vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

module-eval: escape case names in the failure report

Browse source 
`echo 'FAILED: ${c.name}'` hand-quoted a string that is prose, so the
first case name containing an apostrophe to actually fail terminated the
builder script mid-report. The remaining failures never printed, and the
error read as a shell syntax error rather than as a broken property.

Only failing cases are ever echoed, so every green run agreed the
reporter was fine -- the defect was reachable exclusively at the moment
the report was the thing being relied on. Measured: with two cases
failing, the old form printed one line and an EOF error, the escaped
form prints both plus the count.
This commit is contained in:
atlas 2026-08-31 19:44:51 +02:00 • committed by mara
commit d6c8bcf5d3
1 changed files with 18 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

21
nix/module-eval.nix
View file

@ -233,17 +233,32 @@ let
# local mints certificates off-host — so this orders against nothing. # local mints certificates off-host — so this orders against nothing.
# Eval cannot see that failure; only the empty list here stands in for it. # Eval cannot see that failure; only the empty list here stands in for it.
name = "an off-host reader requires no unit the store's host would have provided"; name = "an off-host reader requires no unit the store's host would have provided";
ok = baoRemoteReader.systemd.services.swarm-bao-matrix-token.requires == [ ]; # Membership first, then the value: indexing a missing unit throws, and a
# table that reports which property broke must not be the thing that dies.
ok =
let
s = baoRemoteReader.systemd.services;
in
s ? swarm-bao-matrix-token && s.swarm-bao-matrix-token.requires == [ ];
} }
{ {
# Presence control for the case above: the list is conditional, not gone. # Presence control for the case above: the list is conditional, not gone.
name = "a co-located reader still orders after the local pki unit"; name = "a co-located reader still orders after the local pki unit";
ok = baoWithMatrix.systemd.services.swarm-bao-matrix-token.requires == [ "swarm-bao-pki.service" ]; ok =
let
s = baoWithMatrix.systemd.services;
in
s ? swarm-bao-matrix-token && s.swarm-bao-matrix-token.requires == [ "swarm-bao-pki.service" ];
} }
]; ];
bad = builtins.filter (c: !c.ok) cases; bad = builtins.filter (c: !c.ok) cases;
report = lib.concatMapStringsSep "\n" (c: " echo 'FAILED: ${c.name}' >&2") bad; # Escaped, because a name is prose and prose contains apostrophes. Hand-quoting
# broke the builder mid-report on the first such name that failed — and only
# ever on failure, so every green run agreed the reporter was fine.
report = lib.concatMapStringsSep "\n" (
c: " echo ${lib.escapeShellArg "FAILED: ${c.name}"} >&2"
) bad;
in in
# The results are embedded in the builder text on purpose: that is what # The results are embedded in the builder text on purpose: that is what
# makes this derivation's hash depend on them, so a nix-only change that # makes this derivation's hash depend on them, so a nix-only change that