krane: write krane binary to a tempfile

Cargo.toml

@@ -106,7 +106,6 @@ nix = "0.28"
 nonzero_ext = "0.3"
 num_cpus = "1"
 olpc-cjson = "0.1"
-pentacle = "1.1"
 rand = { version = "0.8", default-features = false }
 regex = "1"
 reqwest = { version = "0.11", default-features = false }

tools/krane/Cargo.toml

@@ -10,7 +10,7 @@ publish = false
 anyhow.workspace = true
 flate2.workspace = true
 lazy_static.workspace = true
-pentacle.workspace = true
+tempfile.workspace = true
 
 [build-dependencies]
 flate2.workspace = true

tools/krane/README.md

@@ -4,8 +4,7 @@ This crate packages the `krane` utility from [google/go-containerregistry].
 
 The utility is compiled by a build script, the output of which is compressed and stored in the Rust
 crate as via `include_bytes!`.
-At runtime, `krane-bundle` writes the decompressed binary to a [sealed anonymous file], passing the
+At runtime, `krane-bundle` writes the decompressed binary to a temp file, passing the
 filepath of that file to any caller.
 
 [google/go-containerregistry]: https://github.com/google/go-containerregistry
-[sealed anonymous file]: https://github.com/haha-business/pentacle

tools/krane/src/lib.rs

@@ -1,10 +1,10 @@
-use anyhow::{Context, Result};
+use anyhow::Result;
 use flate2::read::GzDecoder;
-use std::fs::File;
-use std::os::fd::AsRawFd;
-use std::path::{Path, PathBuf};
+use std::fs::{File, Permissions};
+use std::os::unix::fs::PermissionsExt;
+use std::path::PathBuf;
 
-use pentacle::SealOptions;
+use tempfile::TempDir;
 
 const COMPRESSED_KRANE_BIN: &[u8] = include_bytes!(env!("KRANE_GZ_PATH"));
 
@@ -15,31 +15,30 @@ lazy_static::lazy_static! {
 #[derive(Debug)]
 pub struct Krane {
     // Hold the file in memory to keep the fd open
-    _sealed_binary: File,
+    _tmp_dir: TempDir,
     path: PathBuf,
 }
 
 impl Krane {
     fn seal() -> Result<Krane> {
-        let mut krane_reader = GzDecoder::new(COMPRESSED_KRANE_BIN);
+        let tmp_dir = TempDir::new()?;
+        let path = tmp_dir.path().join("krane");
+
+        let mut krane_file = File::create(&path)?;
+        let permissions = Permissions::from_mode(0o755);
+        krane_file.set_permissions(permissions)?;
 
-        let sealed_binary = SealOptions::new()
-            .close_on_exec(false)
-            .executable(true)
-            .copy_and_seal(&mut krane_reader)
-            .context("Failed to write krane binary to sealed anonymous file")?;
+        let mut krane_reader = GzDecoder::new(COMPRESSED_KRANE_BIN);
 
-        let fd = sealed_binary.as_raw_fd();
-        let pid = std::process::id();
-        let path = PathBuf::from(format!("/proc/{pid}/fd/{fd}"));
+        std::io::copy(&mut krane_reader, &mut krane_file)?;
 
         Ok(Krane {
-            _sealed_binary: sealed_binary,
+            _tmp_dir: tmp_dir,
             path,
         })
     }
 
-    pub fn path(&self) -> &Path {
+    pub fn path(&self) -> &PathBuf {
         &self.path
     }
 }

tools/oci-cli-wrapper/src/cli.rs

@@ -27,7 +27,12 @@ impl CommandLine {
         ensure!(
             output.status.success(),
             error::OperationFailedSnafu {
-                message: String::from_utf8_lossy(&output.stderr),
+                message: format!(
+                    "status: {} stderr: {} stdout: {}",
+                    &output.status,
+                    String::from_utf8_lossy(&output.stderr),
+                    String::from_utf8_lossy(&output.stdout)
+                ),
                 program: self.path.clone(),
                 args: args.iter().map(|x| x.to_string()).collect::<Vec<_>>()
             }