2 files changed, 18 insertions, 6 deletions
diff --git a/app/services/govuk_guix/build_mini_environment.rb b/app/services/govuk_guix/build_mini_environment.rb
index 9cada20..37fc16b 100644
--- a/app/services/govuk_guix/build_mini_environment.rb
+++ b/app/services/govuk_guix/build_mini_environment.rb
@@ -36,7 +36,7 @@ module GovukGuix::BuildMiniEnvironment
 
     remote_host = options[:run_remotely_on_host]
 
-    if remote_host && Guix.available_locally?
+    if remote_host && Guix.available_locally? && false # TODO
       # TODO: This doesn't use the private key specified by the
       # backend, so it'll only work when the default SSH key has
       # access to the remote host.
@@ -73,11 +73,12 @@ module GovukGuix::BuildMiniEnvironment
     )
 
     build_output = output.last.strip
-
-    raise 'InvalidOutput' unless build_output.starts_with? '/gnu/store'
-
     logger.debug(self.class) { "build_output: #{build_output}" }
 
+    unless arguments[:type] == 'aws-packer-ami'
+      raise 'InvalidOutput' unless build_output.starts_with? '/gnu/store'
+    end
+
     mini_environment.update(
       backend_data: {
         build_output: build_output
diff --git a/app/services/govuk_guix/update_gcroots_directory.rb b/app/services/govuk_guix/update_gcroots_directory.rb
index 97fe703..dec4679 100644
--- a/app/services/govuk_guix/update_gcroots_directory.rb
+++ b/app/services/govuk_guix/update_gcroots_directory.rb
@@ -24,6 +24,11 @@ module GovukGuix::UpdateGcrootsDirectory
   DIRECTORY = '/var/guix/gcroots/govuk-mini-environment-admin'
 
   def self.set_in_use_store_paths(store_paths, options = {})
+    store_paths.each do |store_path|
+      raise "Invalid store path #{store_path}" \
+        unless Guix.valid_store_path?(store_path)
+    end
+
     current_store_paths = list_store_paths(options)
 
     (current_store_paths - store_paths).each do |store_path|
@@ -36,15 +41,21 @@ module GovukGuix::UpdateGcrootsDirectory
   end
 
   def self.add_store_path(store_path, options = {})
+    raise "Invalid store path #{store_path}" \
+      unless Guix.valid_store_path?(store_path)
+
     run_command(
-      'ln', '-s',
-      store_path,
+      'ln', '-f', '-s',
+      '-T', store_path,
       File.join(DIRECTORY, store_path['/gnu/store/'.length..-1]),
       run_remotely_on_host: options[:run_remotely_on_host]
     )
   end
 
   def self.remove_store_path(store_path, options = {})
+    raise "Invalid store path #{store_path}" \
+      unless Guix.valid_store_path?(store_path)
+
     run_command(
       'rm', File.join(DIRECTORY, store_path['/gnu/store/'.length..-1]),
       run_remotely_on_host: options[:run_remotely_on_host]