diag: verify credentials and probe reflink/API base for real

doctor's checks reported configuration rather than reality:

- reflink capability was inferred from the fs type (btrfs/xfs/zfs), which
  is wrong for XFS without reflink=1 or ZFS without block cloning. Replace
  with reflinkProbe(), which runs the same cp --reflink=always the
  provisioner uses — ground truth. Feeds both doctor and the machine-readable
  StatusReport.workdir.reflink_capable field.
- apiReach hardcoded api.github.com/zen, wrong for GHES/proxy. Derive the
  API base from the configured URL (githubAPIBase) and treat any HTTP
  response as reachable (only >=500/transport error warns).
- authCheck only proved credentials were present/parseable. Add authVerify:
  a live read-only call (PAT -> /rate_limit, App -> signed RS256 JWT ->
  /app/installations/ID) that FAILs on 401/403, WARNs when offline.
- workdirCheck no longer MkdirAll's the dir (a diagnostic must not mutate
  host state); it Stats instead and reports the euid it probed as, since
  writability is only meaningful when run as the service user.

JWT signing is stdlib-only (crypto/rsa + PKCS1/PKCS8 PEM parsing).

Author: linyiru

README.md

@@ -289,9 +289,10 @@ the host (cross-checked against firecracker processes and tap devices).
 
 `doctor` runs a checklist — `/dev/kvm`, the firecracker/jailer binaries, the
 kernel and golden images, the egress interface, `ip_forward`, `nftables`, a
-writable and reflink-capable work dir, GitHub auth, and API reachability — and
-prints one `PASS`/`WARN`/`FAIL` line each. It exits non-zero when any check
-fails, so it can gate a deploy.
+writable and reflink-capable work dir, GitHub auth (presence plus a live
+read-only credential check), and API reachability (against the derived API base,
+so GitHub Enterprise Server works too) — and prints one `PASS`/`WARN`/`FAIL`
+line each. It exits non-zero when any check fails, so it can gate a deploy.
 
