48 lines
1.8 KiB
Python
48 lines
1.8 KiB
Python
import shutil
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
SCRIPT = ROOT / "infrastructure/images/security-bases/ingestion-clamd/verify-pcre2.sh"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("inventory", "accepted"),
|
|
[
|
|
("P:unrelated\nV:1.0\n\nP:pcre2\nV:10.49-r0\nT:normal description\n", True),
|
|
("P:pcre2\nV:10.48-r0\n", False),
|
|
("P:pcre2\n", False),
|
|
("P:pcre2\nV:10.49-r0\nV:10.49-r0\n", False),
|
|
("P:pcre2\nV:10.49-r0\n\nP:pcre2\nV:10.49-r0\n", False),
|
|
("P:pcre2\nP:pcre2\nV:10.49-r0\n", False),
|
|
("P:unrelated\nV:10.49-r0\n", False),
|
|
("P:pcre2\nV:private-secret-never-echo\n", False),
|
|
(
|
|
"pcre2-10.49-r0 description:\nPerl-compatible regular expressions library\n"
|
|
"pcre2-10.49-r0 webpage:\nhttps://www.pcre.org/\n"
|
|
"pcre2-10.49-r0 installed size:\n1234 B\n",
|
|
False,
|
|
),
|
|
],
|
|
)
|
|
def test_actual_inventory_query_rejects_ambiguous_or_verbose_apk_output(
|
|
inventory: str, accepted: bool
|
|
) -> None:
|
|
source = SCRIPT.read_text()
|
|
assert "apk info" not in source
|
|
query = source.split("awk -v RS='' '", 1)[1].split("\n' /lib/apk/db/installed", 1)[0]
|
|
binary = shutil.which("awk")
|
|
fallback = Path("C:/Program Files/Git/usr/bin/awk.exe")
|
|
if binary is None and fallback.is_file():
|
|
binary = str(fallback)
|
|
if binary is None:
|
|
pytest.skip("real awk query runs in required native Linux CI")
|
|
result = subprocess.run( # noqa: S603 - exact trusted installed-inventory query
|
|
[binary, "-v", "RS=", query], input=inventory, text=True, capture_output=True, timeout=10
|
|
)
|
|
assert (result.returncode == 0) is accepted
|
|
assert result.stdout == ("10.49-r0\n" if accepted else "")
|
|
assert "private-secret" not in result.stdout + result.stderr
|