Publish curated ITWorx_MCP_Hub source from 3237e4d8aec312d63d13b4e80664422a7520b5f9

tests/test_security_pcre_inventory.py

@@ -0,0 +1,47 @@
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / "infrastructure/images/security-bases/ingestion-clamd/verify-pcre2.sh"
+
+
+@pytest.mark.parametrize(
+    ("inventory", "accepted"),
+    [
+        ("P:unrelated\nV:1.0\n\nP:pcre2\nV:10.49-r0\nT:normal description\n", True),
+        ("P:pcre2\nV:10.48-r0\n", False),
+        ("P:pcre2\n", False),
+        ("P:pcre2\nV:10.49-r0\nV:10.49-r0\n", False),
+        ("P:pcre2\nV:10.49-r0\n\nP:pcre2\nV:10.49-r0\n", False),
+        ("P:pcre2\nP:pcre2\nV:10.49-r0\n", False),
+        ("P:unrelated\nV:10.49-r0\n", False),
+        ("P:pcre2\nV:private-secret-never-echo\n", False),
+        (
+            "pcre2-10.49-r0 description:\nPerl-compatible regular expressions library\n"
+            "pcre2-10.49-r0 webpage:\nhttps://www.pcre.org/\n"
+            "pcre2-10.49-r0 installed size:\n1234 B\n",
+            False,
+        ),
+    ],
+)
+def test_actual_inventory_query_rejects_ambiguous_or_verbose_apk_output(
+    inventory: str, accepted: bool
+) -> None:
+    source = SCRIPT.read_text()
+    assert "apk info" not in source
+    query = source.split("awk -v RS='' '", 1)[1].split("\n' /lib/apk/db/installed", 1)[0]
+    binary = shutil.which("awk")
+    fallback = Path("C:/Program Files/Git/usr/bin/awk.exe")
+    if binary is None and fallback.is_file():
+        binary = str(fallback)
+    if binary is None:
+        pytest.skip("real awk query runs in required native Linux CI")
+    result = subprocess.run(  # noqa: S603 - exact trusted installed-inventory query
+        [binary, "-v", "RS=", query], input=inventory, text=True, capture_output=True, timeout=10
+    )
+    assert (result.returncode == 0) is accepted
+    assert result.stdout == ("10.49-r0\n" if accepted else "")
+    assert "private-secret" not in result.stdout + result.stderr