99 lines
5.8 KiB
Bash
Executable File
99 lines
5.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fail-closed checks for the build guardrails, without root or ARM hardware.
|
|
source "$(dirname -- "${BASH_SOURCE[0]}")/../../tools/lib.sh"
|
|
cd "$FDS_ROOT"
|
|
expect_failure() {
|
|
local label=$1
|
|
shift
|
|
if "$@" >"$scratch/rejection.log" 2>&1; then
|
|
die "Validation incorrectly accepted: $label"
|
|
fi
|
|
printf 'PASS: rejects %s\n' "$label"
|
|
}
|
|
scratch=$(mktemp -d)
|
|
trap 'rm -rf -- "$scratch"' EXIT
|
|
for script in tools/* tests/integration/m0-checks; do
|
|
[[ -f $script ]] || continue
|
|
[[ $(head -n 1 "$script") == '#!/usr/bin/env bash' ]] || continue
|
|
bash -n "$script"
|
|
done
|
|
tools/verify-elf target/aarch64-unknown-linux-musl/release/fds-smoketest aarch64 static
|
|
expect_failure 'static musl executable as a glibc package' tools/verify-elf \
|
|
target/aarch64-unknown-linux-musl/release/fds-smoketest aarch64 glibc
|
|
expect_failure 'wrong target architecture' tools/verify-elf /bin/bash aarch64 static
|
|
expect_failure 'dynamic host executable as static' tools/verify-elf /bin/bash x86_64 static
|
|
expect_failure 'non-ELF input' tools/verify-elf README.md aarch64 static
|
|
expect_failure 'missing artifact' tools/verify-elf "$scratch/missing" aarch64 static
|
|
expect_failure 'unknown linkage mode' tools/verify-elf /bin/bash x86_64 unknown
|
|
expect_failure 'invalid package path' tools/build-package ../hello
|
|
expect_failure 'unsupported bootstrap option' tools/bootstrap-host --unknown
|
|
|
|
# Use a disposable minimal checkout to exercise pin and dirty-tree detection.
|
|
mkdir -p "$scratch/repo/tools" "$scratch/repo/vendor/void-packages"
|
|
cp tools/lib.sh tools/prepare-void tools/prepare-void-workspace tools/version tools/fds_version.py "$scratch/repo/tools/"
|
|
printf "1.0\n" >"$scratch/repo/FDS_VERSION"
|
|
fake="$scratch/repo/vendor/void-packages"
|
|
git -C "$fake" init -q
|
|
printf '# fixture\n' >"$fake/xbps-src"
|
|
mkdir -p "$fake/srcpkgs/fds-upstream" "$fake/etc" "$scratch/repo/config" "$scratch/repo/packages/fds-fixture"
|
|
printf '# upstream\n' >"$fake/srcpkgs/fds-upstream/template"
|
|
printf 'etc/conf\nhostdir/\nmasterdir-*/\n' >"$fake/.gitignore"
|
|
cp config/xbps-src.conf "$scratch/repo/config/"
|
|
printf '# inert overlay fixture\n' >"$scratch/repo/packages/fds-fixture/template"
|
|
git -C "$fake" add .
|
|
git -C "$fake" -c user.name=FDS -c user.email=test@example.invalid commit -qm fixture
|
|
git -C "$fake" rev-parse HEAD >"$scratch/repo/VOID_PACKAGES_COMMIT"
|
|
bash -c 'source "$1"; check_void_source' _ "$scratch/repo/tools/lib.sh"
|
|
printf 'PASS: accepts exact clean Void commit\n'
