Skip to content

Commit e67dd1a

Browse files
award999award999
committed
Allow disabling SwiftPM sanboxing
To get our tests to run in a sandbox, we need to disable sandboxing because you cannot create a new sandbox when you're already running under a sandbox - Add new `swift.disableSandbox` setting - Disable sandboxing for tasks and commands run by the extension - Disable hardware acceleration since ci.swift.org will run on x64 - Fix failing xcode watcher unit test - Increase some timeouts as build times seem slower on these nodes - Skip any LSP dependent tests for 6.0 or earlier. The LSP will only allow disabling sandboxing in 6.1+ - Disable debugging tests since need shareport permission
1 parent 77f8cf5 commit e67dd1a

33 files changed

+554
-101
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,4 @@ default.profraw
1212
assets/documentation-webview
1313
assets/test/**/Package.resolved
1414
assets/swift-docc-render
15+
ud

‎.prettierignore

+3
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,6 @@ node_modules/
1818
/coverage/
1919
/dist/
2020
/snippets/
21+
22+
# macOS CI
23+
/ud/

‎.vscode-test.js

+22-13
Original file line numberDiff line numberDiff line change
@@ -18,25 +18,40 @@ const path = require("path");
1818
const isCIBuild = process.env["CI"] === "1";
1919
const isFastTestRun = process.env["FAST_TEST_RUN"] === "1";
2020

21+
const dataDir = process.env["VSCODE_DATA_DIR"];
22+
2123
// "env" in launch.json doesn't seem to work with vscode-test
2224
const isDebugRun = !(process.env["_"] ?? "").endsWith("node_modules/.bin/vscode-test");
2325

2426
// so tests don't timeout when a breakpoint is hit
2527
const timeout = isDebugRun ? Number.MAX_SAFE_INTEGER : 3000;
2628

29+
const launchArgs = [
30+
"--disable-updates",
31+
"--disable-crash-reporter",
32+
"--disable-workspace-trust",
33+
"--disable-telemetry",
34+
"--disable-extension",
35+
"vscode.github",
36+
"--disable-extension",
37+
"vscode.github-authentication",
38+
];
39+
if (dataDir) {
40+
launchArgs.push("--user-data-dir", dataDir);
41+
}
42+
// GPU hardware acceleration not working on Darwin for intel
43+
if (process.platform === "darwin" && process.arch === "x64") {
44+
launchArgs.push("--disable-gpu");
45+
}
46+
2747
module.exports = defineConfig({
2848
tests: [
2949
{
3050
label: "integrationTests",
3151
files: ["dist/test/common.js", "dist/test/integration-tests/**/*.test.js"],
3252
version: process.env["VSCODE_VERSION"] ?? "stable",
3353
workspaceFolder: "./assets/test",
34-
launchArgs: [
35-
"--disable-updates",
36-
"--disable-crash-reporter",
37-
"--disable-workspace-trust",
38-
"--disable-telemetry",
39-
],
54+
launchArgs,
4055
mocha: {
4156
ui: "tdd",
4257
color: true,
@@ -59,13 +74,7 @@ module.exports = defineConfig({
5974
label: "unitTests",
6075
files: ["dist/test/common.js", "dist/test/unit-tests/**/*.test.js"],
6176
version: process.env["VSCODE_VERSION"] ?? "stable",
62-
launchArgs: [
63-
"--disable-extensions",
64-
"--disable-updates",
65-
"--disable-crash-reporter",
66-
"--disable-workspace-trust",
67-
"--disable-telemetry",
68-
],
77+
launchArgs: launchArgs.concat("--disable-extensions"),
6978
mocha: {
7079
ui: "tdd",
7180
color: true,

‎assets/test/.vscode/tasks.json

+1
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
"command": "command_plugin",
3636
"args": ["--foo"],
3737
"cwd": "command-plugin",
38+
"disableSandbox": true,
3839
"problemMatcher": [
3940
"$swiftc"
4041
],

