tegwick
9b4bb25d32
All checks were successful
Publish exact zlib-only remediation candidate / publish-candidate (push) Successful in 13s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
32 lines
2.4 KiB
Python
32 lines
2.4 KiB
Python
import copy,importlib.util,json,tempfile,unittest,shutil
|
|
from pathlib import Path
|
|
ROOT=Path(__file__).parent
|
|
spec=importlib.util.spec_from_file_location('compare',ROOT/'compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp)
|
|
spec=importlib.util.spec_from_file_location('inputs',ROOT/'check_build_inputs.py');inputs=importlib.util.module_from_spec(spec);spec.loader.exec_module(inputs)
|
|
CASE=ROOT.parents[1]/'docs/evidence/2026-10-11-zlib-remediation-candidate'
|
|
class NarrowCandidate(unittest.TestCase):
|
|
def test_actual_single_package_delta(self):
|
|
a=json.loads((CASE/'base-runtime.json').read_text());b=json.loads((CASE/'candidate-runtime.json').read_text());self.assertTrue(cmp.compare(a,b)['zlib_only_delta'])
|
|
def test_unrelated_package_policy_identity_backend_database_python_refuse(self):
|
|
a=json.loads((CASE/'base-runtime.json').read_text());original=json.loads((CASE/'candidate-runtime.json').read_text())
|
|
for field in ('package','policy','uid','backend','database','python'):
|
|
b=copy.deepcopy(original)
|
|
if field=='package':b['apk_packages']['musl']='different'
|
|
elif field=='policy':b['policy_sha256']='0'*64
|
|
elif field=='uid':b['uid']=0
|
|
elif field=='backend':b['malformed_zlib_refusals']=0
|
|
elif field=='database':b['database_opened']=True
|
|
else:b['python_dependencies']['PyJWT']='different'
|
|
with self.subTest(field=field),self.assertRaises(ValueError):cmp.compare(a,b)
|
|
def test_mutated_package_or_index_refuse(self):
|
|
source=ROOT.parents[1]/'deploy/zlib-overlay'
|
|
for name in ('zlib-1.3.2-r1.apk','APKINDEX.tar.gz'):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
root=Path(directory)/'context';shutil.copytree(source,root);p=root/name;p.write_bytes(p.read_bytes()+b'changed')
|
|
with self.assertRaises(ValueError):inputs.verify(root)
|
|
def test_closed_recipe(self):
|
|
source=ROOT.parents[1]/'deploy/zlib-overlay';self.assertEqual(inputs.verify(source)['input_files'],4)
|
|
text=(source/'Containerfile').read_text()
|
|
for fragment in ('--no-preupgrade','--no-logfile','--no-network','--repositories-file /dev/null','--repository /tmp/infd-zlib zlib'):self.assertIn(fragment,text)
|
|
self.assertNotIn('--allow-untrusted',text)
|
|
if __name__=='__main__':unittest.main()
|