Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

nvx-rs: replace the golden launch-profile and sandbox-option fixtures with specification tests

Open
  • Is something wrong?
#730 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
json, python, rust
Domain
backend, devtools, testing

Research direction

Start by reading the listed sandbox tests and src/host/sandbox/{golden.rs,mod.rs,layer.rs,mount.rs,options.rs}, plus the OpenVMM and guest contracts; this is step 4 of #722 and depends on #726. Replace fixture checks with the named specification tests and map each fixture section to a test. Done means both fixtures are removed, the new tests pass on Linux and Windows, every section is covered, and accepted launches retain their OpenVMM arguments and kernel tokens.

Written by the indexing model from the issue text.

Description

Part of #722. Step 4. Its gate needs #726. Related: #723.

Goal

Replace tests/fixtures/sandbox.json, tests/fixtures/sandbox_options.json, and src/host/sandbox/golden.rs with table-driven and property tests derived from the documented options and from the contracts with OpenVMM and the guest. Then make the checks Rust-native.

Background
  • sandbox.json holds 1,412 cases in POSIX and Windows path flavors: 213 identities, 320 layers, 212 mount values, 228 mount targets, 53 child names, 210 mounts, and 176 launches. Since #556 removed the runtime and custom block roles, 130 of the launches end in the same error.
  • sandbox_options.json holds 885 cases: 128 share targets of run, 250 sandbox mounts, 80 exec environments, 109 environment files, and 318 distro manifests.
  • Six tests check them: identities_and_layers_parse_as_python_parses_them, mount_values_targets_and_child_names_match_python, mounts_lower_to_the_arguments_that_python_gives, launches_give_the_arguments_and_command_lines_that_python_gives, sandbox_option_helpers_match_nvx_py, and environment_files_and_distro_manifests_read_as_python_reads_them.
  • Contracts that the new tests keep: OpenVMM's arguments, the guest's kernel tokens and their 1024-byte budget, the reserved targets and tokens, and the names of an aggregate's children, INDEX-HEX, where HEX is the first 16 bytes of the SHA-256 of the target, on which restores depend.
  • Python behavior that goes: Python's messages and repr quoting, int()'s Unicode digits and underscores, the other spellings that uuid.UUID accepts, the leniency of json.loads, and checking both path flavors on every host.
Tasks

Replacement tests, in a pull request that doesn't change behavior:

  • workload_identity_grammar: UID:GID from 1 to 4294967295, root refused, and malformed values.
  • layer_values_are_role_path_uuid: only distro; a canonical UUID reaches the guest token unchanged; a configuration of a retired role is refused.
  • mount_value_grammar: TARGET,HOST, optionally followed by ,ro or ,rw, commas in host paths, and empty parts.
  • reserved_mount_targets_are_refused: a property over the reserved trees and exact targets.
  • aggregate_child_names_follow_the_restore_contract: a property that computes the names with sha2, and known answers such as 0-c52ddf65534b7b46035084358ab7902b for /workspace at index 0.
  • launch_arguments_follow_the_openvmm_contract
  • kernel_command_line_stays_within_1024_bytes: a property that a launch's command line either fits and holds every token or is refused, and that reserved tokens are always refused.
  • policy_paths_attach_to_their_shares: a property over sequences of options, for sandbox, where they apply to the --mount before them, and for run, where they apply to the share that holds them.
  • exec_environment_limits and environment_files_hold_a_json_array_of_strings.
  • distro_manifest_binds_the_layer and systemd_entrypoint_needs_systemd_in_the_manifest.
  • host_paths_become_absolute: a property on each OS's own filesystem, and a table of Windows drive-relative and UNC paths.
  • A temporary table that maps every section of the two fixtures to tests.

Retirement, in the next pull request:

  • Integers are ASCII decimal within documented ranges, UUIDs are canonical, environment files and distro manifests are strict JSON, and messages quote values as Rust does.
  • Values that become kernel tokens refuse the separators of #723, if it hasn't landed yet.
  • Each host checks its own path flavor only.
  • Replace nvx::host::sandbox::{Int, IntError}, which re-export Python's integers, and note the API change in the README.
  • Delete the two fixtures and src/host/sandbox/golden.rs.
  • Docs: the README's module table and "Python parity", and doc/usage.md and doc/run.md where accepted input changes.
Gate
  • The lines and branches that only these fixtures reach, on Windows and Linux (#726), are reached by the new tests or deleted.
  • cargo mutants on src/host/sandbox/mod.rs, layer.rs, mount.rs, and options.rs misses no mutant with the new tests that the fixtures catch.
  • Every section maps to a test.
  • The OpenVMM arguments and kernel tokens of every launch that the fixtures accept are unchanged.
Acceptance criteria
  • The two fixtures are gone, and the new tests pass on Linux and Windows.
Dominant language
Python
Stars
408
Forks
28
Avg merge
16h 18m
Merged PRs (30d)
332

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/nvx

All issues in microsoft/nvx

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.