|
|
# Existing generated files and caches move without copying their payloads.
|
|
cp -a "$scratch/repo/packages/fds-fixture" "$fake/srcpkgs/"
|
|
cp config/xbps-src.conf "$fake/etc/conf"
|
|
mkdir -p "$fake/hostdir" "$fake/masterdir-x86_64"
|
|
printf 'cached input\n' >"$fake/hostdir/cache"
|
|
cache_inode=$(stat -c %i "$fake/hostdir/cache")
|
|
"$scratch/repo/tools/prepare-void"
|
|
build="$scratch/repo/.host/void-packages"
|
|
[[ -z $(git -C "$fake" status --porcelain --untracked-files=all) ]] || die 'Migration dirtied upstream'
|
|
[[ ! -e $fake/hostdir && ! -e $fake/etc/conf && ! -e $fake/srcpkgs/fds-fixture ]] || die 'Migration left build state in upstream'
|
|
[[ $(stat -c %i "$build/hostdir/cache") == "$cache_inode" ]] || die 'Migration copied cache data'
|
|
[[ ! -f $build/.git/objects/info/alternates ]] || die 'Build checkout depends on upstream object storage'
|
|
bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
|
|
cmp "$scratch/repo/packages/fds-fixture/template" "$build/srcpkgs/fds-fixture/template"
|
|
"$scratch/repo/tools/prepare-void"
|
|
printf 'PASS: overlays and caches moved outside clean upstream; preparation is idempotent\n'
|
|
printf '# changed\n' >>"$scratch/repo/packages/fds-fixture/template"
|
|
expect_failure 'stale generated overlay' "$scratch/repo/tools/prepare-void"
|
|
cp "$build/srcpkgs/fds-fixture/template" "$scratch/repo/packages/fds-fixture/template"
|
|
# Preserve unexpected upstream additions and independently edited legacy copies.
|
|
printf 'personal source\n' >"$fake/personal-file"
|
|
expect_failure 'unknown upstream addition' "$scratch/repo/tools/prepare-void"
|
|
[[ -f $fake/personal-file ]] || die 'Unknown file was removed'
|
|
rm "$fake/personal-file"
|
|
cp -a "$scratch/repo/packages/fds-fixture" "$fake/srcpkgs/"
|
|
printf '# independent edit\n' >>"$fake/srcpkgs/fds-fixture/template"
|
|
expect_failure 'edited legacy overlay' "$scratch/repo/tools/prepare-void"
|
|
grep -q 'independent edit' "$fake/srcpkgs/fds-fixture/template"
|
|
rm -r "$fake/srcpkgs/fds-fixture"
|
|
# An explicit upstream pin update advances the build checkout and keeps caches.
|
|
printf 'new upstream revision\n' >"$fake/README"
|
|
git -C "$fake" add README
|
|
git -C "$fake" -c user.name=FDS -c user.email=test@example.invalid commit -qm update
|
|
git -C "$fake" rev-parse HEAD >"$scratch/repo/VOID_PACKAGES_COMMIT"
|
|
# Production initializes upstream with depth 1; updating that boundary must work.
|
|
git -C "$fake" rev-parse HEAD >"$fake/.git/shallow"
|
|
expect_failure 'outdated build checkout' bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
|
|
"$scratch/repo/tools/prepare-void"
|
|
[[ $(stat -c %i "$build/hostdir/cache") == "$cache_inode" ]] || die 'Pin update replaced cache'
|
|
[[ $(git -C "$build" rev-parse HEAD) == "$(cat "$scratch/repo/VOID_PACKAGES_COMMIT")" ]] || die 'Build pin not advanced'
|
|
mkdir -p "$scratch/repo/packages/fds-upstream"
|
|
printf '# collision\n' >"$scratch/repo/packages/fds-upstream/template"
|
|
expect_failure 'overlay replacing upstream package' "$scratch/repo/tools/prepare-void"
|
|
rm -r "$scratch/repo/packages/fds-upstream"
|
|
printf '# changed config\n' >>"$build/etc/conf"
|
|
expect_failure 'overwriting local xbps configuration' "$scratch/repo/tools/prepare-void"
|
|
printf '\n# dirty\n' >>"$fake/xbps-src"
|
|
expect_failure 'modified Void source' bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
|
|
printf '%040d\n' 0 >"$scratch/repo/VOID_PACKAGES_COMMIT"
|
|
expect_failure 'wrong Void commit' bash -c 'source "$1"; check_void_pin' _ "$scratch/repo/tools/lib.sh"
|
|
printf 'PASS: M0 guardrail checks complete\n'
|