64 lines
3.4 KiB
Bash
Executable File
64 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fail-closed checks for the build guardrails, without root or ARM hardware.
|
|
source "$(dirname -- "${BASH_SOURCE[0]}")/../../tools/lib.sh"
|
|
cd "$FDS_ROOT"
|
|
expect_failure() {
|
|
local label=$1
|
|
shift
|
|
if "$@" >"$scratch/rejection.log" 2>&1; then
|
|
die "Validation incorrectly accepted: $label"
|
|
fi
|
|
printf 'PASS: rejects %s\n' "$label"
|
|
}
|
|
scratch=$(mktemp -d)
|
|
trap 'rm -rf -- "$scratch"' EXIT
|
|
for script in tools/* tests/integration/m0-checks; do
|
|
[[ -f $script ]] || continue
|
|
[[ $(head -n 1 "$script") == '#!/usr/bin/env bash' ]] || continue
|
|
bash -n "$script"
|
|
done
|
|
tools/verify-elf target/aarch64-unknown-linux-musl/release/fds-smoketest aarch64 static
|
|
expect_failure 'static musl executable as a glibc package' tools/verify-elf \
|
|
target/aarch64-unknown-linux-musl/release/fds-smoketest aarch64 glibc
|
|
expect_failure 'wrong target architecture' tools/verify-elf /bin/bash aarch64 static
|
|
expect_failure 'dynamic host executable as static' tools/verify-elf /bin/bash x86_64 static
|
|
expect_failure 'non-ELF input' tools/verify-elf README.md aarch64 static
|
|
expect_failure 'missing artifact' tools/verify-elf "$scratch/missing" aarch64 static
|
|
expect_failure 'unknown linkage mode' tools/verify-elf /bin/bash x86_64 unknown
|
|
expect_failure 'invalid package path' tools/build-package ../hello
|
|
expect_failure 'unsupported bootstrap option' tools/bootstrap-host --unknown
|
|
|
|
# Use a disposable minimal checkout to exercise pin and dirty-tree detection.
|
|
mkdir -p "$scratch/repo/tools" "$scratch/repo/vendor/void-packages"
|
|
cp tools/lib.sh tools/prepare-void "$scratch/repo/tools/"
|
|
fake="$scratch/repo/vendor/void-packages"
|
|
git -C "$fake" init -q
|
|
printf '# fixture\n' >"$fake/xbps-src"
|
|
mkdir -p "$fake/srcpkgs/fds-upstream" "$fake/etc" "$scratch/repo/config" "$scratch/repo/packages/fds-fixture"
|
|
printf '# upstream\n' >"$fake/srcpkgs/fds-upstream/template"
|
|
printf 'etc/conf\n' >"$fake/.gitignore"
|
|
cp config/xbps-src.conf "$scratch/repo/config/"
|
|
printf '# inert overlay fixture\n' >"$scratch/repo/packages/fds-fixture/template"
|
|
git -C "$fake" add .
|
|
git -C "$fake" -c user.name=FDS -c user.email=test@example.invalid commit -qm fixture
|
|
git -C "$fake" rev-parse HEAD >"$scratch/repo/VOID_PACKAGES_COMMIT"
|
|
bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
|
|
printf 'PASS: accepts exact clean Void commit\n'
|
|
"$scratch/repo/tools/prepare-void"
|
|
cmp "$scratch/repo/packages/fds-fixture/template" "$fake/srcpkgs/fds-fixture/template"
|
|
"$scratch/repo/tools/prepare-void"
|
|
printf 'PASS: overlay copied and repeat preparation is idempotent\n'
|
|
printf '# changed\n' >>"$scratch/repo/packages/fds-fixture/template"
|
|
expect_failure 'stale generated overlay' "$scratch/repo/tools/prepare-void"
|
|
cp "$fake/srcpkgs/fds-fixture/template" "$scratch/repo/packages/fds-fixture/template"
|
|
mkdir -p "$scratch/repo/packages/fds-upstream"
|
|
printf '# collision\n' >"$scratch/repo/packages/fds-upstream/template"
|
|
expect_failure 'overlay replacing upstream package' "$scratch/repo/tools/prepare-void"
|
|
printf '# changed config\n' >>"$fake/etc/conf"
|
|
expect_failure 'overwriting local xbps configuration' "$scratch/repo/tools/prepare-void"
|
|
printf '\n# dirty\n' >>"$fake/xbps-src"
|
|
expect_failure 'modified Void source' bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
|
|
printf '%040d\n' 0 >"$scratch/repo/VOID_PACKAGES_COMMIT"
|
|
expect_failure 'wrong Void commit' bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
|
|
printf 'PASS: M0 guardrail checks complete\n'
|