Fix: Close verification gate review findings
This commit is contained in:
Gabriel Brown
@@ -234,16 +234,116 @@ grep -qx 'install-packages' <<<"$ran_full" \
|
||||
# The fixture also covers a clean fast-forward, installer status propagation,
|
||||
# and the boundary between update and sync before forcing the conflict below.
|
||||
|
||||
# Make every ambient configuration source hostile before constructing the Git
|
||||
# fixtures. A hermetic fixture overrides these values with its own empty state;
|
||||
# consuming any of them either leaves a sentinel or prevents a commit.
|
||||
hostile="$tmp/hostile-environment"
|
||||
mkdir -p "$hostile/home" "$hostile/xdg-config" "$hostile/xdg-state" \
|
||||
"$hostile/xdg-cache" "$hostile/xdg-data" "$hostile/hooks" \
|
||||
"$hostile/template/hooks"
|
||||
for profile in .bash_profile .bashrc .profile; do
|
||||
cat >"$hostile/home/$profile" <<'EOF'
|
||||
printf 'profile\n' >>"${PANAMA_HOSTILE_PROFILE_SENTINEL:?}"
|
||||
EOF
|
||||
done
|
||||
cat >"$hostile/bash-env" <<'EOF'
|
||||
printf 'BASH_ENV\n' >>"${PANAMA_HOSTILE_BASH_ENV_SENTINEL:?}"
|
||||
EOF
|
||||
cat >"$hostile/hooks/pre-commit" <<'EOF'
|
||||
#!/usr/bin/env bash
|
||||
printf 'global hook\n' >>"${PANAMA_HOSTILE_GIT_SENTINEL:?}"
|
||||
exit 97
|
||||
EOF
|
||||
cat >"$hostile/template/hooks/pre-commit" <<'EOF'
|
||||
#!/usr/bin/env bash
|
||||
# PANAMA_HOSTILE_TEMPLATE_HOOK
|
||||
printf 'template hook\n' >>"${PANAMA_HOSTILE_TEMPLATE_SENTINEL:?}"
|
||||
exit 98
|
||||
EOF
|
||||
chmod +x "$hostile/hooks/pre-commit" "$hostile/template/hooks/pre-commit"
|
||||
cat >"$hostile/global.gitconfig" <<EOF
|
||||
[core]
|
||||
hooksPath = $hostile/hooks
|
||||
[commit]
|
||||
gpgSign = true
|
||||
[init]
|
||||
templateDir = $hostile/template
|
||||
EOF
|
||||
cp "$hostile/global.gitconfig" "$hostile/system.gitconfig"
|
||||
|
||||
export HOME="$hostile/home"
|
||||
export XDG_CONFIG_HOME="$hostile/xdg-config"
|
||||
export XDG_STATE_HOME="$hostile/xdg-state"
|
||||
export XDG_CACHE_HOME="$hostile/xdg-cache"
|
||||
export XDG_DATA_HOME="$hostile/xdg-data"
|
||||
export BASH_ENV="$hostile/bash-env"
|
||||
export PANAMA_HOSTILE_PROFILE_SENTINEL="$hostile/profile-sourced"
|
||||
export PANAMA_HOSTILE_BASH_ENV_SENTINEL="$hostile/bash-env-sourced"
|
||||
export PANAMA_HOSTILE_GIT_SENTINEL="$hostile/global-config-sourced"
|
||||
export PANAMA_HOSTILE_TEMPLATE_SENTINEL="$hostile/template-hook-sourced"
|
||||
export GIT_CONFIG_NOSYSTEM=0
|
||||
export GIT_CONFIG_SYSTEM="$hostile/system.gitconfig"
|
||||
export GIT_CONFIG_GLOBAL="$hostile/global.gitconfig"
|
||||
export GIT_CONFIG_COUNT=1
|
||||
export GIT_CONFIG_KEY_0=core.hooksPath
|
||||
export GIT_CONFIG_VALUE_0="$hostile/hooks"
|
||||
export GIT_TEMPLATE_DIR="$hostile/template"
|
||||
|
||||
prepare_cli_fixture_environment() {
|
||||
local root="$1"
|
||||
mkdir -p "$root/home" "$root/xdg-config" "$root/xdg-state" \
|
||||
"$root/xdg-cache" "$root/xdg-data" "$root/xdg-runtime" \
|
||||
