From 078fed868c532988b28fe151de159a3b2de3cfda Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Tue, 12 May 2026 07:54:38 +0100 Subject: [PATCH] nono: shorten test skipping Remove the need to repeat `--skip=` for every test. --- pkgs/by-name/no/nono/package.nix | 119 ++++++++++++++++--------------- 1 file changed, 60 insertions(+), 59 deletions(-) diff --git a/pkgs/by-name/no/nono/package.nix b/pkgs/by-name/no/nono/package.nix index 6a67b02ce381..c4bf330111a5 100644 --- a/pkgs/by-name/no/nono/package.nix +++ b/pkgs/by-name/no/nono/package.nix @@ -37,69 +37,70 @@ rustPlatform.buildRustPackage (finalAttrs: { writableTmpDirAsHomeHook ]; - checkFlags = [ - # fails to initialize the sandbox under '/build' - "--skip=test_all_profiles_signal_mode_resolves" - # panic - "--skip=build_run_profile_patch_adds_override_deny_for_sensitive_file" - "--skip=build_run_profile_patch_merges_read_and_write_to_allow_file" - "--skip=prepare_profile_save_from_patch_updates_existing_user_profile" - "--skip=would_shadow_builtin_allows_update_of_existing_user_override" - "--skip=would_shadow_builtin_flags_known_builtin_names" - "--skip=create_audit_state_creates_session_when_enabled" + checkFlags = map (t: "--skip=${t}") ( + [ + # fails to initialize the sandbox under '/build' + "test_all_profiles_signal_mode_resolves" + # panic + "build_run_profile_patch_adds_override_deny_for_sensitive_file" + "build_run_profile_patch_merges_read_and_write_to_allow_file" + "prepare_profile_save_from_patch_updates_existing_user_profile" + "would_shadow_builtin_allows_update_of_existing_user_override" + "would_shadow_builtin_flags_known_builtin_names" + "create_audit_state_creates_session_when_enabled" - # audit_attestation - # needs /bin/pwd - "--skip=audit_verify_reports_signed_attestation_with_pinned_public_key" - "--skip=rollback_signed_session_verifies_from_audit_dir_bundle" + # audit_attestation + # needs /bin/pwd + "audit_verify_reports_signed_attestation_with_pinned_public_key" + "rollback_signed_session_verifies_from_audit_dir_bundle" - # nono-cli - # wants a script `cripts/test-list-aliases.sh`, `git`, and `.git` history - "--skip=alias_inventory_script_passes" - # fails to initialize the sandbox under '/build' - "--skip=policy::tests::test_all_groups_no_deny_within_allow_overlap" - # not relevant for us, requires `git` - "--skip=lint_docs_script_passes" - # want to run `git` - "--skip=alias_inventory_rejects_marker_missing_field" - "--skip=alias_inventory_rejects_naked_serde_alias" - "--skip=alias_inventory_rejects_unapproved_deprecated_module_reach_in" - "--skip=lint_docs_accepts_clean_tree" - "--skip=lint_docs_rejects_quoted_override_deny_outside_allowlist" + # nono-cli + # wants a script `cripts/test-list-aliases.sh`, `git`, and `.git` history + "alias_inventory_script_passes" + # fails to initialize the sandbox under '/build' + # has also failed due to running on darwin despite testing the linux only + # landlock sandboxing + "policy::tests::test_all_groups_no_deny_within_allow_overlap" + # not relevant for us, requires `git` + "lint_docs_script_passes" + # want to run `git` + "alias_inventory_rejects_marker_missing_field" + "alias_inventory_rejects_naked_serde_alias" + "alias_inventory_rejects_unapproved_deprecated_module_reach_in" + "lint_docs_accepts_clean_tree" + "lint_docs_rejects_quoted_override_deny_outside_allowlist" - # nono-proxy - # fails to prepare TLS bundle inside build sandbox - "--skip=server::tests::test_intercept_lifecycle_end_to_end" - "--skip=server::tests::test_route_diagnostics_summarises_each_route" - "--skip=tls_intercept::bundle::tests::bundle_contains_ephemeral_and_system_roots" - "--skip=tls_intercept::bundle::tests::bundle_file_has_restrictive_permissions" - ] - ++ lib.optionals stdenv.hostPlatform.isDarwin [ - # panics with "Deny-within-allow overlap on Linux ... Landlock cannot enforce this. ..." - # landlock is linux only - "--skip=policy::tests::test_all_groups_no_deny_within_allow_overlap" - # panics with "exact-path fallback must not recursively cover descendants" - "--skip=capability_ext::tests::test_from_profile_allow_file_falls_back_to_exact_directory_when_present" + # nono-proxy + # fails to prepare TLS bundle inside build sandbox + "server::tests::test_intercept_lifecycle_end_to_end" + "server::tests::test_route_diagnostics_summarises_each_route" + "tls_intercept::bundle::tests::bundle_contains_ephemeral_and_system_roots" + "tls_intercept::bundle::tests::bundle_file_has_restrictive_permissions" + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + # panics with "exact-path fallback must not recursively cover descendants" + "capability_ext::tests::test_from_profile_allow_file_falls_back_to_exact_directory_when_present" - # env_vars - # don't work inside of the /nix dir - # unsure why home is still under /nix with writableTmpDirAsHomeHook - # Sandbox initialization failed: Refusing to grant '/nix' (source: group:system_read_macos) because it overlaps protected nono state root '/nix/build/nix-/.home/.nono'. - "--skip=allow_net_overrides_profile_external_proxy" - "--skip=cli_flag_overrides_env_var" - "--skip=env_nono_allow_comma_separated" - "--skip=env_nono_block_net" - "--skip=env_nono_block_net_accepts_true" - "--skip=env_nono_network_profile" - "--skip=env_nono_profile" - "--skip=env_nono_upstream_bypass_comma_separated" - "--skip=env_nono_upstream_proxy" - "--skip=legacy_env_nono_net_block_still_works" - "--skip=environment_allow_vars_bare_star" - "--skip=environment_allow_vars_default_allows_all" - "--skip=environment_allow_vars_prefix_patterns" - "--skip=environment_allow_vars_with_profile" - ]; + # env_vars + # don't work inside of the /nix dir + # unsure why home is still under /nix with writableTmpDirAsHomeHook + # Sandbox initialization failed: Refusing to grant '/nix' (source: group:system_read_macos) because it overlaps protected nono state root '/nix/build/nix-/.home/.nono'. + "allow_net_overrides_profile_external_proxy" + "cli_flag_overrides_env_var" + "env_nono_allow_comma_separated" + "env_nono_block_net" + "env_nono_block_net_accepts_true" + "env_nono_network_profile" + "env_nono_profile" + "env_nono_upstream_bypass_comma_separated" + "env_nono_upstream_proxy" + "legacy_env_nono_net_block_still_works" + "environment_allow_vars_bare_star" + "environment_allow_vars_default_allows_all" + "environment_allow_vars_prefix_patterns" + "environment_allow_vars_with_profile" + ] + ); meta = { description = "Secure, kernel-enforced sandbox for AI agents, MCP and LLM workloads";