From 5ab8282af1b6aec7b80ac62095c688d1f2935376 Mon Sep 17 00:00:00 2001 From: Aram Grigoryan <132480+aram356@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:58:47 -0700 Subject: [PATCH 1/3] Add a failing test for the build-time git version in env overrides The core build script exports TRUSTED_SERVER__GIT_VERSION with cargo:rustc-env, and Cargo also sets it on every cargo test run of the crate. The test-only from_toml_and_env loader reads every TRUSTED_SERVER__ variable as a settings override, so the variable is deserialized as an unknown git_version field and settings loading fails. Native `cargo test -p trusted-server-core --lib` fails 11 env override tests. CI runs core unit tests only on wasm32-wasip1 under Viceroy, which does not pass the host environment to the guest, so it never sees the variable. Setting it explicitly in the test reproduces the failure on both targets. --- crates/trusted-server-core/src/settings.rs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs index 3efc157701..26a9936e12 100644 --- a/crates/trusted-server-core/src/settings.rs +++ b/crates/trusted-server-core/src/settings.rs @@ -6304,6 +6304,18 @@ source_domain = "partner.example.com" ); } + #[test] + fn legacy_env_loader_ignores_build_time_git_version() { + let toml_str = crate_test_settings_str(); + + for value in ["v0.0.0-example", ""] { + temp_env::with_var("TRUSTED_SERVER__GIT_VERSION", Some(value), || { + Settings::from_toml_and_env(&toml_str) + .expect("should ignore the build-time git version input"); + }); + } + } + #[test] fn test_origin_host_header_override_env() { let env_key = format!( From e46987a95431b402a3a842f7d2d97232a50a563e Mon Sep 17 00:00:00 2001 From: Aram Grigoryan <132480+aram356@users.noreply.github.com> Date: Wed, 14 Oct 2026 00:08:04 -0700 Subject: [PATCH 2/3] Ignore the build-time git version in test env overrides from_toml_and_env now reads overrides from a copy of the environment without TRUSTED_SERVER__GIT_VERSION. That name is a build input that shares the settings prefix, and Cargo exports it to every cargo test run of the crate through cargo:rustc-env. Runtime loading is unaffected: the EdgeZero overlay only overrides keys that already exist in the config. --- crates/trusted-server-core/src/settings.rs | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs index 26a9936e12..e8fd3d126f 100644 --- a/crates/trusted-server-core/src/settings.rs +++ b/crates/trusted-server-core/src/settings.rs @@ -29,6 +29,12 @@ use crate::redacted::Redacted; pub const ENVIRONMENT_VARIABLE_PREFIX: &str = "TRUSTED_SERVER"; #[cfg(test)] pub const ENVIRONMENT_VARIABLE_SEPARATOR: &str = "__"; +/// Build inputs that share the settings prefix but are not settings. +/// +/// The core build script exports these with `cargo:rustc-env`, and Cargo sets +/// them on every `cargo test` run of this crate. +#[cfg(test)] +const BUILD_ENVIRONMENT_VARIABLES: [&str; 1] = ["TRUSTED_SERVER__GIT_VERSION"]; #[derive(Debug, Clone, Deserialize, Serialize, Validate)] #[serde(deny_unknown_fields)] @@ -3044,16 +3050,22 @@ impl Settings { /// Runtime loading does not use this legacy helper; `EdgeZero` CLI app-config /// overlays are applied before deserializing [`crate::config::TrustedServerAppConfig`]. /// This helper remains available to existing tests that exercise legacy - /// parsing behavior. + /// parsing behavior. Build inputs such as `TRUSTED_SERVER__GIT_VERSION` + /// are not treated as overrides. /// /// # Errors /// /// - [`TrustedServerError::Configuration`] if the TOML is invalid or missing required fields #[cfg(test)] pub fn from_toml_and_env(toml_str: &str) -> Result> { + let overrides = std::env::vars_os() + .filter_map(|(key, value)| Some((key.into_string().ok()?, value.into_string().ok()?))) + .filter(|(key, _)| !BUILD_ENVIRONMENT_VARIABLES.contains(&key.as_str())) + .collect(); let environment = Environment::default() .prefix(ENVIRONMENT_VARIABLE_PREFIX) - .separator(ENVIRONMENT_VARIABLE_SEPARATOR); + .separator(ENVIRONMENT_VARIABLE_SEPARATOR) + .source(Some(overrides)); let toml = File::from_str(toml_str, FileFormat::Toml); let config = Config::builder() From 9de68fab8aea732fddb7337e7742345e99afc6d0 Mon Sep 17 00:00:00 2001 From: Aram Grigoryan <132480+aram356@users.noreply.github.com> Date: Wed, 21 Oct 2026 20:13:56 -0700 Subject: [PATCH 3/3] Ignore build environment variables regardless of case --- crates/trusted-server-core/build.rs | 2 ++ crates/trusted-server-core/src/settings.rs | 23 ++++++++++++++++------ 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/crates/trusted-server-core/build.rs b/crates/trusted-server-core/build.rs index 4cc29466f7..db9c31d27c 100644 --- a/crates/trusted-server-core/build.rs +++ b/crates/trusted-server-core/build.rs @@ -30,6 +30,8 @@ const WORKSPACE_INPUTS: [&str; 3] = ["Cargo.toml", "Cargo.lock", "edgezero.toml" /// /// The resolved value is re-emitted under the same name, so `option_env!` reads /// the validated value rather than the raw pipeline input. +/// Keep this build input in `settings.rs`'s `BUILD_ENVIRONMENT_VARIABLES` list +/// so the legacy test loader does not treat it as a settings override. const OVERRIDE_ENV: &str = "TRUSTED_SERVER__GIT_VERSION"; /// Runs `git` in the crate directory; `None` if git is missing or fails. diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs index e8fd3d126f..2f44734592 100644 --- a/crates/trusted-server-core/src/settings.rs +++ b/crates/trusted-server-core/src/settings.rs @@ -3060,7 +3060,11 @@ impl Settings { pub fn from_toml_and_env(toml_str: &str) -> Result> { let overrides = std::env::vars_os() .filter_map(|(key, value)| Some((key.into_string().ok()?, value.into_string().ok()?))) - .filter(|(key, _)| !BUILD_ENVIRONMENT_VARIABLES.contains(&key.as_str())) + .filter(|(key, _)| { + !BUILD_ENVIRONMENT_VARIABLES + .iter() + .any(|name| name.eq_ignore_ascii_case(key)) + }) .collect(); let environment = Environment::default() .prefix(ENVIRONMENT_VARIABLE_PREFIX) @@ -6320,11 +6324,18 @@ source_domain = "partner.example.com" fn legacy_env_loader_ignores_build_time_git_version() { let toml_str = crate_test_settings_str(); - for value in ["v0.0.0-example", ""] { - temp_env::with_var("TRUSTED_SERVER__GIT_VERSION", Some(value), || { - Settings::from_toml_and_env(&toml_str) - .expect("should ignore the build-time git version input"); - }); + for key in [ + "TRUSTED_SERVER__GIT_VERSION", + "trusted_server__git_version", + "Trusted_Server__Git_Version", + ] { + for value in ["v0.0.0-example", ""] { + temp_env::with_var(key, Some(value), || { + Settings::from_toml_and_env(&toml_str).expect( + "should ignore the build-time git version input regardless of case", + ); + }); + } } }