diff --git a/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs index e8e601bf4..600843061 100644 --- a/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs +++ b/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs @@ -68,10 +68,10 @@ #[path = "common/mod.rs"] mod common; -use common::binary; +use common::{binary, hermetic, hermetic_command}; use std::path::{Path, PathBuf}; -use std::process::{Command, Output}; +use std::process::Output; use sha2::{Digest, Sha256}; use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes; @@ -107,18 +107,13 @@ const PATCH_SUFFIX: &str = // ── self-contained helpers ──────────────────────────────────────────── -/// Run socket-patch with ambient `SOCKET_*` vars scrubbed and the fixture's -/// private CARGO_HOME injected (the cargo crawler resolves the registry -/// source tree through it). +/// Run socket-patch in the hermetic environment (`tests/common/hermetic.rs`) +/// with the fixture's private CARGO_HOME injected (the cargo crawler +/// resolves the registry source tree through it). fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, String) { - let mut cmd = Command::new(binary()); + let mut cmd = hermetic_command(&binary()); + hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]); cmd.args(args).current_dir(cwd); - for (k, _) in std::env::vars_os() { - if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" { - cmd.env_remove(&k); - } - } - cmd.env_remove("VIRTUAL_ENV"); cmd.env("CARGO_HOME", cargo_home); let out = cmd.output().expect("failed to run socket-patch binary"); ( diff --git a/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs index 27980f321..df9354d36 100644 --- a/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs +++ b/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs @@ -53,12 +53,13 @@ //! release. `#[ignore]`-gated like the vendored twin: the unpinned `test` job //! skips it; the e2e job runs it with a pinned toolchain via `--ignored`. +#[path = "common/hermetic.rs"] +mod hermetic; #[path = "common/rollback_json.rs"] mod rollback_json; use std::io::Write as _; use std::path::{Path, PathBuf}; -use std::process::Command; use sha1::{Digest as _, Sha1}; use wiremock::matchers::{method, path, path_regex}; @@ -304,19 +305,13 @@ fn lock_entry(proj: &Path, name: &str) -> serde_json::Value { .clone() } -/// A socket-patch invocation with the ambient `SOCKET_*` surface scrubbed -/// (telemetry off, no socket-cli config, `VIRTUAL_ENV` removed). +/// A socket-patch invocation in the hermetic environment +/// (`tests/common/hermetic.rs`: telemetry off, no socket-cli config) with +/// `VIRTUAL_ENV` removed. fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) { - let mut cmd = Command::new(binary()); + let mut cmd = hermetic::command(&binary()); + hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]); cmd.args(args).current_dir(cwd); - for (k, _) in std::env::vars_os() { - if k.to_string_lossy().starts_with("SOCKET_") { - cmd.env_remove(&k); - } - } - cmd.env("SOCKET_TELEMETRY_DISABLED", "1") - .env("SOCKET_NO_CONFIG", "1") - .env_remove("VIRTUAL_ENV"); let out = cmd.output().expect("run socket-patch"); ( out.status.code().unwrap_or(-1), diff --git a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs index 93cebb4f4..31b0ee309 100644 --- a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs +++ b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs @@ -97,7 +97,7 @@ #[path = "common/mod.rs"] mod common; -use common::binary; +use common::{binary, hermetic, hermetic_command}; use std::io::Write as _; use std::path::{Path, PathBuf}; @@ -150,28 +150,20 @@ const TINY_LIB: &str = "module TinyDep\n VALUE = \"tiny-ok\"\nend\n"; // ── self-contained helpers ──────────────────────────────────────────── -/// Run the socket-patch binary with the ambient `SOCKET_*` surface scrubbed -/// (a developer's `SOCKET_DRY_RUN=1` must not steer the assertions) and -/// `VIRTUAL_ENV` (crawler discovery input) removed. +/// Run the socket-patch binary in the hermetic environment +/// (`tests/common/hermetic.rs`: a developer's `SOCKET_DRY_RUN=1` must not +/// steer the assertions) with `VIRTUAL_ENV` (crawler discovery input) and +/// every ambient `BUNDLE_*` var (the crawler reads `BUNDLE_GEMFILE`, +/// `BUNDLE_PATH`, mirrors, ...) removed. fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) { run_socket_env(cwd, args, &[]) } /// [`run_socket`] with extra environment on top of the scrubbed surface. fn run_socket_env(cwd: &Path, args: &[&str], envs: &[(&str, &str)]) -> (i32, String, String) { - let mut cmd = Command::new(binary()); + let