v31.1-roots.1 · Commit 8: [PATCH 08/17] chore(roots): integrate v31 identity and maintenance tooling
ci/test/test_runner_release_notices.py
Before: /dev/null · After: ci/test/test_runner_release_notices.py
File metadata
new file mode 100755 index 0000000000000000000000000000000000000000..534c52b7b77737e0d61bfe5ee90e7dcdef83fed2
Download original patch · Release notes
Diff rows 1–220 of 220. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
ci/test/test_runner_release_notices.py
ADDED
|
@@ -0,0 +1,220 @@
|
|
|
1
|
+
#!/usr/bin/env python3
|
|
2
|
+
# Copyright (c) 2026-present The Bitcoin Roots developers
|
|
3
|
+
# Distributed under the MIT software license, see the accompanying
|
|
4
|
+
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
5
|
+
|
|
6
|
+
import importlib.util
|
|
7
|
+
import io
|
|
8
|
+
import json
|
|
9
|
+
import os
|
|
10
|
+
from types import SimpleNamespace
|
|
11
|
+
from pathlib import Path
|
|
12
|
+
import sys
|
|
13
|
+
import tarfile
|
|
14
|
+
import tempfile
|
|
15
|
+
import unittest
|
|
16
|
+
from unittest.mock import patch
|
|
17
|
+
|
|
18
|
+
ROOT = Path(__file__).resolve().parents[2]
|
|
19
|
+
sys.path.insert(0, str(ROOT / 'ci/release'))
|
|
20
|
+
spec = importlib.util.spec_from_file_location('runner', ROOT / 'ci/release/runner-notices.py')
|
|
21
|
+
runner = importlib.util.module_from_spec(spec)
|
|
22
|
+
spec.loader.exec_module(runner)
|
|
23
|
+
|
|
24
|
+
|
|
25
|
+
class RunnerNoticeTest(unittest.TestCase):
|
|
26
|
+
def setUp(self):
|
|
27
|
+
temporary = tempfile.TemporaryDirectory()
|
|
28
|
+
self.addCleanup(temporary.cleanup)
|
|
29
|
+
self.work = Path(temporary.name)
|
|
30
|
+
|
|
31
|
+
def archive(self, name='source/LICENSE'):
|
|
32
|
+
archive = self.work / 'source.tar.gz'
|
|
33
|
+
with tarfile.open(archive, 'w:gz') as out:
|
|
34
|
+
entry = tarfile.TarInfo(name)
|
|
35
|
+
data = b'Exact upstream copyright and license\n'
|
|
36
|
+
entry.size = len(data)
|
|
37
|
+
out.addfile(entry, io.BytesIO(data))
|
|
38
|
+
return archive, runner.sha256(archive)
|
|
39
|
+
|
|
40
|
+
def test_pinned_depends_receipt_uses_real_archive_and_host_selection(self):
|
|
41
|
+
source, checksum = self.archive()
|
|
42
|
+
depends = self.work / 'depends'
|
|
43
|
+
(depends / 'packages').mkdir(parents=True)
|
|
44
|
+
(depends / 'packages/boost.mk').write_text('pinned recipe\n')
|
|
45
|
+
installed = self.work / 'installed'
|
|
46
|
+
installed.mkdir()
|
|
47
|
+
(installed / 'toolchain.cmake').write_text('installed toolchain\n')
|
|
48
|
+
values = {'packages': 'boost', 'host_prefix': str(installed), 'SOURCES_PATH': str(self.work),
|
|
49
|
+
'boost_version': '1.88.0', 'boost_source': str(source), 'boost_sha256_hash': checksum,
|
|
50
|
+
'boost_download_path': 'https://example.invalid', 'boost_download_file': 'source.tar.gz',
|
|
51
|
+
'boost_extra_sources': ''}
|
|
52
|
+
def execute(*args):
|
|
53
|
+
if args[0] == 'git':
|
|
54
|
+
return 'a' * 40
|
|
55
|
+
if 'print-boost_download_path' in args:
|
|
56
|
+
self.assertIn('--eval=print-boost_download_path: package=boost', args)
|
|
57
|
+
return '\n'.join(x.removeprefix('print-') + '=' + values[x.removeprefix('print-')]
|
|
58
|
+
for x in args if x.startswith('print-'))
