From f0233f3a3fd92d443d2502ed29aea076b6572ab7 Mon Sep 17 00:00:00 2001
From: Guillaume Maudoux <guillaume.maudoux@tweag.io>
Date: Tue, 23 May 2023 09:59:49 +0200
Subject: [PATCH] Further refactor linux-sandbox.sh and fix tee usage

---
 tests/linux-sandbox.sh | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/tests/linux-sandbox.sh b/tests/linux-sandbox.sh
index 5c4e0cae9..19a7527bf 100644
--- a/tests/linux-sandbox.sh
+++ b/tests/linux-sandbox.sh
@@ -11,6 +11,8 @@ requireSandboxSupport
 # otherwise things get complicated (e.g. if it's in /bin, do we need
 # /lib as well?).
 if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
+# An alias to automatically bind-mount the $SHELL on nix-build invocations
+nix-sandbox-build () { nix-build --no-out-link --sandbox-paths /nix/store "$@"; }
 
 chmod -R u+w $TEST_ROOT/store0 || true
 rm -rf $TEST_ROOT/store0
@@ -18,7 +20,7 @@ rm -rf $TEST_ROOT/store0
 export NIX_STORE_DIR=/my/store
 export NIX_REMOTE=$TEST_ROOT/store0
 
-outPath=$(nix-build dependencies.nix --no-out-link --sandbox-paths /nix/store)
+outPath=$(nix-sandbox-build dependencies.nix)
 
 [[ $outPath =~ /my/store/.*-dependencies ]]
 
@@ -29,17 +31,18 @@ nix store ls -R -l $outPath | grep foobar
 nix store cat $outPath/foobar | grep FOOBAR
 
 # Test --check without hash rewriting.
-nix-build dependencies.nix --no-out-link --check --sandbox-paths /nix/store
+nix-sandbox-build dependencies.nix --check
 
 # Test that sandboxed builds with --check and -K can move .check directory to store
-nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link
+nix-sandbox-build check.nix -A nondeterministic
 
-expectStderr 104 nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link --check -K \
-  | tee >( grepQuietInverse 'error: renaming' ) \
-  | grepQuiet 'may not be deterministic'
+expectStderr 104 nix-sandbox-build check.nix -A nondeterministic --check -K > $TEST_ROOT/log
+grepQuietInverse 'error: renaming' $TEST_ROOT/log
+grepQuiet 'may not be deterministic' $TEST_ROOT/log
 
 # Test that sandboxed builds cannot write to /etc easily
-expect 100 nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store
+expectStderr 100 nix-sandbox-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' |
+    grepQuiet "/etc/test: Permission denied"
 
 
 ## Test mounting of SSL certificates into the sandbox
@@ -48,9 +51,9 @@ testCert () {
     mode=$2        # "normal" | "fixed-output"
     certFile=$3    # a string that can be the path to a cert file
     [ "$mode" == fixed-output ] && ret=1 || ret=100
-    expectStderr $ret nix-build linux-sandbox-cert-test.nix --argstr mode "$mode" --no-out-link --sandbox-paths /nix/store --option ssl-cert-file "$certFile" | \
-      # tee /dev/stderr | \
-      grepQuiet "CERT_${expectation}_IN_SANDBOX"
+    expectStderr $ret nix-sandbox-build linux-sandbox-cert-test.nix --argstr mode "$mode" --option ssl-cert-file "$certFile" |
+        # tee /dev/stderr |
+        grepQuiet "CERT_${expectation}_IN_SANDBOX"
 }
 
 nocert=$TEST_ROOT/no-cert-file.pem