278 lines
11 KiB
Bash
Executable File
278 lines
11 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# `boot` is downloaded before the repository exists. It may hand off only
|
|
# after both the downloaded script and the requested Git commit have been
|
|
# verified. This fixture stubs Git and install inside a throwaway PANAMA_PATH;
|
|
# it never contacts the network or mutates the real checkout.
|
|
|
|
set -uo pipefail
|
|
|
|
repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
boot="$repo_dir/boot"
|
|
|
|
findings=()
|
|
note() { findings+=("$1"); }
|
|
|
|
[[ -x "$boot" ]] || { printf 'boot contract: %s is not executable\n' "$boot" >&2; exit 1; }
|
|
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "$work"' EXIT
|
|
|
|
calls="$work/calls"
|
|
state="$work/state"
|
|
stub_dir="$work/bin"
|
|
clone_dir="$work/Panama"
|
|
revision='0123456789abcdef0123456789abcdef01234567'
|
|
ancestor_revision='1111111111111111111111111111111111111111'
|
|
mismatched_revision='fedcba9876543210fedcba9876543210fedcba98'
|
|
boot_sha="$(sha256sum "$boot" | cut -d' ' -f1)"
|
|
mkdir -p "$stub_dir" "$state"
|
|
|
|
cat >"$work/fake-install" <<STUB
|
|
#!/usr/bin/env bash
|
|
printf 'install PANAMA_PATH=%s\n' "\${PANAMA_PATH:-unset}" >>"$calls"
|
|
STUB
|
|
chmod +x "$work/fake-install"
|
|
|
|
cat >"$stub_dir/git" <<STUB
|
|
#!/usr/bin/env bash
|
|
printf 'git %s\n' "\$*" >>"$calls"
|
|
mode="\$(<"$state/mode")"
|
|
|
|
case "\${1:-}" in
|
|
init)
|
|
[[ "\$#" -eq 2 && "\$2" == "$clone_dir" ]] || exit 97
|
|
mkdir -p "$clone_dir/.git"
|
|
;;
|
|
-C)
|
|
[[ "\${2:-}" == "$clone_dir" ]] || exit 97
|
|
case "\${3:-}" in
|
|
remote)
|
|
[[ "\$#" -eq 6 && "\$4" == add && "\$5" == origin \
|
|
&& "\$6" == https://git.gbrown.org/gib/Panama.git ]] || exit 97
|
|
;;
|
|
fetch)
|
|
if [[ "\${4:-}" == --depth=1 ]]; then
|
|
[[ "\$#" -eq 6 && "\$5" == origin && "\$6" == "$revision" ]] || exit 97
|
|
else
|
|
[[ "\$#" -eq 5 && "\$4" == origin && "\$5" == "$revision" ]] || exit 97
|
|
fi
|
|
[[ "\$mode" != fetch-failure && "\$mode" != fresh-fetch-failure ]] || exit 42
|
|
;;
|
|
checkout)
|
|
if [[ "\${4:-}" == --detach ]]; then
|
|
[[ "\$#" -eq 5 && "\$5" == "$revision" ]] || exit 97
|
|
cp "$work/fake-install" "$clone_dir/install"
|
|
chmod +x "$clone_dir/install"
|
|
printf '%s\n' '$revision' >"$clone_dir/.git/HEAD"
|
|
elif [[ "\${4:-}" == -b ]]; then
|
|
[[ "\$#" -eq 5 && "\$5" == main ]] || exit 97
|
|
mkdir -p "$clone_dir/.git/refs/heads"
|
|
printf '%s\n' '$revision' >"$clone_dir/.git/refs/heads/main"
|
|
printf 'ref: refs/heads/main\n' >"$clone_dir/.git/HEAD"
|
|
else
|
|
exit 97
|
|
fi
|
|
;;
|
|
config)
|
|
case "\${4:-}:\${5:-}:\${6:-}" in
|
|
branch.main.remote:origin:|branch.main.merge:refs/heads/main:) ;;
|
|
*) exit 97 ;;
|
|
esac
|
|
;;
|
|
status)
|
|
[[ "\$#" -eq 4 && "\$4" == --porcelain ]] || exit 97
|
|
cat "$state/status"
|
|
;;
|
|
merge-base)
|
|
[[ "\$#" -eq 6 && "\$4" == --is-ancestor && "\$5" == HEAD \
|
|
&& "\$6" == "$revision" ]] || exit 97
|
|
[[ "\$mode" != divergent ]] || exit 1
|
|
;;
|
|
merge)
|
|
[[ "\$#" -eq 5 && "\$4" == --ff-only && "\$5" == "$revision" ]] || exit 97
|
|
if [[ "\$mode" == existing-head-mismatch ]]; then
|
|
printf '%s\n' '$mismatched_revision' >"$state/head-revision"
|
|
else
|
|
printf '%s\n' '$revision' >"$state/head-revision"
|
|
fi
|
|
cp "$work/fake-install" "$clone_dir/install"
|
|
chmod +x "$clone_dir/install"
|
|
;;
|
|
rev-parse)
|
|
[[ "\$#" -eq 4 && "\$4" == 'HEAD^{commit}' ]] || exit 97
|
|
cat "$state/head-revision"
|
|
;;
|
|
*) exit 97 ;;
|
|
esac
|
|
;;
|
|
*) exit 97 ;;
|
|
esac
|
|
STUB
|
|
chmod +x "$stub_dir/git"
|
|
|
|
configure_case() {
|
|
