From 5fb0dd156dfe4811b1c70db4d4bfabd78726e63d Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Thu, 26 Feb 2026 20:30:45 +0100
Subject: [PATCH] testing: migrate build.sh

Change-Id: I9d2da21cc226e0c1ef2dfa4d475c1989bbbfaf79
---
 tests/functional/build.sh             | 24 -----------------
 tests/functional/meson.build          |  1 -
 tests/functional2/store/test_build.py | 39 +++++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 25 deletions(-)
 delete mode 100644 tests/functional/build.sh
 create mode 100644 tests/functional2/store/test_build.py

diff --git a/tests/functional/build.sh b/tests/functional/build.sh
deleted file mode 100644
index aa565e155..000000000
--- a/tests/functional/build.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-source common.sh
-
-clearStore
-
-BUILD_DIR=$(mktemp -d)
-# ensure that the build directory parent is not world-accessible
-chmod 0755 "$BUILD_DIR"
-FIFO="$BUILD_DIR/fifo"
-mkfifo "$FIFO"
-(
-  echo > "$FIFO"
-  trap 'echo > "$FIFO"' EXIT
-  mode=$(stat -c %a $BUILD_DIR/b/*)
-  [ "$mode" = "700" -o "$mode" = "710" ]
-) &
-nix build --build-dir "$BUILD_DIR/b" -E '
-  with import ./config.nix; mkDerivation {
-    name = "test";
-    buildCommand = "cat '"$FIFO"'; cat '"$FIFO"' > $out";
-  }' \
-  --extra-sandbox-paths "$FIFO" \
-  --impure \
-  --no-link
-wait
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index f24432d02..415db56d1 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -100,7 +100,6 @@ functional_tests_scripts = [
   'derivation-json.sh',
   'import-derivation.sh',
   'ssh-relay.sh',
-  'build.sh',
   'output-normalization.sh',
   'selfref-gc.sh',
   'db-migration.sh',
diff --git a/tests/functional2/store/test_build.py b/tests/functional2/store/test_build.py
new file mode 100644
index 000000000..9ccce5409
--- /dev/null
+++ b/tests/functional2/store/test_build.py
@@ -0,0 +1,39 @@
+import os
+import stat
+from pathlib import Path
+
+from testlib.fixtures.file_helper import with_files
+from testlib.fixtures.nix import Nix
+from testlib.utils import get_global_asset
+
+
+@with_files({"config.nix": get_global_asset("config.nix")})
+def test_build_dir_permissions(nix: Nix):
+    """
+    ensure that the build directory parent is not world-accessible
+    """
+
+    build_dir = nix.env.dirs.home / "build-dir"
+    build_dir.mkdir(0o755)
+    fifo = build_dir / "fifo"
+    os.mkfifo(fifo)
+    expr = f"""
+        with import ./config.nix; mkDerivation {{
+            name = "test";
+            buildCommand = "echo >'{fifo}'; cat '{fifo}' > $out";
+        }}
+    """
+
+    nix.settings.add_xp_feature("nix-command")
+    nix.settings.extra_sandbox_paths = [str(fifo)]
+
+    build = nix.nix(["build", "--build-dir", f"{build_dir}/b", "-E", expr, "--impure"]).start()
+
+    fifo.read_text()
+    try:
+        child_dir = Path(next(iter((build_dir / "b").iterdir())))
+        assert stat.S_IMODE(child_dir.stat().st_mode) in [0o700, 0o710]
+    finally:
+        fifo.write_text("")
+
+    build.wait().ok()