mesh-build-go, mesh-build-node: a missing bubblewrap fails the sandbox proofs on a build node instead of skipping them (issue 1309) #523

2026-10-27T20:39:44Z

mesh-tools commented

2026-10-27 20:39:44 +00:00

Issue 1309 (ADR 0448: a check's build and tests run sandboxed, without the build seat's key, logins or network).

The sandbox tests skipped with "NOT RUN" wherever bwrap was missing, so a build node without it would pass a check without proving its isolation. mesh-build-go now hands every level it runs (unit, integration, store) MESH_BUILD_NODE=1 through checkEnv (it reaches the tests through the isolated step's --setenv); needTools in mesh-build-go and a new needBubblewrap in mesh-build-node (5 sites) fail when bwrap is missing and the mark is set, and still skip off a build node.

Quick or thorough: the quick fix (flip mesh-build-go's needTools) left mesh-build-node's five skips; the thorough fix (a mesh-sdk helper) costs a new repository and a group delivery for about 15 lines. Chosen: one rule in both build modules in this repository (rule weighed and said on 1309, note 15).

Nesting: these tests already start bwrap inside the step today (bwrap is in /usr/bin, bound read-only); the reviewer ran the step's own bwrap arguments around a nested bwrap on shanks: exit 0. This change alters only the missing-bwrap path.

Tests: table rows (missing on a build node -> fail) failing on the old behaviour; unit suites and go vet -tags integration clean; mesh-build-go 164 unit / 37 integration, mesh-build-node 94 / 8.

Left for 1309 after this: a check on a build node to show S5 runs (verdicts count skipped tests but do not name them).

Reviewed-by: review-1309@shanks at 9109524502

Issue 1309 (ADR 0448: a check's build and tests run sandboxed, without the build seat's key, logins or network). The sandbox tests skipped with "NOT RUN" wherever bwrap was missing, so a build node without it would pass a check without proving its isolation. mesh-build-go now hands every level it runs (unit, integration, store) `MESH_BUILD_NODE=1` through `checkEnv` (it reaches the tests through the isolated step's `--setenv`); `needTools` in mesh-build-go and a new `needBubblewrap` in mesh-build-node (5 sites) fail when bwrap is missing and the mark is set, and still skip off a build node. Quick or thorough: the quick fix (flip mesh-build-go's needTools) left mesh-build-node's five skips; the thorough fix (a mesh-sdk helper) costs a new repository and a group delivery for about 15 lines. Chosen: one rule in both build modules in this repository (rule weighed and said on 1309, note 15). Nesting: these tests already start bwrap inside the step today (bwrap is in /usr/bin, bound read-only); the reviewer ran the step's own bwrap arguments around a nested bwrap on shanks: exit 0. This change alters only the missing-bwrap path. Tests: table rows (missing on a build node -> fail) failing on the old behaviour; unit suites and `go vet -tags integration` clean; mesh-build-go 164 unit / 37 integration, mesh-build-node 94 / 8. Left for 1309 after this: a check on a build node to show S5 runs (verdicts count skipped tests but do not name them). Reviewed-by: review-1309@shanks at 9109524502f9a469d41e0426cc637f402912b971

mesh-tools added 1 commit 2026-10-27 20:39:44 +00:00

A missing bubblewrap fails the sandbox proofs on a build node instead of skipping them

mesh/delivery merged: source.main moved to novox/mesh-catalog@476a59162f55

Details

mesh/check checking 9109524502f9 on bf94af0a820f

9109524502

The levels a build module judges hand the tests MESH_BUILD_NODE=1; the tests that run a step in bubblewrap fail on it when bwrap is missing. Issue 1309

mesh-tools commented

2026-10-27 20:39:49 +00:00

Delivery novox/mesh-catalog@9109524502f9 — merged since 2026-10-27T21:00:56Z

Source — source.main moved to novox/mesh-catalog@476a59162f. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-10-27 20:39 (new) → proposed (announced): novox/mesh-catalog#523's head announced
2026-10-27 20:39 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-27 21:00 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@9109524502f9` — **merged** since 2026-10-27T21:00:56Z **Source** — source.main moved to novox/mesh-catalog@476a59162f55. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-10-27 20:39 (new) → proposed (announced): novox/mesh-catalog#523's head announced - 2026-10-27 20:39 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-27 21:00 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 476a59162f into main

2026-10-27 21:00:53 +00:00

mesh-tools deleted branch fix/1309-bwrap-fatal

2026-10-27 21:00:56 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#523