35 lines
2.1 KiB
Python
35 lines
2.1 KiB
Python
"""Execute snapshot-source setup and verify exact-index refusal without APT."""
|
|
from pathlib import Path
|
|
import subprocess
|
|
import tempfile
|
|
import unittest
|
|
|
|
REPO=Path(__file__).resolve().parents[2]
|
|
|
|
class SnapshotTests(unittest.TestCase):
|
|
def test_hook_requires_exact_indexes(self):
|
|
with tempfile.TemporaryDirectory() as tmp:
|
|
root=Path(tmp)
|
|
subprocess.run(['sh',str(REPO/'image-recipe/configs/build-snapshot-sources.sh'),str(root)],check=True)
|
|
sources=(root/'etc/apt/sources.list.d/archipelago-build.sources').read_text()
|
|
self.assertIn('Check-Valid-Until: no',sources)
|
|
self.assertIn('Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg',sources)
|
|
checker=root/'usr/local/lib/archipelago/check-build-indexes.sh'
|
|
# Test the actual algorithm with fixture digests, never change its
|
|
# production pins or fetch mutable metadata in the unit suite.
|
|
import hashlib,re
|
|
lists=root/'lists'; lists.mkdir()
|
|
for suite,contents in [('trixie',b'authenticated main fixture'),('trixie-security',b'authenticated security fixture')]:
|
|
(lists/('fixture_dists_'+suite+'_InRelease')).write_bytes(contents)
|
|
script=checker.read_text().replace('/var/lib/apt/lists/',str(lists)+'/')
|
|
for suite,contents in [('trixie',b'authenticated main fixture'),('trixie-security',b'authenticated security fixture')]:
|
|
script=re.sub(r'check [0-9a-f]{64} (.*_dists_'+suite+r'_InRelease)',lambda m:'check '+hashlib.sha256(contents).hexdigest()+' '+m[1],script)
|
|
checker.write_text(script)
|
|
self.assertEqual(subprocess.run(['sh',str(checker)],capture_output=True).returncode,0)
|
|
(lists/'fixture_dists_trixie_InRelease').write_bytes(b'changed signed metadata')
|
|
self.assertNotEqual(subprocess.run(['sh',str(checker)],capture_output=True).returncode,0)
|
|
(lists/'fixture_dists_trixie_InRelease').unlink()
|
|
self.assertNotEqual(subprocess.run(['sh',str(checker)],capture_output=True).returncode,0)
|
|
|
|
if __name__=='__main__': unittest.main()
|