71 lines
2.4 KiB
Python
71 lines
2.4 KiB
Python
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
from uvm.errors import UvmError
|
|
from uvm.integrity import load_manifest, verify_file, write_manifest
|
|
|
|
|
|
class IntegrityTests(unittest.TestCase):
|
|
def test_verifies_a_matching_sha256(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temporary_directory:
|
|
artifact = Path(temporary_directory) / "artifact"
|
|
artifact.write_bytes(b"trusted artifact")
|
|
digest = hashlib.sha256(b"trusted artifact").hexdigest()
|
|
|
|
verify_file(
|
|
artifact,
|
|
digest,
|
|
"artifact",
|
|
"UVM_ARTIFACT_SHA256",
|
|
allow_unverified=False,
|
|
)
|
|
|
|
def test_rejects_missing_or_mismatched_checksums_by_default(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temporary_directory:
|
|
artifact = Path(temporary_directory) / "artifact"
|
|
artifact.write_bytes(b"artifact")
|
|
|
|
with self.assertRaises(UvmError):
|
|
verify_file(
|
|
artifact,
|
|
None,
|
|
"artifact",
|
|
"UVM_ARTIFACT_SHA256",
|
|
allow_unverified=False,
|
|
)
|
|
with self.assertRaises(UvmError):
|
|
verify_file(
|
|
artifact,
|
|
"0" * 64,
|
|
"artifact",
|
|
"UVM_ARTIFACT_SHA256",
|
|
allow_unverified=False,
|
|
)
|
|
|
|
def test_allows_an_explicit_local_development_opt_out(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temporary_directory:
|
|
artifact = Path(temporary_directory) / "artifact"
|
|
artifact.write_bytes(b"artifact")
|
|
|
|
verify_file(
|
|
artifact,
|
|
None,
|
|
"artifact",
|
|
"UVM_ARTIFACT_SHA256",
|
|
allow_unverified=True,
|
|
)
|
|
|
|
def test_unverified_manifest_is_not_promoted_to_a_verified_install(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temporary_directory:
|
|
manifest_path = Path(temporary_directory) / "integrity.json"
|
|
write_manifest(manifest_path, {"kernel": "0" * 64}, verified=False)
|
|
|
|
manifest = load_manifest(manifest_path)
|
|
|
|
self.assertFalse(manifest.verified)
|
|
self.assertEqual(manifest.checksums["kernel"], "0" * 64)
|