Publish Vulpes Preview 15 sources for desktop, Android and Tundra

Share Gaia assets and adapters, keep private profiles and development documents local, and update both public READMEs.

tundra/tests/test_native_launch.py

@@ -0,0 +1,65 @@
+# SPDX-License-Identifier: MPL-2.0
+import importlib.util
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/'tools'))
+spec=importlib.util.spec_from_file_location('native_launch',ROOT/'tools/run-sargo-native.py')
+launch=importlib.util.module_from_spec(spec);spec.loader.exec_module(launch)
+
+
+class QualifiedLaunchTests(unittest.TestCase):
+    def setUp(self):
+        self.temp=tempfile.TemporaryDirectory();self.addCleanup(self.temp.cleanup)
+        self.root=Path(self.temp.name);self.folder=self.root/'out/build'
+        self.folder.mkdir(parents=True)
+        (self.folder/'proof.json').write_text('{"passed":true}')
+        (self.folder/'build.json').write_text(json.dumps({'imageSha256':'image-hash'}))
+        self.report={'passed':True,'flashReady':False,'imageSha256':'image-hash',
+                     'evidenceSha256':{'proof.json':launch.digest(self.folder/'proof.json')}}
+        self.write_report()
+        self.root_patch=patch.object(launch,'ROOT',self.root);self.root_patch.start();self.addCleanup(self.root_patch.stop)
+
+    def write_report(self):
+        report=self.folder/'qualification.json';report.write_text(json.dumps(self.report))
+        (self.root/'out/sargo-native-qualified.json').write_text(json.dumps({
+            'directory':'out/build','qualificationSha256':launch.digest(report)}))
+
+    def test_local_verification_does_not_request_boot(self):
+        with patch.object(launch.subprocess,'run') as run:
+            self.assertEqual(launch.qualified_build(),self.folder)
+        self.assertNotIn('--boot',run.call_args.args[0])
+
+    def test_modified_evidence_stops_before_device_tool(self):
+        (self.folder/'proof.json').write_text('changed')
+        with patch.object(launch.subprocess,'run') as run:
+            with self.assertRaisesRegex(ValueError,'evidence changed'):launch.qualified_build()
+            run.assert_not_called()
+
+    def test_failed_qualification_stops_before_device_tool(self):
+        self.report['passed']=False;self.write_report()
+        with patch.object(launch.subprocess,'run') as run:
+            with self.assertRaisesRegex(ValueError,'qualified native'):launch.qualified_build()
+            run.assert_not_called()
+
+    def test_interactive_diagnostics_cannot_be_the_normal_launcher(self):
+        (self.folder/'build.json').write_text(json.dumps({
+            'imageSha256':'image-hash', 'interactiveDiagnostics':True}))
+        with patch.object(launch.subprocess,'run') as run:
+            with self.assertRaisesRegex(ValueError,'Interactive diagnostic'):
+                launch.qualified_build()
+            run.assert_not_called()
+
+    def test_pointer_cannot_escape_output_directory(self):
+        (self.root/'out/sargo-native-qualified.json').write_text(json.dumps({'directory':'../outside'}))
+        with patch.object(launch.subprocess,'run') as run:
+            with self.assertRaises(ValueError):launch.qualified_build()
+            run.assert_not_called()
+
+
+if __name__=='__main__':unittest.main()