test(e2e): audit the index for recipes registration now rejects - #400
Merged
Conversation
Provider-scoped registration validates a package's whole set of xvm
operations as one batch and fails closed. Three of those checks turn
recipe defects that used to pass silently into install failures:
SelfBinding, RootNotInBatch, and DuplicateNode. A recipe hitting any of
them cannot be installed at all, so the index has to be clean before the
release ships.
Result against the pinned index (dee7848, 113 recipes, 89 registering
with xvm): zero rejections. Three cases the scan cannot decide, all read
by hand and all benign:
git.lua, sourcetrail.lua one name registered in both arms of an
if is_host("windows") -- only one arm runs
seeme-report.lua binds to package.name .. "@" .. version,
which the same recipe registers
The first version of the scan reported the two if/else cases as
rejections. That is the failure mode an audit has to avoid: two false
alarms out of two findings teaches people to ignore it. Proving
exclusivity needs the Lua evaluated, so an else or elseif between the
two registrations now downgrades them to unresolved -- neither cleared
nor rejected.
Same reasoning for runtime-built binding targets: reported rather than
skipped. An audit that quietly passes over what it could not parse reads
as "nothing to fix" when it means "did not look".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
为什么需要
provider-scoped 注册把一个包的全部 xvm 操作作为一个批次校验并 fail-closed。其中三项检查会把过去静默通过的 recipe 缺陷变成安装失败：
SelfBindingRootNotInBatchDuplicateNode命中任一项的 recipe 完全装不上。索引必须在发布前是干净的。
结果
对钉住的索引（
dee7848，113 个 recipe，89 个使用 xvm）：三条无法静态判定的，全部人工读过，全部无害：
git.lua/sourcetrail.luaif is_host("windows")的两个分支各注册一次 —— 只有一个分支会执行seeme-report.luapackage.name .. "@" .. version，而同一 recipe 就注册了它第一版扫描把前两条报成了 REJECT
这正是审计工具必须避免的失败模式：两个发现两个都是误报，会训练人忽略它。
要证明分支互斥需要真正求值 Lua。所以现在两次注册之间出现
else/elseif就降级为 unresolved —— 既不清白也不定罪。runtime 构建的 binding 目标同理：报告而非跳过。
Verification
三条 unresolved 已逐条打开源文件确认。
后续
建议在 pkgindex 仓的 CI 里对新 recipe 强制跑一次（跨仓，不在本 PR 范围）。