From b9c2f834ee37c76fcb21bc5dbcd60bb58a229194 Mon Sep 17 00:00:00 2001 From: Guillaume Maudoux Date: Mon, 22 May 2023 23:39:31 +0200 Subject: [PATCH] Check exact error codes in linux-sandbox.sh --- tests/linux-sandbox-cert-test.nix | 45 ++++++++++++++++--------------- tests/linux-sandbox.sh | 18 ++++++++----- 2 files changed, 34 insertions(+), 29 deletions(-) diff --git a/tests/linux-sandbox-cert-test.nix b/tests/linux-sandbox-cert-test.nix index 2b86dad2e..2fc083ea9 100644 --- a/tests/linux-sandbox-cert-test.nix +++ b/tests/linux-sandbox-cert-test.nix @@ -1,29 +1,30 @@ -{ fixed-output }: +{ mode }: with import ./config.nix; -mkDerivation ({ - name = "ssl-export"; - buildCommand = '' - # Add some indirection, otherwise grepping into the debug output finds the string. - report () { echo CERT_$1_IN_SANDBOX; } +mkDerivation ( + { + name = "ssl-export"; + buildCommand = '' + # Add some indirection, otherwise grepping into the debug output finds the string. + report () { echo CERT_$1_IN_SANDBOX; } - if [ -f /etc/ssl/certs/ca-certificates.crt ]; then - content=$( $TEST_ROOT/log) -if grepQuiet 'error: renaming' $TEST_ROOT/log; then false; fi -grepQuiet 'may not be deterministic' $TEST_ROOT/log +expectStderr 104 nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link --check -K \ + | tee >( grepQuietInverse 'error: renaming' ) \ + | grepQuiet 'may not be deterministic' # Test that sandboxed builds cannot write to /etc easily -(! nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store) +expect 100 nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store ## Test mounting of SSL certificates into the sandbox testCert () { - (! nix-build linux-sandbox-cert-test.nix --argstr fixed-output "$2" --no-out-link --sandbox-paths /nix/store --option ssl-cert-file "$3" 2> $TEST_ROOT/log) - cat $TEST_ROOT/log - grepQuiet "CERT_${1}_IN_SANDBOX" $TEST_ROOT/log + expectation=$1 # "missing" | "present" + mode=$2 # "normal" | "fixed-output" + certFile=$3 # a string that can be the path to a cert file + [ "$mode" == fixed-output ] && ret=1 || ret=100 + expectStderr $ret nix-build linux-sandbox-cert-test.nix --argstr mode "$mode" --no-out-link --sandbox-paths /nix/store --option ssl-cert-file "$certFile" | \ + # tee /dev/stderr | \ + grepQuiet "CERT_${expectation}_IN_SANDBOX" } nocert=$TEST_ROOT/no-cert-file.pem