build: package CLI with pinned producer verifier

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

tests/test_release_bundle.py

@@ -0,0 +1,137 @@
+"""Actual offline installation proof; only supplied locked public dependency wheel.
+
+Set SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL to a local PyYAML wheel from uv.lock.
+No production install, trust admission, backend or credential is used.
+"""
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+
+import pytest
+
+from tests.test_decision_signature import FIXTURE, PUBLIC
+from tests.test_decision_transport import server
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def run(command, **kwargs):
+    return subprocess.run(command, text=True, capture_output=True, timeout=120, **kwargs)
+
+
+@pytest.fixture(scope='module')
+def bundles(tmp_path_factory):
+    dependency=os.environ.get('SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL')
+    if not dependency:
+        pytest.skip('provide the locked public PyYAML wheel for actual bundle build/install tests')
+    directory=tmp_path_factory.mktemp('cli-bundles')
+    result=[]
+    for name in ['one','two']:
+        bundle=directory/name
+        built=run([sys.executable,str(ROOT/'scripts/build_release_bundle.py'),'--output',str(bundle),
+                   '--dependency-wheel',dependency])
+        assert built.returncode==0,built.stderr
+        result.append(bundle)
+    return result
+
+
+def manifest_hash(bundle):
+    return hashlib.sha256((bundle/'manifest.json').read_bytes()).hexdigest()
+
+
+def install(bundle,prefix):
+    return run([sys.executable,str(bundle/'install.py'),'--bundle',str(bundle),'--prefix',str(prefix),
+                '--manifest-sha256',manifest_hash(bundle)])
+
+
+@pytest.fixture
+def installed(bundles,tmp_path):
+    prefix=tmp_path/'installed'
+    result=install(bundles[0],prefix)
+    assert result.returncode==0,result.stderr
+    return prefix
+
+
+def test_two_builds_match_and_contain_no_signer(bundles):
+    one,two=bundles
+    names={str(path.relative_to(one)) for path in one.rglob('*') if path.is_file()}
+    assert names=={str(path.relative_to(two)) for path in two.rglob('*') if path.is_file()}
+    for name in names:
+        assert (one/name).read_bytes()==(two/name).read_bytes(),name
+    assert not any('signer' in name or 'testsupport' in name for name in names)
+    assert (one/'bin/secrets-engine-pdp-verify').is_file()
+    assert len(list((one/'wheels').glob('secrets_engine-*.whl')))==1
+
+
+def test_clean_install_uses_installed_wheel_and_signed_boundary(installed,tmp_path):
+    env={**os.environ,'SECRETS_ENGINE_PDP_VERIFIER':'/must-not-use-ambient-override'}
+    help_result=run([str(installed/'bin/secrets-engine'),'--help'],env=env,cwd='/tmp')
+    assert help_result.returncode==0,help_result.stderr
+    envelope=json.loads(FIXTURE.read_bytes())
+    trust={name:envelope['provenance'][name] for name in ('evaluator','mode','policy_package','policy_version','policy_package_digest')}
+    trust.update(schema='secrets-engine.pdp-trust.v1',keys={'testdata-ed25519':PUBLIC})
+    trust_file=tmp_path/'synthetic-trust.json';trust_file.write_text(json.dumps(trust))
+    token=tmp_path/'synthetic.token';token.write_text('synthetic-pdp-credential');token.chmod(0o600)
+    script='''import pathlib,sys
+import secrets_engine.decision_check as installed
+from secrets_engine.errors import DecisionError
+assert str(pathlib.Path(installed.__file__).resolve()).startswith(sys.argv[1]+'/venv/')
+try:
+ result=installed.check_decision(base_url=sys.argv[2],token_file=pathlib.Path(sys.argv[3]),request={},trust_file=pathlib.Path(sys.argv[4]),verifier=pathlib.Path(sys.argv[1]+'/libexec/secrets-engine-pdp-verify'))
+except DecisionError:
+ if sys.argv[5]=='refuse':sys.exit(0)
+ raise
+assert sys.argv[5]=='accept' and result['effect']=='allow'
+'''
+    clean_env={key:value for key,value in os.environ.items() if key not in ('PYTHONPATH','PYTHONHOME')}
+    for body,expect in [(FIXTURE.read_bytes(),'accept'),(b'{"effect":"allow"}','refuse')]:
+        with server(body=body) as (origin,seen):
+            result=run([str(installed/'venv/bin/python'),'-c',script,str(installed),origin,str(token),str(trust_file),expect],env=clean_env,cwd='/tmp')
+            assert result.returncode==0,result.stderr
+            assert seen==[True]
+
+
+@pytest.mark.parametrize('change',['missing','tampered'])
+def test_installed_cli_refuses_missing_or_tampered_helper(installed,change):
+    helper=installed/'libexec/secrets-engine-pdp-verify'
+    if change=='missing':helper.rename(helper.with_suffix('.held'))
+    else:helper.write_bytes(helper.read_bytes()+b'tampered')
+    result=run([str(installed/'bin/secrets-engine'),'--help'],cwd='/tmp')
+    assert result.returncode==1
+    assert 'verifier missing or changed' in result.stderr
+    assert not result.stdout
+
+
+def test_installer_refuses_changed_artifact_and_existing_prefix(bundles,tmp_path):
+    altered=tmp_path/'altered';shutil.copytree(bundles[0],altered)
+    helper=altered/'bin/secrets-engine-pdp-verify';helper.write_bytes(helper.read_bytes()+b'tampered')
+    prefix=tmp_path/'must-not-create'
+    result=install(altered,prefix)
+    assert result.returncode==1 and not prefix.exists()
+    existing=tmp_path/'existing';existing.mkdir();marker=existing/'keep';marker.write_text('unchanged')
+    result=install(bundles[0],existing)
+    assert result.returncode==1 and marker.read_text()=='unchanged'
+    assert sorted(path.name for path in existing.iterdir())==['keep']
+
+
+def test_installer_requires_exact_reviewed_manifest(bundles,tmp_path):
+    prefix=tmp_path/'must-not-create'
+    result=run([sys.executable,str(bundles[0]/'install.py'),'--prefix',str(prefix),'--manifest-sha256','0'*64])
+    assert result.returncode==1 and not prefix.exists()
+
+
+def test_changed_producer_source_stops_before_build(tmp_path):
+    root=tmp_path/'source';(root/'scripts').mkdir(parents=True)
+    for name in ['build_release_bundle.py','check_pdp_producer_source.py']:
+        shutil.copyfile(ROOT/'scripts'/name,root/'scripts'/name)
+    shutil.copytree(ROOT/'verifier',root/'verifier')
+    shutil.copytree(ROOT/'tests/fixtures/pdp-signature',root/'tests/fixtures/pdp-signature')
+    source=root/'verifier/internal/sign/sign.go';source.write_bytes(source.read_bytes()+b'// drift\n')
+    output=tmp_path/'must-not-build'
+    result=run([sys.executable,str(root/'scripts/build_release_bundle.py'),'--output',str(output),
+                '--dependency-wheel',str(tmp_path/'not-reached.whl')])
+    assert result.returncode==1 and not output.exists()