94 lines
3.1 KiB
Python
94 lines
3.1 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Integration test for deterministic artifact generation and verification."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import hashlib
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
from pathlib import Path
|
|
|
|
|
|
def expect_verification_failure(command: list[str], description: str) -> None:
|
|
result = subprocess.run(command, check=False, capture_output=True, text=True)
|
|
if result.returncode == 0:
|
|
raise RuntimeError(f"verification unexpectedly accepted {description}")
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
root = args.root.resolve()
|
|
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
temporary = Path(directory)
|
|
artifact = temporary / "test.elf"
|
|
manifest = temporary / "test.json"
|
|
payload = b"chimera-gfx-test-artifact\n"
|
|
artifact.write_bytes(payload)
|
|
subprocess.run(
|
|
[
|
|
sys.executable,
|
|
str(root / "tools/generate_artifact_manifest.py"),
|
|
"--artifact",
|
|
str(artifact),
|
|
"--output",
|
|
str(manifest),
|
|
"--id",
|
|
"manifest-tool-test",
|
|
"--version",
|
|
"1",
|
|
"--source-repository",
|
|
"test://chimera-gfx",
|
|
"--source-commit",
|
|
"0" * 40,
|
|
"--target",
|
|
"test",
|
|
"--profile",
|
|
"unit-test",
|
|
],
|
|
check=True,
|
|
)
|
|
document = json.loads(manifest.read_text(encoding="utf-8"))
|
|
if document["artifact"]["sha256"] != hashlib.sha256(payload).hexdigest():
|
|
raise RuntimeError("generated digest differs from expected digest")
|
|
if document["execution"].get("execution_eligible") is not False:
|
|
raise RuntimeError("new artifacts must default to execution-ineligible")
|
|
verify_command = [
|
|
sys.executable,
|
|
str(root / "tools/verify_artifact_manifest.py"),
|
|
"--manifest",
|
|
str(manifest),
|
|
"--artifact",
|
|
str(artifact),
|
|
]
|
|
subprocess.run(verify_command, check=True)
|
|
|
|
artifact.write_bytes(payload + b"changed")
|
|
expect_verification_failure(verify_command, "changed artifact bytes")
|
|
artifact.write_bytes(payload)
|
|
|
|
document["execution"]["authorized"] = True
|
|
manifest.write_text(
|
|
json.dumps(document, indent=2, sort_keys=True) + "\n", encoding="utf-8"
|
|
)
|
|
expect_verification_failure(verify_command, "execution authority")
|
|
|
|
document["execution"]["authorized"] = False
|
|
del document["execution"]["execution_eligible"]
|
|
manifest.write_text(
|
|
json.dumps(document, indent=2, sort_keys=True) + "\n", encoding="utf-8"
|
|
)
|
|
expect_verification_failure(verify_command, "missing execution eligibility")
|
|
print("artifact manifest generation and verification passed")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|