vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run the platform containers' root check through a build-independent path

Browse source
This commit is contained in:
atlas 2026-10-30 11:13:16 +01:00
commit 29c57e058a
1 changed files with 34 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/module-eval/core-toggle.nix
View file

@ -1814,7 +1814,7 @@ let
# their own unit, warn-only. Every container in these fixtures is one of
# hyperhive's, so the names are read off the fixture: a container added
# without the check breaks the list, which is the point. The unit's own
# pre-start script is not a `hive-priv` entry, so the count is the check
# pre-start script is not a `check-rootfs` entry, so the count is the check
# alone.
name = "every hyperhive container runs the root check warn-only from its own unit, and no hyperhive container is left out";
ok =
@ -1824,13 +1824,13 @@ let
let
pre = m.systemd.services."container@${name}".serviceConfig.ExecStartPre or [ ];
in
builtins.filter (lib.hasInfix "hive-priv") (
builtins.filter (lib.hasInfix "check-rootfs") (
map (p: builtins.unsafeDiscardStringContext (toString p)) pre
);
carries =
m: name:
checks m name == [
(builtins.unsafeDiscardStringContext "-${m.services.hyperhive.deploy.hive-controller.package}/bin/hive-priv check-rootfs --warn-only ${name}")
"-/run/hive-rootfs-check check-rootfs --warn-only ${name}"
];
names = lib.attrNames allLocal.containers;
in
@ -1853,6 +1853,13 @@ let
&& lib.all (carries allLocal) names
&& withCi.containers ? swarm-ci-runner
&& lib.all (carries withCi) (lib.attrNames withCi.containers)
# The line holds no store path, so a new hyperhive build leaves the
# unit text alone. Presence control: the lookup does find the line,
# and a line with a store path is caught by the same test.
&& lib.all (n: !(lib.hasInfix "/nix/store" (lib.head (checks allLocal n)))) names
&& lib.hasInfix "/nix/store" "-/nix/store/x-hyperhive/bin/hive-priv check-rootfs --warn-only x"
# The stable path is a link to the current package's hive-priv.
&& lib.elem "L+ /run/hive-rootfs-check - - - - ${allLocal.services.hyperhive.deploy.hive-controller.package}/bin/hive-priv" allLocal.systemd.tmpfiles.rules
# Control: a name with no unit finds nothing.
&& checks allLocal "swarm-nope" == [ ];
}
@ -1868,7 +1875,7 @@ let
let
hivePrivLines =
m: name:
builtins.filter (lib.hasInfix "hive-priv") (
builtins.filter (lib.hasInfix "check-rootfs") (
map (p: builtins.unsafeDiscardStringContext (toString p)) (
m.systemd.services."container@${name}".serviceConfig.ExecStartPre or [ ]
)
@ -1881,7 +1888,7 @@ let
&& lib.all ignored (allLines allLocal)
&& lib.all ignored (allLines withCi)
# Control: the test discriminates, a line without the prefix is not ignored.
&& !(ignored "/nix/store/x-hyperhive/bin/hive-priv check-rootfs --warn-only x");
&& !(ignored "/run/hive-rootfs-check check-rootfs --warn-only x");
}
{
# The operator's other containers are not hyperhive's to touch: a
@ -1893,7 +1900,7 @@ let
let
checks =
name:
builtins.filter (lib.hasInfix "hive-priv") (
builtins.filter (lib.hasInfix "check-rootfs") (
map (p: builtins.unsafeDiscardStringContext (toString p)) (
withForeignContainer.systemd.services."container@${name}".serviceConfig.ExecStartPre or [ ]
)