141 lines
5.3 KiB
Python
141 lines
5.3 KiB
Python
"""WP-310 base-image remediation and live-tool contract regression tests."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
from pathlib import Path
|
|
from uuid import UUID
|
|
|
|
from jsonschema import Draft202012Validator
|
|
|
|
from connectors.gitea import GiteaConnector
|
|
from connectors.unraid import FakeBrokerClient, RegisteredContainer, UnraidConnector
|
|
from packages.connector_kit import ConnectorContext, GiteaRepositoryRegistry, RegisteredRepository
|
|
from services.runtime.control_api import _project_connector_output
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
PROJECT_ID = UUID("11111111-1111-1111-1111-111111111111")
|
|
|
|
|
|
class _RepositoryMetadataClient:
|
|
@staticmethod
|
|
def repository(repository: RegisteredRepository) -> dict[str, object]:
|
|
return {
|
|
"name": repository.name,
|
|
"owner": {"login": repository.owner},
|
|
"private": repository.private,
|
|
"default_branch": "main",
|
|
"empty": False,
|
|
}
|
|
|
|
|
|
def _context() -> ConnectorContext:
|
|
return ConnectorContext(
|
|
workspace_id=UUID("22222222-2222-2222-2222-222222222222"),
|
|
project_id=PROJECT_ID,
|
|
project_slug="ludarium",
|
|
environment="prod",
|
|
)
|
|
|
|
|
|
def _output_schema(name: str) -> dict:
|
|
document = json.loads((ROOT / "catalog" / "tools" / name).read_text(encoding="utf-8"))
|
|
return document["spec"]["outputSchema"]
|
|
|
|
|
|
def test_all_python_runtime_images_apply_the_exact_security_layer() -> None:
|
|
installer = (ROOT / "infrastructure" / "images" / "install-base-security-updates.sh").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
assert "2.41.5-0+deb13u1" in installer
|
|
assert "1:4.16.0-2+really2.41.5-0+deb13u1" in installer
|
|
assert "apt-get upgrade" not in installer
|
|
assert "apt-get dist-upgrade" not in installer
|
|
for dockerfile in (
|
|
ROOT / "infrastructure" / "images" / "python-service" / "Dockerfile",
|
|
ROOT / "infrastructure" / "images" / "docker-read-broker" / "Dockerfile",
|
|
ROOT / "infrastructure" / "images" / "observability" / "Dockerfile",
|
|
):
|
|
content = dockerfile.read_text(encoding="utf-8")
|
|
assert "COPY infrastructure/images/install-base-security-updates.sh" in content
|
|
assert "RUN sh /tmp/install-base-security-updates.sh" in content
|
|
|
|
|
|
def test_base_security_layer_pins_and_verifies_staging_fixed_versions() -> None:
|
|
installer = (ROOT / "infrastructure" / "images" / "install-base-security-updates.sh").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
fixed_packages = {
|
|
"gzip": ("gzip", "1.13-1+deb13u1"),
|
|
"libpcre2-8-0": ("pcre2", "10.46-1~deb13u3"),
|
|
"libsqlite3-0": ("sqlite3", "3.46.1-7+deb13u2"),
|
|
"libssl3t64": ("openssl", "3.5.7-1~deb13u3"),
|
|
"openssl": ("openssl", "3.5.7-1~deb13u3"),
|
|
"openssl-provider-legacy": ("openssl", "3.5.7-1~deb13u3"),
|
|
"perl-base": ("perl_base", "5.40.1-6+deb13u1"),
|
|
}
|
|
for package, (variable, version) in fixed_packages.items():
|
|
assert f"{variable}_version='{version}'" in installer
|
|
assert f'"{package}=${{{variable}_version}}"' in installer
|
|
assert f'assert_package_version "{package}" "${{{variable}_version}}"' in installer
|
|
|
|
|
|
def test_gitea_list_envelope_projects_to_the_registered_contract() -> None:
|
|
registry = GiteaRepositoryRegistry(
|
|
(
|
|
RegisteredRepository(
|
|
repository_ref="ludarium",
|
|
project_id=PROJECT_ID,
|
|
owner="jens",
|
|
name="Ludarium",
|
|
source_uri="itworx-git://ludarium/ludarium",
|
|
private=True,
|
|
),
|
|
)
|
|
)
|
|
connector = GiteaConnector(_RepositoryMetadataClient(), registry) # type: ignore[arg-type]
|
|
schema = _output_schema("gitea-repository-list.yaml")
|
|
|
|
projected, warnings = _project_connector_output(connector.repository_list(_context()), schema)
|
|
|
|
assert list(Draft202012Validator(schema).iter_errors(projected)) == []
|
|
assert projected["items"][0]["defaultBranch"] == "main"
|
|
assert "sourceUri" not in projected["items"][0]
|
|
assert projected["generatedAt"]
|
|
assert warnings == []
|
|
|
|
|
|
def test_unraid_host_envelope_projects_to_the_registered_contract() -> None:
|
|
connector = UnraidConnector(
|
|
FakeBrokerClient(), (RegisteredContainer("ludarium-web", PROJECT_ID, "prod"),)
|
|
)
|
|
schema = _output_schema("unraid-host-status.yaml")
|
|
|
|
projected, warnings = _project_connector_output(connector.host_status(_context()), schema)
|
|
|
|
assert list(Draft202012Validator(schema).iter_errors(projected)) == []
|
|
assert projected["hostRef"] == "unraid"
|
|
assert projected["generatedAt"]
|
|
assert warnings == []
|
|
|
|
|
|
def test_catalog_marks_only_live_registered_connector_bindings_verified() -> None:
|
|
expected = {
|
|
"devrunbook": set(),
|
|
"forgeflow": set(),
|
|
"geointel": set(),
|
|
"ludarium": {"knowledge-default", "gitea-default", "unraid-default"},
|
|
"vacatureradar": {"knowledge-default", "gitea-default", "unraid-default"},
|
|
"mobilityops": {"mobilityops-default"},
|
|
}
|
|
for slug, verified in expected.items():
|
|
document = json.loads(
|
|
(ROOT / "catalog" / "projects" / f"{slug}.yaml").read_text(encoding="utf-8")
|
|
)
|
|
actual = {
|
|
binding["ref"]
|
|
for binding in document["spec"]["connectorBindings"]
|
|
if binding.get("verification") == "verified"
|
|
}
|
|
assert actual == verified
|