mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
090a7b622b
* refactor(nixpak): split policy checks into per-app suites Make hardening/tests/policy.nix a small loader that auto-discovers one suite per app under hardening/tests/policy. Shared checks live in policy-lib.nix and common expectations are generated by mkAppPolicy; app files only declare differences and special cases. The loader also discovers wrappers from hardening/nixpaks and fails when wrapper/suite inventory or check names diverge. Assisted-by: DeepSeek Harness (deepseek-flash) * fix(nixpak): reject duplicate per-app policy checks mkAppPolicy merges generated and custom checks, so an extraChecks key could silently override a standard assertion. Fail explicitly when a per-app check name is defined twice. Assisted-by: DeepSeek Harness (deepseek-flash)
37 lines
1.4 KiB
Nix
37 lines
1.4 KiB
Nix
# Evaluate with the same pkgs/mkNixPak as the wrappers. Every file under
|
|
# ./policy is imported as one app policy suite. Wrapper files are auto-discovered
|
|
# from ../nixpaks, so a wrapper and its suite must be added together.
|
|
{
|
|
pkgs,
|
|
mkNixPak,
|
|
mylib,
|
|
}:
|
|
let
|
|
inherit (pkgs) lib;
|
|
ctx = import ./policy-lib.nix { inherit pkgs mkNixPak; };
|
|
suitePaths = mylib.scanPaths ./policy;
|
|
suiteNames = map (path: lib.removeSuffix ".nix" (baseNameOf (toString path))) suitePaths;
|
|
suites = map (path: import path ctx) suitePaths;
|
|
merge =
|
|
acc: suite:
|
|
let
|
|
duplicates = lib.attrNames (lib.intersectAttrs acc suite);
|
|
in
|
|
if duplicates != [ ] then
|
|
throw "duplicate nixpak policy checks: ${lib.concatStringsSep ", " duplicates}"
|
|
else
|
|
acc // suite;
|
|
checks = ctx.globalChecks // lib.foldl' merge { } suites;
|
|
missing = lib.subtractLists suiteNames ctx.appNames;
|
|
orphans = lib.subtractLists ctx.appNames suiteNames;
|
|
failures = builtins.filter (name: !(checks.${name} or false)) (builtins.attrNames checks);
|
|
problems =
|
|
lib.optional (missing != [ ]) "missing policy suites: ${lib.concatStringsSep ", " missing}"
|
|
++ lib.optional (orphans != [ ]) "orphan policy suites: ${lib.concatStringsSep ", " orphans}"
|
|
++ lib.optional (failures != [ ]) "failed checks:\n - ${lib.concatStringsSep "\n - " failures}";
|
|
in
|
|
if problems == [ ] then
|
|
true
|
|
else
|
|
throw "nixpak policy check failed:\n${lib.concatStringsSep "\n" problems}"
|