cpak Developer

1. 1. Which order describes the main launch decisions before the application process begins?

   Resolve package, calculate policy, compose layers, prepare the boundary Create namespaces, resolve package, ask the storage driver, calculate policy Compose layers, grant addon permissions, resolve package, start the broker Start the process, mount the image, verify the manifest, apply the ceiling
2. 2. A user override removes network and the system ceiling allows it. What is the effective network policy?

   Denied because a ceiling cannot restore a removed grant Allowed because the system ceiling has priority Allowed only for nested packages Denied only when verified launch is set to refuse
3. 3. Which mechanism prevents a process from gaining privilege through a setuid executable after launch setup?

   The runtime index no_new_privs The package lock OverlayFS
4. 4. Why is an arbitrary command field invalid for a host action provider?

   It prevents cpak from choosing Podman or Docker It requires a system bus It cannot preserve standard output It turns a finite policy-gated operation into general host execution
5. 5. A container action asks to remove a host container without the requesting package ownership label. What should the provider do?

   Remove it when manage-owned is granted Ask the desktop user for confirmation Forward it only to a rootless backend Refuse it before selecting the backend operation
6. 6. What may a storage driver change while repairing a derived checkout?

   Only rebuildable data under its assigned driver root The application's writable data The package manifest digest The immutable source layer
7. 7. Why must a storage driver publish a checkout atomically?

   So source layers can be removed immediately So OverlayFS can sort the lower directories So a failed preparation never replaces the last valid checkout with a partial one So the driver can run as another user
8. 8. An external storage driver returns a symlink that escapes its assigned root. What happens?

   cpak mounts it read-only cpak rejects the returned path after symlink resolution cpak follows it when the socket owner matches The system ceiling decides
9. 9. Which runtime source installer is the smaller boundary for a Debian package whose maintainer scripts are not needed?

   tar, after renaming the package dpkg deb-extract file
10. 10. A runtime source download returns one byte more than its declared size. What happens?

    The runtime source is retried without a size check The download is rejected before installation The source is installed when the package is signed The extra byte is ignored and SHA-256 is checked
11. 11. What is the correct slot mode for choosing either Go or TinyGo as the active sdk.go provider?

    layer exclusive nested multiple
12. 12. A provider exports a library_path and include_path. What does that change?

    The Store selects it for every installed parent The provider becomes a required dependency The provider paths join the runtime and compiler search environments The parent receives new host filesystem permissions
13. 13. A nested request claims a different parent origin from the process that opened the private socket. Which identity is authoritative?

    The authenticated package instance bound to the connection The desktop account name The installed dependency's publisher The origin written in the request
14. 14. A package session declares an identifier already owned by a system session. What should registration do?

    Register both and let the display manager decide Replace it after Polkit approval Refuse the collision Rename the system session
15. 15. Verified launch finds a checkout that contradicts the state bound to its layer. Enforcement is off. What happens?

    The storage driver chooses whether to continue The layer is enrolled again automatically The launch starts with a warning The launch is refused as tampered
16. 16. An update fails after staging new runtime sources but before switching the active package record. Which version remains active?

    Whichever version has the newer OCI digest Neither version until audit repairs the transaction The staged version, without its exports The previous version

0 of 16 answered. Finish the 16 remaining questions to hand it in.