admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

attestation_spec: fixup

Browse Source 
Signed-off-by: William Woodruff <william@yossarian.net>
This commit is contained in:
William Woodruff 2024-05-03 13:01:02 -04:00
parent 18a8b12f7a
commit 2aa3d77f72
No known key found for this signature in database
1 changed files with 33 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
Library/Homebrew/test/attestation_spec.rb
View File

@ -4,6 +4,8 @@ require "diagnostic"
RSpec.describe Homebrew::Attestation do
let(:fake_gh) { Pathname.new("/extremely/fake/gh") }
let(:fake_gh_creds) { "fake-gh-api-token" }
let(:fake_error_status) { instance_double(Process::Status, exitstatus: 1, termsig: nil) }
let(:cached_download) { "/fake/cached/download" }
let(:fake_bottle_filename) { instance_double(Bottle::Filename, to_s: "fakebottle--1.0.faketag.bottle.tar.gz") }
let(:fake_bottle_url) { "https://example.com/#{fake_bottle_filename}" }
@ -61,11 +63,24 @@ RSpec.describe Homebrew::Attestation do
.and_return(fake_gh)
end
it "raises without any gh credentials" do
expect(GitHub::API).to receive(:credentials)
.and_return(nil)
expect do
described_class.check_attestation fake_bottle,
described_class::HOMEBREW_CORE_REPO
end.to raise_error(described_class::GhAuthNeeded)
end
it "raises when gh subprocess fails" do
expect(GitHub::API).to receive(:credentials)
.and_return(fake_gh_creds)
expect(Utils).to receive(:safe_popen_read)
.with(fake_gh, "attestation", "verify", cached_download, "--repo",
.with({ "GH_TOKEN" => fake_gh_creds }, fake_gh, "attestation", "verify", cached_download, "--repo",
described_class::HOMEBREW_CORE_REPO, "--format", "json")
.and_raise(ErrorDuringExecution.new(["foo"], status: 1))
.and_raise(ErrorDuringExecution.new(["foo"], status: fake_error_status))
expect do
described_class.check_attestation fake_bottle,
@ -74,8 +89,11 @@ RSpec.describe Homebrew::Attestation do
end
it "raises when gh returns invalid JSON" do
expect(GitHub::API).to receive(:credentials)
.and_return(fake_gh_creds)
expect(Utils).to receive(:safe_popen_read)
.with(fake_gh, "attestation", "verify", cached_download, "--repo",
.with({ "GH_TOKEN" => fake_gh_creds }, fake_gh, "attestation", "verify", cached_download, "--repo",
described_class::HOMEBREW_CORE_REPO, "--format", "json")
.and_return("\"invalid json")
@ -86,8 +104,11 @@ RSpec.describe Homebrew::Attestation do
end
it "raises when gh returns other subjects" do
expect(GitHub::API).to receive(:credentials)
.and_return(fake_gh_creds)
expect(Utils).to receive(:safe_popen_read)
.with(fake_gh, "attestation", "verify", cached_download, "--repo",
.with({ "GH_TOKEN" => fake_gh_creds }, fake_gh, "attestation", "verify", cached_download, "--repo",
described_class::HOMEBREW_CORE_REPO, "--format", "json")
.and_return(fake_json_resp_wrong_sub)
@ -102,11 +123,14 @@ RSpec.describe Homebrew::Attestation do
before do
allow(described_class).to receive(:gh_executable)
.and_return(fake_gh)
allow(GitHub::API).to receive(:credentials)
.and_return(fake_gh_creds)
end
it "calls gh with args for homebrew-core" do
expect(Utils).to receive(:safe_popen_read)
.with(fake_gh, "attestation", "verify", cached_download, "--repo",
.with({ "GH_TOKEN" => fake_gh_creds }, fake_gh, "attestation", "verify", cached_download, "--repo",
described_class::HOMEBREW_CORE_REPO, "--format", "json", "--cert-identity",
described_class::HOMEBREW_CORE_CI_URI)
.and_return(fake_json_resp)
@ -116,14 +140,14 @@ RSpec.describe Homebrew::Attestation do
it "calls gh with args for backfill when homebrew-core fails" do
expect(Utils).to receive(:safe_popen_read)
.with(fake_gh, "attestation", "verify", cached_download, "--repo",
.with({ "GH_TOKEN" => fake_gh_creds }, fake_gh, "attestation", "verify", cached_download, "--repo",
described_class::HOMEBREW_CORE_REPO, "--format", "json", "--cert-identity",
described_class::HOMEBREW_CORE_CI_URI)
.once
.and_raise(described_class::InvalidAttestationError)
expect(Utils).to receive(:safe_popen_read)
.with(fake_gh, "attestation", "verify", cached_download, "--repo",
.with({ "GH_TOKEN" => fake_gh_creds }, fake_gh, "attestation", "verify", cached_download, "--repo",
described_class::BACKFILL_REPO, "--format", "json")
.and_return(fake_json_resp_backfill)
@ -132,14 +156,14 @@ RSpec.describe Homebrew::Attestation do
it "raises when the backfilled attestation is too new" do
expect(Utils).to receive(:safe_popen_read)
.with(fake_gh, "attestation", "verify", cached_download, "--repo",
.with({ "GH_TOKEN" => fake_gh_creds }, fake_gh, "attestation", "verify", cached_download, "--repo",
described_class::HOMEBREW_CORE_REPO, "--format", "json", "--cert-identity",
described_class::HOMEBREW_CORE_CI_URI)
.once
.and_raise(described_class::InvalidAttestationError)
expect(Utils).to receive(:safe_popen_read)
.with(fake_gh, "attestation", "verify", cached_download, "--repo",
.with({ "GH_TOKEN" => fake_gh_creds }, fake_gh, "attestation", "verify", cached_download, "--repo",
described_class::BACKFILL_REPO, "--format", "json")
.and_return(fake_json_resp_too_new)