mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
3d3eb5f3a8
Git in the build container could not read a worktree's repository, whose .git names a directory outside the mounted tree, or the objects a --shared clone borrows from another repository. Worktree packages carried no revision, and a --shared clone's package claimed a clean tree when it was dirty. The container build now mounts, read-only at their own paths, the git directories outside the tree that the checkout refers to: the common git directory and every alternate object store, followed as deep as git follows them. A relative alternates entry that would climb above / where the container sees it is refused, with a request to write it as an absolute path. The container compares the HEAD it reads with the host's before it waits for the lock, so a gap in those mounts fails at once. A tree that is not the top of its own work tree, such as a release tarball unpacked inside a packaging repository, is built as no checkout and its binaries carry no revision: the outer repository's HEAD is not the tree's revision. After packaging, testing/check-deb-revision.sh runs each packaged binary and checks that it carries the tree's commit and dirty flag. It fails when HEAD moved during the build, and when git can read HEAD but not the tree's state. When the state changed during the build it checks the commit only.