test(corpus): make the CORPUS_DIR and committed-fixture gates report when they skip

[h4x0r]

Dependency form — resolved

The forensic-testgate dev-dependency was a path dep pointing at a machine-local scratch
directory, so cargo metadata failed on every other machine and every CI job died at manifest
load before running a single check.

forensic-testgate 0.1.0 published to crates.io on
2026-08-02, so the dep is now the registry form this PR originally promised:

forensic-testgate = "0.1"

A git-pinned revision was the alternative, and was rejected. A git dep carries no publisher record,
so cargo-vet would need an [[exemptions]] entry where a trust entry applies — the weaker
mechanism, which ADR-0018 treats as a defect when a stronger one is available — and the dep would
have had to be swapped a second time once the registry version landed.

Supply chain: the crate is ours and published by h4x0r, which is ADR-0018 mechanism (2), so it
gets [[trusted.forensic-testgate]] scoped to safe-to-run (it is a dev-dependency).

The loud-skip contract is unchanged — with CORPUS_DIR unset the tests still announce the skip by
name, and FORENSIC_TESTGATE_STRICT=1 still turns each skip into a failure.

Why

core/tests/corpus.rs stacked two silent skips in every corpus test:

let Some(dir) = corpus_dir() else { return };   // CORPUS_DIR unset  — silent
let path = dir.join("dynamic.vhdx");
if !path.exists() { return; }                    // fixture absent   — silent

cargo test prints ok whether the VHDX reader was validated against the real corpus or never opened a file. Those are not the same claim, and the suite could not tell you which one you got.

This is one instance of a fleet-wide pattern: a sweep found 216 env-gated test skip sites that produce no output at all. This exact corpus_dir() helper is cloned verbatim in qcow2-forensic, vhd-forensic, and vmdk-forensic; this is the vhdx instance. Companion PRs: SecurityRonin/qcow2-forensic#4, SecurityRonin/vhd-forensic#3.

What changed

1. The CORPUS_DIR gates. Both halves now resolve through forensic_testgate::gated_file. The notice is emitted by the resolver, on the library side of the seam, so there is no quiet variant to reach for and a later edit cannot drop it.

CORPUS_DIR	Behaviour
unset	notice naming the variable, skip, exit 0
set, fixture absent	notice naming the directory and the fixture, skip
set to a missing path	FAILS, naming the variable and showing the value

The third is the deliberate design call: setting the variable is the operator saying run this test, so a path that is not there is a misconfiguration, not a skip.

2. A committed-fixture skip in core/tests/bounded.rs. assert_open_matches_from_bytes guarded its input with if !path.exists() { return; }. Those fixtures (ext2.vhdx, qemu_fixed.vhdx, fat-parent.vhdx, dfvfs_ext2.vhdx) are tracked in git — git ls-files tests/data lists them — so their absence is a broken checkout, not a skip. As written, the entire from_bytes vs open differential could validate nothing and still report ok. It now asserts.

Verification

$ cargo test -p vhdx-core --test corpus -- --nocapture
SKIP [forensic-testgate]: CORPUS_DIR is unset — this test did not run. Set CORPUS_DIR to the fixture it gates on to run it.
SKIP [forensic-testgate]: CORPUS_DIR is unset — this test did not run. Set CORPUS_DIR to the fixture it gates on to run it.
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

Full suite: 195 passed. clippy --all-targets --all-features -D warnings clean.

Separate finding — a gate that has never fired in CI

Not fixed here, to keep this diff reviewable. core/tests/corpus_differential.rs:12 hardcodes the oracle path:

const QEMU_IMG: &str = "/opt/homebrew/bin/qemu-img";
if !Path::new(QEMU_IMG).exists() || !corpus.exists() { return; }

That is the macOS-ARM Homebrew path only, so on the Linux CI runner it never exists and the qemu differential tests silently skip on every CI run. The file's own doc comment concedes it — "these tests skip automatically if qemu-img is not installed, so they run in CI only on machines with QEMU available (the dev machine)" — which describes a differential oracle that has never validated anything in CI.

qcow2-forensic/core/tests/real_images.rs already fixed this exact bug by searching /opt/homebrew, /usr/local and /usr/bin. The same defect is live in vhd-forensic and qcow2-forensic's forensic/ crate.

Worth its own PR, along with a loud tool-resolution gate so the next occurrence announces itself.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	forensic-testgate@​0.1.0

View full report