Publish curated Unraid-AppOps-Gateway source from ac2bae3fcb4ec64df12f9313d09a3128c7cc6614

PUBLIC_SOURCE_EXPORT.md

@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `965c416ebf041123a61bc54b20bde0ad09b9ccc3`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `ac2bae3fcb4ec64df12f9313d09a3128c7cc6614`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.

PUBLIC_SOURCE_MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "965c416ebf041123a61bc54b20bde0ad09b9ccc3",
+  "sourceRevision": "ac2bae3fcb4ec64df12f9313d09a3128c7cc6614",
   "files": [
     {
       "path": ".dockerignore",
@@ -1439,8 +1439,8 @@
     },
     {
       "path": "backend/tests/test_registered_build_context.py",
-      "sha256": "1aef4bb4634a89d8e1c47da3c2ba209958653f2b7108368413d5d889d69052eb",
-      "bytes": 15112
+      "sha256": "29424b9024deeefe28a4c6636d68bfa2ad8c07a0ec08759a6f9dc6e474f67437",
+      "bytes": 16974
     },
     {
       "path": "backend/tests/test_registered_build_metadata.py",

backend/tests/test_registered_build_context.py

@@ -24,6 +24,23 @@ def load():
     return module
 
 
+def git_fixture_environment():
+    # Keep platform executable/temp discovery, excluding personal Git settings,
+    # hooks, signing overrides and inherited author/committer metadata.
+    allowed = {"PATH", "SYSTEMROOT", "WINDIR", "TMP", "TEMP", "TMPDIR"}
+    environment = {
+        key: value for key, value in os.environ.items() if key.upper() in allowed
+    }
+    environment.update(
+        GIT_CONFIG_NOSYSTEM="1",
+        GIT_CONFIG_GLOBAL=os.devnull,
+        GIT_ATTR_NOSYSTEM="1",
+        GIT_TERMINAL_PROMPT="0",
+        LC_ALL="C",
+    )
+    return environment
+
+
 def git(path, *args):
     return (
         subprocess.run(
@@ -31,6 +48,7 @@ def git(path, *args):
             check=True,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
+            env=git_fixture_environment(),
         )
         .stdout.decode()
         .strip()
@@ -45,18 +63,16 @@ def inputs(tmp_path):
     git(checkout, "config", "user.email", "test@example.invalid")
     git(checkout, "config", "user.name", "Test")
     (checkout / "server").mkdir()
-    (checkout / "server/Dockerfile").write_text("FROM scratch\nCOPY . /app\n")
-    (checkout / "server/main.py").write_text("print('protected')\n")
-    (checkout / "run.sh").write_text("#!/bin/sh\nexit 0\n")
+    (checkout / "server/Dockerfile").write_text("FROM scratch\nCOPY . /app\n", newline="\n")
+    (checkout / "server/main.py").write_text("print('protected')\n", newline="\n")
+    (checkout / "run.sh").write_text("#!/bin/sh\nexit 0\n", newline="\n")
     (checkout / "run.sh").chmod(0o755)
     git(checkout, "add", ".")
     git(checkout, "update-index", "--chmod=+x", "run.sh")
     git(checkout, "commit", "-qm", "protected source")
     revision = git(checkout, "rev-parse", "HEAD")
     bare = tmp_path / "repo.git"
-    subprocess.run(
-        ["git", "clone", "--bare", "--quiet", str(checkout), str(bare)], check=True
-    )
+    git(tmp_path, "clone", "--bare", "--quiet", str(checkout), str(bare))
     live = tmp_path / "live"
     live.mkdir()
     (live / "server").mkdir()
@@ -117,8 +133,9 @@ def test_new_cache_does_not_rewrite_existing_private_directory_context(inputs):
     before = marker.stat()
     tree = Path(prepare(load(), inputs)["quiz-server"])
     assert "registered-builds-v2" in tree.parts
-    assert marker.read_bytes() == b"keep previous build bytes"
+    # Observe preservation before our own read can update the access timestamp.
     assert marker.stat() == before
+    assert marker.read_bytes() == b"keep previous build bytes"
     if os.name != "nt":
         assert legacy.stat().st_mode & 0o777 == 0o700
 
@@ -401,3 +418,30 @@ def test_git_manifest_rejects_windows_drive_and_stream_paths_before_extraction(
     with pytest.raises(module.RegisteredBuildContextError, match="path_invalid"):
         module._manifest(tmp_path, revision)
     assert not list(tmp_path.iterdir())
+
+
+@pytest.mark.parametrize(
+    "ambient", ["global-signing", "environment-signing", "invalid-author-date"]
+)
+def test_synthetic_repository_ignores_ambient_git_configuration(
+    tmp_path, monkeypatch, ambient
+):
+    """Personal signing/identity settings must not govern synthetic test commits."""
+    if ambient == "global-signing":
+        config = tmp_path / "ambient-git-config"
+        config.write_text(
+            "[commit]\n  gpgsign = true\n"
+            "[gpg]\n  program = appops-test-gpg-must-not-run\n"
+        )
+        monkeypatch.setenv("GIT_CONFIG_GLOBAL", str(config))
+    elif ambient == "environment-signing":
+        monkeypatch.setenv("GIT_CONFIG_COUNT", "1")
+        monkeypatch.setenv("GIT_CONFIG_KEY_0", "commit.gpgSign")
+        monkeypatch.setenv("GIT_CONFIG_VALUE_0", "true")
+    else:
+        monkeypatch.setenv("GIT_AUTHOR_DATE", "appops-invalid-fixture-date")
+    fixture_root = tmp_path / "synthetic"
+    fixture_root.mkdir()
+    bare, revision, *_ = inputs.__wrapped__(fixture_root)
+    assert git(bare, "rev-parse", "HEAD") == revision
+    assert git(bare, "log", "-1", "--format=%an <%ae>") == "Test <test@example.invalid>"