Build immutable policy publication artifact

2026-08-18 12:16:04 +02:00 · 2026-08-18 12:16:04 +02:00 · e8035f3887
commit e8035f3887
parent cac0301866
22 changed files with 2375 additions and 452 deletions
--- a/tests/test_release.py
+++ b/tests/test_release.py
@ -0,0 +1,106 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+
+ROOT = Path(__file__).parents[1]
+sys.path.insert(0, str(ROOT / "tools"))
+from verify_release import verify
+
+
+COMMIT = "1" * 40
+SOURCE_DIGEST = "2" * 64
+
+
+def _page(revision: str = COMMIT, digest: str = SOURCE_DIGEST) -> str:
+    return (
+        '<!doctype html><meta name="policy-source-revision" '
+        f'content="{revision}"><meta name="policy-source-digest" content="{digest}">'
+    )
+
+
+def _release(root: Path) -> Path:
+    build = root / "build"
+    canonical = build / "standards/example/v1/index.html"
+    revision = build / "standards/example/v1/revisions/draft-1/index.html"
+    canonical.parent.mkdir(parents=True)
+    revision.parent.mkdir(parents=True)
+    canonical.write_text(_page(), encoding="utf-8")
+    revision.write_text(_page(), encoding="utf-8")
+    (build / "index.html").write_text("<!doctype html>", encoding="utf-8")
+    manifest = {
+        "schema_version": 1,
+        "generated_as_of": "2026-08-18",
+        "documents": [
+            {
+                "id": "example",
+                "title": "Example Standard",
+                "status": "proposed",
+                "revision": "draft-1",
+                "owner": "example-owner",
+                "last_reviewed": "2026-08-18",
+                "review_due": "2027-02-18",
+                "canonical_path": "standards/example/v1/index.html",
+                "revision_path": "standards/example/v1/revisions/draft-1/index.html",
+                "source_revision": COMMIT,
+                "source_digest": SOURCE_DIGEST,
+            }
+        ],
+    }
+    (build / "publication-manifest.json").write_text(
+        json.dumps(manifest, sort_keys=True) + "\n", encoding="utf-8"
+    )
+    return build
+
+
+class ReleaseVerificationTest(unittest.TestCase):
+    def test_accepts_clean_provenance_and_returns_manifest_digest(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            build = _release(Path(directory))
+            evidence = verify(build)
+            expected = hashlib.sha256(
+                (build / "publication-manifest.json").read_bytes()
+            ).hexdigest()
+            self.assertEqual(expected, evidence["publication_manifest_digest"])
+            self.assertEqual(["example"], evidence["documents"])
+
+    def test_rejects_working_tree_source_revision(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            build = _release(Path(directory))
+            manifest_path = build / "publication-manifest.json"
+            manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+            dirty = COMMIT + "+working-tree." + SOURCE_DIGEST[:12]
+            manifest["documents"][0]["source_revision"] = dirty
+            manifest_path.write_text(json.dumps(manifest), encoding="utf-8")
+            canonical = build / manifest["documents"][0]["canonical_path"]
+            canonical.write_text(_page(revision=dirty), encoding="utf-8")
+
+            with self.assertRaisesRegex(ValueError, "clean 40-hex Git commit"):
+                verify(build)
+
+    def test_rejects_immutable_revision_built_from_dirty_source(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            build = _release(Path(directory))
+            revision = build / "standards/example/v1/revisions/draft-1/index.html"
+            revision.write_text(
+                _page(revision=COMMIT + "+working-tree." + SOURCE_DIGEST[:12]),
+                encoding="utf-8",
+            )
+            with self.assertRaisesRegex(ValueError, "immutable revision page"):
+                verify(build)
+
+    def test_rejects_page_digest_mismatch(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            build = _release(Path(directory))
+            canonical = build / "standards/example/v1/index.html"
+            canonical.write_text(_page(digest="3" * 64), encoding="utf-8")
+            with self.assertRaisesRegex(ValueError, "provenance differs"):
+                verify(build)
+
+
+if __name__ == "__main__":
+    unittest.main()