failed for commit $sha (commit not present in $url? short SHA disallowed)"
   fi
 
+  log "scrubbing checkout"
+  git reset --hard "$sha" >/dev/null
+  git clean -ffdx >/dev/null
+
   local head
   head=$(git rev-parse --verify HEAD)
   local sha_lc=${sha,,}

git-launcher/tests/run-tests.sh

@@ -173,6 +173,34 @@ EOF
   return 0
 }
 
+test_checkout_scrubs_dirty_source() {
+  local work=$TMPROOT/work-scrub
+  local marker=$TMPROOT/marker-scrub.txt
+  local conf=$TMPROOT/conf-scrub.env
+
+  git clone -q "$FIXTURE" "$work"
+  git -C "$work" checkout -q --detach "$PIN_SHA"
+  echo "tampered" > "$work/greeting.txt"
+  echo "stale" > "$work/stale.txt"
+  mkdir -p "$work/target"
+  echo "compiled object from a previous boot" > "$work/target/old.o"
+
+  cat > "$conf" <<EOF
+REPO_URL=$FIXTURE
+COMMIT_SHA=$PIN_SHA
+WORK_DIR=$work
+REPO_SUBDIR=sub
+INSTALL_CMD=
+RUN_CMD="MARKER_FILE='$marker' ./run.sh"
+EOF
+  "$LAUNCHER" "$conf" || return 1
+  grep -q "greeting=hello" "$marker" || { echo "dirty tracked file was not reset" >&2; cat "$marker" >&2; return 1; }
+  [[ ! -e $work/stale.txt ]] || { echo "untracked stale file survived checkout scrub" >&2; return 1; }
+  [[ ! -e $work/target/old.o ]] || { echo "untracked build artifact survived checkout scrub" >&2; return 1; }
+  [[ -z $(git -C "$work" status --short --untracked-files=all) ]] || { echo "worktree is not clean after launcher scrub" >&2; git -C "$work" status --short --untracked-files=all >&2; return 1; }
+  return 0
+}
+
 test_bogus_sha_fails() {
   local work=$TMPROOT/work-bogus
   local conf=$TMPROOT/conf-bogus.env
@@ -518,6 +546,7 @@ echo
 
 run_case "happy_pinning_runs_pinned_commit"      test_happy_pinning
 run_case "rerun_advances_pin"                    test_rerun_advance_pin
+run_case "checkout_scrubs_dirty_source"          test_checkout_scrubs_dirty_source
 run_case "bogus_sha_fails"                       test_bogus_sha_fails
 run_case "branch_name_rejected"                  test_branch_name_rejected
 run_case "tag_name_rejected"                     test_tag_name_rejected