mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
34a2561af7
Four sites where a check could report a verdict it had not established, or detect a failure and then not turn it red. assert_no_panic in both NAT suites read `docker logs ... || true`, so a container that could not be read produced empty output, matched no panic pattern, and returned success. The assertion's failure mode was indistinguishable from its success condition. It now reports that absence of panics is not established. deb-install's apt capture discarded the exit status, so a failed docker exec gave an empty capture that matched neither error pattern and reached the pass branch. The status is now kept and checked before the output is inspected, with the output still printed on failure. wait_for_systemd printed a warning and returned success on timeout, so every check after it read a system that may not have started its units. It now returns non-zero and the caller abandons that distro leg rather than testing an unstarted system. interop's copy of count_log_pattern carried the same defect fixed in rekey: a node whose logs could not be read contributed zero to eight expect-zero assertions. Fixed the same way, and its consumer now reports the unreadable case rather than comparing a sentinel against zero. Each validated by breaking what it guards and by confirming the healthy path is unchanged: an absent container now fails each check where it previously passed, a readable panic-free container still passes, a real panic is still caught, and a genuinely successful install still passes.