From cbdc4dc8793632991395dd9487ce5ae19aa85617 Mon Sep 17 00:00:00 2001 From: shujaat hasan Date: Fri, 24 Jul 2026 14:55:46 +0200 Subject: [PATCH 1/2] fix: resolve Bugbot findings on promotion PR #383 - Golden step scrape: broaden [a-f] to [a-z] so new steps stay covered - Golden summary capture: route stdout+stderr through a file for deterministic ordering - check_golden: point at TB_UPDATE_GOLDEN=1 when the golden is missing - Host audit: stop promising "no admin" for Tier 1 until rootless lands Co-Authored-By: Claude Opus 4.8 --- scripts/lib/probe.sh | 2 +- scripts/testdata/golden/00-install.golden | 2 +- scripts/tests/copy-catalog.bats | 22 ++++++++++++++++++---- scripts/tests/probe.bats | 6 ++++-- 4 files changed, 24 insertions(+), 8 deletions(-) diff --git a/scripts/lib/probe.sh b/scripts/lib/probe.sh index 06f6c633..ba07ced3 100644 --- a/scripts/lib/probe.sh +++ b/scripts/lib/probe.sh @@ -220,7 +220,7 @@ render_host_audit() { case "${INSTALL_TIER:-2}" in 0) echo -e " ${TB_HEADING}→ Install tier${RESET} Tier 0 (zero root) — a container is already runnable; no privileged steps." ;; - 1) echo -e " ${TB_HEADING}→ Install tier${RESET} Tier 1 — set up rootless Docker in your account (no admin needed)." ;; + 1) echo -e " ${TB_HEADING}→ Install tier${RESET} Tier 1 — set up Docker for your account; a one-time admin step is still needed for now." ;; 2) case "${INSTALL_TIER_REASON:-}" in needs-docker-desktop) echo -e " ${TB_HEADING}→ Install tier${RESET} Tier 2 — Docker isn't running; start/install Docker Desktop (needs admin once)." ;; diff --git a/scripts/testdata/golden/00-install.golden b/scripts/testdata/golden/00-install.golden index 75b46359..89778522 100644 --- a/scripts/testdata/golden/00-install.golden +++ b/scripts/testdata/golden/00-install.golden @@ -35,7 +35,7 @@ $ ./install-k8s.sh # the plan, printed once before install begins -$ ./install-k8s.sh # the six running step headers (a-f), titles from install-k8s.sh +$ ./install-k8s.sh # the running step headers, titles from install-k8s.sh a) Checking your machine b) Installing what tracebloc needs diff --git a/scripts/tests/copy-catalog.bats b/scripts/tests/copy-catalog.bats index 47083462..a94a6470 100644 --- a/scripts/tests/copy-catalog.bats +++ b/scripts/tests/copy-catalog.bats @@ -8,7 +8,7 @@ # golden catalog (cli repo, internal/cli/testdata/golden/). # # Two files, ordered like the run: -# 00-install.golden — banner, the "2. Installing" roadmap, the six running +# 00-install.golden — banner, the "2. Installing" roadmap, the running # step headers (titles read live from install-k8s.sh), # and --help. # 01-outcomes.golden — the state-branched final summary (connected / starting @@ -58,6 +58,13 @@ check_golden() { cp "$actual" "$golden" return 0 fi + # No golden yet → a bare `diff` just errors with "No such file"; point the + # reader at the regenerate command instead (a missing golden isn't drift). + if [ ! -f "$golden" ]; then + printf 'golden missing: %s\n' "$golden" >&2 + printf 'regenerate with: TB_UPDATE_GOLDEN=1 bats scripts/tests/copy-catalog.bats\n' >&2 + return 1 + fi diff -u "$golden" "$actual" } @@ -82,8 +89,8 @@ PROSE printf '\n$ ./install-k8s.sh # the plan, printed once before install begins\n' print_roadmap - printf '\n$ ./install-k8s.sh # the six running step headers (a-f), titles from install-k8s.sh\n' - sed -nE 's/.*step_header ([a-f]) "([^"]*)".