"$root/empty-templates" "$root/empty-hooks"
|
||||
chmod 700 "$root/xdg-runtime"
|
||||
}
|
||||
|
||||
run_cli_fixture_environment() {
|
||||
local root="$1"
|
||||
shift
|
||||
env -u BASH_ENV -u ENV -u GIT_CONFIG_PARAMETERS \
|
||||
-u GIT_CONFIG_KEY_0 -u GIT_CONFIG_VALUE_0 \
|
||||
HOME="$root/home" \
|
||||
XDG_CONFIG_HOME="$root/xdg-config" \
|
||||
XDG_STATE_HOME="$root/xdg-state" \
|
||||
XDG_CACHE_HOME="$root/xdg-cache" \
|
||||
XDG_DATA_HOME="$root/xdg-data" \
|
||||
XDG_RUNTIME_DIR="$root/xdg-runtime" \
|
||||
GIT_CONFIG_NOSYSTEM=1 \
|
||||
GIT_CONFIG_SYSTEM=/dev/null \
|
||||
GIT_CONFIG_GLOBAL=/dev/null \
|
||||
GIT_CONFIG_COUNT=0 \
|
||||
GIT_TEMPLATE_DIR="$root/empty-templates" \
|
||||
"$@"
|
||||
}
|
||||
|
||||
fixture_git() {
|
||||
local root="$1"
|
||||
shift
|
||||
run_cli_fixture_environment "$root" \
|
||||
git -c commit.gpgSign=false -c tag.gpgSign=false \
|
||||
-c core.hooksPath="$root/empty-hooks" "$@"
|
||||
}
|
||||
|
||||
configure_fixture_repo() {
|
||||
local root="$1" repository="$2"
|
||||
fixture_git "$root" -C "$repository" config user.email contract@panama || return 1
|
||||
fixture_git "$root" -C "$repository" config user.name contract || return 1
|
||||
fixture_git "$root" -C "$repository" config commit.gpgSign false || return 1
|
||||
fixture_git "$root" -C "$repository" config tag.gpgSign false || return 1
|
||||
fixture_git "$root" -C "$repository" config core.hooksPath "$root/empty-hooks" || return 1
|
||||
}
|
||||
|
||||
# Each fixture has the same three repositories as a real update: a bare remote,
|
||||
# a clone that publishes upstream changes, and the machine clone being updated.
|
||||
build_cli_fixture() (
|
||||
local root="$1"
|
||||
rm -rf "$root" || return 1
|
||||
mkdir -p "$root" || return 1
|
||||
git init -q --bare "$root/origin.git" || return 1
|
||||
git clone -q "$root/origin.git" "$root/upstream" 2>/dev/null || return 1
|
||||
git -C "$root/upstream" config user.email contract@panama || return 1
|
||||
git -C "$root/upstream" config user.name contract || return 1
|
||||
prepare_cli_fixture_environment "$root" || return 1
|
||||
fixture_git "$root" init -q --bare "$root/origin.git" || return 1
|
||||
fixture_git "$root" -C "$root/origin.git" config core.hooksPath "$root/empty-hooks" || return 1
|
||||
fixture_git "$root" clone -q "$root/origin.git" "$root/upstream" 2>/dev/null || return 1
|
||||
configure_fixture_repo "$root" "$root/upstream" || return 1
|
||||
|
||||
mkdir -p "$root/upstream/bin" || return 1
|
||||
cp "$panama" "$root/upstream/bin/panama" || return 1
|
||||
@@ -254,21 +354,20 @@ exit "${PANAMA_UPDATE_INSTALL_RC:-0}"
|
||||
EOF
|
||||
chmod +x "$root/upstream/bin/panama" "$root/upstream/install" || return 1
|
||||
printf 'one\n' >"$root/upstream/f" || return 1
|
||||
git -C "$root/upstream" add -A || return 1
|
||||
git -C "$root/upstream" commit -qm initial || return 1
|
||||
git -C "$root/upstream" push -qu origin HEAD || return 1
|
||||
fixture_git "$root" -C "$root/upstream" add -A || return 1
