tests: check output, test rsync versions, close gaps in what's asserted

Several checks would pass with the feature they cover broken, or cover
it only by chance:

- Phases can state what a succeeding populate prints.  That covers the
  warnings of insecureLinks, the lines pruning prints, the one about a
  replaced symlink, and what rsync logs about each item.
- The insecureLinks scenarios take their expectations from the version of
  rsync, so with an rsync older than 3.5.0 they pass without the check
  ever running.  New tests, rsync-3-4-1 and rsync-3-5-0, run them with
  these versions, which tests/rsync.nix builds from their release
  tarballs, with ACLs and extended attributes, which backups use.
- Pruning has a leftover upload to remove, and a source that stops
  having inputs to root leaves no empty directory of roots.
- A full clone has every commit from the start, so the fetch for a commit
  it lacks never runs.  A git scenario deploys a commit that appears on
  the server after cloning.
- The jq test also runs the Nix function that finds a flake's
  subdirectory on the target, over both shapes of nix flake metadata's
  output.

1 files changed, 50 insertions, 0 deletions

diff --git a/tests/rsync.nix b/tests/rsync.nix
new file mode 100644
index 0000000..6c14048
--- /dev/null
+++ b/tests/rsync.nix
@@ -0,0 +1,50 @@
+# rsync versions whose behaviour around .rsync-filter files differs: 3.4.1
+# reads them like the files it transfers, and 3.5.0 opens them more
+# strictly.  The tests run the scenarios depending on that with each,
+# whatever version nixpkgs has.  rsync's own test suite doesn't run: these
+# builds only need to behave like the releases.
+{ lib, stdenv, fetchurl, fetchpatch, perl, updateAutotoolsGnuConfigScriptsHook
+, acl, libiconv, popt, zlib
+}:
+
+let
+  rsync = { version, hash, patches ? [] }: stdenv.mkDerivation {
+    pname = "rsync";
+    inherit version patches;
+    src = fetchurl {
+      # signed with key 9FEF 112D CE19 A0DC 7E88  2CB8 1BB2 4997 A853 5F6F
+      url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
+      inherit hash;
+    };
+    nativeBuildInputs = [ perl updateAutotoolsGnuConfigScriptsHook ];
+    # With ACLs and extended attributes, which backups use (rsync -aAX).
+    buildInputs = [ acl libiconv popt zlib ];
+    configureFlags = [
+      "--disable-lz4"
+      "--disable-openssl"
+      "--disable-xxhash"
+      "--disable-zstd"
+      "--enable-ipv6"
+      "--with-included-zlib=no"
+      "--with-nobody-group=nogroup"
+    ];
+    enableParallelBuilding = true;
+    meta.mainProgram = "rsync";
+  };
+in {
+  "3.4.1" = rsync {
+    version = "3.4.1";
+    hash = "sha256-KSS8s6Hti1UfwQH3QLnw/gogKxFQJ2R89phQ1l/YjFI=";
+    patches = [
+      # Compilation with GCC 15.
+      (fetchpatch {
+        url = "https://github.com/RsyncProject/rsync/commit/a4b926dcdce96b0f2cc0dc7744e95747b233500a.patch";
+        hash = "sha256-UiEQJ+p2gtIDYNJqnxx4qKgItKIZzCpkHnvsgoxBmSE=";
+      })
+    ];
+  };
+  "3.5.0" = rsync {
+    version = "3.5.0";
+    hash = "sha256-x//R72U+mVQPZh5HywC3+crR7muXI5mxb5PWcmVuDTM=";
+  };
+}