Fix: Lock installer input state
This commit is contained in:
Gabriel Brown
@@ -55,6 +55,7 @@ fi
|
||||
# ── The extension ────────────────────────────────────────────────────────────
|
||||
|
||||
manifest="$extension/package.json"
|
||||
lockfile="$extension/package-lock.json"
|
||||
if [[ ! -f "$manifest" ]]; then
|
||||
note 'the panama-search extension has no manifest'
|
||||
else
|
||||
@@ -76,6 +77,15 @@ else
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ! -f "$lockfile" ]]; then
|
||||
note 'the panama-search extension has no package-lock.json, so npm ci cannot install a fresh clone'
|
||||
elif git -C "$repo_dir" check-ignore -q "$lockfile" 2>/dev/null; then
|
||||
note 'the panama-search package-lock.json is ignored, so a fresh clone cannot use npm ci'
|
||||
elif ! git -C "$repo_dir" ls-files --error-unmatch -- \
|
||||
'config/local/share/vicinae/extensions/panama-search/package-lock.json' >/dev/null 2>&1; then
|
||||
note 'the panama-search package-lock.json is not tracked, so a fresh clone cannot use npm ci'
|
||||
fi
|
||||
|
||||
# ── One engine, written twice ────────────────────────────────────────────────
|
||||
#
|
||||
# The script command and the extension both have to know where a search goes.
|
||||
@@ -124,23 +134,29 @@ trap 'rm -rf -- "$fixture_root"' EXIT
|
||||
mkdir -p "$fixture_root/config/local/share/vicinae/scripts" \
|
||||
"$fixture_root/config/local/share/vicinae/extensions/panama-search/src" \
|
||||
"$fixture_root/bin"
|
||||
printf '{"name":"panama-search","dependencies":{"left-pad":"1.3.0"}}\n' \
|
||||
>"$fixture_root/config/local/share/vicinae/extensions/panama-search/package.json"
|
||||
printf '{"lockfileVersion":3,"packages":{}}\n' \
|
||||
>"$fixture_root/config/local/share/vicinae/extensions/panama-search/package-lock.json"
|
||||
lockfile="$fixture_root/config/local/share/vicinae/extensions/panama-search/package-lock.json"
|
||||
fixture_extension="$fixture_root/config/local/share/vicinae/extensions/panama-search"
|
||||
cp -- "$manifest" "$fixture_extension/package.json"
|
||||
cp -- "$lockfile" "$fixture_extension/package-lock.json"
|
||||
cmp -s -- "$lockfile" "$fixture_extension/package-lock.json" \
|
||||
|| note 'the fresh-clone fixture did not consume the repository package-lock.json'
|
||||
sed -i 's/"dependencies": {/"dependencies": {"fixture-mismatch": "1.0.0",/' \
|
||||
"$fixture_extension/package.json"
|
||||
lockfile="$fixture_extension/package-lock.json"
|
||||
lock_before="$fixture_root/package-lock.before"
|
||||
cp -- "$lockfile" "$lock_before"
|
||||
repository_lock_sha256="$(sha256sum -- "$lock_before" | awk '{ print $1 }')"
|
||||
cat >"$fixture_root/bin/npm" <<'EOF'
|
||||
#!/usr/bin/env bash
|
||||
printf '%s\n' "$*" >>"${NPM_LOG:?}"
|
||||
[[ "${1:-}" == ci ]] || exit 64
|
||||
[[ "$(sha256sum -- package-lock.json | awk '{ print $1 }')" == "${NPM_EXPECTED_LOCK_SHA256:?}" ]] || exit 65
|
||||
exit 1
|
||||
EOF
|
||||
chmod +x "$fixture_root/bin/npm"
|
||||
stage_status=0
|
||||
stage_output="$(PATH="$fixture_root/bin:$PATH" PANAMA_PATH="$fixture_root" \
|
||||
VICINAE_DATA_DIR="$fixture_root/vicinae-data" NPM_LOG="$fixture_root/npm.log" \
|
||||
NPM_EXPECTED_LOCK_SHA256="$repository_lock_sha256" \
|
||||
bash "$stage" 2>&1)" || stage_status=$?
