v31.1-roots.1 · Commit 8: [PATCH 08/17] chore(roots): integrate v31 identity and maintenance tooling

ci/test/test_prepare_release.py

Before: /dev/null · After: ci/test/test_prepare_release.py

File metadata

new file mode 100755
index 0000000000000000000000000000000000000000..eefc00275c41480c3e1b45768881746ec3d59b15

Download original patch · Release notes

Diff rows 1–400 of 457. Line numbers refer to the original before/after files.

+ Added− RemovedUnmarked lines are context.

Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.

ci/test/test_prepare_release.py ADDED Viewed

	@@ -0,0 +1,457 @@

+#!/usr/bin/env python3
+# Copyright (c) 2026-present The Bitcoin Roots developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+import hashlib
+import io
+import os
+import shutil
+from pathlib import Path
+import subprocess
+import tarfile
+import tempfile
+import unittest
+import zipfile
+import test_release_notices as notice_fixtures
+ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = ROOT / "ci/release/prepare-release.sh"
+ARCHIVE_TOOL = ROOT / "ci/release/archive.py"
+PUBLIC_KEY = ROOT / "contrib/release/bitcoin-roots-release-key.asc"
+class PrepareReleaseTest(unittest.TestCase):
+    def write_package(self, path, root, content, copying=None, notices=True):
+        member = f"{root}/bin/bitcoind"
+        copying = (ROOT / "COPYING").read_bytes() if copying is None else copying
+        notice_members = {}
+        platform = path.name.removeprefix("bitcoin-roots-").removesuffix(".tar.gz").removesuffix(".zip")
+        if notices and platform in notice_fixtures.NOTICES.PLATFORMS:
+            with tempfile.TemporaryDirectory() as temporary_dir:
+                work = Path(temporary_dir)
+                descriptor = notice_fixtures.ReleaseNoticesTest().descriptor(work, platform)
+                notice_fixtures.NOTICES.collect(platform, descriptor, work / "collected")
+                notice_members = {f"{root}/notices/{file.relative_to(work / 'collected').as_posix()}": file.read_bytes()
+                                  for file in (work / "collected").rglob("*") if file.is_file()}
+        if path.name.endswith(".tar.gz"):
+            with tarfile.open(path, mode="w:gz") as package:
+                info = tarfile.TarInfo(member)
+                info.size = len(content)
+                package.addfile(info, io.BytesIO(content))
+                if copying:
+                    info = tarfile.TarInfo(f"{root}/COPYING")
+                    info.size = len(copying)
+                    package.addfile(info, io.BytesIO(copying))
+                for name, data in notice_members.items():
+                    info = tarfile.TarInfo(name)
+                    info.size = len(data)
+                    package.addfile(info, io.BytesIO(data))
+        else:
+            with zipfile.ZipFile(path, mode="w") as package:
+                package.writestr(member, content)
+                if copying:
+                    package.writestr(f"{root}/COPYING", copying)
+                for name, data in notice_members.items():
+                    package.writestr(name, data)
+    def test_final_gate_accepts_canonical_copying_without_dependency_index(self):
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            downloads = Path(temporary_dir) / "downloads"
+            downloads.mkdir()
+            archive = downloads / "bitcoin-roots-darwin-arm64.zip"
+            self.write_package(archive, "bitcoin-roots-30.3-roots.1", b"binary", notices=False)
+            (downloads / "series.patch").write_text("patch\n")
+            output = Path(temporary_dir) / "output"
+            result = subprocess.run([SCRIPT, downloads, output, PUBLIC_KEY, "v30.3-roots.1", "1"],
+                                    capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertTrue((output / "SHA512SUMS").exists())
+    def test_explicit_assembly_rejects_intermediate_package(self):
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            work = Path(temporary_dir)
+            downloads = work / "downloaded-artifacts"
+            downloads.mkdir()
+            self.write_package(downloads / "bitcoin-roots-linux-x86_64.tar.gz",
+                               "bitcoin-roots-30.3-roots.1", b"binary", copying=b"", notices=False)
+            (downloads / "series.patch").write_text("patch\n")
+            result = subprocess.run([SCRIPT, downloads, work / "release-assets", PUBLIC_KEY,
+                                     "v30.3-roots.1", "1"], capture_output=True, text=True)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertFalse((work / "release-assets/SHA512SUMS").exists())
