testing: migrate build.sh

Change-Id: I9d2da21cc226e0c1ef2dfa4d475c1989bbbfaf79

tests/functional/build.sh

@@ -1,24 +0,0 @@
-source common.sh
-
-clearStore
-
-BUILD_DIR=$(mktemp -d)
-# ensure that the build directory parent is not world-accessible
-chmod 0755 "$BUILD_DIR"
-FIFO="$BUILD_DIR/fifo"
-mkfifo "$FIFO"
-(
-  echo > "$FIFO"
-  trap 'echo > "$FIFO"' EXIT
-  mode=$(stat -c %a $BUILD_DIR/b/*)
-  [ "$mode" = "700" -o "$mode" = "710" ]
-) &
-nix build --build-dir "$BUILD_DIR/b" -E '
-  with import ./config.nix; mkDerivation {
-    name = "test";
-    buildCommand = "cat '"$FIFO"'; cat '"$FIFO"' > $out";
-  }' \
-  --extra-sandbox-paths "$FIFO" \
-  --impure \
-  --no-link
-wait

tests/functional/meson.build

@@ -100,7 +100,6 @@ functional_tests_scripts = [
   'derivation-json.sh',
   'import-derivation.sh',
   'ssh-relay.sh',
-  'build.sh',
   'output-normalization.sh',
   'selfref-gc.sh',
   'db-migration.sh',

tests/functional2/store/test_build.py

@@ -0,0 +1,39 @@
+import os
+import stat
+from pathlib import Path
+
+from testlib.fixtures.file_helper import with_files
+from testlib.fixtures.nix import Nix
+from testlib.utils import get_global_asset
+
+
+@with_files({"config.nix": get_global_asset("config.nix")})
+def test_build_dir_permissions(nix: Nix):
+    """
+    ensure that the build directory parent is not world-accessible
+    """
+
+    build_dir = nix.env.dirs.home / "build-dir"
+    build_dir.mkdir(0o755)
+    fifo = build_dir / "fifo"
+    os.mkfifo(fifo)
+    expr = f"""
+        with import ./config.nix; mkDerivation {{
+            name = "test";
+            buildCommand = "echo >'{fifo}'; cat '{fifo}' > $out";
+        }}
+    """
+
+    nix.settings.add_xp_feature("nix-command")
+    nix.settings.extra_sandbox_paths = [str(fifo)]
+
+    build = nix.nix(["build", "--build-dir", f"{build_dir}/b", "-E", expr, "--impure"]).start()
+
+    fifo.read_text()
+    try:
+        child_dir = Path(next(iter((build_dir / "b").iterdir())))
+        assert stat.S_IMODE(child_dir.stat().st_mode) in [0o700, 0o710]
+    finally:
+        fifo.write_text("")
+
+    build.wait().ok()