Harden release artifact publication
This commit is contained in:
@@ -2,6 +2,7 @@ from __future__ import annotations
|
||||
|
||||
import json
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
import unittest
|
||||
@@ -13,10 +14,204 @@ RELEASE_TOOLS_ROOT = META_ROOT / "tools" / "release"
|
||||
if str(RELEASE_TOOLS_ROOT) not in sys.path:
|
||||
sys.path.insert(0, str(RELEASE_TOOLS_ROOT))
|
||||
|
||||
from govoplan_release.publisher import publish_catalog_candidate # noqa: E402
|
||||
from govoplan_release.publisher import ( # noqa: E402
|
||||
publish_catalog_candidate,
|
||||
verify_committed_publication,
|
||||
)
|
||||
|
||||
|
||||
class ReleaseCatalogPublicationTests(unittest.TestCase):
|
||||
def test_committed_publication_must_match_validated_blobs_exactly(self) -> None:
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
web_root = Path(tmp) / "website"
|
||||
module_root = web_root / "public" / "catalogs" / "v1" / "modules"
|
||||
module_root.mkdir(parents=True)
|
||||
catalog = web_root / "public" / "catalogs" / "v1" / "channels" / "stable.json"
|
||||
keyring = web_root / "public" / "catalogs" / "v1" / "keyring.json"
|
||||
catalog.parent.mkdir(parents=True)
|
||||
expected = {
|
||||
catalog.relative_to(web_root).as_posix(): b'{"catalog":true}\n',
|
||||
keyring.relative_to(web_root).as_posix(): b'{"keys":[]}\n',
|
||||
(module_root / "index.json").relative_to(web_root).as_posix(): b'{"modules":[]}\n',
|
||||
}
|
||||
for relative, encoded in expected.items():
|
||||
target = web_root / relative
|
||||
target.parent.mkdir(parents=True, exist_ok=True)
|
||||
target.write_bytes(encoded)
|
||||
self._git(web_root, "init", "--quiet")
|
||||
self._git(web_root, "config", "user.email", "test@example.test")
|
||||
self._git(web_root, "config", "user.name", "Test")
|
||||
self._git(web_root, "add", ".")
|
||||
self._git(web_root, "commit", "--quiet", "-m", "publication")
|
||||
commit_sha = self._git(web_root, "rev-parse", "HEAD").strip()
|
||||
|
||||
verify_committed_publication(
|
||||
web_root=web_root,
|
||||
commit_sha=commit_sha,
|
||||
expected_blobs=expected,
|
||||
module_root=module_root,
|
||||
)
|
||||
changed = dict(expected)
|
||||
changed[catalog.relative_to(web_root).as_posix()] = b'{"catalog":false}\n'
|
||||
with self.assertRaisesRegex(RuntimeError, "differs"):
|
||||
verify_committed_publication(
|
||||
web_root=web_root,
|
||||
commit_sha=commit_sha,
|
||||
expected_blobs=changed,
|
||||
module_root=module_root,
|
||||
)
|
||||
catalog_path = catalog.relative_to(web_root).as_posix()
|
||||
self._git(web_root, "update-index", "--chmod=+x", catalog_path)
|
||||
self._git(web_root, "commit", "--quiet", "-m", "unsafe mode")
|
||||
executable_commit = self._git(web_root, "rev-parse", "HEAD").strip()
|
||||
with self.assertRaisesRegex(RuntimeError, "regular blob"):
|
||||
verify_committed_publication(
|
||||
web_root=web_root,
|
||||
commit_sha=executable_commit,
|
||||
expected_blobs=expected,
|
||||
module_root=module_root,
|
||||
)
|
||||
|
||||
def test_apply_writes_validated_objects_even_if_candidate_path_changes(self) -> None:
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
candidate = self._candidate(root, key="trusted-key")
|
||||
catalog_path = candidate / "channels" / "stable.json"
|
||||
catalog = json.loads(catalog_path.read_text(encoding="utf-8"))
|
||||
catalog.update({"channel": "stable", "sequence": 1})
|
||||
catalog["core_release"]["python_package"] = "govoplan-core"
|
||||
catalog["release"] = {
|
||||
"selected_units": [
|
||||
{
|
||||
"repo": "govoplan-core",
|
||||
"version": "1.2.3",
|
||||
"tag": "v1.2.3",
|
||||
"commit_sha": "a" * 40,
|
||||
"tag_object_sha": "b" * 40,
|
||||
}
|
||||
],
|
||||
"artifacts": [
|
||||
{
|
||||
"artifact_kind": "python-wheel",
|
||||
"package_name": "govoplan-core",
|
||||
"package_version": "1.2.3",
|
||||
"archive_sha256": "c" * 64,
|
||||
"archive_size": 100,
|
||||
"installed_payload": {
|
||||
"algorithm": "govoplan-wheel-declared-payload-v1",
|
||||
"sha256": "d" * 64,
|
||||
"file_count": 1,
|
||||
