100 lines
4.2 KiB
Python
100 lines
4.2 KiB
Python
#!/usr/bin/env python3
|
|
import hashlib
|
|
import json
|
|
import os
|
|
import subprocess
|
|
import tarfile
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
|
|
SCRIPT_DIR = Path(__file__).resolve().parent
|
|
BUILDER = SCRIPT_DIR / "build-external-data-plane-artifact.mjs"
|
|
EXPECTED_ENTRIES = [
|
|
"platform/docker-compose.external-data-plane.yml",
|
|
"platform/services/external-data-plane",
|
|
"platform/packages/external-provider-contract/package.json",
|
|
"platform/packages/external-provider-contract/src/contract-version.mjs",
|
|
"platform/packages/external-provider-contract/src/data-plane.mjs",
|
|
"platform/packages/external-provider-contract/src/data-product.mjs",
|
|
"platform/packages/external-provider-contract/src/intake-batch.mjs",
|
|
"platform/packages/external-provider-contract/src/index.mjs",
|
|
"platform/packages/external-provider-contract/src/provider-package.mjs",
|
|
"platform/packages/external-provider-contract/src/sensitive-field-policy.mjs",
|
|
"platform/packages/external-provider-contract/providers/gelios",
|
|
]
|
|
|
|
|
|
class ExternalDataPlaneArtifactTest(unittest.TestCase):
|
|
def build(self, artifact_dir, patch_id):
|
|
environment = os.environ.copy()
|
|
environment["NODEDC_DEPLOY_ARTIFACT_DIR"] = str(artifact_dir)
|
|
result = subprocess.run(
|
|
["node", str(BUILDER), patch_id],
|
|
check=True,
|
|
capture_output=True,
|
|
text=True,
|
|
env=environment,
|
|
)
|
|
return json.loads(result.stdout)
|
|
|
|
def test_artifact_is_runtime_only_public_trust_and_deterministic(self):
|
|
with tempfile.TemporaryDirectory(prefix="nodedc-edp-artifact-") as directory:
|
|
artifact_dir = Path(directory)
|
|
first = self.build(artifact_dir, "edp-managed-publish-unit-001")
|
|
artifact = Path(first["artifact"])
|
|
first_bytes = artifact.read_bytes()
|
|
second = self.build(artifact_dir, "edp-managed-publish-unit-001")
|
|
second_bytes = Path(second["artifact"]).read_bytes()
|
|
|
|
self.assertEqual(first["entries"], EXPECTED_ENTRIES)
|
|
self.assertEqual(first["sha256"], hashlib.sha256(first_bytes).hexdigest())
|
|
self.assertEqual(first["sha256"], second["sha256"])
|
|
self.assertEqual(first_bytes, second_bytes)
|
|
|
|
with tarfile.open(artifact, "r:gz") as archive:
|
|
members = archive.getmembers()
|
|
names = {member.name for member in members}
|
|
files = archive.extractfile("files.txt").read().decode("utf-8").splitlines()
|
|
manifest = archive.extractfile("manifest.env").read().decode("utf-8")
|
|
compose = archive.extractfile(
|
|
"payload/platform/docker-compose.external-data-plane.yml"
|
|
).read().decode("utf-8")
|
|
regular_payloads = [
|
|
archive.extractfile(member).read()
|
|
for member in members
|
|
if member.isfile()
|
|
]
|
|
|
|
self.assertEqual(files, EXPECTED_ENTRIES)
|
|
self.assertEqual(
|
|
manifest,
|
|
"id=edp-managed-publish-unit-001\ncomponent=platform\ntype=app-overlay\n",
|
|
)
|
|
self.assertFalse(any(
|
|
name.startswith("payload/platform/services/external-data-plane/test/")
|
|
or "/node_modules/" in name
|
|
or Path(name).name.startswith(".env")
|
|
or Path(name).name == "private-key.pem"
|
|
for name in names
|
|
))
|
|
self.assertIn(
|
|
"source: /volume1/docker/nodedc-platform/trust/engine-managed-provisioner",
|
|
compose,
|
|
)
|
|
self.assertIn(
|
|
"source: /volume1/docker/nodedc-platform/trust/foundry-managed-provisioner",
|
|
compose,
|
|
)
|
|
self.assertIn(
|
|
"EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_PUBLIC_KEY_FILE: /run/nodedc-trust/foundry-managed-provisioner/public-key.pem",
|
|
compose,
|
|
)
|
|
self.assertNotIn("private-key.pem", compose)
|
|
self.assertNotIn(b"-----BEGIN PRIVATE KEY-----", b"\n".join(regular_payloads))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main(verbosity=2)
|