AIOS Governed Continuation
540e28a724
autonomy-smoke-tests Exact governed tree; evidence 7dbba7ff168e72af
autonomy-unit-tests Exact governed tree; evidence 7dbba7ff168e72af
campaign-approval-gate Exact governed tree; evidence 7dbba7ff168e72af
git-diff-check Exact governed tree; evidence 7dbba7ff168e72af
py-compile Exact governed tree; evidence 7dbba7ff168e72af
reconciliation-contract Exact governed tree; evidence 7dbba7ff168e72af
release-state-machine Exact governed tree; evidence 7dbba7ff168e72af
secret-scan Exact governed tree; evidence 7029b3eafb209066
signer-validator-contract Exact governed tree; evidence 7dbba7ff168e72af
59 lines
2.3 KiB
Python
59 lines
2.3 KiB
Python
"""Immutable V3 issuer overlay assembly from a committed source tree."""
|
|
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
from pathlib import Path
|
|
import subprocess
|
|
import tarfile
|
|
|
|
import pytest
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
spec = importlib.util.spec_from_file_location(
|
|
"build_c5_live_principal_overlay", ROOT / "scripts" / "build_c5_live_principal_overlay.py",
|
|
)
|
|
assert spec is not None and spec.loader is not None
|
|
builder = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(builder)
|
|
|
|
|
|
def _commit() -> str:
|
|
return subprocess.run(
|
|
["git", "rev-parse", "HEAD"], cwd=ROOT, check=True,
|
|
capture_output=True, text=True,
|
|
).stdout.strip()
|
|
|
|
|
|
def test_overlay_archive_is_deterministic_and_hash_bound(tmp_path):
|
|
fixture = ROOT / "tests" / "fixtures" / "issuer-v3-base"
|
|
manifests = [builder.build_issuer_v3_overlay(
|
|
adapter_source_root=fixture, output_root=tmp_path / str(i),
|
|
source_commit=_commit(), repository_root=ROOT,
|
|
) for i in (1, 2)]
|
|
assert manifests[0]["artifact_sha256"] == manifests[1]["artifact_sha256"]
|
|
assert manifests[0]["file_manifest_sha256"] == manifests[1]["file_manifest_sha256"]
|
|
archive = tmp_path / "1" / manifests[0]["artifact_filename"]
|
|
assert builder.sha256(archive) == manifests[0]["artifact_sha256"]
|
|
with tarfile.open(archive, "r") as bundle:
|
|
assert set(bundle.getnames()) == set(manifests[0]["files"])
|
|
for member in bundle:
|
|
assert member.uid == member.gid == member.mtime == 0
|
|
assert member.mode == 0o444
|
|
assert builder.hashlib.sha256(bundle.extractfile(member).read()).hexdigest() == (
|
|
manifests[0]["files"][member.name]
|
|
)
|
|
|
|
|
|
def test_base_snapshot_drift_is_rejected_before_assembly(tmp_path):
|
|
source = ROOT / "tests" / "fixtures" / "issuer-v3-base"
|
|
copied = tmp_path / "base"
|
|
copied.mkdir()
|
|
for item in source.glob("*.py"):
|
|
(copied / item.name).write_bytes(item.read_bytes())
|
|
(copied / "governed_runtime_scope.py").write_bytes(b"changed")
|
|
with pytest.raises(SystemExit, match="ISSUER_V3_BASE_HASH_MISMATCH"):
|
|
builder.build_issuer_v3_overlay(
|
|
adapter_source_root=copied, output_root=tmp_path / "out",
|
|
source_commit=_commit(), repository_root=ROOT,
|
|
)
|