tests: check output, test rsync versions, close gaps in what's asserted

Several checks would pass with the feature they cover broken, or cover
it only by chance:

- Phases can state what a succeeding populate prints.  That covers the
  warnings of insecureLinks, the lines pruning prints, the one about a
  replaced symlink, and what rsync logs about each item.
- The insecureLinks scenarios take their expectations from the version of
  rsync, so with an rsync older than 3.5.0 they pass without the check
  ever running.  New tests, rsync-3-4-1 and rsync-3-5-0, run them with
  these versions, which tests/rsync.nix builds from their release
  tarballs, with ACLs and extended attributes, which backups use.
- Pruning has a leftover upload to remove, and a source that stops
  having inputs to root leaves no empty directory of roots.
- A full clone has every commit from the start, so the fetch for a commit
  it lacks never runs.  A git scenario deploys a commit that appears on
  the server after cloning.
- The jq test also runs the Nix function that finds a flake's
  subdirectory on the target, over both shapes of nix flake metadata's
  output.

1 files changed, 7 insertions, 2 deletions

diff --git a/tests/vm.nix b/tests/vm.nix
index a203962..906bb09 100644
--- a/tests/vm.nix
+++ b/tests/vm.nix
@@ -1,7 +1,7 @@
 # Runs scenarios in a NixOS VM test with two machines: deployer, which runs
 # populate, and target, which it deploys to via ssh.  Local scenarios deploy
 # to deployer itself.
-{ pkgs, name, scenarios, gitHead }:
+{ pkgs, name, scenarios, gitHead, rsync ? pkgs.rsync }:
 
 let
   inherit (pkgs) lib;
@@ -35,7 +35,7 @@ let
     nix.settings.substituters = lib.mkForce [];
     environment.systemPackages = [
       pkgs.git
-      pkgs.rsync
+      rsync
       (pkgs.writeScriptBin "nixos-rebuild" (builtins.readFile ./nixos-rebuild.sh))
     ];
     # The stand-in replaces nixos-rebuild.
@@ -162,6 +162,11 @@ in pkgs.testers.runNixOSTest {
                     elif phase["expect"] is None:
                         if status != 0:
                             raise Exception(f"populate {i} fails:\n{out}")
+                        for expected in phase["output"]:
+                            if expected not in out:
+                                raise Exception(
+                                    f"populate {i} doesn't print {expected!r}:\n{out}"
+                                )
                     elif status == 0 or phase["expect"] not in out:
                         raise Exception(
                             f"populate {i} doesn't fail with {phase['expect']!r}:\n{out}"