From 8cfe39ea3750ad26f5acb2bf46daed9311ca4108 Mon Sep 17 00:00:00 2001 From: Public Source Publisher Date: Sat, 10 Oct 2026 21:08:44 +0000 Subject: [PATCH] Publish curated Unraid-AppOps-Gateway source from ac2bae3fcb4ec64df12f9313d09a3128c7cc6614 --- PUBLIC_SOURCE_EXPORT.md | 2 +- PUBLIC_SOURCE_MANIFEST.json | 6 +- .../tests/test_registered_build_context.py | 58 ++++++++++++++++--- 3 files changed, 55 insertions(+), 11 deletions(-) diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md index 0452475..17bc425 100644 --- a/PUBLIC_SOURCE_EXPORT.md +++ b/PUBLIC_SOURCE_EXPORT.md @@ -1,3 +1,3 @@ # Public source export -This source snapshot was generated from the private canonical repository at revision `965c416ebf041123a61bc54b20bde0ad09b9ccc3`. It contains no private Git history or operational evidence. Changes are published from the canonical repository. +This source snapshot was generated from the private canonical repository at revision `ac2bae3fcb4ec64df12f9313d09a3128c7cc6614`. It contains no private Git history or operational evidence. Changes are published from the canonical repository. diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json index 7cba0ac..f907ae3 100644 --- a/PUBLIC_SOURCE_MANIFEST.json +++ b/PUBLIC_SOURCE_MANIFEST.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "sourceRevision": "965c416ebf041123a61bc54b20bde0ad09b9ccc3", + "sourceRevision": "ac2bae3fcb4ec64df12f9313d09a3128c7cc6614", "files": [ { "path": ".dockerignore", @@ -1439,8 +1439,8 @@ }, { "path": "backend/tests/test_registered_build_context.py", - "sha256": "1aef4bb4634a89d8e1c47da3c2ba209958653f2b7108368413d5d889d69052eb", - "bytes": 15112 + "sha256": "29424b9024deeefe28a4c6636d68bfa2ad8c07a0ec08759a6f9dc6e474f67437", + "bytes": 16974 }, { "path": "backend/tests/test_registered_build_metadata.py", diff --git a/backend/tests/test_registered_build_context.py b/backend/tests/test_registered_build_context.py index 99f1628..dcc71eb 100644 --- a/backend/tests/test_registered_build_context.py +++ b/backend/tests/test_registered_build_context.py @@ -24,6 +24,23 @@ def load(): return module +def git_fixture_environment(): + # Keep platform executable/temp discovery, excluding personal Git settings, + # hooks, signing overrides and inherited author/committer metadata. + allowed = {"PATH", "SYSTEMROOT", "WINDIR", "TMP", "TEMP", "TMPDIR"} + environment = { + key: value for key, value in os.environ.items() if key.upper() in allowed + } + environment.update( + GIT_CONFIG_NOSYSTEM="1", + GIT_CONFIG_GLOBAL=os.devnull, + GIT_ATTR_NOSYSTEM="1", + GIT_TERMINAL_PROMPT="0", + LC_ALL="C", + ) + return environment + + def git(path, *args): return ( subprocess.run( @@ -31,6 +48,7 @@ def git(path, *args): check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, + env=git_fixture_environment(), ) .stdout.decode() .strip() @@ -45,18 +63,16 @@ def inputs(tmp_path): git(checkout, "config", "user.email", "test@example.invalid") git(checkout, "config", "user.name", "Test") (checkout / "server").mkdir() - (checkout / "server/Dockerfile").write_text("FROM scratch\nCOPY . /app\n") - (checkout / "server/main.py").write_text("print('protected')\n") - (checkout / "run.sh").write_text("#!/bin/sh\nexit 0\n") + (checkout / "server/Dockerfile").write_text("FROM scratch\nCOPY . /app\n", newline="\n") + (checkout / "server/main.py").write_text("print('protected')\n", newline="\n") + (checkout / "run.sh").write_text("#!/bin/sh\nexit 0\n", newline="\n") (checkout / "run.sh").chmod(0o755) git(checkout, "add", ".") git(checkout, "update-index", "--chmod=+x", "run.sh") git(checkout, "commit", "-qm", "protected source") revision = git(checkout, "rev-parse", "HEAD") bare = tmp_path / "repo.git" - subprocess.run( - ["git", "clone", "--bare", "--quiet", str(checkout), str(bare)], check=True - ) + git(tmp_path, "clone", "--bare", "--quiet", str(checkout), str(bare)) live = tmp_path / "live" live.mkdir() (live / "server").mkdir() @@ -117,8 +133,9 @@ def test_new_cache_does_not_rewrite_existing_private_directory_context(inputs): before = marker.stat() tree = Path(prepare(load(), inputs)["quiz-server"]) assert "registered-builds-v2" in tree.parts - assert marker.read_bytes() == b"keep previous build bytes" + # Observe preservation before our own read can update the access timestamp. assert marker.stat() == before + assert marker.read_bytes() == b"keep previous build bytes" if os.name != "nt": assert legacy.stat().st_mode & 0o777 == 0o700 @@ -401,3 +418,30 @@ def test_git_manifest_rejects_windows_drive_and_stream_paths_before_extraction( with pytest.raises(module.RegisteredBuildContextError, match="path_invalid"): module._manifest(tmp_path, revision) assert not list(tmp_path.iterdir()) + + +@pytest.mark.parametrize( + "ambient", ["global-signing", "environment-signing", "invalid-author-date"] +) +def test_synthetic_repository_ignores_ambient_git_configuration( + tmp_path, monkeypatch, ambient +): + """Personal signing/identity settings must not govern synthetic test commits.""" + if ambient == "global-signing": + config = tmp_path / "ambient-git-config" + config.write_text( + "[commit]\n gpgsign = true\n" + "[gpg]\n program = appops-test-gpg-must-not-run\n" + ) + monkeypatch.setenv("GIT_CONFIG_GLOBAL", str(config)) + elif ambient == "environment-signing": + monkeypatch.setenv("GIT_CONFIG_COUNT", "1") + monkeypatch.setenv("GIT_CONFIG_KEY_0", "commit.gpgSign") + monkeypatch.setenv("GIT_CONFIG_VALUE_0", "true") + else: + monkeypatch.setenv("GIT_AUTHOR_DATE", "appops-invalid-fixture-date") + fixture_root = tmp_path / "synthetic" + fixture_root.mkdir() + bare, revision, *_ = inputs.__wrapped__(fixture_root) + assert git(bare, "rev-parse", "HEAD") == revision + assert git(bare, "log", "-1", "--format=%an <%ae>") == "Test "