nordisk/holger

scripts/scan-sandbox-live.sh

#!/usr/bin/env bash
# The scan sandbox's container arms (lane SANDBOX-SCAN), as `cargo xtask
# scan-worker tests` runs them.
#
# On the host: a podman API service of our own (its own PID) on a socket under
# the target directory, and clamd in its sandbox. Then the tests run in the
# toolchain container with the repository's parent and the target directory
# mounted at their OWN paths, and TMPDIR under the target directory, so a job
# directory and a test's YARA rules are the same path for the server and for the
# engine. Every container started here is stopped here, by name.
set -euo pipefail
REPO=$(cd "$(dirname "$0")/.." && pwd)
PARENT=$(dirname "$REPO")
TARGET="${CARGO_TARGET_DIR:-$REPO/target}"
IMAGE="${HOLGER_SCAN_WORKER_IMAGE:-localhost/holger-scan-worker:$(sed -n 's/^version = "\(.*\)"/\1/p' "$REPO/server/cli/Cargo.toml" | head -1)}"
TOOLCHAIN="${TOOLCHAIN_IMAGE:-localhost/nordisk-cargo-toolchain:live}"
REGISTRY="${CARGO_REGISTRY_DIR:-${CARGO_HOME:-$HOME/.cargo}/registry}"
W="$TARGET/scan-sandbox"
SOCK="$W/podman.sock"
CLAMD="holger-test-clamd-$$"
mkdir -p "$W/jobs" "$W/tmp"
podman image exists "$IMAGE" || { echo "the worker image $IMAGE is not minted: cargo xtask scan-worker image" >&2; exit 1; }
rm -f "$SOCK"
podman system service --time=0 "unix://$SOCK" & SVC=$!
cleanup() { kill "$SVC" 2>/dev/null || true; wait "$SVC" 2>/dev/null || true; "$REPO/scripts/clamd-sandbox.sh" stop "$CLAMD"; rm -f "$SOCK"; }
trap cleanup EXIT
for _ in $(seq 1 100); do [ -S "$SOCK" ] && break; sleep 0.1; done
"$REPO/scripts/clamd-sandbox.sh" start "$CLAMD" "$W/clamd"
FEATURES_LIB="supply-chain,jobs,online"
podman run --rm -v "$PARENT:$PARENT" -v "$TARGET:$TARGET" -v "$REGISTRY:/usr/local/cargo/registry" \
  -e CARGO_TARGET_DIR="$TARGET" -e CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-24}" \
  -e HOLGER_SANDBOX_LIVE=1 -e HOLGER_TEST_SANDBOX=required -e HOLGER_TEST_SANDBOX_URL="unix://$SOCK" \
  -e HOLGER_TEST_SANDBOX_WORKDIR="$W/jobs" -e HOLGER_SCAN_WORKER_IMAGE="$IMAGE" \
  -e HOLGER_TEST_CLAMD_SOCKET="$W/clamd/clamd.sock" \
  -e TMPDIR="$W/tmp" \
  -w "$REPO" "$TOOLCHAIN" bash -c "
    set -e
    cargo test --locked -p holger-sandbox --test live_podman -- --include-ignored $*
    cargo test --locked -p holger-server-lib --features $FEATURES_LIB --test scan_sandbox_live -- --include-ignored $*
    cargo test --locked -p holger-server-lib --features $FEATURES_LIB --test pull_through_runs_the_intake_chain -- $*
  "