Commitf9c20d08Recorded30 Jul 2026Repositorycore-channel

Assert the hello under test came from the gate's own store

Message

sigil env shell does not isolate PATH, so a command the environment does not provide resolves from the host. Observed while sabotage-testing: with a profile shipping no hello, -- hello ran the guix profile's hello and printed "MD5('Hello, world!') = ...".

That string contains the literal text the run-stage assertion looks for. An unanchored grep would have matched it and passed a sabotage that must fail -- the gate would have been vacuous again, in a new way. The assertion is anchored, so it refused; this commit removes the reliance on that being noticed, by establishing provenance before trusting output.

Changed
 scripts/gate-crosscheckout.sh | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
Diff
scripts/gate-crosscheckout.shmodified
@@ -64,6 +64,29 @@ fi
64
65
# Consumption: deliberately WITHOUT SIGIL_REGISTRY_METADATA and without
66
# SIGIL_CHANNEL, which also holds the lock-only consumption boundary honest.
+67
#
+68
# PROVENANCE FIRST. `sigil env shell` does not isolate PATH, so a command the
+69
# environment does not provide resolves from the HOST. Observed directly: with
+70
# a profile that ships no hello, `-- hello` ran /gnu/store/...-profile/bin/hello
+71
# and printed "MD5('Hello, world!') = ...". So establish that the hello about
+72
# to run came out of THIS gate's store before believing anything it prints.
+73
which_status=0
+74
HOME="$scratch/home" \
+75
"$sigil_bin" env --store "$scratch/store" shell \
+76
-f "$scratch/env.lock" -- sh -c 'command -v hello' \
+77
>"$scratch/hello.path" 2>&1 || which_status=$?
+78
+79
hello_path=$(head -1 "$scratch/hello.path" 2>/dev/null || true)
+80
case "$hello_path" in
+81
"$scratch/store/"*) : ;;
+82
*)
+83
echo "cross-checkout gate: FAILED at provenance" >&2
+84
echo " exit status: $which_status" >&2
+85
echo " hello must resolve inside $scratch/store, got: ${hello_path:-<nothing>}" >&2
+86
exit 1
+87
;;
+88
esac
+89
90
run_status=0
91
HOME="$scratch/home" \
92
"$sigil_bin" env --store "$scratch/store" shell \
@@ -83,4 +106,5 @@ fi
106
# observed is auditable from a CI log; a bare "green" is what this gate
107
# printed for five days while observing nothing.
108
echo "cross-checkout gate: fresh clone bootstrapped, locked, and ran hello from the lock"
+109
echo "cross-checkout gate: ran $hello_path"
110
echo "cross-checkout gate: observed program output: $(head -1 "$scratch/hello.out")"