nordisk/edda

crates/nornir-build-thing/tests/pinned_recipe_reproduces.rs

//! **A pinned recipe, rebuilt through the forge's own image door, is its pin again.**
//!
//! MEASURED 2026-09-22 on t14s: the kernel toolchain's Containerfile (tunnr and edda carry
//! it byte-identical) built through `BollardImageBuilder` into a FRESH EMPTY podman store
//! answered `caf41863…` / `e28bd99a…` while every row pins `78eaa55a…` (image id
//! `3f632569…`). File for file the apt layer was the same — names, modes, owners, sizes,
//! link targets — and differed ONLY in mtimes: the builder never handed podman the
//! recipe's `SOURCE_DATE_EPOCH`, so each package kept its own file times. The same
//! recipe built with `podman build --timestamp 1783900800` gave `3f632569`/`78eaa55a`
//! exactly. The fix is the builder sending podman's `timestamp`; this test is the proof
//! it reaches the engine.
//!
//! `#[ignore]`d: it pulls debian and packages from snapshot.debian.org and mints ~1.2 GB.
//! Run it with `DOCKER_HOST` pointed at an EMPTY store (a store that already holds a cached
//! build of these layers can answer from its cache and prove nothing):
//!
//! ```text
//! podman --root R --runroot RR system service --time=0 unix://S &
//! DOCKER_HOST=unix://S cargo test -p nornir-build-thing --features image-build \
//!     --test pinned_recipe_reproduces -- --ignored
//! ```
#![cfg(feature = "image-build")]

use nornir_build_thing::container::ContainerBuild;
use nornir_build_thing::image_build::{build_container, BollardImageBuilder};
use nornir_build_thing::kernel::KERNEL_TOOLCHAIN_CONTAINERFILE;

/// The manifest digest every `[[build.kernel]]` row pins for its toolchain.
const PIN: &str = "78eaa55a651d5bd76aae36db0f3307e267a92d2a547ee338a17822a103e0320e";

#[test]
#[ignore = "mints the kernel toolchain (~1.2 GB) from snapshot.debian.org into the store DOCKER_HOST names — run it against an EMPTY store"]
fn the_kernel_toolchain_recipe_rebuilt_through_the_forge_door_is_its_pin() {
    let root = tempfile::tempdir().unwrap();
    let dir = root.path().join("containers/nordisk-kernel-toolchain");
    std::fs::create_dir_all(&dir).unwrap();
    std::fs::write(dir.join("Containerfile"), KERNEL_TOOLCHAIN_CONTAINERFILE).unwrap();
    let image = ContainerBuild {
        name: "nordisk-kernel-toolchain".into(),
        containerfile: "containers/nordisk-kernel-toolchain/Containerfile".into(),
        tags: vec!["nordisk-kernel-toolchain:reproduce-check".into()],
        expected_sha256: PIN.into(),
        ..Default::default()
    };
    let builder = BollardImageBuilder::connect().expect("an engine at DOCKER_HOST");
    let out = build_container(&builder, &image, "edda", root.path())
        .expect("the pinned recipe rebuilds as its pin — a mismatch names both identities");
    assert!(out.success, "{:?}", out.artifacts);
}