mirror of
https://github.com/jcreek/CosmicClash.git
synced 2026-09-10 16:04:04 +00:00
Josh Creek
37 lines
1.4 KiB
Python
37 lines
1.4 KiB
Python
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
|
|
|
|
ROOT = Path(__file__).parents[2]
|
|
CHECKER = ROOT / "scripts" / "verify_supply_chain.py"
|
|
|
|
|
|
class SupplyChainTest(unittest.TestCase):
|
|
def run_checker(self, *args):
|
|
return subprocess.run([sys.executable, str(CHECKER), *args], cwd=ROOT, text=True, capture_output=True)
|
|
|
|
def test_checked_in_references_are_digest_pinned(self):
|
|
result = self.run_checker()
|
|
self.assertEqual(result.returncode, 0, result.stderr)
|
|
|
|
def test_checker_rejects_tags_plaintext_secrets_and_template_release(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
dockerfile = root / "Dockerfile"
|
|
manifests = root / "manifests"
|
|
manifests.mkdir()
|
|
dockerfile.write_text("FROM example.invalid/game:latest\n")
|
|
(manifests / "bad.yaml").write_text("image: example.invalid/game@sha256:" + "0" * 64 + "\npassword: leaked\n")
|
|
result = self.run_checker("--dockerfile", str(dockerfile), "--manifest-dir", str(manifests), "--require-concrete")
|
|
self.assertNotEqual(result.returncode, 0)
|
|
self.assertIn("not digest-pinned", result.stderr)
|
|
self.assertIn("plaintext credential", result.stderr)
|
|
self.assertIn("not a release artifact", result.stderr)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|