Publish curated Unraid-AppOps-Gateway source from 84f2a9958b2bdf1c1c13553925026d75f32703c3

backend/tests/test_registered_build_context.py

@@ -338,9 +338,17 @@ def test_git_replacement_refs_cannot_substitute_other_commit_contents(inputs):
     other = git(checkout, "rev-parse", "HEAD")
     git(bare, "fetch", "--quiet", str(checkout), "HEAD")
     git(bare, "replace", protected, other)
-    assert (
-        git(bare, "show", f"{protected}:server/main.py") == "replacement commit bytes"
-    )
+    # The positive attack demonstration must not inherit the production guard.
+    replacement_env = {
+        key: value for key, value in os.environ.items()
+        if key != "GIT_NO_REPLACE_OBJECTS"
+    }
+    replaced = subprocess.check_output(
+        ["git", "-C", str(bare), "show", f"{protected}:server/main.py"],
+        text=True,
+        env=replacement_env,
+    ).strip()
+    assert replaced == "replacement commit bytes"
     tree = Path(prepare(load(), inputs)["quiz-server"])
     assert tree.joinpath("server/main.py").read_text() == "print('protected')\n"