c562d7134c
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
34 lines
1.9 KiB
Python
34 lines
1.9 KiB
Python
import importlib.util
|
|
from pathlib import Path
|
|
from datetime import datetime,timedelta,timezone
|
|
from unittest.mock import patch
|
|
import pytest
|
|
from cryptography import x509
|
|
from cryptography.hazmat.primitives import hashes,serialization
|
|
from cryptography.hazmat.primitives.asymmetric import rsa
|
|
from cryptography.x509.oid import NameOID
|
|
|
|
spec=importlib.util.spec_from_file_location('metadata',Path(__file__).parents[1]/'tools/public-tls-metadata.py');m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
|
|
@pytest.fixture
|
|
def cert(tmp_path):
|
|
key=rsa.generate_private_key(public_exponent=65537,key_size=2048);name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'synthetic.invalid')]);now=datetime.now(timezone.utc)
|
|
cert=(x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(1).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(hours=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName('synthetic.invalid')]),critical=False).sign(key,hashes.SHA256()))
|
|
p=tmp_path/'public.pem';p.write_bytes(cert.public_bytes(serialization.Encoding.PEM));return p
|
|
|
|
def test_public_only_metadata_and_hashes(cert):
|
|
result=m.describe(cert,cert)
|
|
assert result['leaf_dns_sans']==['synthetic.invalid'];assert result['network_contacted'] is False
|
|
assert '-----BEGIN' not in str(result)
|
|
|
|
def test_mixed_or_private_pem_is_refused(cert):
|
|
cert.write_bytes(cert.read_bytes()+b'\n-----BEGIN PRIVATE KEY-----\nsynthetic\n-----END PRIVATE KEY-----')
|
|
with pytest.raises(ValueError):m.public_bundle(cert)
|
|
|
|
def test_oversize_is_refused_before_read(cert):
|
|
with patch.object(m,'LIMIT',1),patch.object(m.os,'open') as opened:
|
|
with pytest.raises(ValueError):m.public_bundle(cert)
|
|
opened.assert_not_called()
|
|
|
|
def test_symlink_refused(cert):
|
|
link=cert.with_name('link.pem');link.symlink_to(cert)
|
|
with pytest.raises(ValueError):m.public_bundle(link)
|