‎docker/sandbox.sb

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
(version 1)
2+
; Deny everything by default
3+
(deny default)
4+
5+
; Get fonts
6+
(import "system.sb")
7+
8+
; Helpers
9+
(define (param-regex param-name param-relative-regex)
10+
(regex (string-append "^" (regex-quote (param param-name)) param-relative-regex)))
11+
(define (param-subpath param-name param-relative-subpath)
12+
(subpath (string-append (param param-name) param-relative-subpath)))
13+
(define workspace
14+
(param "workspace"))
15+
16+
; Read
17+
(allow file-read-metadata
18+
(subpath "/"))
19+
(allow file-read*
20+
(subpath workspace)
21+
(path "/")
22+
(path "/private/etc/ssl/openssl.cnf")
23+
(path "/dev/dtracehelper")
24+
(path "/dev/fd")
25+
(path "/dev/null")
26+
(path "/dev/ptmx")
27+
(regex #"^/dev/tty.*")
28+
(path "/etc/shells")
29+
(path "/private/etc/shells")
30+
(path "/private/etc/ssl/cert.pem")
31+
(path "/System/Library/OpenSSL/openssl.cnf")
32+
(regex #"^/Users/[^/]+/.vscode.*")
33+
(regex #"^/Users/[^/]+/.gitconfig$")
34+
(regex #"^/Users/[^/]+/.gitignore$")
35+
(regex #"^/Users/[^/]+/.lldbinit$")
36+
(regex #"^/Users/[^/]+/.sourcekit-lsp.*")
37+
(regex #"^/Users/[^/]+/.swiftpm.*")
38+
(regex #"^/Users/[^/]+/Library/org.swift.swiftpm.*")
39+
(regex #"^/Users/[^/]+/Library/Developer/CommandLineTools")
40+
(regex #"^/Users/[^/]+/Library/Developer/Toolchains")
41+
(regex #"^/Users/[^/]+/Library/Developer/Xcode/DerivedData.*")
42+
(regex #"^/Users/[^/]+/Library/Caches/org.swift.swiftpm.*")
43+
(regex #"^/Users/[^/]+/Library/Caches/com.apple.dt.Xcode.*")
44+
(regex #"^/Users/[^/]+/Library/Caches/com.apple.python.*")
45+
(regex #"^/Users/[^/]+/Library/Application Support/Code.*")
46+
(regex #"^/Users/[^/]+/Library/Application Support/Microsoft.*")
47+
(regex #"^/Users/[^/]+/Library/Preferences/.*.plist")
48+
(regex #"^/Users/[^/]+/Library/Python")
49+
(regex #"^/Users/[^/]+/Library/SymbolCache/dsyms/uuids")
50+
(regex #"^/Users/[^/]+/Library/Saved Application State/com.microsoft.VSCode.savedState.*")
51+
(regex #"^/private/var/folders/[^/]+/[^/]+/.+")
52+
(regex #"^/Library/Preferences/.*.plist")
53+
(regex #"^/[^/]+/Library/Python")
54+
(subpath "/Library/Developer/CommandLineTools")
55+
(subpath "/Library/Developer/Toolchains")
56+
(subpath "/Library/Frameworks/UIAutomation.framework")
57+
(subpath "/Library/Python")
58+
(subpath "/System/Library/Perl")
59+
(subpath "/Applications/Xcode.app")
60+
(subpath "/Applications/Xcode-beta.app")
61+
(subpath "/bin")
62+
(subpath "/usr/bin")
63+
(subpath "/usr/local/bin")
64+
(subpath "/usr/libexec/path_helper")
65+
(subpath "/usr/local/share/git-core")
66+
(subpath "/usr/local/share/hwtrace")
67+
68+
(regex #".*/LLDB.framework/.*")
69+
(regex #".*/Python3.framework/.*")
70+
(regex #".*/branch-main/.*")
71+
(regex #".*/usr/lib/swift/.*")
72+
)
73+
74+
(allow mach-lookup)
75+
(allow mach-priv-task-port)
76+
(allow mach-register)
77+
(allow sysctl-read)
78+
(allow system-debug)
79+
(allow ipc-posix-shm-read-data (literal "apple.shm.notification_center"))
80+
81+
; Write
82+
(allow file-write*
83+
(subpath workspace)
84+
(path "/dev/null")
85+
(path "/dev/ptmx")
86+
(regex #"^/dev/tty.*")
87+
(regex #"^/Users/[^/]+/.sourcekit-lsp.*")
88+
(regex #"^/Users/[^/]+/Library/org.swift.swiftpm.*")
89+
(regex #"^/Users/[^/]+/Library/Caches/org.swift.swiftpm.*")
90+
(regex #"^/Users/[^/]+/Library/Caches/com.apple.dt.Xcode.*")
91+
(regex #"^/Users/[^/]+/Library/Caches/com.apple.python.*")
92+
(regex #"^/Users/[^/]+/Library/Developer/Xcode/DerivedData.*")
93+
(regex #"^/Users/[^/]+/Library/Application Support/Code.*")
94+
(regex #"^/Users/[^/]+/Library/Application Support/Microsoft.*")
95+
(regex #"^/private/var/folders/[^/]+/[^/]+/.+")
96+
(regex #"^/Users/[^/]+/.vscode.*")
97+
98+
(regex #".*/branch-main.*")
99+
)
100+
101+
; Execute
102+
(allow process-exec*)
103+
(allow process-fork)
104+
105+
; Network
106+
(allow system-socket)
107+
(allow network-outbound
108+
(path "/private/var/run/mDNSResponder")
109+
(remote tcp4 "*:443")
110+
(remote tcp4 "*:3128")
111+
; (local tcp4 "*:*") ; CodeLLDB
112+
)
113+
114+
; CodeLLDB
115+
; (allow network-bind
116+
; (local tcp4 "*:*")
117+
; )
118+
; (allow network-inbound
119+
; (local tcp4 "*:*")
120+
; )
121+
122+
; VSCode sockets
123+
(allow network*
124+
(param-regex "workspace" "/ud/1\.[0-9]+-main\.sock")
125+
)
126+
127+
; Open VSCode window
128+
(allow file-ioctl)
129+
(allow iokit-open-user-client)
130+
131+
; VSCode terminal
132+
(allow pseudo-tty)
133+
134+
; SourceKit-LSP
135+
(allow job-creation)
136+
137+
; JSON language server
138+
(allow signal)

