mirror of
https://github.com/saymrwulf/proof-aware-crypto-tooling-agent.git
synced 2026-09-03 19:53:43 +00:00
36 lines
1.7 KiB
Python
36 lines
1.7 KiB
Python
|
"""The publish step overwrites the mirror's verify.py / verify_selftest.py /
|
||
|
|
README.md from the frozen constants in published_assets. A hardening
|
||
|
|
regression here silently fail-opens the PUBLIC verifier on the next publish
|
||
|
|
(exactly what the 2026-07-19 doc audit found: the constants still carried
|
||
|
|
the pre-hardening fail-open verify.py). These tests pin the
|
||
|
|
security-critical markers so that drift fails CI instead of shipping."""
|
||
|
|
|
||
|
|
from pacta_provider.published_assets import README_MD, VERIFY_PY, VERIFY_SELFTEST_PY
|
||
|
|
|
||
|
|
|
||
|
|
def test_verify_py_compiles_and_is_the_hardened_verifier():
|
||
|
|
compile(VERIFY_PY, "verify.py", "exec")
|
||
|
|
for marker in (
|
||
|
|
"FATAL: signature checking unavailable", # fail-closed exit 2
|
||
|
|
"RECEIPT_TYPE", # required type binding
|
||
|
|
"def verify_receipt", # full binding checks
|
||
|
|
"--structural-only", # explicit reduced mode
|
||
|
|
'glob("*.receipt.json")', # --all covers every receipt
|
||
|
|
"public_key_fingerprint_sha256", # required fingerprint
|
||
|
|
):
|
||
|
|
assert marker in VERIFY_PY, f"hardening marker missing: {marker}"
|
||
|
|
|
||
|
|
|
||
|
|
def test_selftest_compiles_and_covers_fail_closed():
|
||
|
|
compile(VERIFY_SELFTEST_PY, "verify_selftest.py", "exec")
|
||
|
|
for marker in ("FAIL CLOSED", "missing key fingerprint REJECTED",
|
||
|
|
"forged (unsigned) root REJECTED"):
|
||
|
|
assert marker in VERIFY_SELFTEST_PY, marker
|
||
|
|
|
||
|
|
|
||
|
|
def test_readme_is_the_corrected_template():
|
||
|
|
assert "identity anchor" in README_MD
|
||
|
|
assert "verify_selftest.py" in README_MD
|
||
|
|
assert "the git hash is the content hash" not in README_MD
|
||
|
|
assert "sole trust anchor" not in README_MD
|