This commit was merged in pull request #974.
This commit is contained in:
@@ -0,0 +1,144 @@
|
||||
#!/usr/bin/env bash
|
||||
# test-verify-clean-clone.sh -- needles for the verifier itself.
|
||||
#
|
||||
# v1 of the verifier passed while the real repository recorded 100644, because it
|
||||
# asserted a SCRATCH repo built by cp. There was no needle that could have caught
|
||||
# that: every case ran against a tree whose modes came off my filesystem.
|
||||
# So the load-bearing needle here is w2 -- SOURCE GIT MODE 100644, DISK MODE 755.
|
||||
# That is the exact contaminated state, and v1 exits 0 on it while v2 must refuse.
|
||||
# A verifier without this needle is the same shape as the defect it verifies.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
VERIFY="$HERE/verify-clean-clone.sh"
|
||||
ARTIFACTS=(push-guard.sh test-push-guard.sh verify-clean-clone.sh mutate-push-guard.sh
|
||||
test-mutate-push-guard.sh
|
||||
test-verify-clean-clone.sh)
|
||||
|
||||
# THE REAL DEPLOYED LAYOUT. Every fixture in the first version of this file
|
||||
# installed the artifacts at the fixture ROOT, so 6/6 green proved flat-layout
|
||||
# operation and said NOTHING about the path these files actually ship at. The
|
||||
# verifier was unusable in place and the suite could not see it, because THE
|
||||
# FIXTURE ENCODED A LAYOUT THAT DOES NOT EXIST. A fixture is a claim about the
|
||||
# world; an untested fixture is an unreviewed one.
|
||||
readonly REAL_PREFIX="packages/mosaic/framework/tools/git"
|
||||
|
||||
PASS=0; FAIL=0
|
||||
TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
|
||||
|
||||
# Build a source repo whose COMMITTED modes are 100755 and whose disk modes are
|
||||
# executable -- the honest state.
|
||||
# mkrepo <repo-root> [subdir]
|
||||
# With a subdir the artifacts are committed at repo/<subdir>/, which is how they
|
||||
# really ship. Echoes the directory the artifacts landed in -- that is what gets
|
||||
# passed as --repo, so the caller never has to reconstruct the path.
|
||||
mkrepo() {
|
||||
local d="$1" sub="${2:-}"
|
||||
local dest="$d${sub:+/$sub}"
|
||||
mkdir -p "$dest"
|
||||
local f
|
||||
for f in "${ARTIFACTS[@]}"; do
|
||||
install -m 755 "$HERE/$f" "$dest/$f"
|
||||
done
|
||||
git -C "$d" init -q .
|
||||
git -C "$d" config user.email "[email protected]"
|
||||
git -C "$d" config user.name "Verifier Needles"
|
||||
git -C "$d" add -A
|
||||
git -C "$d" commit -q -m "artifacts"
|
||||
printf '%s\n' "$dest"
|
||||
}
|
||||
|
||||
run_case() {
|
||||
local name="$1" want_rc="$2" want_txt="$3" repo="$4"
|
||||
local out rc
|
||||
out="$("$VERIFY" --repo "$repo" 2>&1)"; rc=$?
|
||||
if (( rc == want_rc )) && [[ "$out" == *"$want_txt"* ]]; then
|
||||
printf ' ok [%-14s]\n' "$name"; PASS=$(( PASS + 1 ))
|
||||
else
|
||||
printf ' FAIL [%-14s] wanted rc=%d containing %q; got rc=%d\n%s\n' \
|
||||
"$name" "$want_rc" "$want_txt" "$rc" "$out"; FAIL=$(( FAIL + 1 ))
|
||||
fi
|
||||
}
|
||||
|
||||
echo "== POSITIVE CONTROL: an honestly-committed artifact must PASS =="
|
||||
# Without this, every case below could be passing because the verifier always
|
||||
# refuses -- a wall, not a gate.
|
||||
mkrepo "$TMP/good" >/dev/null
|
||||
run_case w1-honest 0 "the COMMITTED artifact ran and passed" "$TMP/good"
|
||||
|
||||
echo
|
||||
echo "== THE DEPLOYED LAYOUT: artifacts NESTED, not at the repository root =="
|
||||
# The blocker: ls-tree was given a bare basename, which is a ROOT-relative
|
||||
# pathspec, so in the real tree every artifact came back NOT TRACKED and the
|
||||
# verifier refused to run at all. This control fails against that version and
|
||||
# passes only when the committed PREFIX is threaded through ls-tree, the cloned
|
||||
# stat, and the suite's working directory.
|
||||
w6dir="$(mkrepo "$TMP/nested" "$REAL_PREFIX")"
|
||||
run_case w6-nested 0 "the COMMITTED artifact ran and passed" "$w6dir"
