Daniel Hilst cfa3073da7 refactor(fips): generate the shell policy through a module sub ...

xCAT-test/unit/fips_policy_sources.t ran build-utils/sync-fips-policy as a
subprocess, so a file in the unit directory measured a program rather than a
routine, and it asserted on the diagnostics the script printed instead of on an
answer. buildrpms.pl and builddebs.pl started the same script with system() to
check the generated libraries before packaging xCAT or xCAT-genesis-scripts.

XCAT::BuildUtils gains fips_policy_artifacts, fips_policy_plan and
sync_fips_policy. fips_policy_plan reads the canonical policy and both runtime
libraries and reports what generation would write, without writing.
sync_fips_policy applies that plan in write mode and returns the stale paths,
the paths it rewrote and the diagnostics for its caller to print. The two
builders now call sync_fips_policy in their own process and print the
diagnostics before they stop, which keeps the output xCAT-test/native/
fips_build_guard.t asserts on. build-utils/sync-fips-policy keeps its
--check and --write contract and its exit status, and is now a thin caller.

The unit test calls the sub in-process and asserts on the returned hash. It
also covers a library holding two policy blocks and a library replaced by a
symbolic link, which the subprocess form did not reach. Ten mutants of the
module, one per guard, each fail the assertion that names that guard.

xCAT-test/bats/fips_policy_artifacts.bats copies XCAT::BuildUtils into its
fixture, because the script it runs now loads the module.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

2026-10-21 10:42:37 -03:00

..

XCAT

refactor(fips): generate the shell policy through a module sub

2026-10-21 10:42:37 -03:00