44 lines
2.3 KiB
Python
44 lines
2.3 KiB
Python
"""Static safety regression tests; run with python3 -m unittest discover -s tests."""
|
|
from pathlib import Path
|
|
import subprocess
|
|
import unittest
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
class ScannerTests(unittest.TestCase):
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
source = (ROOT / 'PHPGuard/SSHScanner.swift').read_text()
|
|
cls.script = source.split('static let script = #"""',1)[1].split('"""#',1)[0]
|
|
def test_posix_shell_syntax(self):
|
|
p = subprocess.run(['sh','-n'],input=self.script,text=True,capture_output=True)
|
|
self.assertEqual(p.returncode,0,p.stderr)
|
|
def test_required_sections(self):
|
|
for section in ('OS_RELEASE','PACKAGE_MANAGER','PACKAGES','PACKAGE_SOURCES','UPDATES','PACKAGE_ORIGINS','DOCKER','END'):
|
|
self.assertIn('===%s===' % section,self.script)
|
|
def test_supported_managers(self):
|
|
for manager in ('apt','dnf','yum','rpm','zypper','apk'):
|
|
self.assertIn(manager,self.script)
|
|
def test_no_package_mutation(self):
|
|
for command in ('apt upgrade','apt install','dnf update','yum update','apk upgrade','zypper update'):
|
|
self.assertNotIn(command,self.script)
|
|
def test_provenance_guard_is_not_hardcoded_false(self):
|
|
code=(ROOT/'PHPGuard/VulnerabilityService.swift').read_text()
|
|
self.assertNotIn('let hasUbuntuOrigin = false',code)
|
|
self.assertIn('VERIFIED_INSTALLED_ORIGIN|ubuntu|',code)
|
|
# Scanner does not issue an attestation from apt-cache policy alone.
|
|
self.assertNotIn('VERIFIED_INSTALLED_ORIGIN|ubuntu|',self.script)
|
|
def test_no_false_secure_claims(self):
|
|
code=(ROOT/'PHPGuard/VulnerabilityService.swift').read_text()
|
|
self.assertIn('Unverified',code)
|
|
def test_icon_assets_are_assigned(self):
|
|
import json
|
|
directory=ROOT/'PHPGuard/Assets.xcassets/AppIcon.appiconset'
|
|
metadata=json.loads((directory/'Contents.json').read_text())
|
|
assigned={i.get('filename') for i in metadata['images']}
|
|
unassigned={p.name for p in directory.glob('*.png')}-assigned
|
|
self.assertFalse(unassigned,unassigned)
|
|
def test_unknown_vendor_not_verified(self):
|
|
store=(ROOT/'PHPGuard/AuditStore.swift').read_text()
|
|
self.assertIn('No vendor advisory adapter for this distribution',store)
|
|
self.assertIn('vendor-verified:',store)
|
|
if __name__=='__main__': unittest.main()
|