114 lines
5.5 KiB
Python
Executable File
114 lines
5.5 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
from pathlib import Path
|
|
import shutil
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
|
|
CHECKER = Path(__file__).with_name("framework-drift-check.py")
|
|
REAL_RESOLVER = CHECKER.parents[2] / "_lib" / "manifest.sh"
|
|
|
|
|
|
class FrameworkDriftCheckTests(unittest.TestCase):
|
|
def setUp(self) -> None:
|
|
self.temp = tempfile.TemporaryDirectory()
|
|
root = Path(self.temp.name)
|
|
self.framework = root / "framework"
|
|
self.source = self.framework / "tools"
|
|
self.installed = root / "home" / "tools"
|
|
for directory in (self.source / "git", self.source / "_lib", self.installed / "git", self.installed / "_lib"):
|
|
directory.mkdir(parents=True, exist_ok=True)
|
|
shutil.copy2(REAL_RESOLVER, self.source / "_lib" / "manifest.sh")
|
|
(self.source / "git" / "guard.sh").write_text("fixed\n")
|
|
(self.source / "git" / "new-wrapper.sh").write_text("new\n")
|
|
(self.source / "_lib" / "credentials.json").write_text("source-placeholder\n")
|
|
self.write_manifest()
|
|
|
|
def tearDown(self) -> None:
|
|
self.temp.cleanup()
|
|
|
|
def write_manifest(self, operator_extra: str = "") -> None:
|
|
(self.framework / "framework-manifest.txt").write_text(
|
|
"[framework]\ntools/**\n[operator]\ntools/_lib/credentials.json\n" + operator_extra
|
|
)
|
|
|
|
def run_check(self, *extra: str) -> subprocess.CompletedProcess[str]:
|
|
return subprocess.run(
|
|
[sys.executable, str(CHECKER), "--source-root", str(self.framework), "--installed-root", str(self.installed), *extra],
|
|
text=True, capture_output=True, check=False,
|
|
env={**os.environ, "PYTHONDONTWRITEBYTECODE": "1"},
|
|
)
|
|
|
|
def install_matching(self) -> None:
|
|
for relative in ("git/guard.sh", "git/new-wrapper.sh", "_lib/manifest.sh"):
|
|
shutil.copy2(self.source / relative, self.installed / relative)
|
|
(self.installed / "_lib" / "credentials.json").write_text("different-operator-secret\n")
|
|
|
|
def test_fails_loudly_and_classifies_stale_missing_and_installed_only(self) -> None:
|
|
(self.installed / "git" / "guard.sh").write_text("broken\n")
|
|
shutil.copy2(self.source / "_lib" / "manifest.sh", self.installed / "_lib" / "manifest.sh")
|
|
(self.installed / "local-helper.sh").write_text("operator\n")
|
|
result = self.run_check("--verbose")
|
|
self.assertEqual(result.returncode, 1)
|
|
self.assertIn("STALE git/guard.sh", result.stdout)
|
|
self.assertIn("NOT_INSTALLED git/new-wrapper.sh", result.stdout)
|
|
self.assertIn("INSTALLED_ONLY operator-or-unknown local-helper.sh", result.stdout)
|
|
self.assertIn("FAIL deployed framework tools", result.stderr)
|
|
|
|
def test_passes_only_when_every_manifest_owned_source_file_matches(self) -> None:
|
|
self.install_matching()
|
|
result = self.run_check()
|
|
self.assertEqual(result.returncode, 0, result.stderr)
|
|
self.assertIn("stale=0 not-installed=0 unsafe-alias=0", result.stdout)
|
|
|
|
def test_manifest_is_required_and_policy_changes_take_effect(self) -> None:
|
|
self.install_matching()
|
|
(self.installed / "git" / "guard.sh").write_text("operator-divergence\n")
|
|
self.write_manifest("tools/git/guard.sh\n")
|
|
self.assertEqual(self.run_check().returncode, 0)
|
|
(self.framework / "framework-manifest.txt").unlink()
|
|
result = self.run_check()
|
|
self.assertEqual(result.returncode, 2)
|
|
self.assertIn("CANNOT_ASSERT ownership manifest is missing", result.stderr)
|
|
|
|
def test_empty_and_unreadable_source_census_cannot_assert(self) -> None:
|
|
empty_framework = Path(self.temp.name) / "empty-framework"
|
|
empty_source = empty_framework / "tools"
|
|
empty_source.mkdir(parents=True)
|
|
shutil.copy2(self.framework / "framework-manifest.txt", empty_framework / "framework-manifest.txt")
|
|
# The canonical resolver is supplied outside the empty census solely so
|
|
# this probe reaches the explicit minimum-population guard.
|
|
result = subprocess.run([sys.executable, str(CHECKER), "--source-root", str(empty_framework), "--installed-root", str(self.installed)], text=True, capture_output=True)
|
|
self.assertEqual(result.returncode, 2)
|
|
self.assertIn("CANNOT_ASSERT", result.stderr)
|
|
|
|
blocked = self.source / "blocked"
|
|
blocked.mkdir(); (blocked / "hidden.sh").write_text("hidden\n"); blocked.chmod(0)
|
|
try:
|
|
result = self.run_check()
|
|
finally:
|
|
blocked.chmod(0o700)
|
|
self.assertEqual(result.returncode, 2)
|
|
self.assertIn("CANNOT_ASSERT", result.stderr)
|
|
self.assertTrue("Permission denied" in result.stderr or "no readable/searchable mode" in result.stderr)
|
|
|
|
def test_root_and_descendant_aliases_cannot_report_clean(self) -> None:
|
|
result = subprocess.run([sys.executable, str(CHECKER), "--source-root", str(self.framework), "--installed-root", str(self.source)], text=True, capture_output=True)
|
|
self.assertEqual(result.returncode, 2)
|
|
self.assertIn("same filesystem object", result.stderr)
|
|
|
|
shutil.copy2(self.source / "_lib" / "manifest.sh", self.installed / "_lib" / "manifest.sh")
|
|
shutil.rmtree(self.installed / "git")
|
|
(self.installed / "git").symlink_to(self.source / "git", target_is_directory=True)
|
|
result = self.run_check()
|
|
self.assertNotEqual(result.returncode, 0)
|
|
self.assertTrue("symlinked directory" in result.stderr or "UNSAFE_ALIAS" in result.stdout)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|