Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

Tests that read ../../../mesh-catalog or ../../../mesh-host gave a verdict that depended on what sat beside the checkout: a stale or dirty sibling failed them on a desktop, and a missing one skipped them unseen. They now read the clone the build seat puts in MESH_CHECK_BESIDE, failing when it is absent there, and elsewhere a copy captured at a named commit. The skip had hidden that the builder test read a module retired by ADR 0190. The systemd reading test no longer counts the machine's own environment.d.
2026-10-11 02:55:04 +02:00
parent 5bddb16514
commit eb72075104
146 changed files with 13749 additions and 102 deletions
@@ -0,0 +1,94 @@
+{
+  "module": "step-ca",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "provides": [
+    {
+      "name": "internal-acme-ca",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "internal-acme-ca": {
+      "path": "/acme/acme/directory",
+      "roots": "/roots.pem"
+    }
+  },
+  "listens": [
+    {
+      "name": "acme",
+      "port": 9000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the ACME directory and step-ca API; a proxy on any node reaches it here over the mesh to obtain certificates, and its single listen is what the consumer is told the port is"
+    }
+  ],
+  "own-secrets": {
+    "password": "${dir:mesh-state}/password"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "home",
+        "path": "${dir:home}",
+        "class": "valuable",
+        "why": "the mesh's certificate authority: its keys and its database of what it issued"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
+    {
+      "id": "home",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "place": "."
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0644",
+      "content": "{}",
+      "merge": "json"
+    },
+    {
+      "id": "init-env",
+      "type": "file",
+      "path": "${dir:mesh-state}/init.env",
+      "mode": "0600",
+      "content": "DOCKER_STEPCA_INIT_PASSWORD=${secret:password}\nDOCKER_STEPCA_INIT_DNS_NAMES=${machine:at},${machine:name},localhost,127.0.0.1\n"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "step-ca",
+      "image": "smallstep/step-ca@sha256:a2b17872915c193259b75a5474c398326f41bd199f0842093e52cf4182bc8270",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "host",
+      "env-file": [
+        "${dir:mesh-state}/init.env"
+      ],
+      "env": {
+        "DOCKER_STEPCA_INIT_NAME": "Mesh Internal CA",
+        "DOCKER_STEPCA_INIT_ACME": "true",
+        "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false"
+      },
+      "volumes": [
+        "${dir:home}:/home/step",
+        "${dir:mesh-state}:/run/mesh:ro"
+      ],
+      "secrets-in-environment": "the entrypoint honours DOCKER_STEPCA_INIT_PASSWORD_FILE; convertible, awaiting a bed that proves it"
+    }
+  ]
+}