| commit | ff2fc79ef93045b708fab4d11b547c043c8e8114 | [log] [tgz] |
|---|---|---|
| author | Oliver Newman <olivernewman@google.com> | Wed May 31 12:25:08 2023 +0000 |
| committer | CQ Bot <fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com> | Wed May 31 12:25:08 2023 +0000 |
| tree | e6f6b9745178e06bcb94e1abdb4f26fa66b156a0 | |
| parent | 545a83ce0d04259598ea19e4cf5da89aa2c10e26 [diff] |
[engine] Pass through $PATH, fix goroot mounting 1. Pass the value of $PATH into sandbox and mount all directories listed in $PATH inside the sandbox. This is helpful for getting shac to run on machines where prerequisite binaries are installed in "non-standard" directories. For example, in Buildbucket builds, binaries such as python3 are installed in a Buildbucket-specific directory that we shouldn't hardcode in shac, so just passing through the entirety of $PATH is the best option. 2. Previously we'd try to mount `runtime.GOROOT()` even if it was an empty string, which would cause the nsjail command setup to fail with a "no such file or directory" error when run by a production `shac` build. That's because the production builds set `-trimpath` to remove all local filesystem paths from the executable, so `runtime.GOROOT()` and other build host-specific values are left unset. 3. Centralize tempdir sandboxing configuration in runtime_ctx_os.go to reduce duplication in sandbox.go. Change-Id: Id22de2338e9ce0212e63eedffe4e48e84f52d7f0 Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/863517 Commit-Queue: Oliver Newman <olivernewman@google.com> Reviewed-by: Marc-Antoine Ruel <maruel@google.com> Fuchsia-Auto-Submit: Oliver Newman <olivernewman@google.com>
Shac (Scalable Hermetic Analysis and Checks) is a unified and ergonomic tool and framework for writing and running static analysis checks.
Shac checks are written in Starlark.
go install go.fuchsia.dev/shac-project/shac@latest shac check shac doc shac.star | less
⚠ The source of truth is at https://fuchsia.googlesource.com/shac-project/shac.git and uses Gerrit for code review.
See CONTRIBUTING.md to submit changes.