mut cmd = hermetic_command(&binary()); + hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv, hermetic::Extra::Bundle]); cmd.args(args).current_dir(cwd); - for (k, _) in std::env::vars_os() { - if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" { - cmd.env_remove(&k); - } - } - for (key, _) in std::env::vars_os() { - if key.to_string_lossy().starts_with("BUNDLE_MIRROR__") { - cmd.env_remove(key); - } - } - cmd.env_remove("VIRTUAL_ENV"); for (k, v) in envs { cmd.env(k, v); } diff --git a/crates/socket-patch-cli/tests/e2e_redirect_maven_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_maven_build.rs index 75f519336..a2f6b2b0b 100644 --- a/crates/socket-patch-cli/tests/e2e_redirect_maven_build.rs +++ b/crates/socket-patch-cli/tests/e2e_redirect_maven_build.rs @@ -52,6 +52,8 @@ //! `SOCKET_PATCH_MAVEN_E2E_{MVN,VERSION,REQUIRED}` gates in //! `maven_build_common`. +#[path = "common/hermetic.rs"] +mod hermetic; #[path = "common/rollback_json.rs"] mod rollback_json; @@ -63,7 +65,6 @@ mod maven_build_common; mod vex_e2e_common; use std::path::{Path, PathBuf}; -use std::process::Command; use hosted_maven_common::{Hosted, Server}; use maven_build_common::*; @@ -133,23 +134,17 @@ fn mount_api(s: &Server, jar: &[u8], pom: &[u8], view: &serde_json::Value) { hosted_maven_common::mount_api(s, &HOSTED, jar, pom, view); } -/// `socket-patch ` with ambient `SOCKET_*` scrubbed and the per-test -/// local repository as the crawler's maven repo. +/// `socket-patch ` in the hermetic environment +/// (`tests/common/hermetic.rs`) with the per-test local repository as the +/// crawler's maven repo. fn socket(cwd: &Path, m2: &Path, args: &[&str]) -> (Option, serde_json::Value, String) { - let mut cmd = Command::new(binary()); - for (k, _) in std::env::vars_os() { - if k.to_string_lossy().starts_with("SOCKET_") { - cmd.env_remove(&k); - } - } + let mut cmd = hermetic::command(&binary()); + hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]); let out = cmd .args(args) .current_dir(cwd) - .env("SOCKET_TELEMETRY_DISABLED", "1") - .env("SOCKET_NO_CONFIG", "1") .env("MAVEN_REPO_LOCAL", m2) .env_remove("M2_HOME") - .env_remove("VIRTUAL_ENV") .output() .expect("run socket-patch"); let stdout = String::from_utf8_lossy(&out.stdout).into_owned(); diff --git a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs index 33e19fe9c..bc451f1df 100644 --- a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs +++ b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs @@ -63,10 +63,10 @@ mod rollback_json; #[path = "common/mod.rs"] mod common; -use common::binary; +use common::{binary, hermetic, hermetic_command}; use std::path::{Path, PathBuf}; -use std::process::{Command, Output}; +use std::process::Output; use sha2::{Digest, Sha512}; use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes; @@ -107,18 +107,13 @@ const PURL_UNINSTALLED: &str = "pkg:npm/left-pad@9.9.9"; // ── self-contained helpers ──────────────────────────────────────────── -/// Run the socket-patch binary with a scrubbed environment: every ambient -/// `SOCKET_*` var is removed (so a developer's `SOCKET_DRY_RUN=1` etc. can't -/// flip behavior) along with `VIRTUAL_ENV` (crawler discovery input). +/// Run the socket-patch binary in the hermetic environment +/// (`tests/common/hermetic.rs`: a developer's `SOCKET_DRY_RUN=1` etc. can't +/// flip behavior) with `VIRTUAL_ENV` (crawler discovery input) removed. fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) { - let mut cmd = Command::new(binary()); + let mut cmd = hermetic_command(&binary()); + hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]); cmd.args(args).current_dir(cwd); - for (k, _) in std::env::vars_os() { - if k.to_string_lossy().starts_with("SOCKET_") && k.to_string_lossy() != "SOCKET_NO_CONFIG" { - cmd.env_remove(&k); - } - } - cmd.env_remove("VIRTUAL_ENV"); let out = cmd.output().expect("failed to run socket-patch binary"); ( out.status.code().unwrap_or(-1), diff --git a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs index 1ab36debd..c6f5f77d6 100644 --- a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs +++ b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs @@ -46,12 +46,7 @@ const PENDING_RAW_SPAWNS: &[&str] = &[ "e2e_pypi.rs", "e2e_pypi_multi_copy.rs", "e2e_redirect_bun_build.rs", - "e2e_redirect_cargo_build.rs", "e2e_redirect_cargo_shapes.rs", - "e2e_redirect_composer_build.rs", - "e2e_redirect_gem_build.rs", - "e2e_redirect_maven_build.rs", - "e2e_redirect_npm_build.rs", "e2e_scan.rs", "e2e_socket_yml_policy.rs", "e2e_vendor_bun_build.rs",