+    def test_stages_copying_for_every_platform_archive(self):
+        workflow = (ROOT / ".github/workflows/release.yml").read_text()
+        # Both Linux and both macOS matrix jobs share their platform's block.
+        self.assertEqual(workflow.count("ci/release/archive.py stage-copying"), 3)
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            work = Path(temporary_dir)
+            for platform in ("linux-x86_64", "linux-aarch64", "darwin-x86_64", "darwin-arm64", "windows-x86_64"):
+                with self.subTest(platform=platform):
+                    root = work / platform / "bitcoin-roots-30.3-roots.1"
+                    root.mkdir(parents=True)
+                    (root / "payload").write_bytes(b"executable fixture")
+                    subprocess.run(["python3", ARCHIVE_TOOL, "stage-copying", root], check=True)
+                    self.assertEqual((root / "COPYING").read_bytes(), (ROOT / "COPYING").read_bytes())
+                    archive = root.parent / ("package.tar.gz" if platform.startswith("linux") else "package.zip")
+                    if platform.startswith("linux"):
+                        with tarfile.open(archive, mode="w:gz") as package:
+                            package.add(root, arcname=root.name)
+                    else:
+                        with zipfile.ZipFile(archive, mode="w") as package:
+                            for path in root.iterdir():
+                                package.write(path, f"{root.name}/{path.name}")
+                    subprocess.run(["python3", ARCHIVE_TOOL, "validate", archive, root.name,
+                                    "--copying", ROOT / "COPYING"], check=True)
+    def test_actual_unix_workflow_stages_copying_without_dependency_index_and_prepares(self):
+        lines = (ROOT / ".github/workflows/release.yml").read_text().splitlines()
+        def packaging_block(name):
+            start = lines.index(f"      - name: {name}")
+            start = lines.index("        run: |", start) + 1
+            end = start
+            while end < len(lines) and (lines[end].startswith("          ") or not lines[end]):
+                end += 1
+            return "\n".join(line[10:] for line in lines[start:end])
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            for platform in ("linux-x86_64", "linux-aarch64", "darwin-x86_64", "darwin-arm64"):
+                with self.subTest(platform=platform):
+                    work = Path(temporary_dir) / platform
+                    (work / "runner").mkdir(parents=True)
+                    out = work / "out"
+                    out.mkdir()
+                    environment = {**os.environ, "RUNNER_TEMP": str(work / "runner"),
+                                   "BASE_OUTDIR": str(out), "BASE_BUILD_DIR": str(work / "runner"), "ARTIFACT_NAME": f"bitcoin-roots-{platform}",
+                                   "RELEASE_TAG": "v30.3-roots.1", "GITHUB_WORKSPACE": str(work)}
+                    if platform.startswith("linux"):
+                        (out / "payload").write_bytes(b"binary fixture")
+                        # Model the non-writable Docker-owned mount. Privilege
+                        # escalation is unavailable locally; this narrow sudo
+                        # fixture grants write access only around the command.
+                        out.chmod(0o555)
+                        if os.geteuid() != 0:
+                            denied = subprocess.run(["python3", ARCHIVE_TOOL, "stage-copying", out],
+                                                    capture_output=True, text=True)
+                            self.assertNotEqual(denied.returncode, 0)
+                            self.assertIn("Permission denied", denied.stderr)
+                        tools = work / "tools"
+                        tools.mkdir()
+                        sudo = tools / "sudo"
+                        sudo.write_text('#!/usr/bin/env bash\nset -Eeuo pipefail\n'
+                                        'printf "%s\\n" "$@" > "$SUDO_RECORD"\n'
+                                        'test "$#" -eq 4\n'
+                                        'test "$1" = python3\n'
+                                        'test "$2" = ci/release/archive.py\n'
+                                        'test "$3" = stage-copying\n'
+                                        'chmod u+w "$4"\n'
+                                        "trap 'chmod u-w \"$4\"' EXIT\n"
+                                        '"$@"\n')
+                        sudo.chmod(0o755)
+                        environment.update(PATH=f"{tools}:{os.environ['PATH']}",
+                                           SUDO_RECORD=str(work / "sudo-record"))
