vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#3527): a missing source must report as zero, not as empty

Browse source 
argus, reviewing, ran the guard against a source path that does not
exist rather than one that is empty. grep writes nothing to stdout in
that case, so `|| true` left the count variable empty and the -eq test
died with "integer expected" instead of reporting.

The unit still failed — cat hits the same missing file and set -e stops
it — but with a generic "no such file" rather than the message naming
which half is absent, which is the only thing this guard is for.

`|| echo 0` on all three counts. The gate gained the arm that was
missing: an absent source, asserted to fail THROUGH the guard rather
than merely to fail.
This commit is contained in:
atlas 2026-08-19 20:25:38 +02:00
commit 893b686c15
1 changed files with 18 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nix/host-modules/lib/hive-ca-trust.nix
View file

@ -181,19 +181,32 @@ in
# nothing but public CAs is, for this purpose, an empty one that # nothing but public CAs is, for this purpose, an empty one that
# measures as full. # measures as full.
# #
# `grep -c` exits 1 on zero matches and `set -e` is on, hence the # One helper, because the safe form is not the obvious one and
# `|| true` — without it the guard would die instead of reporting. # three copies of a subtle idiom is three chances to get it wrong.
contributed=$(grep -c 'BEGIN CERTIFICATE' ${source} || true) #
# `grep -c` has two different zero-ish outcomes and `set -e` is
# on: an EMPTY file prints `0` and exits 1, a MISSING file prints
# nothing and exits 2. So `|| true` leaves the variable empty on
# the second — the `-eq` then dies with "integer expected"
# instead of reporting — and `|| echo 0` appends a second zero on
# the first, yielding `00`. Normalising afterwards is the only
# form that survives both.
certs() {
n=$(grep -c 'BEGIN CERTIFICATE' "$1" 2>/dev/null || true)
if [ -z "$n" ]; then n=0; fi
printf '%s' "$n"
}
contributed=$(certs ${source})
if [ "$contributed" -eq 0 ]; then if [ "$contributed" -eq 0 ]; then
echo "${unit}: ${source} contributed no certificate to the bundle" >&2 echo "${unit}: ${source} contributed no certificate to the bundle" >&2
exit 1 exit 1
fi fi
system=$(grep -c 'BEGIN CERTIFICATE' /etc/ssl/certs/ca-certificates.crt || true) system=$(certs /etc/ssl/certs/ca-certificates.crt)
cat /etc/ssl/certs/ca-certificates.crt ${source} > "$tmp" cat /etc/ssl/certs/ca-certificates.crt ${source} > "$tmp"
# `cat` of a source truncated between the count and the copy still # `cat` of a source truncated between the count and the copy still
# exits 0, so the result is checked against what both halves # exits 0, so the result is checked against what both halves
# brought rather than merely for being non-empty. # brought rather than merely for being non-empty.
total=$(grep -c 'BEGIN CERTIFICATE' "$tmp" || true) total=$(certs "$tmp")
if [ "$total" -ne $((system + contributed)) ]; then if [ "$total" -ne $((system + contributed)) ]; then
echo "${unit}: bundle has $total certificates, expected $system + $contributed" >&2 echo "${unit}: bundle has $total certificates, expected $system + $contributed" >&2
exit 1 exit 1