|
||||
fixture_git "$root" -C "$root/upstream" commit -qm initial || return 1
|
||||
fixture_git "$root" -C "$root/upstream" push -qu origin HEAD || return 1
|
||||
|
||||
git clone -q "$root/origin.git" "$root/machine" || return 1
|
||||
git -C "$root/machine" config user.email contract@panama || return 1
|
||||
git -C "$root/machine" config user.name contract || return 1
|
||||
fixture_git "$root" clone -q "$root/origin.git" "$root/machine" || return 1
|
||||
configure_fixture_repo "$root" "$root/machine" || return 1
|
||||
)
|
||||
|
||||
advance_upstream() (
|
||||
local root="$1" file="$2" contents="$3"
|
||||
printf '%s\n' "$contents" >"$root/upstream/$file" || return 1
|
||||
git -C "$root/upstream" add "$file" || return 1
|
||||
git -C "$root/upstream" commit -qm "update $file" || return 1
|
||||
git -C "$root/upstream" push -q || return 1
|
||||
fixture_git "$root" -C "$root/upstream" add "$file" || return 1
|
||||
fixture_git "$root" -C "$root/upstream" commit -qm "update $file" || return 1
|
||||
fixture_git "$root" -C "$root/upstream" push -q || return 1
|
||||
)
|
||||
|
||||
# This write fails before the later Git commands. The helper must return that
|
||||
@@ -285,26 +384,28 @@ fi
|
||||
|
||||
clean="$tmp/clean-update"
|
||||
if build_cli_fixture "$clean" && advance_upstream "$clean" release new; then
|
||||
machine_before="$(git -C "$clean/machine" rev-parse HEAD)"
|
||||
upstream_after="$(git -C "$clean/upstream" rev-parse HEAD)"
|
||||
machine_before="$(fixture_git "$clean" -C "$clean/machine" rev-parse HEAD)"
|
||||
upstream_after="$(fixture_git "$clean" -C "$clean/upstream" rev-parse HEAD)"
|
||||
[[ "$machine_before" != "$upstream_after" ]] \
|
||||
|| note 'the clean update fixture started current, so it cannot prove a fast-forward'
|
||||
|
||||
: >"$clean/install.log"
|
||||
update_status=0
|
||||
PANAMA_UPDATE_FIXTURE_LOG="$clean/install.log" \
|
||||
run_cli_fixture_environment "$clean" \
|
||||
PANAMA_UPDATE_FIXTURE_LOG="$clean/install.log" \
|
||||
"$clean/machine/bin/panama" update >"$clean/update.out" 2>&1 \
|
||||
|| update_status=$?
|
||||
[[ "$update_status" -eq 0 ]] \
|
||||
|| note "panama update failed on a clean clone with status $update_status"
|
||||
[[ "$(git -C "$clean/machine" rev-parse HEAD)" == "$upstream_after" ]] \
|
||||
[[ "$(fixture_git "$clean" -C "$clean/machine" rev-parse HEAD)" == "$upstream_after" ]] \
|
||||
|| note 'panama update did not fast-forward the clean machine clone'
|
||||
grep -qx -- '--upgrade' "$clean/install.log" \
|
||||
|| note 'panama update did not invoke the installer with --upgrade'
|
||||
|
||||
: >"$clean/install.log"
|
||||
update_status=0
|
||||
PANAMA_UPDATE_FIXTURE_LOG="$clean/install.log" PANAMA_UPDATE_INSTALL_RC=23 \
|
||||
run_cli_fixture_environment "$clean" \
|
||||
PANAMA_UPDATE_FIXTURE_LOG="$clean/install.log" PANAMA_UPDATE_INSTALL_RC=23 \
|
||||
"$clean/machine/bin/panama" update >"$clean/failing-update.out" 2>&1 \
|
||||
|| update_status=$?
