secrets-engine/tests/test_release_bundle.py

"""Actual offline installation proof; only supplied locked public dependency wheel.

Set SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL to a local PyYAML wheel from uv.lock.
No production install, trust admission, backend or credential is used.
"""
import hashlib
import json
import os
from pathlib import Path
import shutil
import subprocess
import sys

import pytest

from tests.test_decision_signature import FIXTURE, PUBLIC
from tests.test_decision_transport import server
from tests.signature_support import admit

ROOT = Path(__file__).resolve().parents[1]


def run(command, **kwargs):
    return subprocess.run(command, text=True, capture_output=True, timeout=120, **kwargs)


@pytest.fixture(scope='module')
def bundles(tmp_path_factory):
    dependency=os.environ.get('SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL')
    if not dependency:
        pytest.skip('provide the locked public PyYAML wheel for actual bundle build/install tests')
    directory=tmp_path_factory.mktemp('cli-bundles')
    result=[]
    for name in ['one','two']:
        bundle=directory/name
        built=run([sys.executable,str(ROOT/'scripts/build_release_bundle.py'),'--output',str(bundle),
                   '--dependency-wheel',dependency])
        assert built.returncode==0,built.stderr
        result.append(bundle)
    return result


def manifest_hash(bundle):
    return hashlib.sha256((bundle/'manifest.json').read_bytes()).hexdigest()


def install(bundle,prefix):
    return run([sys.executable,str(bundle/'install.py'),'--bundle',str(bundle),'--prefix',str(prefix),
                '--manifest-sha256',manifest_hash(bundle)])


@pytest.fixture
def installed(bundles,tmp_path):
    prefix=tmp_path/'installed'
    result=install(bundles[0],prefix)
    assert result.returncode==0,result.stderr
    return prefix


def test_two_builds_match_and_contain_no_signer(bundles):
    one,two=bundles
    names={str(path.relative_to(one)) for path in one.rglob('*') if path.is_file()}
    assert names=={str(path.relative_to(two)) for path in two.rglob('*') if path.is_file()}
    for name in names:
        assert (one/name).read_bytes()==(two/name).read_bytes(),name
    assert not any('signer' in name or 'testsupport' in name for name in names)
    assert (one/'bin/secrets-engine-pdp-verify').is_file()
    assert len(list((one/'wheels').glob('secrets_engine-*.whl')))==1


def test_clean_install_uses_installed_wheel_and_signed_boundary(installed,tmp_path):
    env={**os.environ,'SECRETS_ENGINE_PDP_VERIFIER':'/must-not-use-ambient-override'}
    help_result=run([str(installed/'bin/secrets-engine'),'--help'],env=env,cwd='/tmp')
    assert help_result.returncode==0,help_result.stderr
    envelope=json.loads(FIXTURE.read_bytes())
    trust={name:envelope['provenance'][name] for name in ('evaluator','mode','policy_package','policy_version','policy_package_digest')}
    trust.update(schema='secrets-engine.pdp-trust.v1',keys={'testdata-ed25519':PUBLIC})
    trust_file=tmp_path/'synthetic-trust.json';trust_file.write_text(json.dumps(trust));admit(trust_file)
    token=tmp_path/'synthetic.token';token.write_text('synthetic-pdp-credential');token.chmod(0o600)
    script='''import pathlib,sys
import secrets_engine.decision_check as installed
from secrets_engine.errors import DecisionError
import secrets_engine.founder_admission as admission
admission._writable_by_runtime=lambda info: bool(info.st_mode & 0o022)  # test runs as anchor owner
assert str(pathlib.Path(installed.__file__).resolve()).startswith(sys.argv[1]+'/venv/')
try:
 result=installed.check_decision(base_url=sys.argv[2],token_file=pathlib.Path(sys.argv[3]),request={},trust_file=pathlib.Path(sys.argv[4]),verifier=pathlib.Path(sys.argv[1]+'/libexec/secrets-engine-pdp-verify'))
except DecisionError:
 if sys.argv[5]=='refuse':sys.exit(0)
 raise
assert sys.argv[5]=='accept' and result['effect']=='allow'
'''
    clean_env={key:value for key,value in os.environ.items() if key not in ('PYTHONPATH','PYTHONHOME')}
    for body,expect in [(FIXTURE.read_bytes(),'accept'),(b'{"effect":"allow"}','refuse')]:
        with server(body=body) as (origin,seen):
            result=run([str(installed/'venv/bin/python'),'-c',script,str(installed),origin,str(token),str(trust_file),expect],env=clean_env,cwd='/tmp')
            assert result.returncode==0,result.stderr
            assert seen==[True]


@pytest.mark.parametrize('change',['missing','tampered'])
def test_installed_cli_refuses_missing_or_tampered_helper(installed,change):
    helper=installed/'libexec/secrets-engine-pdp-verify'
    if change=='missing':helper.rename(helper.with_suffix('.held'))
    else:helper.write_bytes(helper.read_bytes()+b'tampered')
    result=run([str(installed/'bin/secrets-engine'),'--help'],cwd='/tmp')
    assert result.returncode==1
    assert 'verifier missing or changed' in result.stderr
    assert not result.stdout


def test_installer_refuses_changed_artifact_and_existing_prefix(bundles,tmp_path):
    altered=tmp_path/'altered';shutil.copytree(bundles[0],altered)
    helper=altered/'bin/secrets-engine-pdp-verify';helper.write_bytes(helper.read_bytes()+b'tampered')
    prefix=tmp_path/'must-not-create'
    result=install(altered,prefix)
    assert result.returncode==1 and not prefix.exists()
    existing=tmp_path/'existing';existing.mkdir();marker=existing/'keep';marker.write_text('unchanged')
    result=install(bundles[0],existing)
    assert result.returncode==1 and marker.read_text()=='unchanged'
    assert sorted(path.name for path in existing.iterdir())==['keep']


def test_installer_requires_exact_reviewed_manifest(bundles,tmp_path):
    prefix=tmp_path/'must-not-create'
    result=run([sys.executable,str(bundles[0]/'install.py'),'--prefix',str(prefix),'--manifest-sha256','0'*64])
    assert result.returncode==1 and not prefix.exists()


def test_changed_producer_source_stops_before_build(tmp_path):
    root=tmp_path/'source';(root/'scripts').mkdir(parents=True)
    for name in ['build_release_bundle.py','check_pdp_producer_source.py']:
        shutil.copyfile(ROOT/'scripts'/name,root/'scripts'/name)
    shutil.copytree(ROOT/'verifier',root/'verifier')
    shutil.copytree(ROOT/'tests/fixtures/pdp-signature',root/'tests/fixtures/pdp-signature')
    source=root/'verifier/internal/sign/sign.go';source.write_bytes(source.read_bytes()+b'// drift\n')
    output=tmp_path/'must-not-build'
    result=run([sys.executable,str(root/'scripts/build_release_bundle.py'),'--output',str(output),
                '--dependency-wheel',str(tmp_path/'not-reached.whl')])
    assert result.returncode==1 and not output.exists()