gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Test: Strengthen SSH bootstrap documentation contract

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 04:35:45 -04:00
parent 00e11e0b8d
commit 98e29eb8f3
1 changed files with 36 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/setup/readme-contract
+36 -8
View File
@@ -49,25 +49,53 @@ require_bootstrap_doc() {
grep -qiE "$pattern" <<<"$bootstrap_doc" || note "$explanation"
}
require_bootstrap_doc 'verified target key' \
'the root bootstrap docs do not require a verified target key'
require_bootstrap_doc '700.*600|600.*700' \
'the root bootstrap docs do not state the exact SSH ownership and modes'
require_bootstrap_doc 'hardening (is )?unavailable.*(without|until).*key' \
'the root bootstrap docs do not say hardening is unavailable without a key'
assert_bootstrap_probe_rejected() {
local name="$1" pattern="$2" weakened_doc="$3"
if grep -qiE "$pattern" <<<"$weakened_doc"; then
note "the $name assertion accepts its weakened documentation probe"
fi
}
target_key_requirement='target user owns[^.]*\.ssh[^.]*mode[^.]*([^0-9]|^)0700([^0-9]|$)[^.]*authorized_keys[^.]*mode[^.]*([^0-9]|^)0600([^0-9]|$)'
hardening_continues_requirement='hardening[[:space:]]+is[[:space:]]+unavailable[^.]*without[^.]*verified[^.]*key[^.]*install[[:space:]]+continues[^.]*without[[:space:]]+(it|SSH[[:space:]]+hardening)'
atomic_dropin_requirement='atomic[[:space:]]+same-directory[[:space:]]+drop-in'
rollback_requirement='validation[^.]*reload[^.]*fail[^.]*(restor|rollback)[^.]*previous[[:space:]]+drop-in'
require_bootstrap_doc "$target_key_requirement" \
'the root bootstrap docs do not require target-user ownership with exact 0700/0600 SSH modes'
require_bootstrap_doc "$hardening_continues_requirement" \
'the root bootstrap docs do not say bootstrap continues without unavailable SSH hardening'
require_bootstrap_doc 'sshd -t' \
'the root bootstrap docs do not name sshd -t validation'
require_bootstrap_doc 'atomic.*same.directory|same.directory.*atomic' \
require_bootstrap_doc "$atomic_dropin_requirement" \
'the root bootstrap docs do not describe the atomic same-directory drop-in'
require_bootstrap_doc 'detected (SSH )?unit.*reload|reload.*detected (SSH )?unit' \
'the root bootstrap docs do not describe reloading the detected SSH unit'
require_bootstrap_doc 'restores? (the )?previous drop-in.*(validation|reload)|(validation|reload).*restores? (the )?previous drop-in' \
require_bootstrap_doc "$rollback_requirement" \
'the root bootstrap docs do not promise rollback on validation or reload failure'
require_bootstrap_doc 'fixture contracts.*(these|this) (path|branch)|fixture contracts.*test' \
'the root bootstrap docs do not limit proof to fixture contracts'
require_bootstrap_doc 'no real daemon reload.*panama test --safe|panama test --safe.*no real daemon reload' \
'the root bootstrap docs imply a live daemon reload under the safe suite'
# These prove the semantic assertions above reject the precise omissions they
# guard against. They mutate only the scoped documentation string; README.md
# itself remains the real input that must satisfy the contract.
assert_bootstrap_probe_rejected 'exact SSH modes' "$target_key_requirement" \
"${bootstrap_doc//0700/700}"
assert_bootstrap_probe_rejected 'target-user ownership' "$target_key_requirement" \
"${bootstrap_doc//target user owns/someone owns}"
assert_bootstrap_probe_rejected 'hardening availability' "$hardening_continues_requirement" \
"${bootstrap_doc//unavailable/available}"
assert_bootstrap_probe_rejected 'hardening continuation' "$hardening_continues_requirement" \
"${bootstrap_doc//continues/stops}"
assert_bootstrap_probe_rejected 'atomic drop-in' "$atomic_dropin_requirement" \
"${bootstrap_doc//atomic /}"
assert_bootstrap_probe_rejected 'rollback after failure' "$rollback_requirement" \
"${bootstrap_doc//restores /keeps }"
assert_bootstrap_probe_rejected 'rollback trigger' "$rollback_requirement" \
"${bootstrap_doc//fails/works}"
if grep -qiE 'merely writes? (the )?(SSH )?(drop-in|file)|reload failure.*ignored|ignores? .*reload failure' <<<"$bootstrap_doc"; then
note 'the root bootstrap docs weaken the transaction by treating the write or reload failure as harmless'
fi