action/image-build
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make native checksum proof independent of a consumer bundle

Browse Source 
Authored-By: Codex (GPT-6) <noreply@openai.com>
This commit is contained in:
Evelyn Chen
2026-09-07 14:53:04 +00:00
parent 320cab62a0
commit e75412e6d4
1 changed files with 28 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/private-modules/main_test.go
+28 -36
View File
@@ -1,13 +1,13 @@
package main
import (
"archive/zip"
"bytes"
"encoding/json"
"errors"
"os"
"os/exec"
"path/filepath"
"strings"
"testing"
)
@@ -74,47 +74,39 @@ func TestBundleRejectsStaleMissingModifiedAndUnexpectedArtifacts(t *testing.T) {
}
func TestNativeGoSumRejectsChangedModuleArtifact(t *testing.T) {
repository, err := filepath.Abs("..")
if err != nil {
t.Fatal(err)
}
var m manifest
raw, err := os.ReadFile(filepath.Join(repository, bundleRoot, "manifest.json"))
if err != nil {
t.Fatal(err)
}
if err = json.Unmarshal(raw, &m); err != nil {
t.Fatal(err)
}
selected := m.Modules[0]
root := t.TempDir()
proxy := filepath.Join(root, "proxy")
for _, f := range selected.Files {
b, err := os.ReadFile(filepath.Join(repository, bundleRoot, f.Path))
if err != nil {
t.Fatal(err)
}
target := filepath.Join(proxy, f.Path)
if err = os.MkdirAll(filepath.Dir(target), 0700); err != nil {
t.Fatal(err)
}
if strings.HasSuffix(f.Path, ".mod") {
b = append(b, '\n')
}
if err = os.WriteFile(target, b, 0600); err != nil {
t.Fatal(err)
}
modulePath, version := "code.fritzlab.net/fixture/module", "v0.1.0"
base := filepath.Join(proxy, modulePath, "@v", version)
if err := os.MkdirAll(filepath.Dir(base), 0700); err != nil {
t.Fatal(err)
}
sum, err := os.ReadFile(filepath.Join(repository, "go.sum"))
mod := []byte("module " + modulePath + "\n\ngo 1.27.0\n")
os.WriteFile(base+".mod", mod, 0600)
os.WriteFile(base+".info", []byte(`{"Version":"v0.1.0","Time":"2026-01-01T00:00:00Z"}`), 0600)
var archive bytes.Buffer
zw := zip.NewWriter(&archive)
entry, err := zw.Create(modulePath + "@" + version + "/go.mod")
if err != nil {
t.Fatal(err)
}
os.WriteFile(filepath.Join(root, "go.sum"), sum, 0600)
os.WriteFile(filepath.Join(root, "go.mod"), []byte("module example.invalid/checksum\n\ngo 1.27.0\n"), 0600)
cmd := exec.Command("go", "mod", "download", selected.Path+"@"+selected.Version)
cmd.Dir = root
cmd.Env = append(os.Environ(), "GOMODCACHE="+filepath.Join(root, "cache"), "GOPROXY=file://"+proxy, "GONOPROXY=none", "GONOSUMDB="+privatePrefix, "GOSUMDB=off", "GOTOOLCHAIN=local", "GOFLAGS=", "GOWORK=off")
output, err := cmd.CombinedOutput()
entry.Write(mod)
if err = zw.Close(); err != nil {
t.Fatal(err)
}
os.WriteFile(base+".zip", archive.Bytes(), 0600)
os.WriteFile(filepath.Join(root, "go.mod"), []byte("module example.invalid/checksum\n\ngo 1.27.0\n\nrequire "+modulePath+" "+version+"\n"), 0600)
run := func(cache string) ([]byte, error) {
cmd := exec.Command("go", "mod", "download", modulePath+"@"+version)
cmd.Dir = root
cmd.Env = append(os.Environ(), "GO111MODULE=on", "GOMODCACHE="+filepath.Join(root, cache), "GOPROXY=file://"+proxy, "GONOPROXY=none", "GONOSUMDB="+privatePrefix, "GOSUMDB=off", "GOTOOLCHAIN=local", "GOFLAGS=", "GOWORK=off")
return cmd.CombinedOutput()
}
if output, err := run("original-cache"); err != nil {
t.Fatalf("native fixture admission: %v: %s", err, output)
}
os.WriteFile(base+".mod", append(mod, '\n'), 0600)
output, err := run("fresh-cache")
if err == nil || !bytes.Contains(output, []byte("checksum mismatch")) {
t.Fatalf("native module checksum guard failed: %v: %s", err, output)
}