mirror of
https://github.com/NixOS/nix.git
synced 2025-11-10 20:46:01 +01:00
67ab776e15
Use `set -u` and `set -o pipefail` to catch accidental mistakes and
failures more strongly.
- `set -u` catches the use of undefined variables
- `set -o pipefail` catches failures (like `set -e`) earlier in the
pipeline.
This makes the tests a bit more robust. It is nice to read code not
worrying about these spurious success paths (via uncaught) errors
undermining the tests. Indeed, I caught some bugs doing this.
There are a few tests where we run a command that should fail, and then
search its output to make sure the failure message is one that we
expect. Before, since the `grep` was the last command in the pipeline
the exit code of those failing programs was silently ignored. Now with
`set -o pipefail` it won't be, and we have to do something so the
expected failure doesn't accidentally fail the test.
To do that we use `expect` and a new `expectStderr` to check for the
exact failing exit code. See the comments on each for why.
`grep -q` is replaced with `grepQuiet`, see the comments on that
function for why.
`grep -v` when we just want the exit code is replaced with `grepInverse,
see the comments on that function for why.
`grep -q -v` together is, surprise surprise, replaced with
`grepQuietInverse`, which is both combined.
(cherry picked from commit c11836126b)
172 lines
4.6 KiB
Bash
172 lines
4.6 KiB
Bash
source common.sh
|
||
|
||
needLocalStore "“--no-require-sigs” can’t be used with the daemon"
|
||
|
||
clearStore
|
||
clearCache
|
||
|
||
# Create the binary cache.
|
||
outPath=$(nix-build dependencies.nix --no-out-link)
|
||
|
||
nix copy --to file://$cacheDir $outPath
|
||
|
||
|
||
basicTests() {
|
||
|
||
# By default, a binary cache doesn't support "nix-env -qas", but does
|
||
# support installation.
|
||
clearStore
|
||
clearCacheCache
|
||
|
||
nix-env --substituters "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "---"
|
||
|
||
nix-store --substituters "file://$cacheDir" --no-require-sigs -r $outPath
|
||
|
||
[ -x $outPath/program ]
|
||
|
||
|
||
# But with the right configuration, "nix-env -qas" should also work.
|
||
clearStore
|
||
clearCacheCache
|
||
echo "WantMassQuery: 1" >> $cacheDir/nix-cache-info
|
||
|
||
nix-env --substituters "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "--S"
|
||
nix-env --substituters "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "--S"
|
||
|
||
x=$(nix-env -f dependencies.nix -qas \* --prebuilt-only)
|
||
[ -z "$x" ]
|
||
|
||
nix-store --substituters "file://$cacheDir" --no-require-sigs -r $outPath
|
||
|
||
nix-store --check-validity $outPath
|
||
nix-store -qR $outPath | grep input-2
|
||
|
||
echo "WantMassQuery: 0" >> $cacheDir/nix-cache-info
|
||
}
|
||
|
||
|
||
# Test LocalBinaryCacheStore.
|
||
basicTests
|
||
|
||
|
||
# Test HttpBinaryCacheStore.
|
||
export _NIX_FORCE_HTTP_BINARY_CACHE_STORE=1
|
||
basicTests
|
||
|
||
|
||
# Test whether Nix notices if the NAR doesn't match the hash in the NAR info.
|
||
clearStore
|
||
|
||
nar=$(ls $cacheDir/nar/*.nar.xz | head -n1)
