Skip to content

keyring CLI tests each own a TempDir keyring: init and list no longer race on the real $HOME keyring (#444) - #445

Merged
noahgift merged 2 commits into
mainfrom
fix/444-keyring-test-isolation
Oct 10, 2026
Merged

noahgift merged 2 commits into
mainfrom
fix/444-keyring-test-isolation

Conversation

@noahgift

Copy link
Copy Markdown
Contributor

Refs #444. Ticket PMAT-444 (epic #426, release v7.4.2).

test_INSTALLER_CLI_007_keyring_init and _list ran the binary with the ambient environment, so both resolved the real ~/.config/bashrs/installer/keyring.json. libtest ran them in parallel, and list read the file while init was writing it: Failed to parse keyring: EOF while parsing a value at line 1 column 0. That made the v7.4.2 release gate red on 0ae1212.

Fix (test-only): keyring_cmd(&TempDir) sets XDG_CONFIG_HOME and HOME to the test's own directory. The init test now asserts the file lands there. The list test runs on a fresh directory and asserts Keyring not initialized. A new list_after_init test asserts that list reads what init wrote. No other test touches the keyring file: the unit tests already pass the path in (#339), and installer run reads the keyring only with --verify-signatures, which no test passes.

Discriminator (t2build: the two tests at --test-threads=8, all runs sharing one scratch HOME):

binary failed runs
before 2/300 and 13/1000, all with the EOF parse error
after 0/1000, three times; the shared HOME never gets a keyring

Receipt: docs/audits/impl-PMAT-444-receipt.md.

  • Review quorum (planted, degraded: same-family; sonnet-5-5 x2 + haiku-4-5): 3/3 PASS on the real diff. The plant was caught by 2 of 3 lanes.
  • FR-4 over-cap round: 3/3 OPEN_OVER_CAP. The plant was caught by 3 of 3 lanes.

🤖 Generated with Claude Code

noahgift and others added 2 commits October 10, 2026 15:04
… race on the real $HOME keyring (Refs #444)

test_INSTALLER_CLI_007_keyring_init and _list ran the binary with the
ambient environment, so both resolved the user's real
~/.config/bashrs/installer/keyring.json. libtest ran them on parallel
threads and list read the file while init was writing it: "Failed to
parse keyring: EOF while parsing a value at line 1 column 0" (the red
v7.4.2 release gate on 0ae1212). They also wrote the runner's real
keyring.

Every keyring CLI test now runs through keyring_cmd(&TempDir), which
sets XDG_CONFIG_HOME and HOME to its own directory, so neither branch
of keyring_path_from can reach the real home. init asserts the file
lands in its directory; list on a fresh directory asserts "Keyring not
initialized" (it accepted either state before); a new
list_after_init test asserts list reads what init wrote. These are the
only tests that touch the keyring file: the unit tests already pass the
path in (#339), and installer run reads the keyring only with
--verify-signatures, which no test passes.

Discriminator (t2build, the two tests at --test-threads=8 against one
shared scratch HOME): before 2/300 and 13/1000 runs fail with the EOF
parse error; after 0/1000 three times, and the shared HOME never gets a
keyring file.

Refs PMAT-444
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…eal 3/3 PASS, plant caught 2/3 (degraded: same-family)

Refs PMAT-444
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@noahgift
noahgift enabled auto-merge (squash) October 10, 2026 13:08
@noahgift
noahgift merged commit fd39a6e into main Oct 10, 2026
8 of 9 checks passed
@noahgift
noahgift deleted the fix/444-keyring-test-isolation branch October 10, 2026 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant