Test: Strengthen ambient GPG isolation contract

tests/setup/package-provenance-contract

@@ -49,17 +49,41 @@ snapshot() {
 }
 
 snapshot_gpg_state() {
-    local path="$1" file
+    local path="$1" file relative
-    [[ -d "$path" ]] || return 0
+    [[ -d "$path" ]] || {
-    while IFS= read -r file; do
+        printf 'absent\n'
-        sha256sum "$file"
+        return 0
-    done < <(find "$path" -maxdepth 1 -type f \( -name pubring.kbx -o -name trustdb.gpg \) | sort)
+    }
+
+    {
+        printf 'directory\0'
+        find "$path" -mindepth 1 -print0 | LC_ALL=C sort -z \
+            | while IFS= read -r -d '' file; do
+                relative="${file#"$path"/}"
+                printf '%s\0' "$relative"
+                if [[ -L "$file" ]]; then
+                    printf 'symlink\0%s\0' "$(readlink -- "$file")"
+                elif [[ -f "$file" ]]; then
+                    printf 'file\0%s\0' "$(sha256sum -- "$file" | awk '{ print $1 }')"
+                elif [[ -d "$file" ]]; then
+                    printf 'directory\0'
+                else
+                    printf 'other\0%s\0' "$(stat -c '%F:%a:%s:%Y:%Z' "$file")"
+                fi
+            done
+    } | sha256sum | awk '{ print $1 }'
 }
 
 export GNUPGHOME="$ambient_gnupg"
 mkdir -m 700 "$ambient_gnupg"
+printf 'baseline-value\n' > "$ambient_gnupg/unexpected-entry"
 ambient_before="$(snapshot "$ambient_gnupg")"
 ambient_gpg_files_before="$(snapshot_gpg_state "$ambient_gnupg")"
+printf 'tampered-value\n' > "$ambient_gnupg/unexpected-entry"
+[[ "$ambient_gpg_files_before" != "$(snapshot_gpg_state "$ambient_gnupg")" ]] \
+    || fail 'ambient GPG snapshot ignored unexpected file content'
+printf 'baseline-value\n' > "$ambient_gnupg/unexpected-entry"
+ambient_gpg_files_before="$(snapshot_gpg_state "$ambient_gnupg")"
 before_gnupg="$(snapshot "$host_gnupg")"
 before_gpg_files="$(snapshot_gpg_state "$host_gnupg")"
 before_rpmdb="$(snapshot "$host_rpmdb")"
@@ -184,13 +208,6 @@ expect_failure rpm_signature_matches \
     "$test_tmp/wrong-signer-fixture.rpm" "$fixtures/fixture-key.asc" "$fixture_fingerprint"
 expect_failure rpm_signature_matches \
     "$test_tmp/wrong-signer-fixture.rpm" "$test_tmp/combined-key.asc" "$fixture_fingerprint"
-[[ "$before_gnupg" == "$(snapshot "$host_gnupg")" ]] || fail 'host GPG state changed'
-[[ "$before_gpg_files" == "$(snapshot_gpg_state "$host_gnupg")" ]] || fail 'host GPG keybox or trust database changed'
-[[ "$before_rpmdb" == "$(snapshot "$host_rpmdb")" ]] || fail 'host RPM database changed'
-[[ "$ambient_before" == "$(snapshot "$ambient_gnupg")" ]] || fail 'production helper created ambient GPG state'
-[[ "$ambient_gpg_files_before" == "$(snapshot_gpg_state "$ambient_gnupg")" ]] \
-    || fail 'production helper created an ambient GPG keybox or trust database'
-
 expect_success load_installer_provenance "$config"
 [[ "${INSTALLER_PROVENANCE[BUN_VERSION]:-}" == '1.4.0' ]] || fail 'valid provenance was not loaded'
 for key_spec in \
@@ -207,6 +224,13 @@ for key_spec in \
         "${INSTALLER_PROVENANCE[$fingerprint_name]}"
 done
 
+[[ "$before_gnupg" == "$(snapshot "$host_gnupg")" ]] || fail 'host GPG state changed'
+[[ "$before_gpg_files" == "$(snapshot_gpg_state "$host_gnupg")" ]] || fail 'host GPG state changed'
+[[ "$before_rpmdb" == "$(snapshot "$host_rpmdb")" ]] || fail 'host RPM database changed'
+[[ "$ambient_before" == "$(snapshot "$ambient_gnupg")" ]] || fail 'production helper created ambient GPG state'
+[[ "$ambient_gpg_files_before" == "$(snapshot_gpg_state "$ambient_gnupg")" ]] \
+    || fail 'production helper created or changed an ambient GPG entry'
+
 parser_fixture="$test_tmp/installers.conf"
 cp "$config" "$parser_fixture"
 printf 'UNKNOWN_KEY=value\n' >> "$parser_fixture"