+                        block = packaging_block("Package release artifacts")
+                    else:
+                        deploy = work / "ci/scratch/build-fixture"
+                        deploy.mkdir(parents=True)
+                        with zipfile.ZipFile(deploy / "Bitcoin-Roots.zip", mode="w") as package:
+                            package.writestr("Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt", b"binary fixture")
+                        block = packaging_block("Stage release package")
+                    subprocess.run(["bash", "-c", block], cwd=ROOT, env=environment, check=True)
+                    archive = next((work / "runner/release-packages").iterdir())
+                    member = "bitcoin-roots-30.3-roots.1/COPYING"
+                    if platform.startswith("linux"):
+                        with tarfile.open(archive) as package:
+                            notice = package.extractfile(member).read()
+                            self.assertEqual(package.extractfile("bitcoin-roots-30.3-roots.1/payload").read(), b"binary fixture")
+                    else:
+                        with zipfile.ZipFile(archive) as package:
+                            notice = package.read(member)
+                            self.assertEqual(package.read("bitcoin-roots-30.3-roots.1/Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt"), b"binary fixture")
+                    self.assertEqual(notice, (ROOT / "COPYING").read_bytes())
+                    if platform.startswith("linux"):
+                        self.assertEqual((work / "sudo-record").read_text().splitlines(),
+                                         ["python3", "ci/release/archive.py", "stage-copying", str(out)])
+                        self.assertEqual(out.stat().st_mode & 0o777, 0o555)
+                        # Permit fixture cleanup, preserving the archived mode.
+                        out.chmod(0o755)
+                    downloads = work / "assembled-downloads"
+                    downloads.mkdir()
+                    assembled = downloads / archive.name
+                    shutil.copyfile(archive, assembled)
+                    (downloads / "series.patch").write_text("patch\n")
+                    subprocess.run([SCRIPT, downloads, work / "release-assets", PUBLIC_KEY,
+                                    "v30.3-roots.1", "1"], check=True)
+                    self.assertTrue((work / "release-assets/SHA512SUMS").exists())
+    def test_release_preparation_rejects_missing_or_mismatched_copying(self):
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            work = Path(temporary_dir)
+            for suffix in ("tar.gz", "zip"):
+                for content in (b"", b"wrong notice"):
+                    with self.subTest(suffix=suffix, copying=content):
+                        downloads = work / f"{suffix}-{len(content)}"
+                        downloads.mkdir()
+                        self.write_package(downloads / f"package.{suffix}", "bitcoin-roots-30.3-roots.1", b"payload", copying=content)
+                        (downloads / "series.patch").write_text("patch\n")
+                        result = subprocess.run([SCRIPT, downloads, downloads / "output", PUBLIC_KEY,
+                                                 "v30.3-roots.1", "1"], capture_output=True, text=True)
+                        self.assertNotEqual(result.returncode, 0)
+                        self.assertIn("COPYING", result.stderr)
+    def test_copying_cannot_be_a_symlink_or_directory(self):
+        root = "bitcoin-roots-30.3-roots.1"
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            for kind in ("symlink", "directory", "directory_without_slash"):
+                with self.subTest(kind=kind):
+                    archive = Path(temporary_dir) / f"{kind}.zip"
+                    with zipfile.ZipFile(archive, mode="w") as package:
+                        package.writestr(f"{root}/notice", (ROOT / "COPYING").read_bytes())
+                        info = zipfile.ZipInfo(f"{root}/COPYING" + ("/" if kind == "directory" else ""))
+                        info.create_system = 3
+                        info.external_attr = (0o120777 if kind == "symlink" else 0o40755) << 16
+                        package.writestr(info, "notice" if kind == "symlink" else (ROOT / "COPYING").read_bytes())
+                    result = subprocess.run(["python3", ARCHIVE_TOOL, "validate", archive, root,
+                                             "--copying", ROOT / "COPYING"], capture_output=True, text=True)
+                    self.assertNotEqual(result.returncode, 0)