|
|
59
|
+
with patch.object(runner, 'run', side_effect=execute):
|
|
60
|
+
result = runner.depends_notices(depends, 'aarch64-linux-gnu', self.work / 'notices')
|
|
61
|
+
self.assertEqual(result['boost']['source_sha256'], checksum)
|
|
62
|
+
receipt = json.loads(Path(result['boost']['evidence']).read_text())
|
|
63
|
+
self.assertEqual(receipt['host'], 'aarch64-linux-gnu')
|
|
64
|
+
self.assertEqual(receipt['source_commit'], 'a' * 40)
|
|
65
|
+
source.unlink()
|
|
66
|
+
with self.assertRaises(FileNotFoundError):
|
|
67
|
+
runner.depends_notices(depends, 'aarch64-linux-gnu', self.work / 'missing')
|
|
68
|
+
|
|
69
|
+
def test_actual_depends_print_uses_selected_package_version(self):
|
|
70
|
+
output = runner.run('make', '--no-print-directory', '-C', str(ROOT / 'depends'),
|
|
71
|
+
'HOST=x86_64-linux-gnu',
|
|
72
|
+
'--eval=print-boost_download_path: package=boost',
|
|
73
|
+
'print-boost_version', 'print-boost_download_path')
|
|
74
|
+
values = dict(line.split('=', 1) for line in output.splitlines())
|
|
75
|
+
self.assertEqual(values['boost_download_path'],
|
|
76
|
+
'https://github.com/boostorg/boost/releases/download/boost-' + values['boost_version'])
|
|
77
|
+
|
|
78
|
+
def test_source_hash_and_unsafe_member_fail_closed(self):
|
|
79
|
+
source, checksum = self.archive()
|
|
80
|
+
with self.assertRaisesRegex(ValueError, 'hash mismatch'):
|
|
81
|
+
runner.source_notices(source, '0' * 64, self.work / 'bad')
|
|
82
|
+
for name in ('../LICENSE', '/LICENSE', 'source/C:/LICENSE', 'source\\LICENSE'):
|
|
83
|
+
source, checksum = self.archive(name)
|
|
84
|
+
with self.assertRaisesRegex(ValueError, 'Unsafe'):
|
|
85
|
+
runner.source_notices(source, checksum, self.work / 'bad')
|
|
86
|
+
|
|
87
|
+
def test_irrelevant_systemtap_manpage_names_are_not_written_or_followed(self):
|
|
88
|
+
source = self.work / 'systemtap.tar'
|
|
89
|
+
with tarfile.open(source, 'w') as out:
|
|
90
|
+
for name in ('systemtap-4.8/COPYING',
|
|
91
|
+
'systemtap-4.8/doc/man3/function::HZ.3stap',
|
|
92
|
+
'../irrelevant-test-data', '/absolute-test-data'):
|
|
93
|
+
entry = tarfile.TarInfo(name)
|
|
94
|
+
entry.size = 7
|
|
95
|
+
out.addfile(entry, io.BytesIO(b'license'))
|
|
96
|
+
link = tarfile.TarInfo('systemtap-4.8/LICENSE-link')
|
|
97
|
+
link.type = tarfile.SYMTYPE
|
|
98
|
+
link.linkname = '/outside/LICENSE'
|
|
99
|
+
out.addfile(link)
|
|
100
|
+
files = runner.source_notices(source, runner.sha256(source), self.work / 'selected')
|
|
101
|
+
self.assertEqual([p.relative_to(self.work / 'selected').as_posix() for p in files],
|
|
102
|
+
['systemtap-4.8/COPYING'])
|
|
103
|
+
|
|
104
|
+
def test_brew_retains_actual_receipt_matching_version_and_source(self):
|
|
105
|
+
source, checksum = self.archive()
|
|
106
|
+
prefix = self.work / 'installed'
|
|
107
|
+
prefix.mkdir()
|
|
108
|
+
(prefix / 'INSTALL_RECEIPT.json').write_text('{"built_as_bottle":true}')
|
|
109
|
+
formula = {'name': 'boost', 'installed': [{'version': '1.88.0'}],
|
|
110
|
+
'versions': {'stable': '1.88.0'}, 'urls': {'stable': {'url': 'https://example.invalid/source', 'checksum': checksum}}}
|
|
111
|
+
def execute(*args):
|
|
112
|
+
if args[:2] == ('brew', 'deps'):
