tegwick
174dba17b6
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
52 lines
2.2 KiB
Python
52 lines
2.2 KiB
Python
import hashlib
|
|
import importlib.util
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
spec = importlib.util.spec_from_file_location(
|
|
"runtime_builder", Path(__file__).parents[1] / "scripts/build-rein-runtime.py"
|
|
)
|
|
builder = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(builder)
|
|
|
|
|
|
def test_claude_copy_is_pinned_and_excludes_home(tmp_path):
|
|
source = tmp_path / "native"
|
|
source.write_bytes(b"\x7fELFtest artifact, never executed")
|
|
(tmp_path / "credentials.json").write_text("must not enter artifact")
|
|
output = tmp_path / "runtime"
|
|
(output / "bin").mkdir(parents=True)
|
|
digest = hashlib.sha256(source.read_bytes()).hexdigest()
|
|
metadata = builder.install_claude(output, source, digest, "test-version")
|
|
assert metadata["sha256"] == digest
|
|
assert metadata["path"] == "/opt/sandboxer/runtime/bin/claude"
|
|
assert list((output / "bin").iterdir()) == [output / "bin/claude"]
|
|
assert (output / "bin/claude").read_bytes() == source.read_bytes()
|
|
assert (output / "bin/claude").stat().st_mode & 0o777 == 0o755
|
|
assert not (output / "credentials.json").exists()
|
|
with pytest.raises(FileExistsError):
|
|
builder.install_claude(output, source, digest, "test-version")
|
|
|
|
|
|
def test_changed_binary_and_host_wrapper_refuse(tmp_path):
|
|
source = tmp_path / "binary"
|
|
source.write_bytes(b"#!/usr/bin/env node\n")
|
|
output = tmp_path / "runtime"
|
|
(output / "bin").mkdir(parents=True)
|
|
with pytest.raises(ValueError, match="digest mismatch"):
|
|
builder.install_claude(output, source, "0" * 64, "test-version")
|
|
digest = hashlib.sha256(source.read_bytes()).hexdigest()
|
|
with pytest.raises(ValueError, match="native ELF"):
|
|
builder.install_claude(output, source, digest, "test-version")
|
|
link = tmp_path / "link"
|
|
link.symlink_to(source)
|
|
with pytest.raises(ValueError, match="symlink"):
|
|
builder.install_claude(output, link, digest, "test-version")
|
|
assert not (output / "bin/claude").exists()
|
|
|
|
|
|
def test_incomplete_claude_pin_refuses_before_build(tmp_path):
|
|
with pytest.raises(ValueError, match="supplied together"):
|
|
builder.build(tmp_path / "out", tmp_path, tmp_path, claude_binary=tmp_path / "claude")
|
|
assert not (tmp_path / "out").exists()
|