gamertan
9d9fc83dd0
Export the reviewed allowlisted snapshot from private source commit 8aab3db43f35e6a49aa497f45d73701b13fc9f32 and tree 992132ea4703437dc13ffdbb04a077816c02caf9. This includes routed singleton continuity, deployment evidence, strict schema-2 configuration, restricted transport, and the independently compilable public-tree guard. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
76 lines
1.8 KiB
Go
76 lines
1.8 KiB
Go
// SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
//go:build linux
|
|
|
|
package deploy
|
|
|
|
import (
|
|
"archive/tar"
|
|
"compress/gzip"
|
|
"os"
|
|
"path/filepath"
|
|
"syscall"
|
|
"testing"
|
|
)
|
|
|
|
func TestExtractArtifactAppliesReleaseModesUnderRestrictiveUmask(t *testing.T) {
|
|
dir := t.TempDir()
|
|
artifact := filepath.Join(dir, "release.tar.gz")
|
|
file, err := os.OpenFile(artifact, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
gz := gzip.NewWriter(file)
|
|
tw := tar.NewWriter(gz)
|
|
entries := map[string][]byte{
|
|
"bundle/app": []byte("executable"),
|
|
"bundle/BUILDINFO.json": []byte("{}"),
|
|
"bundle/RELEASE.json": []byte("{}"),
|
|
"bundle/SBOM.spdx.json": []byte("{}"),
|
|
"bundle/SHA256SUMS": []byte("checksums"),
|
|
}
|
|
for name, body := range entries {
|
|
if err := tw.WriteHeader(&tar.Header{Name: name, Typeflag: tar.TypeReg, Mode: 0o600, Size: int64(len(body))}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := tw.Write(body); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if err := tw.Close(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := gz.Close(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := file.Close(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
oldUmask := syscall.Umask(0o077)
|
|
t.Cleanup(func() { syscall.Umask(oldUmask) })
|
|
stage := filepath.Join(dir, "stage")
|
|
if err := os.Mkdir(stage, 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := extractArtifact(artifact, stage); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
for name, want := range map[string]os.FileMode{
|
|
"app": 0o755,
|
|
"BUILDINFO.json": 0o644,
|
|
"RELEASE.json": 0o644,
|
|
"SBOM.spdx.json": 0o644,
|
|
"SHA256SUMS": 0o644,
|
|
} {
|
|
info, err := os.Stat(filepath.Join(stage, name))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got := info.Mode().Perm(); got != want {
|
|
t.Fatalf("%s mode=%#o want=%#o", name, got, want)
|
|
}
|
|
}
|
|
}
|