c8df666bf3
Part of #5081. Follow-up to the review of #5131. - Before this PR, claude read CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX from managed-settings.json in every context. The environment generator reaches every unit of the container's manager, including `machinectl shell` (hivectl choom): machined starts it as a transient container-shell@ unit (systemd 260.5 src/machine/machine.c:980-1004), and every unit's exec environment starts from the manager environment the generators fill (src/core/unit.c:5557, src/core/manager.c:3990-4001). Shells no unit starts do not get it: `nixos-container root-login` / `run` enter with nsenter + `su -l`, and getty logins go through login(1). So hive-facts.nix now also exports the generator's output from /etc/set-environment (environment.extraInit). - The generator's read loop kept a last line only when it ended in a newline; it now keeps one without. - checks.script-test-agent-hive-facts runs the rendered generator and the shell snippet (under dash and bash's sh) against sample files: both facts, a planted LD_PRELOAD/PATH line, a last line without a newline, an empty file and no file. - identity.rs: hive_name()'s doc names the facts file as the source.
71 lines
2.6 KiB
Shell
71 lines
2.6 KiB
Shell
# Cases for ./agent-hive-facts.nix. Each case writes a facts file (or none),
|
|
# runs the generator with a clean environment, and compares its whole output;
|
|
# then sources the login-shell snippet under each POSIX shell and compares what
|
|
# a child process sees.
|
|
set -uo pipefail
|
|
|
|
failures=0
|
|
count=0
|
|
|
|
fail() {
|
|
echo "FAILED: $case: $*" >&2
|
|
failures=$((failures + 1))
|
|
}
|
|
|
|
dir=$(mktemp -d)
|
|
facts=$dir/facts
|
|
sed "s|/etc/hyperhive-hive-facts|$facts|g" "$GENERATOR" >"$dir/generator"
|
|
chmod +x "$dir/generator"
|
|
sed "s|$GENERATOR|$dir/generator|g" "$PROFILE" >"$dir/profile"
|
|
envbin=$(command -v env)
|
|
|
|
case="setup"
|
|
if grep -q '/etc/hyperhive-hive-facts' "$dir/generator"; then fail "the generator still names /etc after the rewrite"; fi
|
|
if ! grep -qF "$facts" "$dir/generator"; then fail "the rewrite did not reach the generator's read"; fi
|
|
if ! grep -qF "$dir/generator" "$dir/profile"; then fail "the snippet does not call the rewritten generator"; fi
|
|
if ! printf '%s\n' "$EXTRA_INIT" | grep -qxF '. /etc/hyperhive/hive-facts.sh'; then
|
|
fail "/etc/set-environment does not source the snippet"
|
|
fi
|
|
|
|
# check <description> <expected generator output>
|
|
check() {
|
|
case=$1
|
|
count=$((count + 1))
|
|
local want=$2 got
|
|
got=$(env -i "$dir/generator")
|
|
if [ "$got" != "$want" ]; then
|
|
fail "generator printed:"$'\n'"$got"$'\n'"wanted:"$'\n'"$want"
|
|
fi
|
|
local sh
|
|
for sh in $SHELLS; do
|
|
# Only what the snippet exported reaches the child's environment. No PATH:
|
|
# the snippet must not need one.
|
|
got=$(env -i "$sh" -c ". '$dir/profile'; exec '$envbin'" | grep -E '^(HYPERHIVE_|CLAUDE_|LD_PRELOAD=|__hyperhive)' | sort)
|
|
if [ "$got" != "$(printf '%s\n' "$want" | sort)" ]; then
|
|
fail "$sh: a child of the sourcing shell saw:"$'\n'"$got"
|
|
fi
|
|
done
|
|
}
|
|
|
|
printf 'HYPERHIVE_HIVE_NAME=pr1ma\nHYPERHIVE_HIVE_DOMAIN=pr1ma.example.test\n' >"$facts"
|
|
check "both facts" "HYPERHIVE_HIVE_NAME=pr1ma
|
|
HYPERHIVE_HIVE_DOMAIN=pr1ma.example.test
|
|
CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=pr1ma-a1"
|
|
|
|
printf 'LD_PRELOAD=/x\nHYPERHIVE_HIVE_NAME=pr1ma\nPATH=/evil\n' >"$facts"
|
|
check "a planted key is dropped" "HYPERHIVE_HIVE_NAME=pr1ma
|
|
CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=pr1ma-a1"
|
|
|
|
printf 'HYPERHIVE_HIVE_DOMAIN=pr1ma.example.test\nHYPERHIVE_HIVE_NAME=pr1ma' >"$facts"
|
|
check "a last line without a newline is kept" "HYPERHIVE_HIVE_DOMAIN=pr1ma.example.test
|
|
HYPERHIVE_HIVE_NAME=pr1ma
|
|
CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=pr1ma-a1"
|
|
|
|
: >"$facts"
|
|
check "an empty file (no facts)" "CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=unknown-a1"
|
|
|
|
rm -f "$facts"
|
|
check "no file" "CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=unknown-a1"
|
|
|
|
echo "$count cases, $failures failed"
|
|
[ "$failures" -eq 0 ]
|