holger-recipe/tests/installer_pin.rs
//! **The installer holger composes with is PINNED, and the pin is not a caret.**
//!
//! MEASURED 2026-09-21, lane H2, after the same shape was found on the gunnar
//! side: `korp-installer` was named as
//!
//! ```toml
//! korp-installer = { version = "0.1.7", path = "../../edda/crates/korp-installer", … }
//! ```
//!
//! and `"0.1.7"` is `^0.1.7` — satisfied by every 0.1.x. The lock resolved
//! **0.1.13**. Six patch releases of the thing that lays down the boot disk,
//! elects the boot device and stages the per-site declarations, and the manifest
//! comment beside it still read *"0.1.7, the version edda main carries"*. The
//! same manifest already carries a written-down scar from this exact class of
//! bug — *"`^0.1` can never reach 0.5.x, so this resolved nornir 0.1.0"* — so
//! the rule was known and not applied one line above it.
//!
//! **The path is the real source, and that is the sharper half.** With a `path`
//! the requirement never selects anything: cargo takes the sibling checkout and
//! only CHECKS that its version satisfies the requirement. So the medium is
//! composed from whatever is in `../../edda` at the moment — whatever branch it
//! is on, committed or not. That cannot be pinned from here, and pretending
//! otherwise would be the lie. What CAN be done is make the requirement EXACT,
//! so the sibling checkout drifting to another version is a build-time refusal
//! with both numbers in it instead of a silent upgrade of the installer.
//!
//! Pure Rust, no cargo process: the manifest and the lock are both TOML.
//!
//! # MOVED 0.1.13 -> 0.1.18, 2026-09-23 — and why the pin needed moving
//!
//! The pin did its job for two days and then became the problem it was written
//! against. edda main carries korp-installer **0.1.18** and the gunnar estate
//! is pinned to 0.1.18; this repository was held at 0.1.13. dwarves resolves
//! its workspace with holger as a sibling, so the DWARVES lock was dragged
//! backwards to 0.1.13 (and nornir-build-thing to 0.1.20), a `--locked` build
//! of dwarves could not resolve at all, and nothing could be released from a
//! tree resolved that way.
//!
//! The lesson is not "raise the number". An exact pin is a promise that
//! somebody will move it deliberately when the thing it names moves, and a pin
//! five patch releases behind the crate that lays down the boot disk is not a
//! pin, it is a retired installer. These two tests are what make the move
//! deliberate: they refuse until the manifest and the lock say the same thing.
use std::path::Path;
fn read(path: &Path) -> toml::Value {
let text =
std::fs::read_to_string(path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
text.parse::<toml::Table>()
.map(toml::Value::Table)
.unwrap_or_else(|e| panic!("parse {}: {e}", path.display()))
}
/// The one manifest in this repository that names `korp-installer`, and the
/// requirement it declares.
fn declared_requirement() -> (std::path::PathBuf, String) {
let root = holger_recipe::repo_root();
let manifest = root.join("xtask/Cargo.toml");
let v = read(&manifest);
let dep = v
.get("dependencies")
.and_then(|d| d.get("korp-installer"))
.unwrap_or_else(|| {
panic!(
"xtask/Cargo.toml no longer names korp-installer — if the \
installer moved, this test must move with it"
)
});
let req = dep
.get("version")
.and_then(toml::Value::as_str)
.unwrap_or_else(|| {
panic!(
"the korp-installer dependency declares no `version` at all — \
a bare `path` pins NOTHING and reads as whatever the sibling \
checkout happens to be"
)
})
.to_string();
(manifest, req)
}
/// **The requirement must be EXACT.** A caret here is not a pin: it accepts
/// every future 0.1.x of the crate that writes the partition table.
#[test]
fn the_installer_requirement_is_exact_and_not_a_caret() {
let (manifest, req) = declared_requirement();
assert!(
req.starts_with('='),
"{}: korp-installer is required as `{req}`, which is a CARET requirement — it accepts \
every 0.1.x, so the crate that elects the boot disk and stages the per-site \
declarations can change under a medium nobody rebuilt. Write `=<version>`.",
manifest.display()
);
}
/// **And the exact requirement must be the version that is actually resolved.**
/// The sibling `path` is what cargo takes; this holds the declaration to it, so
/// a checkout that has moved on is a red test with both numbers in it rather
/// than a quieter installer than the manifest says.
#[test]
fn the_requirement_is_the_version_the_lock_resolved() {
let (manifest, req) = declared_requirement();
let want = req.trim_start_matches('=').trim();
let lock = read(&holger_recipe::repo_root().join("Cargo.lock"));
let resolved: Vec<String> = lock
.get("package")
.and_then(toml::Value::as_array)
.expect("Cargo.lock has a [[package]] array")
.iter()
.filter(|p| p.get("name").and_then(toml::Value::as_str) == Some("korp-installer"))
.filter_map(|p| {
p.get("version")
.and_then(toml::Value::as_str)
.map(str::to_string)
})
.collect();
assert_eq!(
resolved.len(),
1,
"korp-installer resolves to {} entries in Cargo.lock ({resolved:?}) — two copies of the \
installer in one graph means the medium and whatever measured it can be different \
builds",
resolved.len()
);
assert_eq!(
resolved[0],
want,
"{} requires korp-installer `{req}` but the lock resolved {} — the sibling checkout at \
../../tunnr/crates/korp-installer (edda before 2026-09-26) has moved, and with a `path` dependency the checkout \
always wins. Re-read what changed in the installer, then update the requirement \
deliberately.",
manifest.display(),
resolved[0]
);
}