43 lines
1.3 KiB
Nix
43 lines
1.3 KiB
Nix
# `checks.script-test-granter-login` — runs ../host-modules/lib/granter-login.nix
|
|
# against a stub `bao` whose login and status answers are set per case. The
|
|
# cases are in ./granter-login.sh and the stub is ./granter-login-fake-bao.sh.
|
|
#
|
|
# What runs is the rendered login, with the same `baoStoreUp` text the unit
|
|
# passes, rendered once with the bootstrap-token hint and once without.
|
|
{
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
render =
|
|
haveBootstrapToken:
|
|
pkgs.writeText "granter-login.sh" (
|
|
import ../host-modules/lib/granter-login.nix {
|
|
inherit (pkgs) lib;
|
|
granterCn = "bao-granter";
|
|
granterPolicyName = "bao-granter";
|
|
inherit haveBootstrapToken;
|
|
baoStoreUp = ''HOME=/var/empty bao status >/dev/null 2>>"$err"'';
|
|
setupSteps = [ "bao policy write bao-bootstrap /etc/bootstrap.hcl" ];
|
|
}
|
|
);
|
|
|
|
fakeBao = pkgs.runCommand "fake-bao" { } ''
|
|
install -Dm755 ${./granter-login-fake-bao.sh} $out/bin/bao
|
|
patchShebangs $out/bin
|
|
'';
|
|
in
|
|
pkgs.runCommand "hyperhive-script-test-granter-login"
|
|
{
|
|
LOGIN = render false;
|
|
LOGIN_WITH_TOKEN = render true;
|
|
FAKE_BAO_BIN = "${fakeBao}/bin";
|
|
nativeBuildInputs = [
|
|
pkgs.coreutils
|
|
pkgs.gnugrep
|
|
];
|
|
}
|
|
''
|
|
${pkgs.bash}/bin/bash ${./granter-login.sh}
|
|
touch "$out"
|
|
''
|