Add private release candidate handles

tests/test_release_candidate_artifact.py

@@ -0,0 +1,153 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+
+
+META_ROOT = Path(__file__).resolve().parents[1]
+RELEASE_TOOLS_ROOT = META_ROOT / "tools" / "release"
+if str(RELEASE_TOOLS_ROOT) not in sys.path:
+    sys.path.insert(0, str(RELEASE_TOOLS_ROOT))
+
+from govoplan_release.candidate_artifact import (  # noqa: E402
+    CandidateArtifactError,
+    candidate_output_path,
+    issue_candidate_id,
+    issue_candidate_receipt,
+    verify_candidate_receipt,
+    validate_release_channel,
+)
+
+
+class CandidateArtifactTests(unittest.TestCase):
+    def test_channel_is_one_canonical_basename(self) -> None:
+        self.assertEqual("stable_1", validate_release_channel("stable_1"))
+        for value in ("../stable", "/stable", ".", "..", "Stable", "stable/name"):
+            with self.subTest(value=value), self.assertRaises(CandidateArtifactError):
+                validate_release_channel(value)
+
+    def test_handle_is_deterministic_and_can_precede_output(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir) / "not-created" / "release-candidates"
+            candidate_id = issue_candidate_id("rr-123", "attempt-456")
+
+            first = candidate_output_path(root, candidate_id)
+            second = candidate_output_path(root, candidate_id)
+
+        self.assertEqual(first, second)
+        self.assertEqual(candidate_id, first.name)
+        self.assertRegex(candidate_id, r"^candidate-[0-9a-f]{32}$")
+
+    def test_receipt_rejects_catalog_drift(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir) / "release-candidates"
+            candidate_id = issue_candidate_id("run", "attempt")
+            catalog = self._write_candidate(root / candidate_id)
+            receipt = issue_candidate_receipt(
+                root=root, candidate_id=candidate_id, channel="stable"
+            )
+
+            resolved = verify_candidate_receipt(
+                root=root,
+                candidate_id=receipt.candidate_id,
+                catalog_sha256=receipt.catalog_sha256,
+                channel="stable",
+            )
+            catalog.write_text(
+                json.dumps({"channel": "stable", "sequence": 2, "signatures": [{}]}),
+                encoding="utf-8",
+            )
+
+            self.assertEqual(root / candidate_id, resolved)
+            with self.assertRaisesRegex(CandidateArtifactError, "no longer matches"):
+                verify_candidate_receipt(
+                    root=root,
+                    candidate_id=receipt.candidate_id,
+                    catalog_sha256=receipt.catalog_sha256,
+                    channel="stable",
+                )
+
+    def test_unissued_ids_traversal_and_symlinks_fail_closed(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir) / "release-candidates"
+            root.mkdir(mode=0o700)
+            candidate_id = issue_candidate_id("run", "attempt")
+            outside = Path(temp_dir) / "outside"
+            outside.mkdir()
+            (root / candidate_id).symlink_to(outside, target_is_directory=True)
+
+            with self.assertRaises(CandidateArtifactError):
+                candidate_output_path(root, "../candidate-" + "0" * 32)
+            with self.assertRaisesRegex(CandidateArtifactError, "real directory"):
+                candidate_output_path(root, candidate_id)
+
+    def test_catalog_and_channel_components_must_not_be_symlinks(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir) / "release-candidates"
+            candidate_id = issue_candidate_id("run", "attempt")
+            candidate = root / candidate_id
+            target = Path(temp_dir) / "target"
+            target.mkdir()
+            (target / "stable.json").write_text(
+                json.dumps({"signatures": [{}]}), encoding="utf-8"
+            )
+            root.mkdir(mode=0o700)
+            candidate.mkdir(mode=0o700)
+            (candidate / "channels").symlink_to(target, target_is_directory=True)
+
+            with self.assertRaisesRegex(CandidateArtifactError, "real directory"):
+                issue_candidate_receipt(
+                    root=root, candidate_id=candidate_id, channel="stable"
+                )
+
+    def test_shared_candidate_roots_and_catalog_files_fail_closed(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir) / "release-candidates"
+            root.mkdir(mode=0o755)
+            candidate_id = issue_candidate_id("run", "attempt")
+            with self.assertRaisesRegex(CandidateArtifactError, "another user"):
+                candidate_output_path(root, candidate_id)
+
+            root.chmod(0o700)
+            catalog = self._write_candidate(root / candidate_id)
+            catalog.chmod(0o640)
+            with self.assertRaisesRegex(CandidateArtifactError, "another user"):
+                issue_candidate_receipt(
+                    root=root, candidate_id=candidate_id, channel="stable"
+                )
+
+    def test_receipt_rejects_catalog_with_inconsistent_channel(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir) / "release-candidates"
+            candidate_id = issue_candidate_id("run", "attempt")
+            catalog = self._write_candidate(root / candidate_id)
+            catalog.write_text(
+                json.dumps({"channel": "next", "signatures": [{}]}),
+                encoding="utf-8",
+            )
+
+            with self.assertRaisesRegex(CandidateArtifactError, "does not match"):
+                issue_candidate_receipt(
+                    root=root, candidate_id=candidate_id, channel="stable"
+                )
+
+    @staticmethod
+    def _write_candidate(candidate: Path) -> Path:
+        candidate.parent.mkdir(mode=0o700, exist_ok=True)
+        candidate.mkdir(mode=0o700)
+        channels = candidate / "channels"
+        channels.mkdir(mode=0o700)
+        catalog = channels / "stable.json"
+        catalog.write_text(
+            json.dumps({"channel": "stable", "sequence": 1, "signatures": [{}]}),
+            encoding="utf-8",
+        )
+        catalog.chmod(0o600)
+        return catalog
+
+
+if __name__ == "__main__":
+    unittest.main()