|
||||
[[ "$stage_status" -eq 0 ]] \
|
||||
|| note "the Vicinae stage returned $stage_status for a lockfile mismatch instead of remaining nonfatal"
|
||||
|
||||
@@ -40,6 +40,20 @@ STAGE_NAMES=(install-packages link-dotfiles link-skills link-user change-setting
|
||||
link-vicinae-scripts setup-server link-server setup-identity
|
||||
install-hardware)
|
||||
|
||||
copy_hash_inputs() {
|
||||
local root="$1" source relative
|
||||
while IFS= read -r -d '' source; do
|
||||
relative="${source#"$repo_dir"/}"
|
||||
mkdir -p "$(dirname "$root/$relative")"
|
||||
cp -- "$source" "$root/$relative"
|
||||
done < <(
|
||||
find "$repo_dir/setup/packages" -maxdepth 1 -type f -print0
|
||||
find "$repo_dir/setup/provenance" -type f -print0
|
||||
)
|
||||
mkdir -p "$root/setup/lib"
|
||||
cp -- "$repo_dir/setup/lib/artifact-provenance" "$root/setup/lib/artifact-provenance"
|
||||
}
|
||||
|
||||
# A PANAMA_PATH that looks enough like the real one for install to run, and
|
||||
# records what it was asked to do instead of doing it.
|
||||
build_fixture() {
|
||||
@@ -51,10 +65,7 @@ build_fixture() {
|
||||
|
||||
cp "$installer" "$root/install"
|
||||
: >"$root/bin/ascii"
|
||||
printf 'base-package\n' >"$root/setup/packages/core-packages"
|
||||
printf 'artifact provenance\n' >"$root/setup/lib/artifact-provenance"
|
||||
printf 'reviewed installer inputs\n' >"$root/setup/provenance/installers.conf"
|
||||
printf 'reviewed key\n' >"$root/setup/provenance/keys/fixture.asc"
|
||||
copy_hash_inputs "$root"
|
||||
|
||||
local stage
|
||||
for stage in "${STAGE_NAMES[@]}"; do
|
||||
@@ -134,6 +145,20 @@ run_install() {
|
||||
return "$status"
|
||||
}
|
||||
|
||||
run_hash() {
|
||||
local root="$1"
|
||||
sed -n '/^hash_packages() {/,/^}$/p' "$root/install" >"$root/hash-only"
|
||||
printf 'set -uo pipefail\nhash_packages\n' >>"$root/hash-only"
|
||||
PANAMA_PATH="$root" bash "$root/hash-only" 2>"$root/hash-only.err"
|
||||
}
|
||||
|
||||
assert_hash_failure() {
|
||||
local root="$1" description="$2" status=0 digest
|
||||
digest="$(run_hash "$root")" || status=$?
|
||||
[[ "$status" -ne 0 && -z "$digest" ]] \
|
||||
|| note "$description produced a digest instead of failing closed"
|
||||
}
|
||||
|
||||
# ── 1. The interview never runs on an upgrade ────────────────────────────────
|
||||
|
||||
build_fixture "$tmp/a"
|
||||
@@ -197,6 +222,19 @@ done
|
||||
|
||||
# ── 3. The packages hash gates the stage, and a failure does not record it ───
|
||||
|
||||
package_inputs=()
|
||||
while IFS= read -r -d '' input; do
|
||||
package_inputs+=("${input#"$repo_dir"/}")
|
||||
done < <(find "$repo_dir/setup/packages" -maxdepth 1 -type f -print0)
|
||||
provenance_inputs=()
|
||||
while IFS= read -r -d '' input; do
|
||||
provenance_inputs+=("${input#"$repo_dir"/}")
|
||||
done < <(find "$repo_dir/setup/provenance" -type f -print0)
|
||||
(( ${#package_inputs[@]} > 0 )) \
|
||||
|| note 'the current repository has no top-level package input to exercise'
|
||||
(( ${#provenance_inputs[@]} > 0 )) \
|
||||
|| note 'the current repository has no provenance input to exercise'
|
||||
|
||||
# Second run, nothing changed: the stage must be skipped.
|
||||
install_status=0
|
||||
ran_again="$(run_install "$tmp/a" --upgrade)" || install_status=$?
|
||||
@@ -213,33 +251,75 @@ ran_forced="$(run_install "$tmp/a" --upgrade --packages)" || install_status=$?
|
||||
grep -qx 'install-packages' <<<"$ran_forced" \
|
||||
|| note '--packages did not force install-packages to run'
|
||||
|
||||
# A changed list brings the stage back.
|
||||
printf 'another-package\n' >>"$tmp/a/setup/packages/core-packages"
|
||||
install_status=0
|
||||
ran_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
|
||||
[[ "$install_status" -eq 0 ]] \
|
||||
|| note "install --upgrade failed after a package-list change with status $install_status"
|
||||
grep -qx 'install-packages' <<<"$ran_changed" \
|
||||
|| note 'a changed package list did not bring install-packages back'
|
||||
|
||||
# The package stage consumes more than package lists. Each reviewed input must
|
||||
# independently invalidate a recorded package state so an upgrade cannot keep
|
||||
# using a stale trust or installer policy.
|
||||
for state_input in \
|
||||
'setup/scripts/install-packages installer adapter' \
|
||||
'setup/lib/artifact-provenance provenance helper' \
|
||||
'setup/provenance/installers.conf installer provenance' \
|
||||
'setup/provenance/keys/fixture.asc provenance key'; do
|
||||
read -r relative label <<<"$state_input"
|
||||
printf 'changed %s\n' "$label" >>"$tmp/a/$relative"
