b93af8cc78
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
79 lines
3.1 KiB
Python
79 lines
3.1 KiB
Python
from __future__ import annotations
|
|
|
|
import copy
|
|
import json
|
|
import sys
|
|
import unittest
|
|
import uuid
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0, str(ROOT / "scripts"))
|
|
|
|
from check_secret_paths import is_encrypted_content, is_protected_path # noqa: E402
|
|
from s1_receipt import ReceiptError, load_receipt, validate_receipt # noqa: E402
|
|
from sops_rotation import rotation_plan # noqa: E402
|
|
|
|
|
|
class SecretAndReceiptContractTests(unittest.TestCase):
|
|
def test_inventory_secret_paths_are_protected(self) -> None:
|
|
self.assertTrue(is_protected_path("secrets/provider.yaml"))
|
|
self.assertTrue(is_protected_path("inventory/group_vars/secrets.sops.yaml"))
|
|
self.assertFalse(is_protected_path("inventory/group_vars/all.yaml"))
|
|
|
|
def test_plaintext_and_empty_files_fail(self) -> None:
|
|
self.assertFalse(is_encrypted_content("secrets/example.yaml", "value: clear"))
|
|
self.assertFalse(is_encrypted_content("secrets/example.age", ""))
|
|
self.assertTrue(is_encrypted_content("secrets/example.yaml", "sops:\n age: []\n"))
|
|
|
|
def test_synthetic_chain_validates(self) -> None:
|
|
load_receipt(ROOT / "docs" / "evidence" / "s1-receipts" / "synthetic-provisioning-chain.json")
|
|
|
|
def test_incomplete_passing_chain_fails(self) -> None:
|
|
payload = json.loads(
|
|
(ROOT / "docs" / "evidence" / "s1-receipts" / "synthetic-provisioning-chain.json").read_text()
|
|
)
|
|
payload["phases"][2]["status"] = "not-run"
|
|
with self.assertRaisesRegex(ReceiptError, "every phase"):
|
|
validate_receipt(payload)
|
|
|
|
def test_secret_shaped_receipt_content_fails(self) -> None:
|
|
payload = json.loads(
|
|
(ROOT / "docs" / "evidence" / "s1-receipts" / "synthetic-provisioning-chain.json").read_text()
|
|
)
|
|
payload["token"] = "not-even-a-real-value"
|
|
with self.assertRaisesRegex(ReceiptError, "secret-shaped key"):
|
|
validate_receipt(payload)
|
|
|
|
payload.pop("token")
|
|
payload["provider_access_token"] = "redacted-is-still-not-allowed"
|
|
with self.assertRaisesRegex(ReceiptError, "secret-shaped key"):
|
|
validate_receipt(payload)
|
|
|
|
def test_passing_verification_without_evidence_fails(self) -> None:
|
|
payload = {
|
|
"schema_version": "1.0",
|
|
"receipt_id": str(uuid.uuid4()),
|
|
"event_type": "verification",
|
|
"synthetic": False,
|
|
"created_at": "2026-08-23T09:30:00Z",
|
|
"source_revision": "3734a1c",
|
|
"inventory_sha256": "a" * 64,
|
|
"status": "pass",
|
|
"hosts": ["Railiance01"],
|
|
"profiles": {"Railiance01": "ufw-managed"},
|
|
"observed_at": "2026-08-23T09:30:00Z",
|
|
"fresh_until": "2026-08-24T09:30:00Z",
|
|
"evidence": [],
|
|
}
|
|
with self.assertRaisesRegex(ReceiptError, "host evidence"):
|
|
validate_receipt(payload)
|
|
|
|
def test_current_sops_recipient_metadata_matches_policy(self) -> None:
|
|
plan = rotation_plan(ROOT)
|
|
self.assertTrue(plan)
|
|
self.assertFalse(any(item["changed"] for item in plan))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|