Johnathan Corgan
c1ebbb4464
testing/package-isolation/test.sh builds two marked trees at the checkout's HEAD in the package build container, sharing a target volume: one after the other in each order, and both at once, with a fresh target volume per scenario. Tree 2 is a worktree, so its root crate is recompiled on every build as in CI. Each tree adds a line to fips --version naming itself and the fips-core member it was compiled with, and the test reports for every package whether that line and its embedded revision are its own tree's. --script-dir takes the package build scripts from another checkout, so an older script can be shown failing; one that cannot be pointed at other volumes is patched to read them rather than run in the host's. It takes about ten minutes of full CPU and is run by hand, not by ci-local.sh or GitHub CI.
package-isolation
Checks that a Debian package built by
packaging/debian/build-deb-container.sh is built from its own tree,
whatever was built before it or beside it in the shared target volume.
What is here
test.sh: the test. Run it from any checkout:testing/package-isolation/test.sh [--script-dir DIR]. It takes about ten minutes of full CPU and needs docker.- The run's two scratch trees and their packages go in
target/package-isolation.XXXXXXat the checkout's root, made withshared_tmpdirso they can be bind-mount sources, and removed when the test exits. They stay out oftesting/because the static checks that sweep it would read the scratch trees' scripts as the repository's own.
Why it exists
Every checkout on a host builds its package in one target volume,
fips-deb-target-<image>, and every tree is mounted at the same /src in the
container. Cargo judges a workspace crate by file modification times, so
without the protections in packaging/debian/build-in-container.sh a tree
whose files are older than another tree's build reuses that build. This test
builds two marked trees in each order and concurrently, and checks which
tree's code each package holds.
How it decides
Tree 1 is a git clone -s of the checkout's HEAD; tree 2 is a
git worktree add of tree 1, so its root crate is recompiled on every build,
as in a CI worktree. Each tree marks itself before any build: fips --version
gains isolation: root-N core-N, with core-N taken from a constant added to
the fips-core member, or - on a tree without one.
Two verdicts are reported separately for each package:
- marker: the package's isolation line is its own tree's;
- revision: the package's
(rev ...)is its tree's commit and dirty flag.
The marker verdict is the only one that tells the two trees apart. Both are at one commit and both are dirty, so their revisions are identical. Do not drop the marks as redundant with the revision check.
Rules for changing it
- Each scenario uses a fresh target volume, so a scenario's result is its own
and not left over from an earlier one. The registry volume is the run's own;
never point the test at the host's
fips-deb-*volumes. - An older
build-deb-container.shthat cannot takeFIPS_DEB_TARGET_VOLUMEis patched to read it. If the patch does not apply, the test refuses to run rather than build in the host's volumes. - The marks must stay in a part of
--versionthat is compiled whether or not a git revision is embedded: an older script embeds none for a worktree. - Volumes carry the CI label and a run label equal to the name prefix, so
testing/ci-cleanup.shreaps them after a killed run. - It is not in
ci-local.sh's default set or on GitHub, which is a recorded coverage gap: between runs of this test, isolation rests on the checks every package build makes.