Publish curated Unraid-AppOps-Gateway source from a506550ef83ef2d81651e37c98a89f7ee330c730

backend/tests/test_repopulse_target_attestation.py

@@ -5,11 +5,15 @@ from __future__ import annotations
 import hashlib
 import hmac
 import importlib
+import importlib.util
 import json
 import sqlite3
+import sys
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
+import pytest
+
 
 def _module(monkeypatch):
     root = Path(__file__).resolve().parents[2] / "ops" / "gitea-deploy-broker"
@@ -17,6 +21,52 @@ def _module(monkeypatch):
     return importlib.import_module("repopulse_target_attestation")
 
 
+@pytest.mark.parametrize("code_root", [Path("/opt/gitea-deploy"), Path("/private/controller-stage")])
+def test_bootstrap_producer_and_verifier_share_the_config_path(monkeypatch, code_root):
+    root = Path(__file__).resolve().parents[2] / "ops/gitea-deploy-broker"
+    monkeypatch.syspath_prepend(str(root))
+    spec = importlib.util.spec_from_file_location("config_path_attestation_test", root / "repopulse_target_attestation.py")
+    verifier = importlib.util.module_from_spec(spec)
+    verifier.__file__ = str(code_root / "repopulse_target_attestation.py")
+    exec(compile((root / "repopulse_target_attestation.py").read_bytes(), str(spec.origin), "exec"), verifier.__dict__)
+    expected = (
+        Path("/controller-hub-releases/controller-config")
+        if code_root == Path("/opt/gitea-deploy") else code_root
+    ) / "appops-enrollment-bootstrap"
+    assert verifier.BOOTSTRAP_PATH == expected
+    monkeypatch.setitem(sys.modules, "repopulse_target_attestation", verifier)
+    producer_spec = importlib.util.spec_from_file_location("config_path_producer_test", root / "stage_repopulse_target_attestation.py")
+    producer = importlib.util.module_from_spec(producer_spec)
+    producer_spec.loader.exec_module(producer)
+    observed = []
+
+    def unavailable_secret(path, _maximum):
+        observed.append(path)
+        raise OSError("fixture stops before any external operation")
+
+    monkeypatch.setattr(producer.os, "geteuid", lambda: 0, raising=False)
+    monkeypatch.setattr(producer.sys, "argv", ["stage_repopulse_target_attestation.py"])
+    monkeypatch.setattr(producer, "_private_bytes", unavailable_secret)
+    assert producer.main() == 2
+    assert observed == [expected]
+    observed.clear()
+
+    def verifier_file(path, *, maximum):
+        if path == verifier.ATTESTATION_PATH:
+            return json.dumps({"schema": verifier.ENVELOPE_SCHEMA, "claims": {}, "signatureSha256": "0" * 64}).encode()
+        return unavailable_secret(path, maximum)
+
+    monkeypatch.setattr(verifier, "_private_file", verifier_file)
+    required = {
+        "repository", "applicationId", "profileId", "profileVersion",
+        "planSha256", "intentId", "targetSecretRef", "controllerTlsCertificateSha256",
+    }
+    assert verifier.FixedTargetAttestationVerifier().verify_target_attestation(
+        expected={key: "fixture" for key in required}
+    ) is None
+    assert observed == [expected]
+
+
 def _sample(now: datetime) -> dict:
     return {
         "schema": "itworx.repopulse-target-attestation/v1",