|
||||
# ...and prove the run actually happened DOWN THERE rather than at the root, or
|
||||
# a passing w6 would only mean the prefix was ignored harmlessly.
|
||||
#
|
||||
# Captured into a variable rather than piped into `grep -q` ON PURPOSE. grep -q
|
||||
# exits at the FIRST match, the verifier then dies of SIGPIPE, and under
|
||||
# `pipefail` the pipeline reports that 141 -- so A SUCCESSFUL MATCH READS AS A
|
||||
# FAILED ASSERTION. This cost me a red w6-prefix against a verifier that was
|
||||
# printing the right prefix all along. Same family as the pipefail/process-
|
||||
# substitution note already on record: the exit status being consulted is not
|
||||
# the status of the thing being asserted.
|
||||
w6out="$("$VERIFY" --repo "$w6dir" 2>&1)"
|
||||
if [[ "$w6out" == *"prefix $REAL_PREFIX/"* ]]; then
|
||||
printf ' ok [%-14s] verifier reported prefix %s/\n' "w6-prefix" "$REAL_PREFIX"; PASS=$(( PASS + 1 ))
|
||||
else
|
||||
printf ' FAIL [%-14s] verifier did not report the nested prefix -- it may have\n' "w6-prefix"
|
||||
printf ' passed by looking at the root, which is the blocker unfixed\n'; FAIL=$(( FAIL + 1 ))
|
||||
fi
|
||||
# And the mode needle must ALSO bite in the nested layout: a prefix threaded
|
||||
# into the clone but not into ls-tree would silently stop checking modes.
|
||||
w7dir="$(mkrepo "$TMP/nested-laundered" "$REAL_PREFIX")"
|
||||
git -C "$TMP/nested-laundered" update-index --chmod=-x "$REAL_PREFIX/push-guard.sh"
|
||||
git -C "$TMP/nested-laundered" commit -q -m "drop exec bit in git only"
|
||||
run_case w7-nested-mode 1 "committed 100644, needs 100755" "$w7dir"
|
||||
|
||||
echo
|
||||
echo "== THE B1 NEEDLE: source git mode 100644, DISK MODE STILL 755 =="
|
||||
# This is the reviewer's exact reproduction. v1 of the verifier exits 0 here.
|
||||
mkrepo "$TMP/laundered" >/dev/null
|
||||
git -C "$TMP/laundered" update-index --chmod=-x push-guard.sh test-push-guard.sh
|
||||
git -C "$TMP/laundered" commit -q -m "drop exec bit in git only"
|
||||
# PROVE THE FIXTURE IS THE CONTAMINATED STATE, not merely a broken repo: git must
|
||||
# say 100644 while the filesystem still says executable. If the disk bit were
|
||||
# gone too, the needle would be testing something easier than the real defect.
|
||||
src_mode="$(git -C "$TMP/laundered" ls-tree HEAD -- push-guard.sh | awk '{print $1}')"
|
||||
disk_mode="$(stat -c '%a' "$TMP/laundered/push-guard.sh")"
|
||||
if [[ "$src_mode" == "100644" && "$disk_mode" == "755" ]]; then
|
||||
printf ' ok [%-14s] fixture is git=%s disk=%s\n' "w2-fixture" "$src_mode" "$disk_mode"; PASS=$(( PASS + 1 ))
|
||||
else
|
||||
printf ' FAIL [%-14s] fixture wrong: git=%s disk=%s -- needle would not test the defect\n' \
|
||||
"w2-fixture" "$src_mode" "$disk_mode"; FAIL=$(( FAIL + 1 ))
|
||||
fi
|
||||
run_case w2-laundered 1 "committed 100644, needs 100755" "$TMP/laundered"
|
||||
|
||||
echo
|
||||
echo "== the artifact must be COMMITTED, or there is no mode to verify =="
|
||||
mkrepo "$TMP/untracked" >/dev/null
|
||||
git -C "$TMP/untracked" rm -q --cached push-guard.sh
|
||||
git -C "$TMP/untracked" commit -q -m "untrack the guard"
|
||||
run_case w3-untracked 1 "NOT TRACKED" "$TMP/untracked"
|
||||
|
||||
echo
|
||||
echo "== a committed SYMLINK is a path, not the reviewed code =="
|
||||
mkrepo "$TMP/symlink" >/dev/null
|
||||
( cd "$TMP/symlink" && rm -f push-guard.sh && ln -s /dev/null push-guard.sh \
|
||||
&& git add push-guard.sh && git commit -q -m "symlink the guard" )
|
||||
run_case w4-symlink 1 "SYMLINK" "$TMP/symlink"
|
||||
|
||||
echo
|
||||
echo "== not a repository at all: REFUSE, never pass =="
|
||||
mkdir -p "$TMP/bare"
|
||||
for f in "${ARTIFACTS[@]}"; do install -m 755 "$HERE/$f" "$TMP/bare/$f"; done
|
||||
run_case w5-norepo 1 "not inside a git repository" "$TMP/bare"
|
||||
|
||||
echo
|
||||
printf '%d passed, %d failed\n' "$PASS" "$FAIL"
|
||||
(( FAIL == 0 ))
|
||||
Reference in New Issue
Block a user