 ### Warm pool (`--min-runners`)
 

internal/diag/auth.go

@@ -0,0 +1,133 @@
+package diag
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/solcreek/firerunner/internal/config"
+)
+
+// githubAPIBase derives the REST API base URL from the configured org/repo URL,
+// so doctor probes the host firerunner actually talks to. github.com maps to
+// api.github.com; a GitHub Enterprise Server host serves its API under
+// /api/v3 on the same host. An unparseable/empty URL falls back to github.com.
+func githubAPIBase(rawURL string) string {
+	u, err := url.Parse(rawURL)
+	if err != nil || u.Host == "" {
+		return "https://api.github.com"
+	}
+	switch strings.ToLower(u.Host) {
+	case "github.com", "www.github.com":
+		return "https://api.github.com"
+	}
+	scheme := u.Scheme
+	if scheme == "" {
+		scheme = "https"
+	}
+	return scheme + "://" + u.Host + "/api/v3"
+}
+
+// authVerify makes a single read-only authenticated request to confirm the
+// configured credentials are actually accepted by GitHub — the presence checks
+// in authCheck only prove the values are set and parseable. It never mutates
+// anything (a PAT hits /rate_limit; a GitHub App hits GET /app/installations/ID
+// with a short-lived JWT). It is best-effort: a transport error WARNs (the host
+// may simply be offline), an explicit 401/403 FAILs, anything else WARNs.
+func authVerify(cfg *config.Config, apiBase string) Check {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var req *http.Request
+	if cfg.Token != "" {
+		req, _ = http.NewRequestWithContext(ctx, http.MethodGet, apiBase+"/rate_limit", nil)
+		req.Header.Set("Authorization", "Bearer "+cfg.Token)
+	} else {
+		key, err := cfg.ResolvePrivateKey()
+		if err != nil {
+			return fail("auth-verify", "GitHub App private key unreadable: %v", err)
+		}
+		jwt, err := appJWT(cfg.AppClientID, key, time.Now())
+		if err != nil {
+			return fail("auth-verify", "cannot sign GitHub App JWT: %v", err)
+		}
+		req, _ = http.NewRequestWithContext(ctx, http.MethodGet,
+			fmt.Sprintf("%s/app/installations/%d", apiBase, cfg.AppInstallID), nil)
+		req.Header.Set("Authorization", "Bearer "+jwt)
+	}
+	req.Header.Set("Accept", "application/vnd.github+json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return warn("auth-verify", "could not verify credentials (offline?): %v", err)
+	}
+	defer resp.Body.Close()
+	switch {
+	case resp.StatusCode == http.StatusOK:
+		return pass("auth-verify", "credentials accepted by %s", apiBase)
+	case resp.StatusCode == http.StatusUnauthorized, resp.StatusCode == http.StatusForbidden:
+		return fail("auth-verify", "credentials rejected (HTTP %d)", resp.StatusCode)
+	default:
+		return warn("auth-verify", "unexpected HTTP %d verifying credentials", resp.StatusCode)
+	}
+}
+
+// appJWT builds the short-lived RS256 JWT GitHub requires to authenticate as a
+// GitHub App. The issuer is the App's client ID (GitHub also accepts the App
+// ID). Kept stdlib-only: PKCS#1/PKCS#8 PEM parsing + rsa.SignPKCS1v15.
+func appJWT(issuer, pemKey string, now time.Time) (string, error) {
+	key, err := parseRSAPrivateKey(pemKey)
+	if err != nil {
+		return "", err
+	}
+	enc := base64.RawURLEncoding.EncodeToString
+	header := enc([]byte(`{"alg":"RS256","typ":"JWT"}`))
+	claims, err := json.Marshal(map[string]any{
+		"iat": now.Add(-60 * time.Second).Unix(),
+		"exp": now.Add(9 * time.Minute).Unix(), // GitHub caps App JWTs at 10 min
+		"iss": issuer,
+	})
+	if err != nil {
+		return "", err
+	}
+	signingInput := header + "." + enc(claims)
+	sum := sha256.Sum256([]byte(signingInput))
+	sig, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, sum[:])
+	if err != nil {
+		return "", err
+	}
+	return signingInput + "." + enc(sig), nil
+}
+
+// parseRSAPrivateKey accepts either a PKCS#1 ("RSA PRIVATE KEY") or PKCS#8
+// ("PRIVATE KEY") PEM, as GitHub has issued both formats for App keys.
+func parseRSAPrivateKey(pemKey string) (*rsa.PrivateKey, error) {
+	block, _ := pem.Decode([]byte(pemKey))
+	if block == nil {
+		return nil, errors.New("no PEM block found in private key")
+	}
+	if k, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {
+		return k, nil
+	}
+	k, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("parse private key: %w", err)
+	}
+	rk, ok := k.(*rsa.PrivateKey)
+	if !ok {
+		return nil, fmt.Errorf("private key is %T, want RSA", k)
+	}
+	return rk, nil
+}

