mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 19:07:04 +01:00
Krzysztof kuhy Rudnicki
f15f00f3fe
Also bumps the 16 meta/requirements pins the freshness gate flagged (anthropic 1.5.0, numpy 2.5.3, pytest-randomly 5, flake8-bugbear 26.9.9, ruff 0.16.7, pyright 1.1.414, selenium 4.49.0, hypothesis 6.168.0, lxml 6.1.3, pipdeptree 4.2.5, the two types-* stubs) and Flutter 3.47.3 in meta/.fvmrc. One test still expected the pre-move ~/mcp-servers path. The pre-commit hook fed .zsh files to shfmt and shellcheck, neither of which parses zsh (SC2148/SC1071), so no zsh file could be committed since the hook was tightened on 2026-08-22; those now get `zsh -n` instead. The hook's own shfmt pass also staged its reformat of 8 shell files. CI_GREEN_SKIP because main is red on exactly the dependency-freshness finding this commit fixes, which is the documented use of that flag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AwtowrowDXx6ccmWVPkCaF
65 lines
2.8 KiB
Bash
Executable File
65 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Tests for wg_verify_units.sh — the units that run 'verify' by themselves.
|
|
#
|
|
# The generated CONTENT is the whole subject. A unit that exists but is
|
|
# ordered before nftables.service compares /etc/nftables.conf against the
|
|
# previous boot's ruleset; a unit that logs instead of exiting non-zero is a
|
|
# warning nobody reads. Both look identical to a presence check, and both
|
|
# reproduce the outage this exists to catch.
|
|
#
|
|
# Rendering writes only where it is told, so unlike its siblings this suite
|
|
# needs no jail to be safe -- but it runs inside one with the rest of the
|
|
# directory, and must not assume it can reach the real /etc.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=./features_harness.sh
|
|
. "$SCRIPT_DIR/features_harness.sh"
|
|
|
|
_t_setup_env
|
|
trap _t_teardown EXIT
|
|
|
|
# shellcheck source=../wg_verify_units.sh
|
|
. "$SCRIPT_DIR/../wg_verify_units.sh"
|
|
|
|
readonly ENTRY="/home/kuhy/src/testsAndMisc/linux_configuration/features/setup_wireguard_ssh.sh"
|
|
UNIT_DIR="$TEST_TMPDIR/units"
|
|
mkdir -p "$UNIT_DIR"
|
|
|
|
render_verify_units "$UNIT_DIR" "$ENTRY"
|
|
|
|
SERVICE="${UNIT_DIR}/${VERIFY_SERVICE}"
|
|
TIMER="${UNIT_DIR}/${VERIFY_TIMER}"
|
|
|
|
printf '\n-- the service runs the repo checkout, not a copy --\n'
|
|
_t_file_has "$SERVICE" "^ExecStart=${ENTRY} verify\$" \
|
|
"ExecStart invokes the entry script's verify subcommand"
|
|
_t_file_has "$SERVICE" '^Type=oneshot$' "one shot, not a daemon"
|
|
|
|
printf '\n-- ordering: check the ruleset that is actually loaded --\n'
|
|
# Before nftables.service, the check reads whatever the previous boot left.
|
|
_t_file_has "$SERVICE" '^After=.*nftables\.service' "ordered after nftables.service"
|
|
_t_file_has "$SERVICE" '^After=.*docker\.service' "ordered after docker.service"
|
|
# detect_lan_subnet shells out to `ip route get` when LAN_SUBNET is unset, and
|
|
# dies if there is no route yet -- indistinguishable from real drift.
|
|
_t_file_has "$SERVICE" '^After=.*network-online\.target' "ordered after the network is up"
|
|
if grep -q '^Requires=' "$SERVICE"; then
|
|
_t_fail "Requires= would skip the check when nftables.service is dead, which is the worst fault it detects"
|
|
else
|
|
_t_pass "no Requires=, so a dead nftables.service still fails this unit"
|
|
fi
|
|
|
|
printf '\n-- it may not write anything --\n'
|
|
_t_file_has "$SERVICE" '^ProtectHome=read-only$' \
|
|
"cannot root-rewrite the saved LAN_SUBNET in the repo"
|
|
_t_file_has "$SERVICE" '^ProtectSystem=strict$' "cannot rewrite /etc"
|
|
|
|
printf '\n-- it runs at boot, and again on a timer --\n'
|
|
_t_file_has "$SERVICE" '^WantedBy=multi-user\.target$' "enabled at boot"
|
|
_t_file_has "$TIMER" "^Unit=${VERIFY_SERVICE}\$" "the timer triggers that same service"
|
|
_t_file_has "$TIMER" '^Persistent=true$' "a PC that was off still checks when it returns"
|
|
_t_file_has "$TIMER" '^WantedBy=timers\.target$' "the timer is enabled at boot too"
|
|
|
|
printf '\n%d passed, %d failed\n' "$PASS" "$FAIL"
|
|
[[ $FAIL -eq 0 ]]
|