tests: add test for bug with remote builds as non‐root user

Change-Id: I6a6a696420847c1f47f79269be6b63108ab63afa

tests/nixos/default.nix

@@ -111,6 +111,21 @@ in
 
   remoteBuildsSshNg = runNixOSTestFor "x86_64-linux" ./remote-builds-ssh-ng.nix;
 
+  # Test building with a non‐`root` user on the remote
+
+  remoteBuildsSshNgNonRoot = runNixOSTestFor "x86_64-linux" {
+    name = "remoteBuildsSshNgNonRoot";
+    imports = [ ./remote-builds-ssh-ng.nix ];
+    builders.config = {
+      users.users.test-user = {
+        isNormalUser = true;
+      };
+    };
+    sshUser = "test-user";
+    # FIXME: <https://git.lix.systems/lix-project/lix/issues/884>
+    expectSuccess = false;
+  };
+
   # Test our Nix as a client against remotes that are older
 
   remoteBuildsSshNg_remote_2_18 = runNixOSTestFor "x86_64-linux" {

tests/nixos/remote-builds-ssh-ng.nix

@@ -36,6 +36,22 @@ in
       '';
       default = { };
     };
+
+    sshUser = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        Builder user to run remote builds as.
+      '';
+      default = "root";
+    };
+
+    expectSuccess = lib.mkOption {
+      type = lib.types.bool;
+      description = ''
+        Whether to expect the remote build to succeed or not.
+      '';
+      default = true;
+    };
   };
 
   config = {
@@ -54,11 +70,12 @@ in
 
         client =
           { config, lib, pkgs, ... }:
-          { nix.settings.max-jobs = 0; # force remote building
+          {
+            nix.settings.max-jobs = 0; # force remote building
             nix.distributedBuilds = true;
             nix.buildMachines =
               [ { hostName = "builder";
-                  sshUser = "root";
+                  inherit (test.config) sshUser;
                   sshKey = "/root/.ssh/id_ed25519";
                   system = "i686-linux";
                   maxJobs = 1;
@@ -92,19 +109,23 @@ in
       client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
       # Install the SSH key on the builder.
-      builder.succeed("mkdir -p -m 700 /root/.ssh")
-      builder.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
+      ssh_user = "${test.config.sshUser}"
+      ssh_directory = "${nodes.builder.users.users.${test.config.sshUser}.home}/.ssh"
+      builder.succeed(f"mkdir -p -m 700 {ssh_directory}")
+      builder.succeed(f"chown {ssh_user}:root {ssh_directory}")
+      builder.copy_from_host("key.pub", f"{ssh_directory}/authorized_keys")
       builder.wait_for_unit("sshd.service")
 
       out = client.fail("nix-build ${expr nodes.client 1} 2>&1")
       assert "Host key verification failed." in out, f"No host verification error:\n{out}"
-      assert "'ssh-ng://root@builder'" in out, f"No details about which host:\n{out}"
+      assert f"'ssh-ng://{ssh_user}@builder'" in out, f"No details about which host:\n{out}"
 
-      client.succeed(f"ssh -o StrictHostKeyChecking=no {builder.name} 'echo hello world' >&2")
+      client.succeed(f"ssh -o StrictHostKeyChecking=no {ssh_user}@{builder.name} 'echo hello world' >&2")
 
       # Perform a build
-      out = client.succeed("nix-build ${expr nodes.client 1} 2> build-output")
+      out = client.${if test.config.expectSuccess then "succeed" else "fail"}("nix-build ${expr nodes.client 1} 2> build-output")
 
+    '' + lib.optionalString test.config.expectSuccess ''
       # Verify that the build was done on the builder
       builder.succeed(f"test -e {out.strip()}")