package main import ( "os" "path/filepath" "strings" "testing" "gopkg.in/yaml.v3" ) type pinValues struct { Image struct { Digest string `yaml:"digest"` } `yaml:"image"` Args []string `yaml:"args"` } func loadPinValues(t *testing.T, name string) pinValues { t.Helper() raw, err := os.ReadFile(filepath.Join("..", "..", "values", name)) if err != nil { t.Fatal(err) } var v pinValues if err := yaml.Unmarshal(raw, &v); err != nil { t.Fatal(err) } return v } func argAfter(args []string, flag string) []string { var out []string for i := 0; i+1 < len(args); i++ { if args[i] == flag { out = append(out, args[i+1]) } } return out } // FLEX-WP-0035-T04, contract ยง4: the readback pin runs each participant's // package at the same digest its own pin runs. The package is baked into the // image, so same image digest and same path is the same package digest. func TestReadbackPinMatchesParticipantPins(t *testing.T) { readback := loadPinValues(t, "application-readback.yaml") if len(readback.Args) == 0 || readback.Args[0] != "serve-readback" { t.Fatal("readback pin must run serve-readback, which mounts no /v1/check") } participants := map[string]string{"informed-decision": "informed-decision-lifecycle.yaml"} packages := argAfter(readback.Args, "--package") if len(packages) != len(participants) { t.Fatalf("readback packages %v, want one per participant %v", packages, participants) } for _, pkg := range packages { system, path, _ := strings.Cut(pkg, "=") file, ok := participants[system] if !ok { t.Fatalf("readback package for %q has no participant pin", system) } own := loadPinValues(t, file) if own.Image.Digest != readback.Image.Digest { t.Errorf("%s: readback image %s, own pin %s", system, readback.Image.Digest, own.Image.Digest) } if policies := argAfter(own.Args, "--policy"); len(policies) != 1 || policies[0] != path { t.Errorf("%s: readback package %s, own pin %v", system, path, policies) } if !strings.Contains(strings.Join(argAfter(readback.Args, "--registry"), " "), strings.Join(argAfter(own.Args, "--registry"), " ")) { t.Errorf("%s: readback pin does not load its registry", system) } } }