|
||
mv $nar $nar.good
|
||
mkdir -p $TEST_ROOT/empty
|
||
nix-store --dump $TEST_ROOT/empty | xz > $nar
|
||
|
||
expect 1 nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
|
||
grepQuiet "hash mismatch" $TEST_ROOT/log
|
||
|
||
mv $nar.good $nar
|
||
|
||
|
||
# Test whether this unsigned cache is rejected if the user requires signed caches.
|
||
clearStore
|
||
clearCacheCache
|
||
|
||
if nix-store --substituters "file://$cacheDir" -r $outPath; then
|
||
echo "unsigned binary cache incorrectly accepted"
|
||
exit 1
|
||
fi
|
||
|
||
|
||
# Test whether fallback works if a NAR has disappeared. This does not require --fallback.
|
||
clearStore
|
||
|
||
mv $cacheDir/nar $cacheDir/nar2
|
||
|
||
nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result
|
||
|
||
mv $cacheDir/nar2 $cacheDir/nar
|
||
|
||
|
||
# Test whether fallback works if a NAR is corrupted. This does require --fallback.
|
||
clearStore
|
||
|
||
mv $cacheDir/nar $cacheDir/nar2
|
||
mkdir $cacheDir/nar
|
||
for i in $(cd $cacheDir/nar2 && echo *); do touch $cacheDir/nar/$i; done
|
||
|
||
(! nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result)
|
||
|
||
nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result --fallback
|
||
|
||
rm -rf $cacheDir/nar
|
||
mv $cacheDir/nar2 $cacheDir/nar
|
||
|
||
|
||
# Test whether building works if the binary cache contains an
|
||
# incomplete closure.
|
||
clearStore
|
||
|
||
rm $(grep -l "StorePath:.*dependencies-input-2" $cacheDir/*.narinfo)
|
||
|
||
nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
|
||
grepQuiet "copying path" $TEST_ROOT/log
|
||
|
||
|
||
if [ -n "$HAVE_SODIUM" ]; then
|
||
|
||
# Create a signed binary cache.
|
||
clearCache
|
||
clearCacheCache
|
||
|
||
declare -a res=($(nix-store --generate-binary-cache-key test.nixos.org-1 $TEST_ROOT/sk1 $TEST_ROOT/pk1 ))
|
||
publicKey="$(cat $TEST_ROOT/pk1)"
|
||
|
||
res=($(nix-store --generate-binary-cache-key test.nixos.org-1 $TEST_ROOT/sk2 $TEST_ROOT/pk2))
|
||
badKey="$(cat $TEST_ROOT/pk2)"
|
||
|
||
res=($(nix-store --generate-binary-cache-key foo.nixos.org-1 $TEST_ROOT/sk3 $TEST_ROOT/pk3))
|
||
otherKey="$(cat $TEST_ROOT/pk3)"
|
||
|
||
_NIX_FORCE_HTTP_BINARY_CACHE_STORE= nix copy --to file://$cacheDir?secret-key=$TEST_ROOT/sk1 $outPath
|
||
|
||
|
||
# Downloading should fail if we don't provide a key.
|
||
clearStore
|
||
clearCacheCache
|
||
|
||
(! nix-store -r $outPath --substituters "file://$cacheDir")
|
||
|
||
|
||
# And it should fail if we provide an incorrect key.
|
||
clearStore
|
||
clearCacheCache
|
||
|
||
(! nix-store -r $outPath --substituters "file://$cacheDir" --trusted-public-keys "$badKey")
|
||
|
||
|
||
# It should succeed if we provide the correct key.
|
||
nix-store -r $outPath --substituters "file://$cacheDir" --trusted-public-keys "$otherKey $publicKey"
|
||
|
||
|
||
# It should fail if we corrupt the .narinfo.
|
||
clearStore
|
||
|
||
cacheDir2=$TEST_ROOT/binary-cache-2
|
||
rm -rf $cacheDir2
|
||
cp -r $cacheDir $cacheDir2
|
||
|
||
for i in $cacheDir2/*.narinfo; do
|
||
grep -v References $i > $i.tmp
|
||
mv $i.tmp $i
|
||
done
|
||
|
||
clearCacheCache
|
||
|
||
(! nix-store -r $outPath --substituters "file://$cacheDir2" --trusted-public-keys "$publicKey")
|
||
|
||
# If we provide a bad and a good binary cache, it should succeed.
|
||
|
||
nix-store -r $outPath --substituters "file://$cacheDir2 file://$cacheDir" --trusted-public-keys "$publicKey"
|
||
|
||
fi # HAVE_LIBSODIUM
|