Own canonical offline private Go module build tooling

Authored-By: Codex (GPT-6) <noreply@openai.com>
2026-09-07 14:52:03 +00:00
parent b2540dcac2
commit 320cab62a0
7 changed files with 626 additions and 0 deletions
@@ -0,0 +1,174 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestBundleRejectsStaleMissingModifiedAndUnexpectedArtifacts(t *testing.T) {
+	t.Chdir(t.TempDir())
+	os.WriteFile("go.mod", []byte("module example.invalid/test\n"), 0600)
+	os.WriteFile("go.sum", []byte("recorded sum\n"), 0600)
+	mod, _ := inputDigest("go.mod")
+	sum, _ := inputDigest("go.sum")
+	m := manifest{Version: 1, GoModSHA256: mod, GoSumSHA256: sum, Modules: []module{{Path: "code.fritzlab.net/agenthub/example", Version: "v0.1.0"}}}
+	for _, ext := range []string{".info", ".mod", ".zip"} {
+		name := "code.fritzlab.net/agenthub/example/@v/v0.1.0" + ext
+		b := []byte("canonical artifact " + ext)
+		os.MkdirAll(filepath.Dir(filepath.Join(bundleRoot, name)), 0700)
+		os.WriteFile(filepath.Join(bundleRoot, name), b, 0600)
+		m.Modules[0].Files = append(m.Modules[0].Files, artifact{Path: name, Size: int64(len(b)), SHA256: digest(b)})
+	}
+	b, _ := json.Marshal(m)
+	os.WriteFile(filepath.Join(bundleRoot, "manifest.json"), b, 0600)
+	if err := check(); err != nil {
+		t.Fatal(err)
+	}
+	originalPath, originalVersion := m.Modules[0].Path, m.Modules[0].Version
+	for _, change := range []string{"path", "version"} {
+		if change == "path" {
+			m.Modules[0].Path = "code.fritzlab.net/agenthub/other"
+		} else {
+			m.Modules[0].Version = "v0.2.0"
+		}
+		changed, _ := json.Marshal(m)
+		os.WriteFile(filepath.Join(bundleRoot, "manifest.json"), changed, 0600)
+		if check() == nil {
+			t.Fatal("artifact accepted under different module identity")
+		}
+		m.Modules[0].Path, m.Modules[0].Version = originalPath, originalVersion
+	}
+	os.WriteFile(filepath.Join(bundleRoot, "manifest.json"), b, 0600)
+	os.WriteFile("go.mod", []byte("changed graph\n"), 0600)
+	if check() == nil {
+		t.Fatal("stale dependency closure accepted")
+	}
+	os.WriteFile("go.mod", []byte("module example.invalid/test\n"), 0600)
+	path := filepath.Join(bundleRoot, m.Modules[0].Files[2].Path)
+	original, _ := os.ReadFile(path)
+	os.WriteFile(path, []byte("corrupted zip"), 0600)
+	if check() == nil {
+		t.Fatal("modified artifact accepted")
+	}
+	os.Remove(path)
+	if check() == nil {
+		t.Fatal("missing artifact accepted")
+	}
+	os.WriteFile(path, original, 0600)
+	extra := filepath.Join(bundleRoot, "extra")
+	os.WriteFile(extra, []byte("unlisted"), 0600)
+	if check() == nil {
+		t.Fatal("unlisted artifact accepted")
+	}
+	os.Remove(extra)
+	os.Symlink("manifest.json", extra)
+	if check() == nil {
+		t.Fatal("symlink accepted")
+	}
+}
+
+func TestNativeGoSumRejectsChangedModuleArtifact(t *testing.T) {
+	repository, err := filepath.Abs("..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	raw, err := os.ReadFile(filepath.Join(repository, bundleRoot, "manifest.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	selected := m.Modules[0]
+	root := t.TempDir()
+	proxy := filepath.Join(root, "proxy")
+	for _, f := range selected.Files {
+		b, err := os.ReadFile(filepath.Join(repository, bundleRoot, f.Path))
+		if err != nil {
+			t.Fatal(err)
+		}
+		target := filepath.Join(proxy, f.Path)
+		if err = os.MkdirAll(filepath.Dir(target), 0700); err != nil {
