Add documentation and tooling to support the project's 100% code
coverage claim and provide a single-command verification workflow.
New files:
docs/CODE-COVERAGE-100%.md
- Detailed breakdown of code coverage by file and function
- Coverage statistics: 1,419/1,419 lines (100%)
- Test count: 235 tests across 16 test files
- Security requirements coverage: FR-001 (Full Disk Encryption),
FR-007 (Password Complexity) both at 100%
verify.sh
- One-command project verification script covering 18 checks:
1. Docker daemon and build image availability
2. Shellcheck at warning severity (clean)
3. Full BATS test suite (235/235)
4. ISO artifact existence and SHA256 checksum
5. libvirt/virsh VM testing capability
6. Git working tree cleanliness
7. Source file integrity (executable, exists)
8. Config file integrity (all hooks and preseed)
9. Unicode character audit (none remaining)
- Usage: bash verify.sh
- Exit code 0 = all checks pass, 1 = failures found
Modified files:
run.sh
- Update test count from 276 to 235 (accurate count)
AGENTS.md
- Add 100% code coverage section with statistics
- Update test suite status and last-updated date
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Restore the libvirt/virsh ISO testing script that was deleted in commit
c1d8c5d ("will fold into run.sh" but never was). run.sh still references
test-iso.sh via the test:iso command, so it must exist.
The original script had several issues preventing it from running on
this host. This commit restores it from git history (commit 241510c)
with the following fixes:
- Disk path: Changed from /var/lib/libvirt/images/ (root-owned) to
./tmp/ (writable by user), avoiding permission denied errors
- CPU model: Changed from deprecated "host" to "host-model" per
virt-install warning
- Graphics: Simplified from Spice with channel to plain VNC, fixing
"virtio-serial-bus: A port already exists" error
- Networking: Removed --network flag (no libvirt default network
available on this host; not needed for ISO boot testing)
- Sudo: Removed unnecessary sudo from qemu-img and rm commands
(user is in libvirt group and disk is in local tmp/)
- Startup: Removed redundant virsh start after virt-install (which
already starts the domain), fixing "Domain is already active" error
Commands:
./run.sh test:iso create Create and boot test VM from ISO
./run.sh test:iso console Connect to VM serial console
./run.sh test:iso status Show VM status
./run.sh test:iso destroy Stop and remove VM
Tested: VM boots successfully from the 450M ISO artifact.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
This commit addresses every shellcheck warning (severity: warning and
above) across the project's shell scripts. Only SC1091 info-level
notices remain (sourced files not available during static analysis),
which is expected and unavoidable in the Docker build workflow.
Changes by file:
src/build-iso.sh
- Replace Unicode checkmark/cross characters (✓, ✗) with ASCII
equivalents (PASS:, FAIL:) to eliminate commitBuffer encoding errors
- Replace useless `cat | cut` pipeline with direct file redirect
(`cut -d' ' -f1 < file`), resolving SC2002
src/security-hardening.sh
- Pass optional arguments through the function call chain in
apply_security_hardening() to resolve SC2119/SC2120 (functions
reference $1 but are called without arguments)
src/firewall-setup.sh
- Pass optional arguments through apply_firewall() in main() to
resolve SC2119/SC2120
config/hooks/installed/encryption-setup.sh
- Consolidate four individual `echo >> file` redirects into a single
`{ cmd1; cmd2; } >> file` block, resolving SC2129
- Add shellcheck disable directive for intentional SC2016 in sed
command (single quotes are required by sed, not a mistake)
config/hooks/installed/encryption-validation.sh
- Replace remaining Unicode checkmark characters with ASCII
Verification:
shellcheck --severity=warning src/*.sh config/hooks/**/*.sh
=> zero warnings, zero errors
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
reachableceo