73 lines
2.9 KiB
Python
73 lines
2.9 KiB
Python
import hashlib
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import tempfile
|
|
import unittest
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
spec = importlib.util.spec_from_file_location(
|
|
"verify_source_package", ROOT / "deploy" / "verify_source_package.py"
|
|
)
|
|
verify_source_package = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(verify_source_package)
|
|
|
|
|
|
COMMIT = "a" * 40
|
|
VERSION = "0.2.1"
|
|
|
|
|
|
class VerifySourcePackageTests(unittest.TestCase):
|
|
def fixture(self, directory: str):
|
|
root = Path(directory)
|
|
archive = root / "GuestOps-0.2.1-aaaaaaaaaaaa.tar.gz"
|
|
record = root / "GuestOps-0.2.1-aaaaaaaaaaaa.source.json"
|
|
archive.write_bytes(b"committed source package")
|
|
payload = {
|
|
"artifact": {
|
|
"name": archive.name,
|
|
"sha256": hashlib.sha256(archive.read_bytes()).hexdigest(),
|
|
"size": archive.stat().st_size,
|
|
},
|
|
"commit": COMMIT,
|
|
"schemaVersion": 1,
|
|
"version": VERSION,
|
|
}
|
|
record.write_text(json.dumps(payload), encoding="utf-8")
|
|
return archive, record, payload
|
|
|
|
def test_verifies_archive_record_and_expected_identity(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
archive, record, _ = self.fixture(directory)
|
|
result = verify_source_package.validate(archive, record, COMMIT, VERSION)
|
|
self.assertTrue(result["verified"])
|
|
self.assertEqual(result["commit"], COMMIT)
|
|
self.assertEqual(result["artifact"]["sha256"], hashlib.sha256(archive.read_bytes()).hexdigest())
|
|
self.assertEqual(result["sourceRecord"]["sha256"], hashlib.sha256(record.read_bytes()).hexdigest())
|
|
|
|
def test_rejects_changed_archive(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
archive, record, _ = self.fixture(directory)
|
|
archive.write_bytes(b"changed source package")
|
|
with self.assertRaisesRegex(ValueError, "size does not match"):
|
|
verify_source_package.validate(archive, record, COMMIT, VERSION)
|
|
|
|
def test_rejects_wrong_commit_version_and_filename(self):
|
|
cases = [
|
|
(lambda value: value.update(commit="b" * 40), "commit does not match"),
|
|
(lambda value: value.update(version="0.3.0"), "version does not match"),
|
|
(lambda value: value["artifact"].update(name="other.tar.gz"), "filename does not match"),
|
|
]
|
|
for mutate, message in cases:
|
|
with self.subTest(message=message), tempfile.TemporaryDirectory() as directory:
|
|
archive, record, payload = self.fixture(directory)
|
|
mutate(payload)
|
|
record.write_text(json.dumps(payload), encoding="utf-8")
|
|
with self.assertRaisesRegex(ValueError, message):
|
|
verify_source_package.validate(archive, record, COMMIT, VERSION)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|