61 lines
3.1 KiB
Python
61 lines
3.1 KiB
Python
import hashlib
|
|
import json
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
from scripts import build_mcp_hub_release_images as producer
|
|
from scripts import prepare_release_security_bases as preparation
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def test_preparation_recipe_parents_do_not_follow_the_new_production_pins() -> None:
|
|
receipt = json.loads((ROOT / "evidence/WP-400/SECURITY_BASE_PUBLICATION.json").read_text())
|
|
for row in receipt["preparedImages"]:
|
|
parent = preparation.PARENT_IMAGES[row["service"]]
|
|
assert parent == row["parentRef"]
|
|
assert parent != producer.EXTERNAL_IMAGES[row["service"]][0]
|
|
recipe = (
|
|
ROOT / "infrastructure/images/security-bases" / row["service"] / "Dockerfile"
|
|
).read_text()
|
|
assert f"\nFROM {parent}\n" in "\n" + recipe
|
|
|
|
|
|
def test_phase_b_pins_are_the_exact_runtime_verified_publication() -> None:
|
|
receipt = json.loads((ROOT / "evidence/WP-400/SECURITY_BASE_PUBLICATION.json").read_text())
|
|
assert receipt["schema"] == "itworx.security-base-preparation/v1"
|
|
assert receipt["revision"] == "3237e4d8aec312d63d13b4e80664422a7520b5f9"
|
|
assert receipt["runId"] == 23280 and receipt["runAttempt"] == 1
|
|
assert receipt["candidateEmitted"] is False and receipt["reportCount"] == 5
|
|
services = yaml.safe_load((ROOT / "infrastructure/compose/docker-compose.yml").read_text())[
|
|
"services"
|
|
]
|
|
rows = receipt["preparedImages"]
|
|
assert {row["service"] for row in rows} == {"postgres", "ingestion-clamd"}
|
|
for row in rows:
|
|
assert row["runtimeVerified"] is True and row["vulnerabilityAndSecretVerified"] is True
|
|
assert producer.EXTERNAL_IMAGES[row["service"]] == (row["imageRef"], row["archiveRef"])
|
|
assert services[row["service"]]["image"] == row["imageRef"]
|
|
assert row["archiveRef"] == row["imageRef"].split("@", 1)[0]
|
|
assert row["archiveRef"] not in {"postgres:18.6", "clamav/clamav:1.4.6"}
|
|
for path, identities in row["sourceInputs"].items():
|
|
assert path in {
|
|
"infrastructure/images/security-bases/postgres/Dockerfile",
|
|
"evidence/WP-400/database-image-candidate-20261003/recipes/postgres/verify-gosu-metadata.sh",
|
|
"infrastructure/images/security-bases/ingestion-clamd/Dockerfile",
|
|
"infrastructure/images/security-bases/ingestion-clamd/verify-pcre2.sh",
|
|
}
|
|
# The recipes remain byte-identical; HEAD also works in depth-one native checkouts.
|
|
blob = subprocess.check_output(["git", "show", "HEAD:" + path], cwd=ROOT) # noqa: S603,S607 - fixed reviewed recipe blob paths
|
|
assert hashlib.sha256(blob).hexdigest() == identities["sourceSha256"]
|
|
assert (
|
|
hashlib.sha256(blob.replace(b"\r\n", b"\n")).hexdigest()
|
|
== identities["materializedSha256"]
|
|
)
|
|
integration = yaml.safe_load(
|
|
(ROOT / "infrastructure/compose/docker-compose.wp050-integration.yml").read_text()
|
|
)
|
|
assert integration["services"]["postgres"]["image"] == producer.EXTERNAL_IMAGES["postgres"][0]
|