108 lines
3.9 KiB
Python
108 lines
3.9 KiB
Python
"""Unit tests for the immutable container-build input policy."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
from scripts import check_image_inputs as policy
|
|
|
|
|
|
class TestDockerfilePolicy(unittest.TestCase):
|
|
def test_accepts_versioned_digest_base(self):
|
|
text = "FROM node:22.23.1-trixie-slim@sha256:" + "a" * 64 + "\n"
|
|
self.assertEqual([], policy.check_dockerfile(Path("Dockerfile"), text))
|
|
|
|
def test_rejects_mutable_and_latest_bases(self):
|
|
for value in (
|
|
"node:22-trixie-slim",
|
|
"node:latest@sha256:" + "a" * 64,
|
|
"node@sha256:" + "a" * 64,
|
|
):
|
|
with self.subTest(value=value):
|
|
problems = policy.check_dockerfile(
|
|
Path("Dockerfile"), f"FROM {value}\n",
|
|
)
|
|
self.assertTrue(problems)
|
|
|
|
def test_rejects_network_pipe_to_shell(self):
|
|
text = (
|
|
"FROM node:22.23.1@sha256:" + "a" * 64
|
|
+ "\nRUN curl -fsSL https://example.invalid/install.sh | sh\n"
|
|
)
|
|
problems = policy.check_dockerfile(Path("Dockerfile"), text)
|
|
self.assertTrue(any("directly into a shell" in item for item in problems))
|
|
|
|
def test_rejects_unlocked_npm_and_pi_installs(self):
|
|
base = "FROM node:22.23.1@sha256:" + "a" * 64 + "\nRUN "
|
|
for install in (
|
|
"npm install -g package@1.2.3",
|
|
"pi install npm:extension@1.2.3",
|
|
):
|
|
with self.subTest(install=install):
|
|
problems = policy.check_dockerfile(
|
|
Path("Dockerfile"), base + install + "\n",
|
|
)
|
|
self.assertTrue(any("npm ci" in item for item in problems))
|
|
|
|
def test_requires_snapshot_for_apt(self):
|
|
text = (
|
|
"FROM node:22.23.1@sha256:" + "a" * 64
|
|
+ "\nRUN apt-get update && apt-get install git\n"
|
|
)
|
|
problems = policy.check_dockerfile(Path("Dockerfile"), text)
|
|
self.assertTrue(any("fixed Debian snapshot" in item for item in problems))
|
|
|
|
|
|
class TestNpmLockPolicy(unittest.TestCase):
|
|
def _write(self, root: Path, *, version: str, integrity: str = "") -> Path:
|
|
package_dir = root / "provider"
|
|
package_dir.mkdir()
|
|
manifest = {
|
|
"name": "test",
|
|
"private": True,
|
|
"dependencies": {"example": version},
|
|
}
|
|
package = {
|
|
"version": "1.2.3",
|
|
"resolved": "https://registry.npmjs.org/example/-/example-1.2.3.tgz",
|
|
}
|
|
if integrity:
|
|
package["integrity"] = integrity
|
|
lock = {
|
|
"name": "test",
|
|
"lockfileVersion": 3,
|
|
"packages": {
|
|
"": {"dependencies": {"example": version}},
|
|
"node_modules/example": package,
|
|
},
|
|
}
|
|
(package_dir / "package.json").write_text(json.dumps(manifest))
|
|
(package_dir / "package-lock.json").write_text(json.dumps(lock))
|
|
return Path("provider/package.json")
|
|
|
|
def test_accepts_exact_integrity_locked_package(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
path = self._write(root, version="1.2.3", integrity="sha512-abc")
|
|
self.assertEqual([], policy.check_npm_manifest(root, path))
|
|
|
|
def test_rejects_range_and_missing_integrity(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
root = Path(directory)
|
|
path = self._write(root, version="^1.2.3")
|
|
problems = policy.check_npm_manifest(root, path)
|
|
self.assertTrue(any("not an exact version" in item for item in problems))
|
|
self.assertTrue(any("lacks sha512 integrity" in item for item in problems))
|
|
|
|
|
|
class TestRepositoryPolicy(unittest.TestCase):
|
|
def test_repository_image_inputs_pass(self):
|
|
self.assertEqual([], policy.check_repo())
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|