55 lines
2.2 KiB
Python
55 lines
2.2 KiB
Python
import json
|
|
from pathlib import Path
|
|
import shutil
|
|
import subprocess
|
|
import tempfile
|
|
import unittest
|
|
import verify_closure
|
|
|
|
SOURCE=Path(__file__).parent
|
|
|
|
|
|
class VerificationTests(unittest.TestCase):
|
|
def fixture(self, p):
|
|
for d in ['lists','archives']:shutil.copytree(SOURCE/d,p/d)
|
|
shutil.copy2(SOURCE/'package-pins.json',p/'package-pins.json')
|
|
shutil.copy2(SOURCE/'rootfs-dpkg-status',p/'rootfs-dpkg-status')
|
|
(p/'rootfs.wsl').symlink_to(SOURCE/'rootfs.wsl')
|
|
|
|
def test_tampered_deb_rejected(self):
|
|
with tempfile.TemporaryDirectory(prefix='cust73-negative-') as d:
|
|
p=Path(d);self.fixture(p)
|
|
deb=next((p/'archives').glob('*.deb'))
|
|
with deb.open('ab') as f:f.write(b'tamper')
|
|
old=verify_closure.BASE;verify_closure.BASE=p
|
|
try:
|
|
with self.assertRaisesRegex(ValueError,'untrusted package'):verify_closure.verify()
|
|
finally:verify_closure.BASE=old
|
|
|
|
def test_incomplete_closure_rejected(self):
|
|
with tempfile.TemporaryDirectory(prefix='cust73-negative-') as d:
|
|
p=Path(d);self.fixture(p)
|
|
pins=json.loads((p/'package-pins.json').read_text())
|
|
(p/'package-pins.json').write_text(json.dumps(pins[:-1]))
|
|
old=verify_closure.BASE;verify_closure.BASE=p
|
|
try:
|
|
with self.assertRaisesRegex(ValueError,'closure differs'):verify_closure.verify()
|
|
finally:verify_closure.BASE=old
|
|
|
|
def test_tampered_index_rejected(self):
|
|
with tempfile.TemporaryDirectory(prefix='cust73-negative-') as d:
|
|
p=Path(d);self.fixture(p)
|
|
index=next((p/'lists').glob('*_Packages'))
|
|
with index.open('ab') as f:f.write(b'tamper')
|
|
old=verify_closure.BASE;verify_closure.BASE=p
|
|
try:
|
|
with self.assertRaisesRegex(ValueError,'index hash mismatch'):verify_closure.verify()
|
|
finally:verify_closure.BASE=old
|
|
|
|
def test_installer_refuses_and_has_valid_syntax(self):
|
|
subprocess.run(['bash','-n',str(SOURCE/'install-disabled.sh')],check=True)
|
|
r=subprocess.run(['bash',str(SOURCE/'install-disabled.sh')],capture_output=True)
|
|
self.assertEqual(r.returncode,78)
|
|
|
|
|
|
if __name__=='__main__':unittest.main()
|