90 lines
3.1 KiB
Python
90 lines
3.1 KiB
Python
import json
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
VALIDATOR = ROOT / "autoinstall/offline/validate-payload-lock.py"
|
|
CANDIDATE = ROOT / "autoinstall/offline/payload-lock.candidate.json"
|
|
|
|
|
|
def run(lock: Path) -> subprocess.CompletedProcess[str]:
|
|
return subprocess.run(
|
|
[sys.executable, str(VALIDATOR), str(lock)],
|
|
check=False,
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
|
|
|
|
def complete_lock() -> dict:
|
|
digest = "a" * 64
|
|
groups = {}
|
|
for group in ("apt", "python", "runtime", "models", "source"):
|
|
groups[group] = [{
|
|
"id": f"test-{group}",
|
|
"version": "1.0.0-test",
|
|
"architecture": "amd64" if group != "source" else "all",
|
|
"source": f"https://invalid.example/{group}/1.0.0-test",
|
|
"target": f"payload/{group}/test.bin",
|
|
"sha256": digest,
|
|
"bytes": 1,
|
|
"bytes_basis": "measured",
|
|
"license": "TEST-ONLY"
|
|
}]
|
|
groups["containers"] = [{
|
|
"id": "test-container",
|
|
"version": "1.0.0-test",
|
|
"architecture": "amd64",
|
|
"source": f"invalid.example/test/image@sha256:{digest}",
|
|
"target": "payload/containers/test.oci",
|
|
"sha256": digest,
|
|
"bytes": 1,
|
|
"bytes_basis": "measured",
|
|
"license": "TEST-ONLY"
|
|
}]
|
|
return {
|
|
"schema": "nexus-one-ai.offline-workstation-payload-lock.v1",
|
|
"product": "offline-workstation",
|
|
"architecture": "amd64",
|
|
"ubuntu_release": "22.04.5",
|
|
"approval_record": "CT-G1-2026-009",
|
|
"status": "reviewed",
|
|
"unresolved": [],
|
|
"objects": groups,
|
|
}
|
|
|
|
|
|
class PayloadLockTests(unittest.TestCase):
|
|
def test_candidate_fails_closed(self) -> None:
|
|
result = run(CANDIDATE)
|
|
self.assertEqual(result.returncode, 1)
|
|
self.assertIn("status must be reviewed", result.stderr)
|
|
self.assertIn("unresolved must be an empty array", result.stderr)
|
|
|
|
def test_complete_test_lock_passes(self) -> None:
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
lock = Path(directory) / "payload-lock.json"
|
|
lock.write_text(json.dumps(complete_lock()), encoding="utf-8")
|
|
result = run(lock)
|
|
self.assertEqual(result.returncode, 0, result.stderr)
|
|
|
|
def test_mutable_container_and_duplicate_target_fail(self) -> None:
|
|
data = complete_lock()
|
|
data["objects"]["containers"][0]["source"] = "invalid.example/test/image:latest"
|
|
data["objects"]["python"][0]["target"] = data["objects"]["apt"][0]["target"]
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
lock = Path(directory) / "payload-lock.json"
|
|
lock.write_text(json.dumps(data), encoding="utf-8")
|
|
result = run(lock)
|
|
self.assertEqual(result.returncode, 1)
|
|
self.assertIn("must be an OCI reference pinned with @sha256", result.stderr)
|
|
self.assertIn("duplicate target path", result.stderr)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|