32 lines
1.2 KiB
Python
32 lines
1.2 KiB
Python
|
import importlib.util
|
||
|
|
import shutil
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
|
||
|
|
ROOT = Path(__file__).resolve().parents[1]
|
||
|
|
spec = importlib.util.spec_from_file_location("bundle_verifier", ROOT / "scripts/verify_custodian_bundle.py")
|
||
|
|
module = importlib.util.module_from_spec(spec)
|
||
|
|
spec.loader.exec_module(module)
|
||
|
|
|
||
|
|
|
||
|
|
def test_reviewed_bundle_bytes():
|
||
|
|
result = module.verify(ROOT / "k8s/custodian-release/commands", "60d893af1bf77f457504b64ff1c9ffb5c6ae6579")
|
||
|
|
assert result["verified_files"] == 4
|
||
|
|
|
||
|
|
|
||
|
|
def test_tampered_installed_file_refused(tmp_path):
|
||
|
|
shutil.copytree(ROOT / "k8s/custodian-release/commands", tmp_path / "bundle")
|
||
|
|
(tmp_path / "bundle/scripts/security_flow_daily.py").write_text("changed")
|
||
|
|
with pytest.raises(ValueError, match="hash mismatch"):
|
||
|
|
module.verify(tmp_path / "bundle")
|
||
|
|
|
||
|
|
|
||
|
|
def test_installed_symlink_refused(tmp_path):
|
||
|
|
shutil.copytree(ROOT / "k8s/custodian-release/commands", tmp_path / "bundle")
|
||
|
|
path = tmp_path / "bundle/scripts/security_flow_daily.py"
|
||
|
|
path.unlink()
|
||
|
|
path.symlink_to(ROOT / "k8s/custodian-release/commands/scripts/security_flow_daily.py")
|
||
|
|
with pytest.raises(ValueError, match="regular installed"):
|
||
|
|
module.verify(tmp_path / "bundle")
|