*/\1 \2/p' "${SCRIPTS_DIR}/install-k8s.sh" \ + printf '\n$ ./install-k8s.sh # the running step headers, titles from install-k8s.sh\n' + sed -nE 's/.*step_header ([a-z]) "([^"]*)".*/\1 \2/p' "${SCRIPTS_DIR}/install-k8s.sh" \ | while read -r letter title; do step_header "$letter" "$title"; done printf '\n\n------------------------------------------------------------\n--help\n------------------------------------------------------------\n' @@ -109,7 +116,14 @@ PROSE local state for state in connected starting bad_creds image_pull crash; do printf '\n$ (install finished — %s)\n' "$state" - CLIENT_STATE="$state" print_summary 2>&1 + # print_summary splits across stdout (the body) and stderr (the ✖ lead line + # on error states). Merge them through a single file — both fds share one + # file offset, so the bytes land in write order — rather than `2>&1` down a + # pipe, where the two streams can interleave differently across machines and + # flake the byte-exact diff. + local summary="${BATS_TEST_TMPDIR}/summary.${state}" + CLIENT_STATE="$state" print_summary >"$summary" 2>&1 + cat "$summary" done printf '\n$ (connected, on macOS/Windows — the reboot footer differs)\n' diff --git a/scripts/tests/probe.bats b/scripts/tests/probe.bats index 395df5ac..3bf8883e 100644 --- a/scripts/tests/probe.bats +++ b/scripts/tests/probe.bats @@ -159,13 +159,15 @@ setup() { assert_has "Tier 0" "$output" } -@test "audit: Tier 1 panel shows the kernel row + rootless" { +@test "audit: Tier 1 panel shows the kernel row + the one-time admin note" { OS=Linux; PROBE_RUNTIME_USABLE=0; PROBE_CGROUP2=1; PROBE_USERNS=1 PROBE_PRIVILEGE=no_sudo; INSTALL_TIER=1; INSTALL_TIER_REASON=rootless-capable run render_host_audit assert_has "cgroup v2" "$output" assert_has "Tier 1" "$output" - assert_has "rootless" "$output" + # Tier 1 still runs the privileged install path (install_linux) until rootless + # Docker lands (#1177), so the audit must be honest about the one-time admin step. + assert_has "one-time admin" "$output" } @test "audit: Tier 2 no-userns names the disabled namespaces" { From 1a3b5ad7dae144cde23c2ae04f91bf8bef482167 Mon Sep 17 00:00:00 2001 From: shujaat hasan Date: Fri, 24 Jul 2026 14:57:51 +0200 Subject: [PATCH 2/2] chore: refresh installer manifest for probe.sh audit-copy change The supply-chain manifest pins a SHA per sub-script; the Tier 1 host-audit wording fix changed scripts/lib/probe.sh, so regenerate scripts/manifest.sha256. Co-Authored-By: Claude Opus 4.8 --- scripts/manifest.sha256 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/manifest.sha256 b/scripts/manifest.sha256 index c59d73e8..6feaefe7 100644 --- a/scripts/manifest.sha256 +++ b/scripts/manifest.sha256 @@ -12,7 +12,7 @@ fd8d37d698c242ab081095625aa430bb91971db646e35393a02bbadd41325898 scripts/lib/gp 32b5e879f6b27f1a67529d032d6c67cae885e7f60558a65a8037798d3c722b29 scripts/lib/install-cli.sh 725a85e4927761d8362221012ad1b69b380e36ec7fcfcf4c04b801f0994bce5c scripts/lib/provision.sh e2ea63d844e6649f1d3aaae9fd4733845a1a39df37d68abbaeda00330f9e1c7e scripts/lib/assess.sh -d15ddc3f5592bbac3caa5e68019260bd017b94156b48af4980292b27eaf40fc2 scripts/lib/probe.sh +1db9b359d2abccd2a7c530ccf39fcd60fd1d3e4924cef4f420898c4fd0dacd31 scripts/lib/probe.sh 446d83b15f1fdede9b999aa231a60635dec1d33a4356de448dbfdf9161ba8db9 scripts/lib/summary.sh 77e03332ebfab1ef759c6148a57afcf479c02c5dc6cc7b0e0e680f58e20cd364 scripts/lib/diagnose.sh 846844c4659c7d64c229b4a06dbb747428d1e518c4eba973f04e3f8e209fda9e scripts/install-k8s.ps1