|
||||
[[ "$update_status" -eq 23 ]] \
|
||||
@@ -316,7 +417,8 @@ if build_cli_fixture "$clean" && advance_upstream "$clean" release new; then
|
||||
printf 'local sync\n' >"$clean/machine/synced"
|
||||
sync_status=0
|
||||
printf 'y\ncontract sync\n' \
|
||||
| PANAMA_UPDATE_FIXTURE_LOG="$clean/install.log" \
|
||||
| run_cli_fixture_environment "$clean" \
|
||||
PANAMA_UPDATE_FIXTURE_LOG="$clean/install.log" \
|
||||
"$clean/machine/bin/panama" sync >"$clean/sync.out" 2>&1 \
|
||||
|| sync_status=$?
|
||||
[[ "$sync_status" -eq 0 ]] \
|
||||
@@ -335,19 +437,22 @@ if build_cli_fixture "$conflict"; then
|
||||
if advance_upstream "$conflict" f upstream; then
|
||||
: >"$conflict/install.log"
|
||||
conflict_status=0
|
||||
PANAMA_UPDATE_FIXTURE_LOG="$conflict/install.log" \
|
||||
run_cli_fixture_environment "$conflict" \
|
||||
PANAMA_UPDATE_FIXTURE_LOG="$conflict/install.log" \
|
||||
"$conflict/machine/bin/panama" update >"$conflict/update.out" 2>&1 \
|
||||
|| conflict_status=$?
|
||||
[[ "$conflict_status" -eq 0 ]] \
|
||||
|| note "panama update failed while recovering a stash conflict with status $conflict_status"
|
||||
[[ "$(<"$conflict/machine/f")" == upstream ]] \
|
||||
|| note 'panama update did not reset the conflicted file to the upstream version'
|
||||
if git -C "$conflict/machine" grep -qE '^(<<<<<<<|=======|>>>>>>>)' -- .; then
|
||||
if fixture_git "$conflict" -C "$conflict/machine" \
|
||||
grep -qE '^(<<<<<<<|=======|>>>>>>>)' -- .; then
|
||||
note 'panama update left conflict markers in the machine checkout'
|
||||
fi
|
||||
[[ -n "$(git -C "$conflict/machine" stash list)" ]] \
|
||||
[[ -n "$(fixture_git "$conflict" -C "$conflict/machine" stash list)" ]] \
|
||||
|| note 'panama update dropped the stash after its conflicted pop'
|
||||
recovered="$(git -C "$conflict/machine" show 'stash@{0}:f' 2>/dev/null)"
|
||||
recovered="$(fixture_git "$conflict" -C "$conflict/machine" \
|
||||
show 'stash@{0}:f' 2>/dev/null)"
|
||||
[[ "$recovered" == local ]] \
|
||||
|| note 'the stash left by panama update does not contain the local version'
|
||||
else
|
||||
@@ -357,6 +462,18 @@ else
|
||||
note 'the conflict update fixture could not be built'
|
||||
fi
|
||||
|
||||
for sentinel in profile-sourced bash-env-sourced global-config-sourced template-hook-sourced; do
|
||||
[[ ! -e "$hostile/$sentinel" ]] \
|
||||
|| note "the update Git fixture consumed hostile state: $sentinel"
|
||||
done
|
||||
template_copy="$(
|
||||
find "$tmp" -path "$hostile" -prune -o \
|
||||
-type f -path '*/hooks/pre-commit' \
|
||||
-exec grep -lF 'PANAMA_HOSTILE_TEMPLATE_HOOK' {} + 2>/dev/null
|
||||
)"
|
||||
[[ -z "$template_copy" ]] \
|
||||
|| note "the update Git fixture copied a hostile template hook: $template_copy"
|
||||
|
||||
if (( ${#findings[@]} > 0 )); then
|
||||
printf 'update command contract: %d finding(s)\n' "${#findings[@]}" >&2
|
||||
printf ' - %s\n' "${findings[@]}" >&2
|
||||
|
||||
Reference in New Issue
Block a user