Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0
This commit is contained in:
Public Source Publisher committed
1 parent
7082ab955a
commit
848f0d8f8a
434 files changed
+67298
-4315
No files matched your search
@@ -2,12 +2,13 @@
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
import tempfile
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
|
||||
EXPORTER = REPOSITORY_ROOT / "scripts" / "export-public-source.mjs"
|
||||
VALIDATOR = REPOSITORY_ROOT / "scripts" / "validate-public-source.mjs"
|
||||
@@ -28,8 +29,36 @@ class PublicSourceExportTests(unittest.TestCase):
|
||||
"SECURITY.md": "# Security\n",
|
||||
"CONTRIBUTING.md": "# Contributing\n",
|
||||
"docker-compose.yml": "services: {}\n",
|
||||
"docker-compose.validation-tls.yml": "services: {}\n",
|
||||
"deploy/validation/Caddyfile": "https://modelforge.example.test:8443 {}\n",
|
||||
"backend/Dockerfile": (
|
||||
'LABEL org.opencontainers.image.source="https://git.example.com/'
|
||||
'Jens/ITWorx-ModelForge"\n'
|
||||
),
|
||||
"frontend/Dockerfile": (
|
||||
'LABEL org.opencontainers.image.source="https://git.example.com/'
|
||||
'Jens/ITWorx-ModelForge"\n'
|
||||
),
|
||||
"node-agent/Dockerfile": (
|
||||
'LABEL org.opencontainers.image.source="https://git.example.com/'
|
||||
'Jens/ITWorx-ModelForge"\n'
|
||||
),
|
||||
"runtime-worker/Dockerfile": (
|
||||
'LABEL org.opencontainers.image.source="https://git.example.com/'
|
||||
'Jens/ITWorx-ModelForge"\n'
|
||||
),
|
||||
"VERSION": "1.2.1\n",
|
||||
"backend/pyproject.toml": "[project]\nname = 'fixture-api'\n",
|
||||
"clients/README.md": "# Client usage\n",
|
||||
"clients/python/modelforge_client.py": "# Python client\n",
|
||||
"clients/typescript/modelforge-client.mjs": "// JavaScript client\n",
|
||||
"clients/typescript/modelforge-client.d.mts": "// TypeScript declarations\n",
|
||||
"scripts/m16_chaos.py": "# Chaos scenarios\n",
|
||||
"scripts/m16_invariants.py": "# Invariant checks\n",
|
||||
"scripts/m16_soak.py": "# Soak checks\n",
|
||||
"scripts/operator_identity.py": "# Operator identities\n",
|
||||
"scripts/rc_isolation_preflight.py": "# RC isolation\n",
|
||||
"scripts/rc_stack_retention.py": "# RC retention\n",
|
||||
"frontend/package.json": '{"name":"fixture-web"}\n',
|
||||
"node-agent/pyproject.toml": "[project]\nname = 'fixture-agent'\n",
|
||||
"runtime-worker/pyproject.toml": "[project]\nname = 'fixture-worker'\n",
|
||||
@@ -104,6 +133,59 @@ class PublicSourceExportTests(unittest.TestCase):
|
||||
self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
|
||||
validation = self._validate(output)
|
||||
self.assertEqual(validation.returncode, 0, validation.stdout + validation.stderr)
|
||||
self.assertTrue((output / "clients/python/modelforge_client.py").is_file())
|
||||
self.assertTrue((output / "clients/typescript/modelforge-client.mjs").is_file())
|
||||
manifest = json.loads((output / "PUBLIC_SOURCE_MANIFEST.json").read_text())
|
||||
self.assertEqual(
|
||||
manifest["sourceRepository"], "https://git.example.com/example/modelforge"
|
||||
)
|
||||
bound_paths = {entry["path"] for entry in manifest["files"]}
|
||||
for relative_path in (
|
||||
"backend/Dockerfile",
|
||||
"frontend/Dockerfile",
|
||||
"node-agent/Dockerfile",
|
||||
"runtime-worker/Dockerfile",
|
||||
):
|
||||
self.assertIn(relative_path, bound_paths)
|
||||
self.assertIn(
|
||||
'org.opencontainers.image.source="https://git.example.com/example/modelforge"',
|
||||
(output / relative_path).read_text(),
|
||||
)
|
||||
|
||||
dockerfile_path = output / "backend/Dockerfile"
|
||||
original_dockerfile = dockerfile_path.read_bytes()
|
||||
