Four negations assert nothing, including the one guarding the localhost trap #4

New issue

Closed

opened 2026-09-28 05:31:38 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-28 05:31:38 -03:00

(Migrated from github.com)

A bats test body has no assertions of its own: its verdict is the exit status of the last command it ran. Bash does not apply errexit to a negated command, so ! cmd on its own line decides the test when it is the final command of the body and is inert everywhere else.

shellcheck -f gcc --shell=bash tests/*.bats | grep SC2314

Four negations here are inert, and they are the refutations this component exists to make.

tests/conf.bats, the bind fragment

@test "the bind fragment names two literal addresses and no name" {
    # The fragment is content, not code, so it is asserted here: this is the
    # one line the PostgreSQL appliance got wrong (docs/traps.md).
    grep -qx 'bind ::1 127.0.0.1' "$REDIS_CONF_D/10-keel-bind.conf"
    ! grep -qE '^bind .*localhost' "$REDIS_CONF_D/10-keel-bind.conf"  # 253 — inert
    ! grep -qE '^bind .*-::1' "$REDIS_CONF_D/10-keel-bind.conf"       # 254 — last, asserts
}

Line 253 is the refutation the comment above it explains: that the fragment never says localhost. That is the exact line docs/traps.md records the PostgreSQL appliance getting wrong ("On Debian, localhost is not an IPv6 name"), and the test put there to stop it happening again did not run.

tests/conf.bats, the acl fragment

Lines 263 and 264: that the fragment declares no admin user, and no requirepass. Those two are what make the duplicate-user-declaration failure impossible and keep the password off the disk at build time — the other entry in docs/traps.md, "A Redis ACL user may be declared only once". Only the third refusal, +@all on the default user, ran.

tests/unit.bats, the shipped tree

Line 77: that no requirepass line is anywhere in the overlay. The comment above it calls this "the one property the whole design rests on: what lands on the machine is a digest."

What to do

Write every negation run ! cmd, the six in final position included, so that no line's meaning depends on its position. tests/conf.bats and tests/hook.bats already declare bats_require_minimum_version 1.5.0; tests/unit.bats needs it.

Test plan

shellcheck --severity=error --include=SC2314 over tests/*.bats reports nothing.
bats tests/*.bats green with the four inert assertions live.
tests/coverage.sh at the committed threshold of 100.
Tests ship nothing, so no changelog entry is needed.

A bats test body has no assertions of its own: its verdict is the exit status of the last command it ran. Bash does not apply errexit to a negated command, so `! cmd` on its own line decides the test when it is the final command of the body and is **inert everywhere else**. shellcheck -f gcc --shell=bash tests/*.bats | grep SC2314 Four negations here are inert, and they are the refutations this component exists to make. ## tests/conf.bats, the bind fragment @test "the bind fragment names two literal addresses and no name" { # The fragment is content, not code, so it is asserted here: this is the # one line the PostgreSQL appliance got wrong (docs/traps.md). grep -qx 'bind ::1 127.0.0.1' "$REDIS_CONF_D/10-keel-bind.conf" ! grep -qE '^bind .*localhost' "$REDIS_CONF_D/10-keel-bind.conf" # 253 — inert ! grep -qE '^bind .*-::1' "$REDIS_CONF_D/10-keel-bind.conf" # 254 — last, asserts } Line 253 is the refutation the comment above it explains: that the fragment never says `localhost`. That is the exact line `docs/traps.md` records the PostgreSQL appliance getting wrong ("On Debian, `localhost` is not an IPv6 name"), and the test put there to stop it happening again did not run. ## tests/conf.bats, the acl fragment Lines 263 and 264: that the fragment declares no `admin` user, and no `requirepass`. Those two are what make the duplicate-user-declaration failure impossible and keep the password off the disk at build time — the other entry in `docs/traps.md`, "A Redis ACL user may be declared only once". Only the third refusal, `+@all` on the default user, ran. ## tests/unit.bats, the shipped tree Line 77: that no `requirepass` line is anywhere in the overlay. The comment above it calls this "the one property the whole design rests on: what lands on the machine is a digest." ## What to do Write every negation `run ! cmd`, the six in final position included, so that no line's meaning depends on its position. `tests/conf.bats` and `tests/hook.bats` already declare `bats_require_minimum_version 1.5.0`; `tests/unit.bats` needs it. ## Test plan - `shellcheck --severity=error --include=SC2314` over `tests/*.bats` reports nothing. - `bats tests/*.bats` green with the four inert assertions live. - `tests/coverage.sh` at the committed threshold of 100. - Tests ship nothing, so no changelog entry is needed.