+                    self.assertIn("COPYING", result.stderr)
+    def test_prepares_sorted_manifest(self):
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            work = Path(temporary_dir)
+            downloads = work / "downloads"
+            output = work / "output"
+            (downloads / "linux").mkdir(parents=True)
+            (downloads / "darwin").mkdir()
+            packages = {
+                downloads / "linux/bitcoin-roots-linux-x86_64.tar.gz": b"linux package",
+                downloads / "darwin/bitcoin-roots-darwin-arm64.zip": b"macOS package",
+            }
+            archive_root = "bitcoin-roots-29.4-roots.1"
+            for path, content in packages.items():
+                self.write_package(path, archive_root, content)
+            patch = downloads / "bitcoin-roots-29.4-roots.1.patch"
+            patch.write_text("From patch-series\n", encoding="utf-8")
+            subprocess.run([SCRIPT, downloads, output, PUBLIC_KEY, "v29.4-roots.1", "2"], check=True)
+            manifest = (output / "SHA512SUMS").read_text(encoding="utf-8")
+            self.assertIn("# Bitcoin Roots release: v29.4-roots.1\n", manifest)
+            checksum_lines = [line for line in manifest.splitlines() if not line.startswith("#")]
+            expected = [
+                f"{hashlib.sha512(path.read_bytes()).hexdigest()}  {path.name}"
+                for path in sorted([*packages, patch])
+            ]
+            self.assertEqual(checksum_lines, expected)
+            subprocess.run(["sha512sum", "--check", "SHA512SUMS"], cwd=output, check=True)
+    def test_rejects_duplicate_package_names(self):
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            work = Path(temporary_dir)
+            downloads = work / "downloads"
+            output = work / "output"
+            (downloads / "one").mkdir(parents=True)
+            (downloads / "two").mkdir()
+            (downloads / "one/package.zip").write_bytes(b"one")
+            (downloads / "two/package.zip").write_bytes(b"two")
+            result = subprocess.run(
+                [SCRIPT, downloads, output, PUBLIC_KEY, "v29.4-roots.1", "2"],
+                capture_output=True, text=True,
+            )
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn("Duplicate release package name: package.zip", result.stderr)
+    def test_requires_exactly_one_nonempty_patch_series(self):
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            work = Path(temporary_dir)
+            downloads = work / "downloads"
+            output = work / "output"
+            downloads.mkdir()
+            archive_root = "bitcoin-roots-29.4-roots.1"
+            self.write_package(downloads / "package.tar.gz", archive_root, b"package")
+            missing = subprocess.run(
+                [SCRIPT, downloads, output, PUBLIC_KEY, "v29.4-roots.1", "1"],
+                capture_output=True, text=True,
+            )
+            self.assertNotEqual(missing.returncode, 0)
+            self.assertIn("Expected one release patch series, found 0", missing.stderr)
+            (downloads / "one.patch").write_text("one\n", encoding="utf-8")
+            (downloads / "two.patch").write_text("two\n", encoding="utf-8")
+            duplicate = subprocess.run(
+                [SCRIPT, downloads, output, PUBLIC_KEY, "v29.4-roots.1", "1"],
+                capture_output=True, text=True,
+            )
+            self.assertNotEqual(duplicate.returncode, 0)
+            self.assertIn("Expected one release patch series, found 2", duplicate.stderr)
+            (downloads / "two.patch").unlink()
+            (downloads / "one.patch").write_bytes(b"")
+            empty = subprocess.run(
+                [SCRIPT, downloads, output, PUBLIC_KEY, "v29.4-roots.1", "1"],
+                capture_output=True, text=True,
+            )
+            self.assertNotEqual(empty.returncode, 0)
+            self.assertIn("Release patch series is empty", empty.stderr)
+    def test_archive_root_uses_roots_tag_or_commit(self):
+        cases = [
+            ({"RELEASE_TAG": "v29.4-roots.1"}, "bitcoin-roots-29.4-roots.1"),
+            ({"RELEASE_TAG": "v29.4rc1-roots.1"}, "bitcoin-roots-29.4rc1-roots.1"),
+            ({"GITHUB_SHA": "0123456789abcdef"}, "bitcoin-roots-git-0123456789ab"),
+        ]
+        for environment, expected in cases:
+            with self.subTest(environment=environment):
+                result = subprocess.run(
+                    ["python3", ARCHIVE_TOOL, "root-name"],
+                    env={"RELEASE_TAG": "", "GITHUB_SHA": "", **environment},
+                    capture_output=True, text=True, check=True,