local mode="$1" head_revision="${2:-$revision}" status="${3:-}"
|
|
rm -rf "$clone_dir"
|
|
: >"$calls"
|
|
printf '%s\n' "$mode" >"$state/mode"
|
|
printf '%s\n' "$head_revision" >"$state/head-revision"
|
|
printf '%s' "$status" >"$state/status"
|
|
}
|
|
|
|
configure_existing_case() {
|
|
configure_case "$@"
|
|
mkdir -p "$clone_dir/.git"
|
|
cp "$work/fake-install" "$clone_dir/install"
|
|
chmod +x "$clone_dir/install"
|
|
}
|
|
|
|
run_boot() {
|
|
local supplied_revision="$1" supplied_sha="$2"
|
|
local -a env_args=(
|
|
"PATH=$stub_dir:$PATH"
|
|
"PANAMA_PATH=$clone_dir"
|
|
)
|
|
[[ "$supplied_revision" == UNSET ]] \
|
|
&& env_args+=(-u PANAMA_BOOT_REVISION) \
|
|
|| env_args+=("PANAMA_BOOT_REVISION=$supplied_revision")
|
|
[[ "$supplied_sha" == UNSET ]] \
|
|
&& env_args+=(-u PANAMA_BOOT_SHA256) \
|
|
|| env_args+=("PANAMA_BOOT_SHA256=$supplied_sha")
|
|
env "${env_args[@]}" bash "$boot" </dev/null >/dev/null 2>&1
|
|
run_status=$?
|
|
}
|
|
|
|
assert_no_git_or_install() {
|
|
local case_name="$1"
|
|
if grep -qE '^(git|install) ' "$calls"; then
|
|
note "$case_name reached Git or install"
|
|
fi
|
|
}
|
|
|
|
assert_no_install_or_rewrite() {
|
|
local case_name="$1"
|
|
grep -q '^install ' "$calls" && note "$case_name reached install"
|
|
grep -qE '^git .* (reset|checkout -B|checkout -f)($| )' "$calls" \
|
|
&& note "$case_name rewrote the checkout"
|
|
}
|
|
|
|
# Missing, malformed, or mismatched bootstrap inputs fail before Git.
|
|
input_cases=(
|
|
'missing revision|UNSET|BOOT_SHA'
|
|
'short revision|01234567|BOOT_SHA'
|
|
'uppercase revision|0123456789ABCDEF0123456789ABCDEF01234567|BOOT_SHA'
|
|
'missing digest|REVISION|UNSET'
|
|
'short digest|REVISION|01234567'
|
|
'uppercase digest|REVISION|AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
|
|
'mismatched digest|REVISION|aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
|
|
)
|
|
|
|
for input_case in "${input_cases[@]}"; do
|
|
IFS='|' read -r name supplied_revision supplied_sha <<<"$input_case"
|
|
[[ "$supplied_revision" == REVISION ]] && supplied_revision="$revision"
|
|
[[ "$supplied_sha" == BOOT_SHA ]] && supplied_sha="$boot_sha"
|
|
configure_case validation-only
|
|
run_boot "$supplied_revision" "$supplied_sha"
|
|
(( run_status != 0 )) || note "$name was accepted"
|
|
assert_no_git_or_install "$name"
|
|
done
|
|
|
|
# A fresh install fetches only the requested commit, verifies checked-out HEAD,
|
|
# creates the tracked local main branch, and hands off.
|
|
configure_case fresh
|
|
run_boot "$revision" "$boot_sha"
|
|
(( run_status == 0 )) || note 'verified fresh bootstrap failed'
|
|
grep -qF "git init $clone_dir" "$calls" \
|
|
|| note 'fresh bootstrap did not initialize PANAMA_PATH'
|
|
grep -qF "git -C $clone_dir fetch --depth=1 origin $revision" "$calls" \
|
|
|| note 'fresh bootstrap did not fetch the exact revision'
|
|
grep -qF "git -C $clone_dir rev-parse HEAD^{commit}" "$calls" \
|
|
|| note 'fresh bootstrap did not resolve the checked-out commit'
|
|
grep -qF "git -C $clone_dir checkout -b main" "$calls" \
|
|
|| note 'fresh bootstrap did not create local main after verification'
|
|
grep -qF "git -C $clone_dir config branch.main.remote origin" "$calls" \
|
|
|| note 'fresh bootstrap did not configure main remote tracking'
|
|
grep -qF "git -C $clone_dir config branch.main.merge refs/heads/main" "$calls" \
|
|
|| note 'fresh bootstrap did not configure main merge tracking'
|
|
grep -qF "install PANAMA_PATH=$clone_dir" "$calls" \
|
|
|| note 'verified fresh bootstrap did not hand off with PANAMA_PATH'
|
|
grep -qE '^git (clone|.* pull)' "$calls" \
|
|
&& note 'fresh bootstrap used mutable clone or pull behavior'
