gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix installer state and launcher freshness checks

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 17:31:46 -04:00
parent 99156442b5
commit b5832fc94a
6 changed files with 156 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/setup/package-provenance-contract
+25
View File
@@ -164,6 +164,31 @@ expect_failure key_fingerprint_matches "$fixtures/fixture-key.asc" '000000000000
cat "$fixtures/fixture-key.asc" "$fixtures/wrong-signer-key.asc" > "$test_tmp/combined-key.asc"
expect_failure key_fingerprint_matches "$test_tmp/combined-key.asc" "$fixture_fingerprint"
# A parser must not accept plausible output from a GPG process that failed.
# The later import and verify calls succeed so both public helpers depend on
# the show-only producer's status rather than failing for an unrelated reason.
producer_failure_bin="$test_tmp/gpg-producer-failure-bin"
mkdir "$producer_failure_bin"
cat > "$producer_failure_bin/gpg" <<EOF
#!/usr/bin/env bash
if [[ " \$* " == *' --import-options show-only '* ]]; then
printf 'pub:::::::::\n'
printf 'fpr:::::::::$fixture_fingerprint:\n'
exit 42
fi
exit 0
EOF
chmod +x "$producer_failure_bin/gpg"
expect_failure env PATH="$producer_failure_bin:$PATH" bash -c '
source "$1"
key_fingerprint_matches "$2" "$3"
' _ "$repo_dir/setup/lib/artifact-provenance" "$fixtures/fixture-key.asc" "$fixture_fingerprint"
expect_failure env PATH="$producer_failure_bin:$PATH" bash -c '
source "$1"
verify_detached_signature "$2" "$3" "$4"
' _ "$repo_dir/setup/lib/artifact-provenance" "$fixtures/fixture-key.asc" \
"$fixtures/SHASUMS256.txt.asc" "$fixtures/SHASUMS256.txt"
expect_success verify_detached_signature \
"$fixtures/fixture-key.asc" "$fixtures/SHASUMS256.txt.asc" "$fixtures/SHASUMS256.txt"
expect_failure verify_detached_signature \