dockerfile_entry = next(
|
||||
entry for entry in manifest["files"] if entry["path"] == "backend/Dockerfile"
|
||||
)
|
||||
forged_dockerfile = original_dockerfile.replace(
|
||||
b"https://git.example.com/example/modelforge",
|
||||
b"https://attacker.invalid/repository",
|
||||
)
|
||||
dockerfile_path.write_bytes(forged_dockerfile)
|
||||
dockerfile_entry["bytes"] = len(forged_dockerfile)
|
||||
dockerfile_entry["sha256"] = hashlib.sha256(forged_dockerfile).hexdigest()
|
||||
(output / "PUBLIC_SOURCE_MANIFEST.json").write_text(
|
||||
json.dumps(manifest), encoding="utf-8"
|
||||
)
|
||||
identity_tampering = self._validate(output)
|
||||
self.assertNotEqual(identity_tampering.returncode, 0)
|
||||
self.assertIn("source label does not match", identity_tampering.stderr)
|
||||
|
||||
dockerfile_path.write_bytes(original_dockerfile)
|
||||
original_manifest = json.loads(
|
||||
(output / "PUBLIC_SOURCE_MANIFEST.json").read_text(encoding="utf-8")
|
||||
)
|
||||
original_manifest["files"] = [
|
||||
{
|
||||
"path": entry["path"],
|
||||
"bytes": len((output / entry["path"]).read_bytes()),
|
||||
"sha256": hashlib.sha256((output / entry["path"]).read_bytes()).hexdigest(),
|
||||
}
|
||||
for entry in manifest["files"]
|
||||
]
|
||||
(output / "PUBLIC_SOURCE_MANIFEST.json").write_text(
|
||||
json.dumps(original_manifest), encoding="utf-8"
|
||||
)
|
||||
|
||||
original_readme = (output / "README.md").read_bytes()
|
||||
(output / "README.md").write_text("tampered\n", encoding="utf-8")
|
||||
@@ -127,6 +209,41 @@ class PublicSourceExportTests(unittest.TestCase):
|
||||
self.assertNotEqual(result.returncode, 0)
|
||||
self.assertIn("commit the exact source tree", result.stderr)
|
||||
|
||||
def test_private_owner_inventory_is_excluded_from_public_source(self) -> None:
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
repository = self._repository(root)
|
||||
private_files = {
|
||||
"scripts/portfolio_gitea_snapshot.py": "ExampleRAG owner inventory\n",
|
||||
"scripts/portfolio_gitea_repository_ids.json": '{"private-repo": 12}\n',
|
||||
"backend/tests/test_portfolio_gitea_snapshot.py": "192." + "168.1.40\n",
|
||||
"docs/operations/PORTFOLIO_GITEA_SNAPSHOT.md": "Private owner audit\n",
|
||||
}
|
||||
for relative_path, contents in private_files.items():
|
||||
destination = repository / relative_path
|
||||
destination.parent.mkdir(parents=True, exist_ok=True)
|
||||
destination.write_text(contents, encoding="utf-8")
|
||||
public_script = repository / "scripts/public.py"
|
||||
public_script.write_text("print('public')\n", encoding="utf-8")
|
||||
with (repository / "public-source.allowlist").open("a", encoding="utf-8") as allowlist:
|
||||
allowlist.write("scripts/**\nbackend/**\ndocs/operations/**\n")
|
||||
subprocess.run(["git", "add", "."], cwd=repository, check=True)
|
||||
subprocess.run(
|
||||
[
|
||||
"git", "-c", "user.name=ModelForge test", "-c", "user.email=test@example.invalid",
|
||||
"commit", "-qm", "private inventory fixture",
|
||||
],
|
||||
cwd=repository,
|
||||
check=True,
|
||||
)
|
||||
output = root / "public"
|
||||
result = self._export(repository, output)
|
||||
self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
|
||||
self.assertEqual(self._validate(output).returncode, 0)
|
||||
self.assertTrue((output / "scripts/public.py").is_file())
|
||||
for relative_path in private_files:
|
||||
self.assertFalse((output / relative_path).exists())
|
||||
|
||||
def test_sanitized_destination_collisions_fail_before_writing(self) -> None:
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
|
||||
Reference in new issue
Block a user