‎docker/test-macos.sh

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/bin/bash
2+
##===----------------------------------------------------------------------===##
3+
##
4+
## This source file is part of the VS Code Swift open source project
5+
##
6+
## Copyright (c) 2024 the VS Code Swift project authors
7+
## Licensed under Apache License v2.0
8+
##
9+
## See LICENSE.txt for license information
10+
## See CONTRIBUTORS.txt for the list of VS Code Swift project authors
11+
##
12+
## SPDX-License-Identifier: Apache-2.0
13+
##
14+
##===----------------------------------------------------------------------===##
15+
16+
set -e
17+
18+
platform=$([ "$(arch)" == "arm64" ] && echo "arm64" || echo "x64")
19+
20+
NODE_VERSION="$(cat .nvmrc)"
21+
NODE_NAME="node-v$NODE_VERSION-darwin-$platform"
22+
NODE_ARCHIVE="$NODE_NAME.tar.gz"
23+
ARTIFACTS="$PWD/.vscode-test"
24+
USER_DATA="$PWD/ud"
25+
VSCODE_SETTINGS="$USER_DATA/User/settings.json"
26+
LSP_SETTINGS="$HOME/.sourcekit-lsp/config.json"
27+
28+
export TMPDIR="$ARTIFACTS/tmp"
29+
export TMP="$TMPDIR"
30+
mkdir -p "$TMPDIR"
31+
32+
function cleanup {
33+
rm SHASUMS256.txt
34+
rm "$NODE_ARCHIVE"
35+
rm -rf "$ARTIFACTS"
36+
rm -rf "$LSP_SETTINGS"
37+
rm -rf "$USER_DATA"
38+
}
39+
trap "cleanup" EXIT
40+
trap "cleanup" INT
41+
42+
curl -O "https://nodejs.org/dist/v$NODE_VERSION/$NODE_ARCHIVE"
43+
curl -O "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt"
44+
45+
grep "$NODE_ARCHIVE" SHASUMS256.txt | shasum -a 256 -c -
46+
47+
tar -xzf "$NODE_ARCHIVE" -C "$ARTIFACTS"
48+
49+
export NPM_CONFIG_CACHE="$ARTIFACTS/$NODE_NAME/cache"
50+
export NPM_CONFIG_PREFIX="$ARTIFACTS/$NODE_NAME"
51+
export NPM_CONFIG_USERCONFIG="$ARTIFACTS/$NODE_NAME/usernpmrc"
52+
export NPM_CONFIG_GLOBALCONFIG="$ARTIFACTS/$NODE_NAME/globalnpmrc"
53+
54+
PATH="$ARTIFACTS/$NODE_NAME/bin:$PATH"
55+
56+
mkdir -p "$(dirname "$VSCODE_SETTINGS")"
57+
cat <<EOT > "$VSCODE_SETTINGS"
58+
{
59+
"swift.path": "/Users/ec2-user/jenkins/workspace/pr-vscode-swift-macos/branch-main/latest_toolchain/usr/bin"
60+
"swift.disableSandbox": true,
61+
"swift.debugger.disable": true,
62+
"swift.debugger.path": "/Users/ec2-user/jenkins/workspace/pr-vscode-swift-macos/branch-main/latest_toolchain/usr/bin/lldb-dap",
63+
"lldb.library": "/Applications/Xcode-beta.app/Contents/SharedFrameworks/LLDB.framework/Versions/A/LLDB",
64+
"lldb.launch.expressions": "native",
65+
"lldb.suppressUpdateNotifications": true
66+
}
67+
EOT
68+
69+
mkdir -p "$(dirname "$LSP_SETTINGS")"
70+
cat <<EOT > "$LSP_SETTINGS"
71+
{
72+
"swiftPM": {
73+
"disableSandbox": true,
74+
"swiftCompilerFlags": [
75+
"-disable-sandbox"
76+
]
77+
}
78+
}
79+
EOT
80+
81+
npm ci -ignore-script node-pty
82+
npm run lint
83+
npm run format
84+
npm run package
85+
86+
# Ignore hooks when running locally for development
87+
export GIT_CONFIG_COUNT=1
88+
export GIT_CONFIG_KEY_0="core.hookspath"
89+
export GIT_CONFIG_VALUE_0="$PWD/hooks"
90+
91+
# Need to set proxy to download VS Code
92+
export npm_config_https_proxy="$HTTPS_PROXY"
93+
94+
VSCODE_DATA_DIR="$USER_DATA" CI=1 FAST_TEST_RUN=1 npm run coverage -- --coverage-output "$PWD/coverage"

