Publish curated Unraid-AppOps-Gateway source from 4f159a7e60d5becc5218ef4c541e2005d733a537

backend/tests/test_controller_artifact_bootstrap.py

@@ -909,7 +909,22 @@ def test_child_logs_are_bounded_and_redacted_before_result_output():
     assert len(result["logTail"].encode("utf-8")) <= 4096
 
 
-def test_legacy_upgrade_signature_fetches_bootstrap_only_from_protected_git(tmp_path: Path):
+@pytest.mark.parametrize(
+    "temporary_root_info,accepted",
+    [
+        ("1777:0:0", True),
+        ("700:0:0", True),
+        ("777:0:0", False),
+        ("755:0:0", False),
+        ("770:0:0", False),
+        ("1700:0:0", False),
+        ("1777:1000:0", False),
+        ("700:0:1000", False),
+    ],
+)
+def test_legacy_upgrade_signature_fetches_bootstrap_only_from_protected_git(
+    tmp_path: Path, temporary_root_info: str, accepted: bool
+):
     bash = shutil.which("bash")
     if bash is None:
         pytest.skip("bash is required to exercise the upgrade script")
@@ -941,7 +956,7 @@ def test_legacy_upgrade_signature_fetches_bootstrap_only_from_protected_git(tmp_
         "import pathlib, sys\n"
         "args = sys.argv[1:]\n"
         "target = args[-1]\n"
-        "if target == '/tmp': print('1777:0:0')\n"
+        f"if target == '/tmp': print({temporary_root_info!r})\n"
         "elif args[1] == '%u:%a': print('0:700')\n"
         "elif args[1] == '%u:%a:%s': print('0:600:' + str(pathlib.Path(target).stat().st_size))\n"
         "else: raise SystemExit(1)\n",
@@ -985,6 +1000,13 @@ def test_legacy_upgrade_signature_fetches_bootstrap_only_from_protected_git(tmp_
         check=False,
     )
 
+    if not accepted:
+        assert result.returncode == 66, result.stderr
+        assert "temporary root is unsafe" in result.stderr
+        assert not python_trace.exists()
+        calls = [json.loads(line) for line in git_trace.read_text(encoding="utf-8").splitlines()]
+        assert not any("cat-file" in args for args in calls)
+        return
     assert result.returncode == 0, result.stderr
     bootstrap_call = json.loads(python_trace.read_text(encoding="utf-8"))
     assert bootstrap_call["script"] == protected_source
@@ -1062,12 +1084,23 @@ def test_upgrade_script_rejects_mutated_legacy_call_without_bootstrap(
 
 
 @pytest.mark.parametrize("modern_call", ["missing-image", "shared-archive"])
+@pytest.mark.parametrize("temporary_root_info", ["1777:0:0", "700:0:0", "777:0:0"])
 def test_modern_upgrade_path_still_requires_private_archive_and_image_id(
-    tmp_path: Path, modern_call: str
+    tmp_path: Path, modern_call: str, temporary_root_info: str
 ):
     bash = shutil.which("bash")
     if bash is None:
         pytest.skip("bash is required to exercise the upgrade script")
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    stat_shim = bin_dir / "stat"
+    stat_shim.write_text(
+        f"#!{sys.executable}\nimport sys\n"
+        f"if sys.argv[-1] == '/tmp': print({temporary_root_info!r})\n"
+        "else: raise SystemExit(91)\n",
+        encoding="utf-8",
+    )
+    stat_shim.chmod(0o755)
     archive = (
         f"/tmp/itworx-controller-artifact-promoter-{REVISION[:12]}.AAAAAA/controller.tar"
         if modern_call == "missing-image"
@@ -1094,13 +1127,17 @@ def test_modern_upgrade_path_still_requires_private_archive_and_image_id(
     result = subprocess.run(
         [bash, str(ROOT / "scripts/upgrade_deployment_controller.sh"), *args],
         cwd=ROOT,
+        env={**os.environ, "PATH": f"{bin_dir}{os.pathsep}{os.environ['PATH']}"},
         capture_output=True,
         text=True,
         check=False,
     )
 
     assert result.returncode != 0
+    if modern_call == "shared-archive":
+        if temporary_root_info == "777:0:0":
+            assert "helper temporary root is unsafe" in result.stderr
+        else:
+            assert "archive is outside the helper private temporary directory" in result.stderr
     if modern_call == "missing-image":
         assert "image ID" in result.stderr
-    else:
-        assert "archive is outside" in result.stderr