|
|
113
|
+
# Homebrew recurses by default; multi-formula intersection
|
|
114
|
+
# drops dependencies that only one requested formula needs.
|
|
115
|
+
self.assertEqual(args, ('brew', 'deps', '--installed', '--union',
|
|
116
|
+
'qt@6', 'boost', 'libevent', 'zeromq',
|
|
117
|
+
'qrencode', 'miniupnpc', 'capnp'))
|
|
118
|
+
required = runner.notices.required_components('darwin-arm64') - {'qt', 'sqlite', 'openssl', 'icu'}
|
|
119
|
+
return '\n'.join(sorted(required | {'ca-certificates', 'qt', 'qtbase',
|
|
120
|
+
'qtwebengine', 'openssl@3', 'icu4c@78'}))
|
|
121
|
+
if args[:2] == ('brew', 'info'):
|
|
122
|
+
if args[-1] == 'boost':
|
|
123
|
+
return json.dumps({'formulae': [formula]})
|
|
124
|
+
if args[-1] not in {'ca-certificates', 'qt', 'qt@6', 'qtwebengine'}:
|
|
125
|
+
return json.dumps({'formulae': [{**formula, 'name': args[-1]}]})
|
|
126
|
+
return json.dumps({'formulae': [{'name': args[-1], 'urls': {'stable': {'url': 'not-an-archive'}}}]})
|
|
127
|
+
if args[:2] == ('brew', '--prefix'):
|
|
128
|
+
return str(prefix)
|
|
129
|
+
return 'fixture system identity'
|
|
130
|
+
with patch.object(runner, 'run', side_effect=execute), patch.object(runner, 'acquire', return_value=source):
|
|
131
|
+
result = runner.brew_notices(self.work / 'brew')
|
|
132
|
+
receipt = json.loads(Path(result['boost']['evidence']).read_text())
|
|
133
|
+
self.assertTrue(receipt['installed_receipt']['built_as_bottle'])
|
|
134
|
+
self.assertEqual(result['sqlite']['role'], 'system-library')
|
|
135
|
+
self.assertTrue(runner.notices.required_components('darwin-arm64') <= result.keys())
|
|
136
|
+
self.assertIn('qt', result)
|
|
137
|
+
self.assertNotIn('ca-certificates', result)
|
|
138
|
+
self.assertNotIn('qtwebengine', result)
|
|
139
|
+
formula['installed'][0]['version'] = '1.87.0'
|
|
140
|
+
with self.assertRaisesRegex(ValueError, 'version mismatch'):
|
|
141
|
+
runner.brew_notices(self.work / 'wrong-version')
|
|
142
|
+
formula['installed'][0]['version'] = '1.88.0'
|
|
143
|
+
(prefix / 'INSTALL_RECEIPT.json').unlink()
|
|
144
|
+
with self.assertRaises(FileNotFoundError):
|
|
145
|
+
runner.brew_notices(self.work / 'missing-receipt')
|
|
146
|
+
|
|
147
|
+
def test_vcpkg_uses_installed_static_port_version_and_copyright(self):
|
|
148
|
+
installed = self.work / 'vcpkg-installed'
|
|
149
|
+
(installed / 'vcpkg').mkdir(parents=True)
|
|
150
|
+
status = 'Package: qtbase\nVersion: 6.8.2\nArchitecture: x64-windows-static\nStatus: install ok installed\n'
|
|
151
|
+
(installed / 'vcpkg/status').write_text(status)
|
|
152
|
+
copyright = installed / 'x64-windows-static/share/qtbase/copyright'
|
|
153
|
+
copyright.parent.mkdir(parents=True)
|
|
154
|
+
copyright.write_text('Exact installed Qt copyright\n')
|
|
155
|
+
with patch.object(runner, 'run', return_value='a' * 40):
|
|
156
|
+
result = runner.vcpkg_notices(installed, self.work / 'output')
|
|
157
|
+
self.assertEqual(result['qt']['version'], '6.8.2')
|
|
158
|
+
self.assertEqual(Path(result['qt']['files'][0]).read_bytes(), copyright.read_bytes())
|
|
159
|
+
(installed / 'vcpkg/status').write_text(status + '\n' + status)
|
|
160
|
+
with self.assertRaisesRegex(ValueError, 'Duplicate'):
|
|
161
|
+
runner.vcpkg_notices(installed, self.work / 'duplicate')
|
|
162
|
+
(installed / 'vcpkg/status').write_text(status.replace('x64-windows-static', 'x64-windows'))
|
|
163
|
+
self.assertEqual(runner.vcpkg_notices(installed, self.work / 'wrong-triplet'), {})
|
|
164
|
+
(installed / 'vcpkg/status').write_text(status)
|
|
165
|
+
copyright.unlink()
|
|
166
|
+
with self.assertRaisesRegex(ValueError, 'copyright missing'):
|
|
167
|
+
runner.vcpkg_notices(installed, self.work / 'missing')
|
|
168
|
+
|
|
169
|
+