|
||||
# Every current package and provenance member is part of the state definition.
|
||||
# Dynamically discovering them makes this fail when a new reviewed input is
|
||||
# added but omitted from hash_packages.
|
||||
for relative in "${package_inputs[@]}" "${provenance_inputs[@]}" \
|
||||
'setup/scripts/install-packages' 'setup/lib/artifact-provenance'; do
|
||||
printf 'changed %s\n' "$relative" >>"$tmp/a/$relative"
|
||||
install_status=0
|
||||
ran_input_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
|
||||
[[ "$install_status" -eq 0 ]] \
|
||||
|| note "install --upgrade failed after a $label change with status $install_status"
|
||||
|| note "install --upgrade failed after changing $relative with status $install_status"
|
||||
grep -qx 'install-packages' <<<"$ran_input_changed" \
|
||||
|| note "a changed $label did not bring install-packages back"
|
||||
|| note "a changed $relative did not bring install-packages back"
|
||||
done
|
||||
|
||||
# A path-only change must invalidate state even when the file bytes are exact.
|
||||
for relative in "${package_inputs[0]:-}" "${provenance_inputs[0]:-}"; do
|
||||
[[ -n "$relative" ]] || continue
|
||||
build_fixture "$tmp/path-rename"
|
||||
run_install "$tmp/path-rename" --upgrade >/dev/null
|
||||
mv -- "$tmp/path-rename/$relative" "$tmp/path-rename/$relative.renamed"
|
||||
install_status=0
|
||||
ran_renamed="$(run_install "$tmp/path-rename" --upgrade)" || install_status=$?
|
||||
[[ "$install_status" -eq 0 ]] \
|
||||
|| note "install --upgrade failed after renaming $relative with status $install_status"
|
||||
grep -qx 'install-packages' <<<"$ran_renamed" \
|
||||
|| note "renaming $relative without changing bytes did not bring install-packages back"
|
||||
done
|
||||
|
||||
# Fixed hash inputs must not silently disappear or degrade into a directory or
|
||||
# link. An unreadable package input also proves a failed content read cannot be
|
||||
# hidden by the final digest command.
|
||||
for fixed_input in setup/scripts/install-packages setup/lib/artifact-provenance; do
|
||||
for case_name in missing directory symlink unreadable; do
|
||||
case_root="$tmp/hash-${fixed_input//\//-}-$case_name"
|
||||
build_fixture "$case_root"
|
||||
fixed_path="$case_root/$fixed_input"
|
||||
case "$case_name" in
|
||||
missing) rm -- "$fixed_path" ;;
|
||||
directory) rm -- "$fixed_path"; mkdir -- "$fixed_path" ;;
|
||||
symlink)
|
||||
printf 'untrusted target\n' >"$case_root/untrusted-target"
|
||||
rm -- "$fixed_path"
|
||||
ln -s "$case_root/untrusted-target" "$fixed_path"
|
||||
;;
|
||||
unreadable) chmod 000 "$fixed_path" ;;
|
||||
esac
|
||||
assert_hash_failure "$case_root" "$fixed_input $case_name"
|
||||
done
|
||||
done
|
||||
read_failure_root="$tmp/hash-package-read-failure"
|
||||
build_fixture "$read_failure_root"
|
||||
chmod 000 "$read_failure_root/${package_inputs[0]}"
|
||||
assert_hash_failure "$read_failure_root" "${package_inputs[0]} unreadable"
|
||||
|
||||
# A hash failure is an installer failure, not a reason to skip the package
|
||||
# stage and retain a stale stamp.
|
||||
build_fixture "$tmp/hash-failure"
|
||||
run_install "$tmp/hash-failure" --upgrade >/dev/null
|
||||
cp -- "$tmp/hash-failure/state/panama/packages-hash" "$tmp/hash-failure/stamp-before"
|
||||
rm -- "$tmp/hash-failure/setup/lib/artifact-provenance"
|
||||
install_status=0
|
||||
ran_hash_failure="$(run_install "$tmp/hash-failure" --upgrade)" || install_status=$?
|
||||
[[ "$install_status" -ne 0 ]] \
|
||||
|| note 'a failed package-state hash returned success'
|
||||
grep -qx 'install-packages' <<<"$ran_hash_failure" \
|
||||
&& note 'a failed package-state hash still ran install-packages'
|
||||
cmp -s -- "$tmp/hash-failure/stamp-before" "$tmp/hash-failure/state/panama/packages-hash" \
|
||||
|| note 'a failed package-state hash wrote a new packages-hash stamp'
|
||||
|
||||
# A failing stage must not record the hash, or the failure is hidden forever.
|
||||
build_fixture "$tmp/c" 1
|
||||
install_status=0
|
||||
|
||||
Reference in New Issue
Block a user