__init__

2026-09-04 20:56:18 +00:00
commit 1022f24c34
43 changed files with 6160 additions and 0 deletions
@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+import hashlib
+import tempfile
+import unittest
+from pathlib import Path
+
+from uvm.errors import UvmError
+from uvm.integrity import load_manifest, verify_file, write_manifest
+
+
+class IntegrityTests(unittest.TestCase):
+    def test_verifies_a_matching_sha256(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary_directory:
+            artifact = Path(temporary_directory) / "artifact"
+            artifact.write_bytes(b"trusted artifact")
+            digest = hashlib.sha256(b"trusted artifact").hexdigest()
+
+            verify_file(
+                artifact,
+                digest,
+                "artifact",
+                "UVM_ARTIFACT_SHA256",
+                allow_unverified=False,
+            )
+
+    def test_rejects_missing_or_mismatched_checksums_by_default(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary_directory:
+            artifact = Path(temporary_directory) / "artifact"
+            artifact.write_bytes(b"artifact")
+
+            with self.assertRaises(UvmError):
+                verify_file(
+                    artifact,
+                    None,
+                    "artifact",
+                    "UVM_ARTIFACT_SHA256",
+                    allow_unverified=False,
+                )
+            with self.assertRaises(UvmError):
+                verify_file(
+                    artifact,
+                    "0" * 64,
+                    "artifact",
+                    "UVM_ARTIFACT_SHA256",
+                    allow_unverified=False,
+                )
+
+    def test_allows_an_explicit_local_development_opt_out(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary_directory:
+            artifact = Path(temporary_directory) / "artifact"
+            artifact.write_bytes(b"artifact")
+
+            verify_file(
+                artifact,
+                None,
+                "artifact",
+                "UVM_ARTIFACT_SHA256",
+                allow_unverified=True,
+            )
+
+    def test_unverified_manifest_is_not_promoted_to_a_verified_install(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary_directory:
+            manifest_path = Path(temporary_directory) / "integrity.json"
+            write_manifest(manifest_path, {"kernel": "0" * 64}, verified=False)
+
+            manifest = load_manifest(manifest_path)
+
+        self.assertFalse(manifest.verified)
+        self.assertEqual(manifest.checksums["kernel"], "0" * 64)