def test_vcpkg_aggregates_real_boost_ports_and_required_components(self):
|
|
170
|
+
installed = self.work / 'vcpkg'
|
|
171
|
+
(installed / 'vcpkg').mkdir(parents=True)
|
|
172
|
+
ports = sorted(runner.notices.required_components('windows-x86_64') - {'boost', 'qt', 'sqlite', 'qrencode'})
|
|
173
|
+
ports += ['boost-multi-index', 'boost-signals2', 'qtbase', 'sqlite3', 'libqrencode']
|
|
174
|
+
paragraphs = []
|
|
175
|
+
for name in ports:
|
|
176
|
+
version = '1.87.0' if name.startswith('boost-') else '1.0'
|
|
177
|
+
paragraphs.append(f'Package: {name}\nVersion: {version}\nArchitecture: x64-windows-static\nStatus: install ok installed\n')
|
|
178
|
+
notice = installed / 'x64-windows-static/share' / name / 'copyright'
|
|
179
|
+
notice.parent.mkdir(parents=True)
|
|
180
|
+
notice.write_text(f'Actual installed {name} copyright\n')
|
|
181
|
+
(installed / 'vcpkg/status').write_text('\n'.join(paragraphs))
|
|
182
|
+
with patch.object(runner, 'run', return_value='a' * 40):
|
|
183
|
+
result = runner.vcpkg_notices(installed, self.work / 'receipts')
|
|
184
|
+
self.assertTrue(runner.notices.required_components('windows-x86_64') <= result.keys())
|
|
185
|
+
self.assertEqual(len(result['boost']['files']), 2)
|
|
186
|
+
descriptor = self.work / 'descriptor.json'
|
|
187
|
+
descriptor.write_text(json.dumps(result))
|
|
188
|
+
runner.notices.collect('windows-x86_64', descriptor, self.work / 'collected')
|
|
189
|
+
|
|
190
|
+
def test_release_notice_platform_passes_container_allowlist_without_signing_secret(self):
|
|
191
|
+
spec = importlib.util.spec_from_file_location('container', ROOT / 'ci/test/02_run_container.py')
|
|
192
|
+
container = importlib.util.module_from_spec(spec)
|
|
193
|
+
spec.loader.exec_module(container)
|
|
194
|
+
env = {'USER': self.work.name, 'CONTAINER_NAME': 'notice-fixture',
|
|
195
|
+
'RELEASE_NOTICE_PLATFORM': 'linux-aarch64', 'BITCOIN_ROOTS_GPG_SK': 'fixture-never-export',
|
|
196
|
+
'PATH': os.environ.get('PATH', '/usr/bin'), 'DANGER_RUN_CI_ON_HOST': '1', 'BASE_ROOT_DIR': str(self.work),
|
|
197
|
+
'BASE_READ_ONLY_DIR': str(ROOT), 'BASE_SCRATCH_DIR': str(self.work / 'scratch'),
|
|
198
|
+
'CCACHE_DIR': str(self.work / 'ccache'), 'PREVIOUS_RELEASES_DIR': str(self.work / 'previous')}
|
|
199
|
+
path = Path(f"/tmp/env-{env['USER']}-{env['CONTAINER_NAME']}")
|
|
200
|
+
self.addCleanup(path.unlink, missing_ok=True)
|
|
201
|
+
with patch.dict(os.environ, env, clear=True), patch.object(container, 'run', return_value=SimpleNamespace(stdout='export CONTAINER_NAME=fixture')):
|
|
202
|
+
container.main()
|
|
203
|
+
text = path.read_text()
|
|
204
|
+
self.assertIn('RELEASE_NOTICE_PLATFORM=linux-aarch64', text)
|
|
205
|
+
self.assertNotIn('BITCOIN_ROOTS_GPG_SK', text)
|
|
206
|
+
self.assertNotIn('fixture-never-export', text)
|
|
207
|
+
|
|
208
|
+
def test_current_release_stages_copying_without_mandatory_notice_collection(self):
|
|
209
|
+
workflow = (ROOT / '.github/workflows/release.yml').read_text()
|
|
210
|
+
self.assertNotIn('runner-notices.py', workflow)
|
|
211
|
+
self.assertNotIn('ci/release/notices.py', workflow)
|
|
212
|
+
self.assertNotIn('RELEASE_NOTICE_PLATFORM', workflow)
|
|
213
|
+
for job, following in [('linux-release', 'windows-release'), ('windows-release', 'macos-release'), ('macos-release', 'publish-release')]:
|
|
214
|
+
block = workflow.split(f' {job}:', 1)[1].split(f' {following}:', 1)[0]
|
|
215
|
+
self.assertLess(block.index('ci/release/archive.py stage-copying'), block.index('ci/release/archive.py validate'))
|
|
216
|
+
self.assertLess(block.index('ci/release/archive.py validate'), block.index('uses: actions/upload-artifact'))
|
|
217
|
+
|
|
218
|
+
|
|
219
|
+
if __name__ == '__main__':
|
|
220
|
+
unittest.main()
|