gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Test: Strengthen ambient GPG isolation contract

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 06:10:32 -04:00
parent 18ecc2244f
commit 3f8539176a
1 changed files with 36 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/setup/package-provenance-contract
+36 -12
View File
@@ -49,17 +49,41 @@ snapshot() {
}
snapshot_gpg_state() {
local path="$1" file
[[ -d "$path" ]] || return 0
while IFS= read -r file; do
sha256sum "$file"
done < <(find "$path" -maxdepth 1 -type f \( -name pubring.kbx -o -name trustdb.gpg \) | sort)
local path="$1" file relative
[[ -d "$path" ]] || {
printf 'absent\n'
return 0
}
{
printf 'directory\0'
find "$path" -mindepth 1 -print0 | LC_ALL=C sort -z \
| while IFS= read -r -d '' file; do
relative="${file#"$path"/}"
printf '%s\0' "$relative"
if [[ -L "$file" ]]; then
printf 'symlink\0%s\0' "$(readlink -- "$file")"
elif [[ -f "$file" ]]; then
printf 'file\0%s\0' "$(sha256sum -- "$file" | awk '{ print $1 }')"
elif [[ -d "$file" ]]; then
printf 'directory\0'
else
printf 'other\0%s\0' "$(stat -c '%F:%a:%s:%Y:%Z' "$file")"
fi
done
} | sha256sum | awk '{ print $1 }'
}
export GNUPGHOME="$ambient_gnupg"
mkdir -m 700 "$ambient_gnupg"
printf 'baseline-value\n' > "$ambient_gnupg/unexpected-entry"
ambient_before="$(snapshot "$ambient_gnupg")"
ambient_gpg_files_before="$(snapshot_gpg_state "$ambient_gnupg")"
printf 'tampered-value\n' > "$ambient_gnupg/unexpected-entry"
[[ "$ambient_gpg_files_before" != "$(snapshot_gpg_state "$ambient_gnupg")" ]] \
|| fail 'ambient GPG snapshot ignored unexpected file content'
printf 'baseline-value\n' > "$ambient_gnupg/unexpected-entry"
ambient_gpg_files_before="$(snapshot_gpg_state "$ambient_gnupg")"
before_gnupg="$(snapshot "$host_gnupg")"
before_gpg_files="$(snapshot_gpg_state "$host_gnupg")"
before_rpmdb="$(snapshot "$host_rpmdb")"
@@ -184,13 +208,6 @@ expect_failure rpm_signature_matches \
"$test_tmp/wrong-signer-fixture.rpm" "$fixtures/fixture-key.asc" "$fixture_fingerprint"
expect_failure rpm_signature_matches \
"$test_tmp/wrong-signer-fixture.rpm" "$test_tmp/combined-key.asc" "$fixture_fingerprint"
[[ "$before_gnupg" == "$(snapshot "$host_gnupg")" ]] || fail 'host GPG state changed'
[[ "$before_gpg_files" == "$(snapshot_gpg_state "$host_gnupg")" ]] || fail 'host GPG keybox or trust database changed'
[[ "$before_rpmdb" == "$(snapshot "$host_rpmdb")" ]] || fail 'host RPM database changed'
[[ "$ambient_before" == "$(snapshot "$ambient_gnupg")" ]] || fail 'production helper created ambient GPG state'
[[ "$ambient_gpg_files_before" == "$(snapshot_gpg_state "$ambient_gnupg")" ]] \
|| fail 'production helper created an ambient GPG keybox or trust database'
expect_success load_installer_provenance "$config"
[[ "${INSTALLER_PROVENANCE[BUN_VERSION]:-}" == '1.4.0' ]] || fail 'valid provenance was not loaded'
for key_spec in \
@@ -207,6 +224,13 @@ for key_spec in \
"${INSTALLER_PROVENANCE[$fingerprint_name]}"
done
[[ "$before_gnupg" == "$(snapshot "$host_gnupg")" ]] || fail 'host GPG state changed'
[[ "$before_gpg_files" == "$(snapshot_gpg_state "$host_gnupg")" ]] || fail 'host GPG state changed'
[[ "$before_rpmdb" == "$(snapshot "$host_rpmdb")" ]] || fail 'host RPM database changed'
[[ "$ambient_before" == "$(snapshot "$ambient_gnupg")" ]] || fail 'production helper created ambient GPG state'
[[ "$ambient_gpg_files_before" == "$(snapshot_gpg_state "$ambient_gnupg")" ]] \
|| fail 'production helper created or changed an ambient GPG entry'
parser_fixture="$test_tmp/installers.conf"
cp "$config" "$parser_fixture"
printf 'UNKNOWN_KEY=value\n' >> "$parser_fixture"