internal/diag/auth_test.go

@@ -0,0 +1,170 @@
+package diag
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/solcreek/firerunner/internal/config"
+)
+
+func TestGithubAPIBase(t *testing.T) {
+	cases := map[string]string{
+		"https://github.com/solcreek":  "https://api.github.com",
+		"https://github.com/org/repo":  "https://api.github.com",
+		"https://www.github.com/org":   "https://api.github.com",
+		"https://ghe.example.com/org":  "https://ghe.example.com/api/v3",
+		"http://ghe.internal/org/repo": "http://ghe.internal/api/v3",
+		"":                             "https://api.github.com",
+		"://bogus":                     "https://api.github.com",
+		"ghe.example.com/org":          "https://api.github.com", // no scheme => no host
+	}
+	for in, want := range cases {
+		if got := githubAPIBase(in); got != want {
+			t.Errorf("githubAPIBase(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func testRSAKeyPEM(t *testing.T) (string, *rsa.PrivateKey) {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("generate key: %v", err)
+	}
+	der := x509.MarshalPKCS1PrivateKey(key)
+	p := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: der})
+	return string(p), key
+}
+
+func TestAppJWT(t *testing.T) {
+	pemStr, key := testRSAKeyPEM(t)
+	now := time.Unix(1_700_000_000, 0)
+	tok, err := appJWT("Iv1.client", pemStr, now)
+	if err != nil {
+		t.Fatalf("appJWT: %v", err)
+	}
+	parts := strings.Split(tok, ".")
+	if len(parts) != 3 {
+		t.Fatalf("token has %d parts, want 3", len(parts))
+	}
+
+	// Signature must verify against the public key.
+	signing := parts[0] + "." + parts[1]
+	sig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		t.Fatalf("decode sig: %v", err)
+	}
+	sum := sha256.Sum256([]byte(signing))
+	if err := rsa.VerifyPKCS1v15(&key.PublicKey, crypto.SHA256, sum[:], sig); err != nil {
+		t.Fatalf("signature does not verify: %v", err)
+	}
+
+	// Claims must carry issuer and a sane iat/exp window.
+	rawClaims, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		t.Fatalf("decode claims: %v", err)
+	}
+	var claims struct {
+		Iat int64  `json:"iat"`
+		Exp int64  `json:"exp"`
+		Iss string `json:"iss"`
+	}
+	if err := json.Unmarshal(rawClaims, &claims); err != nil {
+		t.Fatalf("unmarshal claims: %v", err)
+	}
+	if claims.Iss != "Iv1.client" {
+		t.Errorf("iss = %q, want Iv1.client", claims.Iss)
+	}
+	if claims.Iat != now.Add(-60*time.Second).Unix() {
+		t.Errorf("iat = %d", claims.Iat)
+	}
+	if claims.Exp <= now.Unix() || claims.Exp > now.Add(10*time.Minute).Unix() {
+		t.Errorf("exp %d outside GitHub's 10-min window", claims.Exp)
+	}
+}
+
+func TestParseRSAPrivateKey_PKCS8(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	der, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	p := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der})
+	if _, err := parseRSAPrivateKey(string(p)); err != nil {
+		t.Fatalf("PKCS8 parse: %v", err)
+	}
+	if _, err := parseRSAPrivateKey("not a pem"); err == nil {
+		t.Error("want error for non-PEM input")
+	}
+}
+
+func TestAuthVerify_PAT(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/rate_limit" {
+			t.Errorf("PAT path = %q, want /rate_limit", r.URL.Path)
+		}
+		if r.Header.Get("Authorization") != "Bearer ghp_valid" {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	if c := authVerify(&config.Config{Token: "ghp_valid"}, srv.URL); c.Level != levelPass {
+		t.Errorf("valid PAT: got %s %s", c.Level, c.Detail)
+	}
+	if c := authVerify(&config.Config{Token: "ghp_wrong"}, srv.URL); c.Level != levelFail {
+		t.Errorf("wrong PAT: want FAIL, got %s", c.Level)
+	}
+	// Unreachable endpoint => WARN, not FAIL.
+	if c := authVerify(&config.Config{Token: "ghp_valid"}, "http://127.0.0.1:1"); c.Level != levelWarn {
+		t.Errorf("offline: want WARN, got %s %s", c.Level, c.Detail)
+	}
+}
+
+func TestAuthVerify_App(t *testing.T) {
+	pemStr, _ := testRSAKeyPEM(t)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/app/installations/123" {
+			t.Errorf("App path = %q", r.URL.Path)
+		}
+		auth := r.Header.Get("Authorization")
+		if !strings.HasPrefix(auth, "Bearer ") || strings.Count(auth, ".") != 2 {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	cfg := &config.Config{AppClientID: "Iv1.client", AppInstallID: 123, AppPrivateKey: pemStr}
+	if c := authVerify(cfg, srv.URL); c.Level != levelPass {
+		t.Errorf("valid App: got %s %s", c.Level, c.Detail)
+	}
+
+	bad := &config.Config{AppClientID: "Iv1.client", AppInstallID: 123, AppPrivateKey: "PRIVATE KEY garbage"}
+	if c := authVerify(bad, srv.URL); c.Level != levelFail {
+		t.Errorf("bad key: want FAIL, got %s", c.Level)
+	}
+}
+
+func TestReflinkProbe_BogusDir(t *testing.T) {
+	if reflinkProbe("/nonexistent/firerunner-does-not-exist") {
+		t.Error("reflinkProbe on missing dir should be false")
+	}
+}