Accept exact qemu PID 1 wrappers

docker/leoclean-nosend/entrypoint.py

@@ -238,8 +238,7 @@ def _health(image_input: dict[str, Any]) -> dict[str, Any]:
         str(READINESS).encode(),
         b"",
     ]
-    expected_binfmt = [expected_native[0], *expected_native]
-    _require(cmdline in (expected_native, expected_binfmt), "runtime process command line drifted")
+    _require(contract.pid_one_command_line_is_exact(cmdline, expected_native), "runtime process command line drifted")
     return {
         "schema": "livingip.leocleanNoSendContainerHealth.v1",
         "status": "pass",

ops/gcp_leoclean_nosend_package.py

@@ -109,6 +109,20 @@ def _require(condition: bool, message: str) -> None:
         raise PackageError(message)
 
 
+def pid_one_command_line_is_exact(cmdline: list[bytes], expected_native: list[bytes]) -> bool:
+    """Accept the pinned native argv and exact x86_64 binfmt wrappers only."""
+    if not expected_native or expected_native[-1] != b"":
+        return False
+    expected_binfmt = [expected_native[0], *expected_native]
+    accepted = (
+        expected_native,
+        expected_binfmt,
+        [b"/usr/bin/qemu-x86_64", *expected_binfmt],
+        [b"/usr/bin/qemu-x86_64-static", *expected_binfmt],
+    )
+    return cmdline in accepted
+
+
 def sha256_file(path: Path) -> str:
     digest = hashlib.sha256()
     with path.open("rb") as handle:

tests/test_gcp_leoclean_nosend_package.py

@@ -766,6 +766,21 @@ def test_dockerfile_has_only_digest_pinned_bases_and_no_floating_package_install
     assert "identity -type f -exec chmod 0444" in dockerfile
 
 
+def test_pid_one_command_line_accepts_only_native_and_exact_x86_64_binfmt_wrappers() -> None:
+    native = [b"/runtime/python", b"/runtime/bootstrap.py", b"service", b""]
+    binfmt = [native[0], *native]
+
+    assert package.pid_one_command_line_is_exact(native, native)
+    assert package.pid_one_command_line_is_exact(binfmt, native)
+    assert package.pid_one_command_line_is_exact([b"/usr/bin/qemu-x86_64", *binfmt], native)
+    assert package.pid_one_command_line_is_exact([b"/usr/bin/qemu-x86_64-static", *binfmt], native)
+
+    assert not package.pid_one_command_line_is_exact([b"/usr/bin/qemu-aarch64", *binfmt], native)
+    assert not package.pid_one_command_line_is_exact([b"/usr/bin/qemu-x86_64", *native], native)
+    assert not package.pid_one_command_line_is_exact([b"/usr/bin/qemu-x86_64", *binfmt, b"--extra"], native)
+    assert not package.pid_one_command_line_is_exact(native, native[:-1])
+
+
 def test_entrypoint_prepares_exact_profile_drops_privileges_and_health_checks_pid_one() -> None:
     source = (ROOT / "docker" / "leoclean-nosend" / "entrypoint.py").read_text(encoding="utf-8")
 
@@ -778,8 +793,7 @@ def test_entrypoint_prepares_exact_profile_drops_privileges_and_health_checks_pi
         "os.chown(PROFILE, contract.RUNTIME_UID, contract.RUNTIME_GID)"
     )
     assert 'value.get("process_id") == 1' in source
-    assert "expected_binfmt = [expected_native[0], *expected_native]" in source
-    assert "cmdline in (expected_native, expected_binfmt)" in source
+    assert "contract.pid_one_command_line_is_exact(cmdline, expected_native)" in source
     assert "contract.NO_SEND_TOOL_SURFACE" in source
     assert 'image_input["runtime"]["config_sha256"]' in source
     assert "gateway_adapter_count" in source