1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
;;; Copyright (c) 2026 Nicholas Vermeulen
;;; SPDX-License-Identifier: AGPL-3.0-or-later
;; pkg-test.lisp — golden test for pkg.lisp. No network: the fixture
;; packages are local git repositories under /tmp, installed via file://
;; URLs. Deterministic (fixed paths, no timestamps/hashes in output).
;; ── Build two fixture packages: rusty-pkg-fix depends on rusty-pkg-dep ──
;; start clean (idempotent re-runs)
;; ── Install: pulls the dependency transitively ───────────────────────────
; second time: no-op
;; ── Load and actually use it (dep loads first) ───────────────────────────
; 3*5+1 = 16
;; require-package on something already present: just loads
;; ── Errors are informative, not crashes ──────────────────────────────────
;; ── Integrity: is this still what I installed? ───────────────────────────
;; Hashes themselves stay out of the golden (they'd be noise); what's pinned is
;; the SHAPE: which files are covered, that .git is not, and that every kind of
;; change is NAMED rather than merely counted.
; sorted; no .git
;; Edit an installed file — the tamper a lock exists to catch.
;; ...and an out-of-band fingerprint (the honest kind) catches it too
;; A file that appeared, and one that vanished, are different words.
;; Absence of a lock is its own answer — never a clean bill of health.
;; pkg-list enumerates the REAL ~/.rusty/packages, so its full contents aren't
;; deterministic (the owner may have other packages installed). Test membership
;; instead: both fixtures we installed must appear, as (name version) rows.
;; ── Uninstall, leave the machine clean ───────────────────────────────────
; already gone