coulomb/activity-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: prepare pinned Custodian worker bundle and required input admission

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
This commit is contained in:
tegwick 2026-10-19 15:09:27 +02:00
parent 0319fe8be8
commit fed119a17c
18 changed files with 1058 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

31
tests/test_custodian_bundle.py Normal file
View file

@ -0,0 +1,31 @@
import importlib.util
import shutil
from pathlib import Path
import pytest
ROOT = Path(__file__).resolve().parents[1]
spec = importlib.util.spec_from_file_location("bundle_verifier", ROOT / "scripts/verify_custodian_bundle.py")
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)
def test_reviewed_bundle_bytes():
result = module.verify(ROOT / "k8s/custodian-release/commands", "60d893af1bf77f457504b64ff1c9ffb5c6ae6579")
assert result["verified_files"] == 4
def test_tampered_installed_file_refused(tmp_path):
shutil.copytree(ROOT / "k8s/custodian-release/commands", tmp_path / "bundle")
(tmp_path / "bundle/scripts/security_flow_daily.py").write_text("changed")
with pytest.raises(ValueError, match="hash mismatch"):
module.verify(tmp_path / "bundle")
def test_installed_symlink_refused(tmp_path):
shutil.copytree(ROOT / "k8s/custodian-release/commands", tmp_path / "bundle")
path = tmp_path / "bundle/scripts/security_flow_daily.py"
path.unlink()
path.symlink_to(ROOT / "k8s/custodian-release/commands/scripts/security_flow_daily.py")
with pytest.raises(ValueError, match="regular installed"):
module.verify(tmp_path / "bundle")