From b9c2f834ee37c76fcb21bc5dbcd60bb58a229194 Mon Sep 17 00:00:00 2001
From: Guillaume Maudoux <guillaume.maudoux@tweag.io>
Date: Mon, 22 May 2023 23:39:31 +0200
Subject: [PATCH] Check exact error codes in linux-sandbox.sh

---
 tests/linux-sandbox-cert-test.nix | 45 ++++++++++++++++---------------
 tests/linux-sandbox.sh            | 18 ++++++++-----
 2 files changed, 34 insertions(+), 29 deletions(-)

diff --git a/tests/linux-sandbox-cert-test.nix b/tests/linux-sandbox-cert-test.nix
index 2b86dad2e..2fc083ea9 100644
--- a/tests/linux-sandbox-cert-test.nix
+++ b/tests/linux-sandbox-cert-test.nix
@@ -1,29 +1,30 @@
-{ fixed-output }:
+{ mode }:
 
 with import ./config.nix;
 
-mkDerivation ({
-  name = "ssl-export";
-  buildCommand = ''
-    # Add some indirection, otherwise grepping into the debug output finds the string.
-    report () { echo CERT_$1_IN_SANDBOX; }
+mkDerivation (
+  {
+    name = "ssl-export";
+    buildCommand = ''
+      # Add some indirection, otherwise grepping into the debug output finds the string.
+      report () { echo CERT_$1_IN_SANDBOX; }
 
-    if [ -f /etc/ssl/certs/ca-certificates.crt ]; then
-      content=$(</etc/ssl/certs/ca-certificates.crt)
-      if [ "$content" == CERT_CONTENT ]; then
-        report present
+      if [ -f /etc/ssl/certs/ca-certificates.crt ]; then
+        content=$(</etc/ssl/certs/ca-certificates.crt)
+        if [ "$content" == CERT_CONTENT ]; then
+          report present
+        fi
+      else
+        report missing
       fi
-    else
-      report missing
-    fi
 
-    # Always fail, because we do not want to bother with fixed-output
-    # derivations being cached, and do not want to compute the right hash.
-    false;
-  '';
-} // (
-  if fixed-output == "fixed-output"
-  then { outputHash = "sha256:0000000000000000000000000000000000000000000000000000000000000000"; }
-  else { }
-))
+      # Always fail, because we do not want to bother with fixed-output
+      # derivations being cached, and do not want to compute the right hash.
+      false;
+    '';
+  } // {
+    fixed-output = { outputHash = "sha256:0000000000000000000000000000000000000000000000000000000000000000"; };
+    normal = { };
+  }.${mode}
+)
 
diff --git a/tests/linux-sandbox.sh b/tests/linux-sandbox.sh
index 45f0ce7a4..5c4e0cae9 100644
--- a/tests/linux-sandbox.sh
+++ b/tests/linux-sandbox.sh
@@ -34,19 +34,23 @@ nix-build dependencies.nix --no-out-link --check --sandbox-paths /nix/store
 # Test that sandboxed builds with --check and -K can move .check directory to store
 nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link
 
-(! nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link --check -K 2> $TEST_ROOT/log)
-if grepQuiet 'error: renaming' $TEST_ROOT/log; then false; fi
-grepQuiet 'may not be deterministic' $TEST_ROOT/log
+expectStderr 104 nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link --check -K \
+  | tee >( grepQuietInverse 'error: renaming' ) \
+  | grepQuiet 'may not be deterministic'
 
 # Test that sandboxed builds cannot write to /etc easily
-(! nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store)
+expect 100 nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store
 
 
 ## Test mounting of SSL certificates into the sandbox
 testCert () {
-    (! nix-build linux-sandbox-cert-test.nix --argstr fixed-output "$2" --no-out-link --sandbox-paths /nix/store --option ssl-cert-file "$3" 2> $TEST_ROOT/log)
-    cat $TEST_ROOT/log
-    grepQuiet "CERT_${1}_IN_SANDBOX" $TEST_ROOT/log
+    expectation=$1 # "missing" | "present"
+    mode=$2        # "normal" | "fixed-output"
+    certFile=$3    # a string that can be the path to a cert file
+    [ "$mode" == fixed-output ] && ret=1 || ret=100
+    expectStderr $ret nix-build linux-sandbox-cert-test.nix --argstr mode "$mode" --no-out-link --sandbox-paths /nix/store --option ssl-cert-file "$certFile" | \
+      # tee /dev/stderr | \
+      grepQuiet "CERT_${expectation}_IN_SANDBOX"
 }
 
 nocert=$TEST_ROOT/no-cert-file.pem