b38dea0597
Share Gaia assets and adapters, keep private profiles and development documents local, and update both public READMEs.
65 lines
3 KiB
Python
65 lines
3 KiB
Python
# SPDX-License-Identifier: MPL-2.0
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
ROOT=Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0,str(ROOT/'tools'))
|
|
spec=importlib.util.spec_from_file_location('native_launch',ROOT/'tools/run-sargo-native.py')
|
|
launch=importlib.util.module_from_spec(spec);spec.loader.exec_module(launch)
|
|
|
|
|
|
class QualifiedLaunchTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.temp=tempfile.TemporaryDirectory();self.addCleanup(self.temp.cleanup)
|
|
self.root=Path(self.temp.name);self.folder=self.root/'out/build'
|
|
self.folder.mkdir(parents=True)
|
|
(self.folder/'proof.json').write_text('{"passed":true}')
|
|
(self.folder/'build.json').write_text(json.dumps({'imageSha256':'image-hash'}))
|
|
self.report={'passed':True,'flashReady':False,'imageSha256':'image-hash',
|
|
'evidenceSha256':{'proof.json':launch.digest(self.folder/'proof.json')}}
|
|
self.write_report()
|
|
self.root_patch=patch.object(launch,'ROOT',self.root);self.root_patch.start();self.addCleanup(self.root_patch.stop)
|
|
|
|
def write_report(self):
|
|
report=self.folder/'qualification.json';report.write_text(json.dumps(self.report))
|
|
(self.root/'out/sargo-native-qualified.json').write_text(json.dumps({
|
|
'directory':'out/build','qualificationSha256':launch.digest(report)}))
|
|
|
|
def test_local_verification_does_not_request_boot(self):
|
|
with patch.object(launch.subprocess,'run') as run:
|
|
self.assertEqual(launch.qualified_build(),self.folder)
|
|
self.assertNotIn('--boot',run.call_args.args[0])
|
|
|
|
def test_modified_evidence_stops_before_device_tool(self):
|
|
(self.folder/'proof.json').write_text('changed')
|
|
with patch.object(launch.subprocess,'run') as run:
|
|
with self.assertRaisesRegex(ValueError,'evidence changed'):launch.qualified_build()
|
|
run.assert_not_called()
|
|
|
|
def test_failed_qualification_stops_before_device_tool(self):
|
|
self.report['passed']=False;self.write_report()
|
|
with patch.object(launch.subprocess,'run') as run:
|
|
with self.assertRaisesRegex(ValueError,'qualified native'):launch.qualified_build()
|
|
run.assert_not_called()
|
|
|
|
def test_interactive_diagnostics_cannot_be_the_normal_launcher(self):
|
|
(self.folder/'build.json').write_text(json.dumps({
|
|
'imageSha256':'image-hash', 'interactiveDiagnostics':True}))
|
|
with patch.object(launch.subprocess,'run') as run:
|
|
with self.assertRaisesRegex(ValueError,'Interactive diagnostic'):
|
|
launch.qualified_build()
|
|
run.assert_not_called()
|
|
|
|
def test_pointer_cannot_escape_output_directory(self):
|
|
(self.root/'out/sargo-native-qualified.json').write_text(json.dumps({'directory':'../outside'}))
|
|
with patch.object(launch.subprocess,'run') as run:
|
|
with self.assertRaises(ValueError):launch.qualified_build()
|
|
run.assert_not_called()
|
|
|
|
|
|
if __name__=='__main__':unittest.main()
|