Repository navigation
test(sensor): cover restorePrev, stamp freshness, failed rollbacks and the writable check - #330
Conversation
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
0x73746F66
left a comment
0x73746F66
left a comment
There was a problem hiding this comment.
Reuse review: test-only (cmd/vulnetix-sensor). Tests write stamps through the package's own healthState type and use t.TempDir(); no duplicated update/rollback logic. No changes needed.
0x73746F66
left a comment
0x73746F66
left a comment
There was a problem hiding this comment.
Reuse review: no reinvented Vulnetix patterns found. The change stays inside the package it covers, uses stdlib/testify helpers already used by the repo's tests, and adds no new client, auth, config-schema or shared-package duplicate (checked internal/testutils and sibling repos). Rebased onto current main locally: go vet and go test pass for every touched package. The earlier red checks (CodeQL Analyze, Install a release with verified provenance, Lockfile) were GitHub API rate-limit failures, not code failures; this will be re-run on a rebased head before merge.
…d the writable check The scenario tests already drive reconcilePending through confirm, window, outage and rollback, and lockUpdate. These add the rules they do not reach: restorePrev's missing, empty and good .prev; a health stamp counts only for the new version written at or after the swap; nothing pending is no verdict; a rollback that cannot restore still adds the release to the bad list with the reason; and updateSkipReason refuses a read-only install directory. Closes #290
4297a7b to
9869f6e
Compare
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
Closes #290
What
New
cmd/vulnetix-sensor/updatehealth_rules_test.go(plaintesting, reusinginstalledfromupdatehealth_test.go).Items 1 and 3 of the card are largely covered already by the scenario tests in
updatehealth_test.go(confirm after report, inside-window, failed unit after one minute, outage deferral and its limit, nothing to restore,TestOnlyOneGuardUpdatesAtATimeforlockUpdate). This adds what they do not reach:restorePrev: missing.prev(error, binary untouched), empty.prev(error, binary untouched), good.prev(target rewritten 0755,.prevkept).reconcilePendingproof rule: a stamp confirms only for the new version written at or after the swap; an older stamp or the old version's stamp is no verdict and the update stays pending..prev) still appends the release toBad(after existing entries), clearsPending, and the reason carries both the unit failure and the rollback error.updateSkipReasonwith a read-only install directory reports "not writable" (skipped as root).Item 4 (
sweepStaleUpdatesLstat/RemoveAll failures) is left out: the only way to makeRemoveAllfail portably is permission tricks that root bypasses, and the existing sweep test already pins the counted removals.Verified
go test -cover ./cmd/vulnetix-sensor/passes (57.4% -> 57.5%; the rules were mostly reached through scenarios, these pin them directly).gofmtclean.