mosaicstack/stack
1
0
Fork 0
Code Issues 87 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

test(wake): restore whole-suite openssl-skip in digest-hmac harness — unmasking D1-D6 in CI deferred to #912 (renderer fix #914a/#914b unaffected)
Some checks failed
ci/woodpecker/pr/ci Pipeline failed
Details

Browse Source
This commit is contained in:
mosaic-coder
2026-07-26 00:41:59 -05:00
parent 2fb15b3aa7
commit d0bdad93e7
1 changed files with 5 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
packages/mosaic/framework/tools/wake/test-wake-digest-hmac.sh
View File

@@ -41,13 +41,11 @@ command -v jq >/dev/null 2>&1 || {
echo "SKIP: jq not available" >&2 echo "SKIP: jq not available" >&2
exit 0 exit 0
} }
# #914: openssl is required ONLY by H1/H2 (sign.sh, A5). D1-D6 exercise # NOTE: whole-suite openssl-skip retained; unmasking D1-D6 to run in CI is tracked in #912 (they currently fail under the CI env).
# digest.sh alone and must still run (and catch a regression) when openssl is command -v openssl >/dev/null 2>&1 || {
# absent from PATH — a whole-file skip would silently drop that coverage. echo "SKIP: openssl not available" >&2
# H1/H2 below are individually SKIPped (not the whole file) when openssl is exit 0
# unavailable, using the same command -v idiom the other harnesses use. }
HAVE_OPENSSL=1
command -v openssl >/dev/null 2>&1 || HAVE_OPENSSL=0
TMP_ROOT="$(mktemp -d)" TMP_ROOT="$(mktemp -d)"
trap 'rm -rf "$TMP_ROOT"' EXIT trap 'rm -rf "$TMP_ROOT"' EXIT
@@ -227,9 +225,6 @@ echo "== D4: SCRUB — secret-canary + ANSI/bidi/zero-width in source free-text
) && ok ) && ok
echo "== H1: NON-CIRCULAR HMAC — wake_id independent + not a signed field; tamper breaks MAC ==" echo "== H1: NON-CIRCULAR HMAC — wake_id independent + not a signed field; tamper breaks MAC =="
if [ "$HAVE_OPENSSL" != "1" ]; then
echo " SKIP: openssl not available (H1 requires sign.sh)" >&2
else
( (
MOSAIC_CREDENTIALS_FILE="$(fresh_cred h1 default 'key-material-h1')" MOSAIC_CREDENTIALS_FILE="$(fresh_cred h1 default 'key-material-h1')"
export MOSAIC_CREDENTIALS_FILE export MOSAIC_CREDENTIALS_FILE
@@ -277,12 +272,8 @@ else
fail_msg "H1: verify passed under a DIFFERENT key (MAC not key-dependent)" fail_msg "H1: verify passed under a DIFFERENT key (MAC not key-dependent)"
fi fi
) && ok ) && ok
fi
echo "== H2: KEY BY-NAME, never inline; no key leak; same-uid boundary documented ==" echo "== H2: KEY BY-NAME, never inline; no key leak; same-uid boundary documented =="
if [ "$HAVE_OPENSSL" != "1" ]; then
echo " SKIP: openssl not available (H2 requires sign.sh)" >&2
else
( (
MOSAIC_CREDENTIALS_FILE="$(fresh_cred h2 signing-key 'SUPERSECRET-KEYVALUE-XYZ')" MOSAIC_CREDENTIALS_FILE="$(fresh_cred h2 signing-key 'SUPERSECRET-KEYVALUE-XYZ')"
export MOSAIC_CREDENTIALS_FILE export MOSAIC_CREDENTIALS_FILE
@@ -315,7 +306,6 @@ else
grep -qi 'same-uid' "$SIGN" || fail_msg "H2: same-uid threat boundary not documented in sign.sh" grep -qi 'same-uid' "$SIGN" || fail_msg "H2: same-uid threat boundary not documented in sign.sh"
grep -qi 'off-uid' "$SIGN" || fail_msg "H2: off-uid future signer not named in sign.sh" grep -qi 'off-uid' "$SIGN" || fail_msg "H2: off-uid future signer not named in sign.sh"
) && ok ) && ok
fi
echo "== D5 (#914a): EMBEDDED ACK NAMESPACE — env-less copy-run targets the RENDER-TIME agent, not 'default' ==" echo "== D5 (#914a): EMBEDDED ACK NAMESPACE — env-less copy-run targets the RENDER-TIME agent, not 'default' =="
( (