Integrate the ignored-workspace corpus into verification

Give the Git Sentry launch shape one Rust owner, update the physical corpus to supply every authority, and make the default repository gate distinguish unavailable physical prerequisites from corpus failures.

tools/ignored_workspace_verifier.py

@@ -576,11 +576,19 @@ def sentry_case(case_id, fixture, sentry_binary):
     commit(fixture)
     transient = fixture.root / "transient-hooks"
     transient.mkdir()
+    transient_config = fixture.root / "transient-config"
+    transient_config.touch()
     write(fixture.host / ".git/hooks/host-sentinel", b"host")
     host_config = (fixture.host / ".git/config").read_bytes()
     with fixture.start():
         process = subprocess.Popen(
-            [sentry_binary, fixture.mount, fixture.host / ".git", transient],
+            git_sentry_command(
+                sentry_binary,
+                fixture.mount,
+                fixture.host / ".git",
+                transient,
+                transient_config,
+            ),
             stdin=subprocess.PIPE,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
@@ -601,6 +609,10 @@ def sentry_case(case_id, fixture, sentry_binary):
     require((transient / "sandbox-hook").read_bytes() == b"transient", "transient hook missing")
 
 
+def git_sentry_command(binary, workspace, common, hooks, config):
+    return [binary, workspace, common, hooks, config]
+
+
 def invalidation_or_race_case(case_id, fixture):
     ignored_pair(fixture)
     with fixture.start():
@@ -705,6 +717,24 @@ def run_corpus(arguments):
     require(all(result["disposition"] == "PASS" for result in results), "one or more corpus cases failed")
 
 
+def unavailable_physical_prerequisite():
+    if sys.platform != "linux":
+        return "Linux is required"
+    for program in ("git", "unshare", "fusermount3"):
+        if shutil.which(program) is None:
+            return f"{program} is unavailable"
+    fuse = Path("/dev/fuse")
+    if not fuse.exists() or not os.access(fuse, os.R_OK | os.W_OK):
+        return "/dev/fuse is unavailable"
+    probe = command(
+        ["unshare", "--user", "--map-root-user", "--mount", "--propagation", "private", "--", "true"],
+        check=False,
+    )
+    if probe.returncode != 0:
+        return "private user and mount namespaces are unavailable"
+    return None
+
+
 def main():
     parser = argparse.ArgumentParser()
     subparsers = parser.add_subparsers(dest="command", required=True)
@@ -717,6 +747,10 @@ def main():
     corpus.add_argument("--fail-fast", action="store_true")
     arguments = parser.parse_args()
     if arguments.command == "corpus":
+        unavailable = unavailable_physical_prerequisite()
+        if unavailable is not None:
+            print(f"SKIP ignored-workspace corpus: {unavailable}", file=sys.stderr)
+            return 77
         if arguments.case in (None, "git-sentry") and os.environ.get(NAMESPACE_MARKER) != "1":
             environment = os.environ.copy()
             environment[NAMESPACE_MARKER] = "1"
@@ -737,7 +771,8 @@ def main():
                 environment,
             )
         run_corpus(arguments)
+    return 0
 
 
 if __name__ == "__main__":
-    main()
+    sys.exit(main())

tools/lazaret_verify.py

@@ -618,6 +618,27 @@ def run_rust_tests() -> None:
     run(list(DOCTEST_COMMAND))
 
 
+def run_ignored_workspace_corpus(metadata: dict) -> None:
+    binaries = build_workspace_binaries(metadata)
+    with tempfile.TemporaryDirectory(prefix="lazaret-ignored-workspace-corpus-") as directory:
+        root = Path(directory)
+        run_physical(
+            [
+                sys.executable,
+                str(ROOT / "tools/ignored_workspace_verifier.py"),
+                "corpus",
+                "--router",
+                str(binaries["lazaret-ignored-workspace"]),
+                "--git-sentry",
+                str(binaries["lazaret-git-sentry"]),
+                "--work-root",
+                str(root / "work"),
+                "--output",
+                str(root / "result.json"),
+            ]
+        )
+
+
 def verify(process_syscalls: bool) -> None:
     check_tool_versions()
     metadata = workspace_metadata()
@@ -637,6 +658,7 @@ def verify(process_syscalls: bool) -> None:
         ]
     )
     run_rust_tests()
+    run_ignored_workspace_corpus(metadata)
     run([sys.executable, "-m", "unittest", "discover", "-s", "tests/tooling"])
     audit_workspace_lints(metadata)
     audit_dependencies(metadata)