A missing bubblewrap fails the sandbox proofs on a build node instead of skipping them

The levels a build module judges hand the tests MESH_BUILD_NODE=1; the tests that run a step in bubblewrap fail on it when bwrap is missing. Issue 1309

modules/mesh-build-node/cmd/mesh-build-node/build_integration_test.go

@@ -24,7 +24,8 @@ import (
 // name: an install from the public registry inside a shut-off level only fails, after 70 s of npm's retries.
 func realMachine(t *testing.T) (*Module, string) {
 	t.Helper()
-	for _, p := range []string{"node", "npm", "bwrap"} { // bwrap: tsc, esbuild and the scripts run shut off (1309)
+	needBubblewrap(t) // tsc, esbuild and the scripts run shut off (1309)
+	for _, p := range []string{"node", "npm"} {
 		if _, err := exec.LookPath(p); err != nil {
 			t.Skipf("NOT RUN: no %s installed where this check runs (the mesh's Go toolchain image holds none); proven live on a build node", p)
 		}

modules/mesh-build-node/cmd/mesh-build-node/isolation_integration_test.go

@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"net"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strconv"
 	"testing"
@@ -34,9 +33,7 @@ fs.writeFileSync("seen.json", JSON.stringify(seen));
 // resolves no name, reaches no socket of the machine (a TCP port on its loopback, a unix socket), and leaves the
 // shared cache unchanged.
 func TestARunStepReachesNoKeyLoginNameOrSocketAndLeavesTheCacheUnchanged(t *testing.T) {
-	if _, err := exec.LookPath("bwrap"); err != nil {
-		t.Skip("NOT RUN: no bubblewrap installed where this check runs; every build node has it (the module declares it)")
-	}
+	needBubblewrap(t)
 	m, work := realMachine(t)
 	home := m.Toolchain.Paths.Home
 	key, login := filepath.Join(home, ".ssh", "mesh_ed25519"), filepath.Join(home, "broker")

modules/mesh-build-node/cmd/mesh-build-node/needtools_test.go

@@ -0,0 +1,49 @@
+package main
+
+import (
+	"os"
+	"os/exec"
+	"testing"
+)
+
+// bubblewrapAction is what a test that runs a step in bubblewrap does: "" when bubblewrap is there, "fail" where a
+// build module that judges says this is a build node (MESH_BUILD_NODE=1, which mesh-build-go hands the tests), since
+// every build node declares and has it, and "skip" anywhere else (issue 1309).
+func bubblewrapAction(found bool, buildNodeMark string) string {
+	switch {
+	case found:
+		return ""
+	case buildNodeMark == "1":
+		return "fail"
+	}
+	return "skip"
+}
+
+// needBubblewrap stops a test that runs a step in bubblewrap where there is none.
+func needBubblewrap(t *testing.T) {
+	t.Helper()
+	_, err := exec.LookPath("bwrap")
+	switch bubblewrapAction(err == nil, os.Getenv("MESH_BUILD_NODE")) {
+	case "fail":
+		t.Fatal("no bubblewrap installed on a build node: every build node declares it, so the proof is not skipped here")
+	case "skip":
+		t.Skip("NOT RUN: no bubblewrap installed where this check runs; every build node has it (the module declares it)")
+	}
+}
+
+func TestAMissingBubblewrapFailsOnABuildNodeAndSkipsElsewhere(t *testing.T) {
+	for _, c := range []struct {
+		name  string
+		found bool
+		mark  string
+		want  string
+	}{
+		{"there", true, "1", ""},
+		{"missing on a desk", false, "", "skip"},
+		{"missing on a build node", false, "1", "fail"},
+	} {
+		if got := bubblewrapAction(c.found, c.mark); got != c.want {
+			t.Errorf("%s: %q, want %q", c.name, got, c.want)
+		}
+	}
+}

modules/mesh-build-node/cmd/mesh-build-node/package_integration_test.go

@@ -45,7 +45,8 @@ func forgeRepo(t *testing.T, root, name string, files map[string]string) string
 // (its build script and npm pack shut off, nothing published), and a member whose lock names that version with that
 // integrity gets it in its node_modules; a member whose lock names it with another integrity fails naming both.
 func TestTheFetchPacksTheGroupsPackageAndServesItToAMember(t *testing.T) {
-	for _, tool := range []string{"node", "npm", "git", "bwrap"} {
+	needBubblewrap(t)
+	for _, tool := range []string{"node", "npm", "git"} {
 		if _, err := exec.LookPath(tool); err != nil {
 			t.Skipf("NOT RUN: no %s where this check runs; every build node has it", tool)
 		}

modules/mesh-build-node/cmd/mesh-build-node/publish_integration_test.go

@@ -81,7 +81,8 @@ func (r *npmRegistry) serve(t *testing.T) *httptest.Server {
 // the module's credential, once: a second trunk build of the same package finds its file there and publishes nothing;
 // a candidate publishes nothing at all.
 func TestARealTrunkPackageIsPublishedOnce(t *testing.T) {
-	for _, tool := range []string{"node", "npm", "bwrap"} {
+	needBubblewrap(t)
+	for _, tool := range []string{"node", "npm"} {
 		if _, err := exec.LookPath(tool); err != nil {
 			t.Skipf("NOT RUN: no %s where this check runs; every build node has it", tool)
 		}

modules/mesh-build-node/cmd/mesh-build-node/store_integration_test.go

@@ -10,7 +10,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -45,9 +44,7 @@ func realStore(t *testing.T, m *Module) string {
 // 1587-S10 (ADR 0498's check): a done bundle names a reference whose tail is its digest, and that reference resolves in
 // a real artifact store to bytes of that digest. The build is the real tsc's and esbuild's, shut off.
 func TestADoneBundleResolvesInARealArtifactStore(t *testing.T) {
-	if _, err := exec.LookPath("bwrap"); err != nil {
-		t.Skip("NOT RUN: no bubblewrap installed where this check runs; every build node has it (the module declares it)")
-	}
+	needBubblewrap(t)
 	m, _ := realMachine(t)
 	addr := realStore(t, m)
 	out, err := m.build(context.Background(), map[string]any{"workspace": "w1", "module": "modules/m", "artifact": "tools"})