|
|
|
|
# A fresh fetch failure stops before any checked-out HEAD or executable
|
|
# handoff exists. The empty initialized Git directory is not a usable checkout.
|
|
configure_case fresh-fetch-failure
|
|
run_boot "$revision" "$boot_sha"
|
|
(( run_status != 0 )) || note 'fresh fetch failure returned success'
|
|
grep -qF "git -C $clone_dir fetch --depth=1 origin $revision" "$calls" \
|
|
|| note 'fresh fetch failure did not exercise the exact fetch'
|
|
assert_no_install_or_rewrite 'fresh fetch failure'
|
|
if grep -qE '^git .* (checkout|rev-parse)($| )' "$calls"; then
|
|
note 'fresh fetch failure reported or materialized a checked-out HEAD'
|
|
fi
|
|
if [[ -x "$clone_dir/install" || -e "$clone_dir/.git/HEAD" \
|
|
|| -e "$clone_dir/.git/refs/heads/main" ]]; then
|
|
note 'fresh fetch failure left a usable checkout'
|
|
fi
|
|
|
|
# A fetched checkout whose HEAD does not equal the requested commit never
|
|
# creates the trusted branch or reaches install.
|
|
configure_case head-mismatch "$mismatched_revision"
|
|
run_boot "$revision" "$boot_sha"
|
|
(( run_status != 0 )) || note 'fresh HEAD mismatch returned success'
|
|
assert_no_install_or_rewrite 'fresh HEAD mismatch'
|
|
grep -qF "git -C $clone_dir checkout -b main" "$calls" \
|
|
&& note 'fresh HEAD mismatch created local main before equality passed'
|
|
|
|
# A clean existing ancestor is fetched and advanced with fast-forward only.
|
|
configure_existing_case existing "$ancestor_revision"
|
|
run_boot "$revision" "$boot_sha"
|
|
(( run_status == 0 )) || note 'clean ancestor bootstrap failed'
|
|
grep -qF "git -C $clone_dir status --porcelain" "$calls" \
|
|
|| note 'existing checkout cleanliness was not checked'
|
|
grep -qF "git -C $clone_dir fetch origin $revision" "$calls" \
|
|
|| note 'existing checkout did not fetch the exact revision'
|
|
grep -qF "git -C $clone_dir merge-base --is-ancestor HEAD $revision" "$calls" \
|
|
|| note 'existing checkout ancestry was not checked'
|
|
grep -qF "git -C $clone_dir merge --ff-only $revision" "$calls" \
|
|
|| note 'existing checkout was not advanced fast-forward-only'
|
|
grep -qF "install PANAMA_PATH=$clone_dir" "$calls" \
|
|
|| note 'verified existing checkout did not reach install'
|
|
grep -qE '^git .* (reset|pull)($| )' "$calls" \
|
|
&& note 'existing checkout used reset or pull instead of the exact revision'
|
|
|
|
# Dirty and divergent checkouts fail closed without rewriting or installing.
|
|
configure_existing_case dirty "$ancestor_revision" $' M boot\n'
|
|
run_boot "$revision" "$boot_sha"
|
|
(( run_status != 0 )) || note 'dirty checkout returned success'
|
|
grep -qF "git -C $clone_dir fetch origin $revision" "$calls" \
|
|
&& note 'dirty checkout fetched before refusing local work'
|
|
assert_no_install_or_rewrite 'dirty checkout'
|
|
|
|
configure_existing_case divergent "$ancestor_revision"
|
|
run_boot "$revision" "$boot_sha"
|
|
(( run_status != 0 )) || note 'divergent checkout returned success'
|
|
grep -qF "git -C $clone_dir merge --ff-only $revision" "$calls" \
|
|
&& note 'divergent checkout attempted a merge'
|
|
assert_no_install_or_rewrite 'divergent checkout'
|
|
|
|
# Fetch and post-fast-forward equality failures also stop before handoff.
|
|
configure_existing_case fetch-failure "$ancestor_revision"
|
|
run_boot "$revision" "$boot_sha"
|
|
(( run_status != 0 )) || note 'fetch failure returned success'
|
|
assert_no_install_or_rewrite 'fetch failure'
|
|
|
|
configure_existing_case existing-head-mismatch "$ancestor_revision"
|
|
run_boot "$revision" "$boot_sha"
|
|
(( run_status != 0 )) || note 'existing HEAD mismatch returned success'
|
|
assert_no_install_or_rewrite 'existing HEAD mismatch'
|
|
|
|
if (( ${#findings[@]} > 0 )); then
|
|
printf 'boot contract: %d finding(s)\n' "${#findings[@]}" >&2
|
|
printf ' - %s\n' "${findings[@]}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf 'boot contract: PASS\n'
|