Verify image publication without Python and bind local managed package

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

tests/test_image_publisher.py

@@ -0,0 +1,64 @@
+"""Execute publisher against a Docker metadata fixture with no Python on PATH."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+REVISION = '0a05383195213e7eaacd08388ce1d7892ce756df'
+DIGEST = 'sha256:' + 'a'*64
+DOCKER = '''#!/bin/bash
+set -eu
+if [[ "$1" == image && "$2" == inspect ]]; then
+  [[ "${CASE:-}" != inspect_error ]] || exit 29
+  if [[ "$4" == *RepoDigests* ]]; then
+    image=${5%:main-*}
+    case "${CASE:-}" in
+      missing) printf '%s@sha256:%064d\\n' other/repository 0 ;;
+      duplicate) printf '%s@%s\\n%s@%s\\n' "$image" "$DIGEST" "$image" "$DIGEST" ;;
+      malformed) printf '%s@sha256:BAD\\n' "$image" ;;
+      prefix_collision) printf '%s-extra@%s\\n' "$image" "$DIGEST" ;;
+      mismatch) if [[ "$image" == */access-engine ]]; then printf '%s@sha256:%064d\\n' "$image" 0; else printf '%s@%s\\n' "$image" "$DIGEST"; fi ;;
+      *) printf '%s@%s\\n' "$image" "$DIGEST" ;;
+    esac
+  else
+    if [[ "${CASE:-}" == wrong_revision ]]; then printf '%040d\\n' 0; else printf '%s\\n' "$REVISION"; fi
+  fi
+fi
+'''
+
+
+class PublisherMetadataChecks(unittest.TestCase):
+    def invoke(self, case='', mode='legacy'):
+        with tempfile.TemporaryDirectory() as tmp:
+            docker = Path(tmp)/'docker'
+            docker.write_text(DOCKER)
+            docker.chmod(0o755)
+            env = {'PATH':tmp, 'CASE':case, 'REVISION':REVISION, 'DIGEST':DIGEST}
+            return subprocess.run(['/bin/bash',str(ROOT/'tools/publish-runtime-images.sh'),
+                                   REVISION,mode,tmp],env=env,capture_output=True,text=True)
+
+    def test_existing_bash_docker_only_runner_and_exact_receipt(self):
+        for mode,count in [('legacy',1),('paired',2)]:
+            result = self.invoke(mode=mode)
+            self.assertEqual(result.returncode,0,result.stderr)
+            self.assertIn('manifest_digest='+DIGEST,result.stdout)
+            self.assertIn('verified_repositories='+str(count),result.stdout)
+
+    def test_missing_duplicate_malformed_foreign_revision_and_inspect_failure_refuse(self):
+        for case in ('missing','duplicate','malformed','prefix_collision','wrong_revision','inspect_error'):
+            with self.subTest(case=case):
+                result = self.invoke(case)
+                self.assertNotEqual(result.returncode,0)
+                self.assertNotIn('publication mode=',result.stdout)
+
+    def test_existing_paired_digest_equality_is_preserved(self):
+        result = self.invoke('mismatch','paired')
+        self.assertNotEqual(result.returncode,0)
+        self.assertIn('manifest digests differ',result.stderr)
+        self.assertNotIn('publication mode=',result.stdout)
+
+
+if __name__ == '__main__':
+    unittest.main()