‎package.json

+6-1
Original file line numberDiff line numberDiff line change
@@ -689,7 +689,12 @@
689689
"swift.swiftSDK": {
690690
"type": "string",
691691
"default": "",
692-
"markdownDescription": "The [Swift SDK](https://github.com/swiftlang/swift-evolution/blob/main/proposals/0387-cross-compilation-destinations.md) to compile against (`--swift-sdk` parameter).",
692+
"markdownDescription": "The [Swift SDK](https://github.com/swiftlang/swift-evolution/blob/main/proposals/0387-cross-compilation-destinations.md) to compile against (`--swift-sdk` parameter)."
693+
},
694+
"swift.disableSandox": {
695+
"type": "boolean",
696+
"default": false,
697+
"markdownDescription": "Disable sandboxing when running SwiftPM commands. In most cases you should keep the sandbox enabled and leave this setting set to `false`",
693698
"order": 4
694699
},
695700
"swift.diagnostics": {

‎src/commands/dependencies/unedit.ts

+6-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,12 @@ async function uneditFolderDependency(
4444
) {
4545
try {
4646
const uneditOperation = new SwiftExecOperation(
47-
["package", "unedit", ...args, identifier],
47+
ctx.toolchain.buildFlags.withAdditionalFlags([
48+
"package",
49+
"unedit",
50+
...args,
51+
identifier,
52+
]),
4853
folder,
4954
`Finish editing ${identifier}`,
5055
{ showStatusItem: true, checkAlreadyRunning: false, log: "Unedit" },

‎src/commands/dependencies/useLocal.ts

+7-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,13 @@ export async function useLocalDependency(
5050
folder = folders[0];
5151
}
5252
const task = createSwiftTask(
53-
["package", "edit", "--path", folder.fsPath, identifier],
53+
ctx.toolchain.buildFlags.withAdditionalFlags([
54+
"package",
55+
"edit",
56+
"--path",
57+
folder.fsPath,
58+
identifier,
59+
]),
5460
"Edit Package Dependency",
5561
{
5662
scope: currentFolder.workspaceFolder,

‎src/commands/resetPackage.ts

+4-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,10 @@ export async function resetPackage(ctx: WorkspaceContext) {
3535
*/
3636
export async function folderResetPackage(folderContext: FolderContext) {
3737
const task = createSwiftTask(
38-
["package", "reset"],
38+
folderContext.workspaceContext.toolchain.buildFlags.withAdditionalFlags([
39+
"package",
40+
"reset",
41+
]),
3942
"Reset Package Dependencies",
4043
{
4144
cwd: folderContext.folder,

0 commit comments

Comments
 (0)