},
|
||||
"requires_installer_receipt": True,
|
||||
}
|
||||
],
|
||||
}
|
||||
catalog["signatures"] = [{}]
|
||||
catalog_path.write_text(json.dumps(catalog), encoding="utf-8")
|
||||
web_root = root / "website"
|
||||
target_keyring = web_root / "public" / "catalogs" / "v1" / "keyring.json"
|
||||
target_keyring.parent.mkdir(parents=True)
|
||||
target_keyring.write_text(json.dumps(self._keyring("trusted-key")))
|
||||
(web_root / ".git").mkdir()
|
||||
|
||||
def validate_and_swap(*args, **kwargs):
|
||||
del args, kwargs
|
||||
catalog_path.write_text(
|
||||
json.dumps(
|
||||
{
|
||||
"channel": "stable",
|
||||
"sequence": 999,
|
||||
"malicious": True,
|
||||
"signatures": [{}],
|
||||
}
|
||||
),
|
||||
encoding="utf-8",
|
||||
)
|
||||
return {"valid": True, "warnings": [], "error": None}
|
||||
|
||||
with (
|
||||
patch(
|
||||
"govoplan_release.publisher.validate_module_package_catalog",
|
||||
side_effect=validate_and_swap,
|
||||
),
|
||||
patch(
|
||||
"govoplan_release.publisher.source_tag_provenance_issues",
|
||||
return_value=(),
|
||||
),
|
||||
patch("govoplan_release.publisher.website_dirty", return_value=False),
|
||||
):
|
||||
result = publish_catalog_candidate(
|
||||
candidate_dir=candidate,
|
||||
web_root=web_root,
|
||||
workspace_root=root,
|
||||
apply=True,
|
||||
allow_dirty_website=True,
|
||||
)
|
||||
|
||||
published = json.loads(
|
||||
(
|
||||
web_root
|
||||
/ "public"
|
||||
/ "catalogs"
|
||||
/ "v1"
|
||||
/ "channels"
|
||||
/ "stable.json"
|
||||
).read_text(encoding="utf-8")
|
||||
)
|
||||
|
||||
self.assertEqual("applied", result.status)
|
||||
self.assertEqual(1, published["sequence"])
|
||||
self.assertNotIn("malicious", published)
|
||||
|
||||
def test_apply_blocks_selected_python_release_without_built_identity(self) -> None:
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
candidate = self._candidate(root, key="trusted-key")
|
||||
catalog_path = candidate / "channels" / "stable.json"
|
||||
catalog = json.loads(catalog_path.read_text(encoding="utf-8"))
|
||||
catalog["core_release"]["python_package"] = "govoplan-core"
|
||||
catalog["release"] = {
|
||||
"selected_units": [
|
||||
{
|
||||
"repo": "govoplan-core",
|
||||
"version": "1.2.3",
|
||||
"tag": "v1.2.3",
|
||||
"commit_sha": "a" * 40,
|
||||
"tag_object_sha": "b" * 40,
|
||||
}
|
||||
]
|
||||
}
|
||||
catalog_path.write_text(json.dumps(catalog), encoding="utf-8")
|
||||
web_root = root / "website"
|
||||
target_keyring = web_root / "public" / "catalogs" / "v1" / "keyring.json"
|
||||
target_keyring.parent.mkdir(parents=True)
|
||||
target_keyring.write_text(json.dumps(self._keyring("trusted-key")))
|
||||
(web_root / ".git").mkdir()
|
||||
|
||||
with (
|
||||
patch(
|
||||
"govoplan_release.publisher.validate_module_package_catalog",
|
||||
return_value={"valid": True, "warnings": [], "error": None},
|
||||
),
|
||||
patch(
|
||||
"govoplan_release.publisher.source_tag_provenance_issues",
|
||||
return_value=(),
|
||||
),
|
||||
patch("govoplan_release.publisher.website_dirty", return_value=False),
|
||||
):
|
||||
result = publish_catalog_candidate(
|
||||
candidate_dir=candidate,
|
||||
web_root=web_root,
|
||||
workspace_root=root,
|
||||
apply=True,
|
||||
)
|
||||
|
||||
self.assertEqual("blocked", result.status)
|
||||
self.assertIn(
|
||||
"selected Python repository govoplan-core has no built artifact identity",
|
||||
" ".join(result.notes),
|
||||
)
|
||||
|
||||
def test_publication_requires_an_existing_trust_anchor(self) -> None:
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root = Path(tmp)
|
||||
@@ -94,6 +289,17 @@ class ReleaseCatalogPublicationTests(unittest.TestCase):
|
||||
]
|
||||
}
|
||||
|
||||
@staticmethod
|
||||
def _git(root: Path, *args: str) -> str:
|
||||
return subprocess.run(
|
||||
["git", *args],
|
||||
cwd=root,
|
||||
check=True,
|
||||
text=True,
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=subprocess.PIPE,
|
||||
).stdout
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
|
||||
Reference in New Issue
Block a user