65 lines
2.1 KiB
Bash
Executable File
65 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-fetch-contract.XXXXXX")"
|
|
trap 'rm -rf "$TMP"' EXIT
|
|
FAKE_BIN="$TMP/bin"; mkdir -p "$FAKE_BIN"
|
|
cat > "$FAKE_BIN/curl" <<'CURL'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
url=""; output=""
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
-o) output="$2"; shift 2 ;;
|
|
-*) shift ;;
|
|
*) url="$1"; shift ;;
|
|
esac
|
|
done
|
|
emit() { if [[ -n "$output" ]]; then cat > "$output"; else cat; fi; }
|
|
case "$url" in
|
|
fixture://ok)
|
|
emit <<'SCRIPT'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
printf 'executed:%s\n' "${1:-missing}"
|
|
SCRIPT
|
|
;;
|
|
fixture://empty) : > "$output" ;;
|
|
fixture://failed) exit 22 ;;
|
|
*) exit 2 ;;
|
|
esac
|
|
CURL
|
|
chmod 0755 "$FAKE_BIN/curl"
|
|
cat > "$TMP/ok.sh" <<'SCRIPT'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
printf 'executed:%s\n' "${1:-missing}"
|
|
SCRIPT
|
|
ok_sha="$(sha256sum "$TMP/ok.sh" | awk '{print $1}')"
|
|
empty_sha="$(printf '' | sha256sum | awk '{print $1}')"
|
|
|
|
mkdir -p "$TMP/downloads"
|
|
output="$(TMPDIR="$TMP/downloads" PATH="$FAKE_BIN:$PATH" bash "$ROOT/tools/verified-installer-fetch.sh" fixture://ok "$ok_sha" -- marker)"
|
|
[[ "$output" == 'executed:marker' ]]
|
|
[[ -z "$(find "$TMP/downloads" -mindepth 1 -print -quit)" ]]
|
|
printf '[test] PASS: digest-pinned fetched artifact executes and its temporary body is removed\n'
|
|
|
|
for row in 'fixture://empty empty-body' 'fixture://failed failed-fetch'; do
|
|
url="${row%% *}"; name="${row#* }"
|
|
set +e
|
|
PATH="$FAKE_BIN:$PATH" bash "$ROOT/tools/verified-installer-fetch.sh" "$url" "$empty_sha" -- marker \
|
|
>"$TMP/$name.log" 2>&1
|
|
status=$?
|
|
set -e
|
|
[[ "$status" -ne 0 ]] || { echo "[test] FAIL: $name certified success" >&2; exit 1; }
|
|
done
|
|
printf '[test] PASS: failed fetch and HTTP-200 empty body are both rejected\n'
|
|
|
|
set +e
|
|
PATH="$FAKE_BIN:$PATH" bash "$ROOT/tools/verified-installer-fetch.sh" fixture://ok "${ok_sha/0/1}" -- marker \
|
|
>"$TMP/mismatch.log" 2>&1
|
|
status=$?
|
|
set -e
|
|
[[ "$status" -ne 0 ]] || { echo '[test] FAIL: digest mismatch was accepted' >&2; exit 1; }
|
|
printf '[test] PASS: fetched installer digest mismatch is blocking\n'
|