+                )
+                self.assertEqual(result.stdout.strip(), expected)
+    def test_rejects_unsafe_archive_members(self):
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            work = Path(temporary_dir)
+            archive = work / "unsafe.tar.gz"
+            with tarfile.open(archive, mode="w:gz") as package:
+                for name, kind in [
+                    ("bitcoin-roots-29.4-roots.1/../escape", tarfile.REGTYPE),
+                    ("bitcoin-roots-29.4-roots.1/link", tarfile.SYMTYPE),
+                    ("bitcoin-roots-29.4-roots.1/hard-link", tarfile.LNKTYPE),
+                    ("bitcoin-roots-29.4-roots.1/fifo", tarfile.FIFOTYPE),
+                ]:
+                    info = tarfile.TarInfo(name)
+                    info.type = kind
+                    if kind in {tarfile.SYMTYPE, tarfile.LNKTYPE}:
+                        info.linkname = "outside"
+                    else:
+                        info.size = 1
+                    package.addfile(info, io.BytesIO(b"x") if kind == tarfile.REGTYPE else None)
+            result = subprocess.run(
+                ["python3", ARCHIVE_TOOL, "validate", archive, "bitcoin-roots-29.4-roots.1"],
+                capture_output=True, text=True,
+            )
+            self.assertNotEqual(result.returncode, 0)
+            zip_archive = work / "symlink.zip"
+            with zipfile.ZipFile(zip_archive, mode="w") as package:
+                info = zipfile.ZipInfo("bitcoin-roots-29.4-roots.1/link")
+                info.external_attr = 0o120777 << 16
+                package.writestr(info, "outside")
+            result = subprocess.run(
+                ["python3", ARCHIVE_TOOL, "validate", zip_archive, "bitcoin-roots-29.4-roots.1"],
+                capture_output=True, text=True,
+            )
+            self.assertNotEqual(result.returncode, 0)
+    def test_rejects_wrong_root_empty_payload_and_backslashes(self):
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            work = Path(temporary_dir)
+            cases = {
+                "wrong.zip": ["bitcoin-roots-other/bin/bitcoind"],
+                "empty.zip": ["bitcoin-roots-29.4-roots.1/"],
+                "nested-directory.zip": ["bitcoin-roots-29.4-roots.1/bin/"],
+                "backslash.zip": ["bitcoin-roots-29.4-roots.1\\bin\\bitcoind"],
+            }
+            for name, members in cases.items():
+                archive = work / name
+                with zipfile.ZipFile(archive, mode="w") as package:
+                    for member in members:
+                        package.writestr(member, b"x")
+                with self.subTest(archive=name):
+                    result = subprocess.run(
+                        ["python3", ARCHIVE_TOOL, "validate", archive, "bitcoin-roots-29.4-roots.1"],
+                        capture_output=True, text=True,
+                    )
+                    self.assertNotEqual(result.returncode, 0)
+    def validate_zip_links(self, links, files):
+        root = "bitcoin-roots-30.3-roots.1"
+        with tempfile.TemporaryDirectory() as temporary_dir:
+            archive = Path(temporary_dir) / "framework.zip"
+            with zipfile.ZipFile(archive, mode="w") as package:
+                for name in files:
+                    info = zipfile.ZipInfo(f"{root}/{name}")
+                    info.create_system = 3
+                    info.external_attr = (0o40755 << 16) | 0x10 if name.endswith("/") else 0o100755 << 16
+                    package.writestr(info, b"" if name.endswith("/") else b"payload")
+                for name, target in links.items():
+                    info = zipfile.ZipInfo(f"{root}/{name}")
+                    info.create_system = 3
+                    info.external_attr = 0o120777 << 16
+                    package.writestr(info, target)
+            return subprocess.run(
+                ["python3", ARCHIVE_TOOL, "validate", archive, root],
+                capture_output=True, text=True,
+            )
+    def test_accepts_internal_macos_framework_symlink_chains(self):
+        framework = "Bitcoin-Qt.app/Contents/Frameworks/QtGui.framework"
+        result = self.validate_zip_links(
+            {f"{framework}/Versions/Current": "A",
+             f"{framework}/Resources": "Versions/Current/Resources",
+             f"{framework}/QtGui": "Versions/Current/QtGui"},
+            ["Bitcoin-Qt.app/", "Bitcoin-Qt.app/Contents/", "Bitcoin-Qt.app/Contents/Frameworks/",
+             f"{framework}/", f"{framework}/Versions/", f"{framework}/Versions/A/",
+             f"{framework}/Versions/A/Resources/", f"{framework}/Versions/A/Resources/Info.plist",