+			t.Fatal(err)
+		}
+		if strings.HasSuffix(f.Path, ".mod") {
+			b = append(b, '\n')
+		}
+		if err = os.WriteFile(target, b, 0600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	sum, err := os.ReadFile(filepath.Join(repository, "go.sum"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	os.WriteFile(filepath.Join(root, "go.sum"), sum, 0600)
+	os.WriteFile(filepath.Join(root, "go.mod"), []byte("module example.invalid/checksum\n\ngo 1.27.0\n"), 0600)
+	cmd := exec.Command("go", "mod", "download", selected.Path+"@"+selected.Version)
+	cmd.Dir = root
+	cmd.Env = append(os.Environ(), "GOMODCACHE="+filepath.Join(root, "cache"), "GOPROXY=file://"+proxy, "GONOPROXY=none", "GONOSUMDB="+privatePrefix, "GOSUMDB=off", "GOTOOLCHAIN=local", "GOFLAGS=", "GOWORK=off")
+	output, err := cmd.CombinedOutput()
+	if err == nil || !bytes.Contains(output, []byte("checksum mismatch")) {
+		t.Fatalf("native module checksum guard failed: %v: %s", err, output)
+	}
+}
+
+func TestGeneratorMissingPrivateMetadataNeverInvokesGit(t *testing.T) {
+	root := t.TempDir()
+	t.Chdir(root)
+	os.WriteFile("go.mod", []byte("module example.invalid/offline\n\ngo 1.27.0\n\nrequire code.fritzlab.net/agenthub/missing v0.0.1\n"), 0600)
+	os.WriteFile("go.sum", nil, 0600)
+	bin := filepath.Join(root, "bin")
+	os.Mkdir(bin, 0700)
+	marker := filepath.Join(root, "git-invoked")
+	os.WriteFile(filepath.Join(bin, "git"), []byte("#!/bin/sh\nprintf invoked > \"$PRIVATE_GIT_PROBE\"\nexit 99\n"), 0700)
+	t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Setenv("PRIVATE_GIT_PROBE", marker)
+	t.Setenv("GOMODCACHE", filepath.Join(root, "empty-cache"))
+	t.Setenv("GOPRIVATE", "code.fritzlab.net")
+	t.Setenv("GONOPROXY", "code.fritzlab.net")
+	t.Setenv("GOTOOLCHAIN", "auto")
+	err := generate()
+	if err == nil {
+		t.Fatal("missing cached module accepted")
+	}
+	var failure *exec.ExitError
+	if !errors.As(err, &failure) || !bytes.Contains(failure.Stderr, []byte("module lookup disabled by GOPROXY=off")) {
+		t.Fatalf("not a proven offline refusal: %v", err)
+	}
+	if _, err = os.Stat(marker); !os.IsNotExist(err) {
+		t.Fatal("Git invoked during offline generation")
+	}
+	if _, err = os.Stat(bundleRoot); !os.IsNotExist(err) {
+		t.Fatal("failed generation published output")
+	}
+	os.WriteFile("go.mod", []byte("module example.invalid/offline\n\ngo 1.999.0\n"), 0600)
+	_, err = nativeGo("list", "-m", "-json", "all")
+	if !errors.As(err, &failure) || !bytes.Contains(failure.Stderr, []byte("GOTOOLCHAIN=local")) {
+		t.Fatalf("toolchain download not disabled: %v", err)
+	}
+}
+
+func TestCanonicalModuleArtifactPathBinding(t *testing.T) {
+	for _, test := range []struct{ path, version, want string }{
+		{"code.fritzlab.net/agenthub/Provider", "v1.2.3-RC.1", "code.fritzlab.net/agenthub/!provider/@v/v1.2.3-!r!c.1"},
+		{"code.fritzlab.net/agenthub/provider", "v2.0.0+incompatible", "code.fritzlab.net/agenthub/provider/@v/v2.0.0+incompatible"},
+	} {
+		got, err := moduleStem(test.path, test.version)
+		if err != nil || got != test.want {
+			t.Fatalf("stem %q %v", got, err)
+		}
+	}
+	for _, path := range []string{"code.fritzlab.net/agenthub/../provider", "code.fritzlab.net/agenthub/provider!", "other.invalid/agenthub/provider"} {
+		if _, err := moduleStem(path, "v1.0.0"); err == nil {
+			t.Fatal("invalid path accepted")
+		}
+	}
+}