104 lines
3.2 KiB
Python
104 lines
3.2 KiB
Python
import hashlib
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
import tarfile
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
PACKAGER = ROOT / "scripts" / "build_release.py"
|
|
VERIFIER = ROOT / "scripts" / "verify_release.py"
|
|
|
|
|
|
def _fixture(root: Path) -> None:
|
|
(root / "src").mkdir(parents=True)
|
|
(root / "frontend").mkdir()
|
|
(root / "src" / "main.py").write_text("print('ready')\n")
|
|
(root / "frontend" / "index.html").write_text("<h1>Stackchain</h1>\n")
|
|
(root / "requirements.txt").write_text("fastapi==1.0\n")
|
|
(root / "README.md").write_text("# Stackchain\n")
|
|
|
|
|
|
def _build(source: Path, output: Path) -> subprocess.CompletedProcess[str]:
|
|
return subprocess.run(
|
|
[
|
|
sys.executable,
|
|
str(PACKAGER),
|
|
"--root",
|
|
str(source),
|
|
"--output-dir",
|
|
str(output),
|
|
"--commit",
|
|
"a" * 40,
|
|
"--source-date-epoch",
|
|
"1720000000",
|
|
],
|
|
text=True,
|
|
capture_output=True,
|
|
check=False,
|
|
)
|
|
|
|
|
|
def test_release_bundle_is_reproducible(tmp_path):
|
|
source = tmp_path / "source"
|
|
_fixture(source)
|
|
|
|
first = _build(source, tmp_path / "first")
|
|
second = _build(source, tmp_path / "second")
|
|
|
|
assert first.returncode == 0, first.stderr
|
|
assert second.returncode == 0, second.stderr
|
|
first_archive = next((tmp_path / "first").glob("*.tar.gz"))
|
|
second_archive = next((tmp_path / "second").glob("*.tar.gz"))
|
|
assert first_archive.read_bytes() == second_archive.read_bytes()
|
|
|
|
manifest = json.loads(next((tmp_path / "first").glob("*.manifest.json")).read_text())
|
|
checksum = next((tmp_path / "first").glob("*.sha256")).read_text().split()[0]
|
|
assert manifest["commit"] == "a" * 40
|
|
assert manifest["artifact"]["sha256"] == checksum
|
|
assert checksum == hashlib.sha256(first_archive.read_bytes()).hexdigest()
|
|
assert sorted(manifest["files"]) == [
|
|
"README.md",
|
|
"frontend/index.html",
|
|
"requirements.txt",
|
|
"src/main.py",
|
|
]
|
|
with tarfile.open(first_archive, "r:gz") as archive:
|
|
names = archive.getnames()
|
|
embedded = json.load(archive.extractfile("release-manifest.json"))
|
|
assert names == [
|
|
"README.md",
|
|
"frontend/index.html",
|
|
"release-manifest.json",
|
|
"requirements.txt",
|
|
"src/main.py",
|
|
]
|
|
assert embedded["commit"] == "a" * 40
|
|
assert embedded["files"] == manifest["files"]
|
|
|
|
|
|
def test_release_bundle_verifier_enforces_integrity(tmp_path):
|
|
source = tmp_path / "source"
|
|
output = tmp_path / "dist"
|
|
_fixture(source)
|
|
built = _build(source, output)
|
|
assert built.returncode == 0, built.stderr
|
|
|
|
valid = subprocess.run(
|
|
[sys.executable, str(VERIFIER), "--input-dir", str(output), "--commit", "a" * 40],
|
|
text=True,
|
|
capture_output=True,
|
|
check=False,
|
|
)
|
|
assert valid.returncode == 0, valid.stderr
|
|
|
|
archive = next(output.glob("*.tar.gz"))
|
|
archive.write_bytes(archive.read_bytes() + b"tampered")
|
|
tampered = subprocess.run(
|
|
[sys.executable, str(VERIFIER), "--input-dir", str(output), "--commit", "a" * 40],
|
|
text=True,
|
|
capture_output=True,
|
|
check=False,
|
|
)
|
|
assert tampered.returncode != 0 |