jason.woltje
04e1ce24cc
Remove the R1 slot-controller ties from the C2-14 fixture: the ROW227_CONTROL_ROOT check, the native permit wait in bindLaunch, the fixture-cleanup.json write, the priority.mjs preload and the owned-bwrap.sh override. The launcher uses its own bwrap. The shell runs the driver from an explicit env -i environment (PATH, LANG, a sandbox HOME, XDG dirs and TMPDIR, MOSAIC_CONFIG, no global git config) as its own process group. On a signal the driver gets 3 s by the clock, then its group and any process whose cwd is in the sandbox get SIGKILL, inside the landing gate's 5 s grace. The fixture credentials are defined only in scripts/case2/fixture-credentials.mjs. The new scripts/case2/leak-check.mjs reads them from there and never prints them.
17 lines
777 B
JavaScript
17 lines
777 B
JavaScript
// C2-14 (#1728): the shell's check that no fixture credential reached the driver's output.
|
|
// The values come from fixture-credentials.mjs, the one place they are defined, and are never
|
|
// printed. Exit 0: none of the files holds one. Exit 1: one does. Exit 2: no file given, or a
|
|
// file could not be read, so nothing was checked.
|
|
import { readFileSync } from 'node:fs';
|
|
import { FIXTURE_CREDENTIALS } from './fixture-credentials.mjs';
|
|
|
|
const files = process.argv.slice(2);
|
|
if (!files.length || !FIXTURE_CREDENTIALS.length) process.exit(2);
|
|
let found = false;
|
|
for (const file of files) {
|
|
let bytes;
|
|
try { bytes = readFileSync(file); } catch { process.exit(2); }
|
|
if (FIXTURE_CREDENTIALS.some(value => bytes.includes(value))) found = true;
|
|
}
|
|
process.exit(found ? 1 : 0);
|