From b6ed8599c8e210cb17781490081396fb762b2bf4 Mon Sep 17 00:00:00 2001 From: jochen Date: Sat, 24 Oct 2026 03:46:45 +0200 Subject: [PATCH] mesh-build-go: a package marked reads-outside is never kept, so tests that read files outside their directory run on every check (issue 1935) --- modules/mesh-build-go/README.md | 6 +++- .../mesh-build-go/cmd/mesh-build-go/digest.go | 28 +++++++++++++++++++ .../cmd/mesh-build-go/digest_test.go | 25 +++++++++++++++++ 3 files changed, 58 insertions(+), 1 deletion(-) diff --git a/modules/mesh-build-go/README.md b/modules/mesh-build-go/README.md index f2493e35..e466c36b 100644 --- a/modules/mesh-build-go/README.md +++ b/modules/mesh-build-go/README.md @@ -102,7 +102,11 @@ integration level, the postgres major and the nats-server version; and, when the workspace (`beside`), each one's repository and commit, which the answer echoes as `beside` (the checker keeps a verdict only for the siblings it was judged with). The text's form is `DigestVersion` 3. The Go version is not in it: the toolchain enters a fingerprint once, as the version the build nodes agree on (ADR 0477 §3), and the standard library's packages are that -version's. A package with no tests at the level has no digest and is named in `without_tests`. A directory that vendors +version's. A package with no tests at the level has no digest and is named in `without_tests`. A package whose directory holds a file named `reads-outside` (any content; say what the tests read) is never kept (issue 1935): its tests read +files outside it, which a digest from `go list` cannot name, so its digest is a fresh random one on every call, the ask finds no kept +verdict for it and runs it, and the answer names it in `reads_outside` and the module's log says why. The checker still writes a +verdict under that digest, which nothing ever reads again. The marker is the plain way to say it until each verdict keeps the files +its tests opened (Go's test log). A directory that vendors is listed and tested from its vendor directory (`-mod=vendor`). ## A change to this module is judged by its candidate diff --git a/modules/mesh-build-go/cmd/mesh-build-go/digest.go b/modules/mesh-build-go/cmd/mesh-build-go/digest.go index 1c92d318..1525f119 100644 --- a/modules/mesh-build-go/cmd/mesh-build-go/digest.go +++ b/modules/mesh-build-go/cmd/mesh-build-go/digest.go @@ -7,6 +7,7 @@ package main import ( "bytes" "context" + "crypto/rand" "crypto/sha256" "encoding/hex" "encoding/json" @@ -30,6 +31,13 @@ const DigestVersion = "4" // depends on the siblings' commits. const besideVariable = "MESH_CHECK_BESIDE" +// ReadsOutsideMarker is the name of a file in a package's directory that says its tests read files outside it (a +// repository's documents, a sibling directory): such a package is never kept (issue 1935). The digest hashes only what +// the Go toolchain lists, so it cannot name what a test opens elsewhere; a marker file, beside the Go files where a +// reader of the package sees it, is the plain way to say so until the checker keeps the files a test opened (the Go +// test log) with each verdict. +const ReadsOutsideMarker = "reads-outside" + // integrationTags are the build tags of the integration level, its run and its digest alike: integration, and isolation // for the bubblewrap proofs (mesh-sdk's and the build modules'), which a build node can run. var integrationTags = []string{"integration", "isolation"} @@ -89,6 +97,9 @@ type DigestResult struct { // only when they are the siblings it gave the fetch. Beside []string `json:"beside,omitempty"` WithoutTests []string `json:"without_tests,omitempty"` + // ReadsOutside names the packages that carry the marker: each has a digest that no kept verdict can have (a fresh + // random one), so the check runs it every time. + ReadsOutside []string `json:"reads_outside,omitempty"` // JudgedBy is the program that ran the digest (ADR 0535 §5): "installed", or "candidate " under the // runner workspace. JudgedBy string `json:"judged_by,omitempty"` @@ -199,6 +210,12 @@ func (m *Module) digestHere(ctx context.Context, workspace, level string) (Diges } } sort.Strings(res.WithoutTests) + sort.Strings(res.ReadsOutside) + for _, p := range res.ReadsOutside { + if m.Say != nil { + m.Say("the %s level of %s always runs: its directory carries %s, so its tests read files outside it that no digest names", level, p, ReadsOutsideMarker) + } + } return res, nil } @@ -256,6 +273,17 @@ func digestModule(res *DigestResult, pkgs map[string]*goPackage, tree string, he if testMain == nil { return fmt.Errorf("go list gave no test binary for %s", path) } + if _, err := os.Stat(filepath.Join(root.Dir, ReadsOutsideMarker)); err == nil { + // The digest of a package that reads outside itself is one nothing can have kept: the key is a fresh random + // hex, so the ask finds no kept verdict and runs it, and what the checker writes under it is never read again. + var nonce [32]byte + if _, err := rand.Read(nonce[:]); err != nil { + return err + } + res.Packages[path] = hex.EncodeToString(nonce[:]) + res.ReadsOutside = append(res.ReadsOutside, path) + continue + } d, err := packageDigest(root, testMain, pkgs, tree, header, beside) if err != nil { return fmt.Errorf("%s: %w", path, err) diff --git a/modules/mesh-build-go/cmd/mesh-build-go/digest_test.go b/modules/mesh-build-go/cmd/mesh-build-go/digest_test.go index 5e2d81d0..2cee4acc 100644 --- a/modules/mesh-build-go/cmd/mesh-build-go/digest_test.go +++ b/modules/mesh-build-go/cmd/mesh-build-go/digest_test.go @@ -189,3 +189,28 @@ func TestAModuleOutsideTheTreeCountsByVersionAndChecksum(t *testing.T) { t.Errorf("a new version left the digest as it was") } } + +// Issue 1935: a package whose directory carries the reads-outside marker is never kept: its digest is one no kept verdict +// can have (it differs on every call, though nothing changed), and the answer names it. A package without the marker +// keeps its digest. +func TestAPackageWithTheReadsOutsideMarkerIsNeverKept(t *testing.T) { + t.Parallel() + m, tree := digestFixture(t) + plain := digests(t, m, "unit") + if len(plain.ReadsOutside) != 0 { + t.Fatalf("a package carries the marker in the fixture: %v", plain.ReadsOutside) + } + edit(t, tree, "c/"+ReadsOutsideMarker, "the tests read ../docs\n") + first, second := digests(t, m, "unit"), digests(t, m, "unit") + c := "fixture/digest/c" + if len(first.Packages[c]) != 64 || first.Packages[c] == second.Packages[c] || first.Packages[c] == plain.Packages[c] { + t.Errorf("c carries the marker and its digest is stable: %s, %s, before %s", first.Packages[c], second.Packages[c], plain.Packages[c]) + } + if strings.Join(first.ReadsOutside, ",") != c { + t.Errorf("the answer does not name the package that reads outside: %v", first.ReadsOutside) + } + a := "fixture/digest/a" + if first.Packages[a] != plain.Packages[a] || first.Packages[a] != second.Packages[a] { + t.Errorf("a has no marker and its digest moved: %s, %s, before %s", first.Packages[a], second.Packages[a], plain.Packages[a]) + } +}