Drive init from the E2E and preflight scripts with flags instead of piped prompt answers (#822) - #823
Conversation
Every script that ran `bootroot init` non-interactively piped a fixed answer sequence into it, and how many prompts the run reached depended on what was on disk: an overwrite confirmation for each of password.txt, ca.json and state.json that happened to exist, plus a db-provision confirmation. The sequences lined up only because a cleanup step earlier in the same script had removed the right files. That coupling was invisible at the call site, and since init fails on EOF rather than answering a prompt itself, changing a cleanup step, a flag or the prompt set aborts the run. Each prompt that has a non-interactive flag is now supplied with that flag, and the runs that need no answer at all read from /dev/null. An overwrite flag whose file is absent is a silent no-op, so the same invocation works on a clean workspace and on a rerun. Two answers remain, both in test-core.sh, and both are commented with the prompt they answer: only the declined branch of the save-unseal-keys prompt echoes the keys in cleartext, which the zero-config assertion reads, and `--no-save-unseal-keys` suppresses that echo as well as requiring a `--summary-json` neither smoke run writes. The three impl scripts that wrote `BOOTROOT_LANG=en` on the left of the pipe bound it to `printf`, leaving the run whose English output they parse to take the caller's locale. With the pipe gone the prefix binds to the run it was written for. Closes #822
|
Test plan executed. Everything under Local (macOS, Docker Desktop)
Both The overwrite flags were also exercised against a dirty workspace: the first CI
Not verifiable on this host (all pre-existing environment constraints, none of them touched by this PR):
For that reason One observation outside this issue's scope: |
|
[Reviewer Round 1] I found no blocking issue. The changed
The English and Korean E2E excerpts now reflect the corresponding non-interactive invocations, including the previously stale remote EAB setup. PR linkage and test-plan structure are also in place. |
|
[Review Verdict Round 1: APPROVED] |
1 participant
Summary
Every
bootroot initinvocation underscripts/was driven non-interactively by piping a fixed answer sequence into it. How many prompts a run actually reaches is state-dependent — an overwrite confirmation for each ofsecrets/password.txt,secrets/config/ca.jsonandstate.jsonthat exists on disk, plus adb-provisionconfirmation — so those sequences lined up only because a cleanup step earlier in the same script had left the right files absent. Sinceinitfails on EOF rather than answering a prompt itself, that invisible coupling breaks the run the moment a cleanup step, a flag or the prompt set changes.Each prompt that has a non-interactive flag is now supplied with that flag (
--overwrite-password,--overwrite-ca-json,--overwrite-state,--confirm-db-provision,--no-eab, and--save-unseal-keys/--no-save-unseal-keys), and the invocations left with nothing to answer read from/dev/null. An overwrite flag whose file is absent is a silent no-op, so the same command works on a clean workspace and on a rerun.Two piped answers remain, both in
scripts/preflight/ci/test-core.sh, each commented with the prompt it answers. Only the declined branch of the save-unseal-keys prompt echoes the keys in cleartext, and that echo is exactly what the zero-config assertion reads;--no-save-unseal-keyssuppresses it, and additionally requires a--summary-jsonneither smoke run writes.The three
scripts/impl/invocations that wroteBOOTROOT_LANG=enon the left of the pipe bound it toprintf, leaving thebootrootrun whose English output the script parses to take the caller's ambient locale. With the pipe gone, the prefix binds to the run it was written for.The
bootroot initexcerpts indocs/en/e2e-ci.mdanddocs/ko/e2e-ci.mdwere updated to match the scripts they document; the remote excerpt had also drifted, still showing--eab-kid/--eab-hmacfor a script that passes--no-eab.No Rust changed:
init's EOF behaviour, the prompts it asks, and the flags it accepts are all untouched.Closes #822
Test plan
scripts/preflight/ci/test-core.shcompletes, including its cleartext unseal-key assertion (grep -q "unseal key" zero-config-init.log)scripts/preflight/extra/cli-scenarios.shcompletesscripts/preflight/ci/e2e-matrix.shcompletes, covering the local, remote and reinit-recovery lifecycle scriptsscripts/preflight/ci/e2e-extended.shcompletes, covering the extended suite that runsscripts/impl/run-ca-key-rotation-recovery.shtest-docker-e2e-matrix) pass in CI on this PRrun-extendedfrome2e-extended.ymlpasses./scripts/check-docs.shpasses (verified locally)scripts/preflight/run-all.shinitinvocation underscripts/depends on the on-disk state ofpassword.txt,ca.jsonorstate.jsonfor its answer sequence to be long enough