jochen
5f147fe6b9
mesh/merge-gate head 5f147fe6b9c7 merged into trunk 0d11b4fc930d — pass: the change touches no module of the mesh's graph
mesh/repo-check head 5f147fe6b9c7 merged into trunk 0d11b4fc930d — pass: its merge-check.sh passed
mesh/delivery delivered
mesh/delivery-group group fix/121-genesis-package-registry delivered: every member is delivered
The build agent declares neither the retired builder's npm-password own-secret nor a serves setting, so the packages step handed its credential to nothing and genesis's sdk step had no way to publish. The packages step now seals the genesis-package-registry own-secret to build-agent: the forge on this node's loopback, the port given for the package registry, its npm path, and the mesh-builder account with its password. setFoundationSettings no longer gives the builder a serves.port.
66 lines
2.7 KiB
Go
66 lines
2.7 KiB
Go
package bootstrap
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// Genesis seals the build agent the forge it raised (novox/hq ADR 0336 §3, issue 121): the agent's
|
|
// npm-package-registry requirement is optional and binds only once the gitea module is assigned, after
|
|
// the base, so until then the packages step's genesis document is how the sdk and base steps reach the
|
|
// forge.
|
|
|
|
func TestThePackagesStepSealsTheGenesisDocumentToTheBuildAgent(t *testing.T) {
|
|
if BuilderModule != "build-agent" {
|
|
t.Fatalf("genesis installs %q; the document is the build agent's", BuilderModule)
|
|
}
|
|
c, control := recording(t)
|
|
o := Options{Node: "anchor", Ports: FoundationPorts{Packages: 3100}, Wait: time.Second}
|
|
doc := genesisRegistry(o.Ports.orDefaults(), "builder-password")
|
|
if err := deliverGenesisRegistry(context.Background(), o, control, doc, quietly); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
carried := c.settings["accepting-"+GenesisRegistrySecret]
|
|
var got GenesisRegistry
|
|
if err := json.Unmarshal([]byte(carried), &got); err != nil {
|
|
t.Fatalf("the genesis document carried is not JSON: %q", carried)
|
|
}
|
|
want := GenesisRegistry{Scheme: "http", At: "127.0.0.1", Port: 3100, NpmPath: "/api/packages/novox/npm/",
|
|
As: "mesh-builder", Password: "builder-password"}
|
|
if got != want {
|
|
t.Fatalf("the genesis document says %+v, want %+v", got, want)
|
|
}
|
|
accept := c.index("secret accept anchor build-agent genesis-package-registry --from /accepting-genesis-package-registry")
|
|
push := c.index("push anchor")
|
|
if accept < 0 || push < 0 || accept > push {
|
|
t.Fatalf("the genesis document was not sealed to the build agent before the push: %v", c.told)
|
|
}
|
|
}
|
|
|
|
// What the retired builder was given and the build agent declares neither of: an `npm-password`
|
|
// own-secret and a `serves` setting for its carried binding (ADR 0336 §3).
|
|
func TestNoStepGivesTheBuildAgentAServesSettingOrAnNpmPassword(t *testing.T) {
|
|
for _, module := range []string{BuilderModule} {
|
|
c, control := recording(t)
|
|
o := Options{Node: "anchor", Ports: FoundationPorts{Packages: 3100}, Wait: time.Second}
|
|
if _, err := installModule(context.Background(), o, control, module, []byte(`{"module":"`+module+`"}`), quietly); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got, set := c.settings[module+"-settings.json"]; set {
|
|
t.Errorf("%s was given a setting on a node with a non-default packages port: %s", module, got)
|
|
}
|
|
if err := deliverGenesisRegistry(context.Background(), o, control,
|
|
genesisRegistry(o.Ports.orDefaults(), "p"), quietly); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, told := range c.told {
|
|
if strings.Contains(told, "npm-password") || strings.Contains(told, "serves") {
|
|
t.Errorf("genesis told the controller %q", told)
|
|
}
|
|
}
|
|
}
|
|
}
|