wehub-resource-sync
59 lines
1.4 KiB
Go
59 lines
1.4 KiB
Go
package plugintrust
|
|
|
|
import (
|
|
"errors"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestApprovalLifecycle(t *testing.T) {
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "example.lua")
|
|
if err := os.WriteFile(path, []byte("original"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
m, err := Load(dir)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Verify(m, "example", path); !errors.Is(err, ErrUntrusted) {
|
|
t.Fatalf("Verify before approval = %v, want ErrUntrusted", err)
|
|
}
|
|
if _, err := Approve(dir, "example", path); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
m, err = Load(dir)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Verify(m, "example", path); err != nil {
|
|
t.Fatalf("Verify approved plugin: %v", err)
|
|
}
|
|
if err := os.WriteFile(path, []byte("changed"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Verify(m, "example", path); !errors.Is(err, ErrHashMismatch) {
|
|
t.Fatalf("Verify changed plugin = %v, want ErrHashMismatch", err)
|
|
}
|
|
|
|
info, err := os.Stat(filepath.Join(dir, manifestName))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got := info.Mode().Perm(); got != 0o600 {
|
|
t.Errorf("manifest mode = %o, want 600", got)
|
|
}
|
|
}
|
|
|
|
func TestLoadRejectsTamperedManifest(t *testing.T) {
|
|
dir := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(dir, manifestName), []byte(`{"version":99,"plugins":{}}`), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := Load(dir); err == nil {
|
|
t.Fatal("Load accepted unsupported manifest")
|
|
}
|
|
}
|