145 lines
4 KiB
Shell
145 lines
4 KiB
Shell
# Cases for ./store-seeded-secret.nix. Each case sets up the store's leaf, the
|
|
# earlier file and the stub's behaviour, runs `store_seeded` under `set -e` as
|
|
# the callers' scripts do, and compares its exit status, its output, what the
|
|
# store holds afterwards and whether the mint command ran.
|
|
set -uo pipefail
|
|
|
|
failures=0
|
|
count=0
|
|
|
|
fail() {
|
|
echo "FAILED: $case: $*" >&2
|
|
failures=$((failures + 1))
|
|
}
|
|
|
|
leaf=secret/swarm/services/t/keys/k
|
|
pem=$'-----BEGIN PRIVATE KEY-----\nMIIfake\nline2\n-----END PRIVATE KEY-----'
|
|
|
|
# setup <description>
|
|
setup() {
|
|
case=$1
|
|
count=$((count + 1))
|
|
dir=$(mktemp -d)
|
|
mkdir "$dir/kv"
|
|
export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
|
|
unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE
|
|
: >"$FAKE_BAO_LOG"
|
|
earlier=$dir/earlier
|
|
minted=$dir/minted
|
|
stored=$FAKE_BAO_KV/$(printf '%s' "$leaf" | tr / _)
|
|
}
|
|
|
|
mint() {
|
|
echo run >>"$minted"
|
|
printf 'minted-value\n'
|
|
}
|
|
|
|
# run — `store_seeded` for $leaf and $earlier with the stub first on PATH.
|
|
# Sets $rc and $got.
|
|
run() {
|
|
got=$(
|
|
set -e
|
|
PATH="$FAKE_BAO_BIN:$PATH"
|
|
unset BAO_TOKEN
|
|
# shellcheck source=/dev/null
|
|
. "$HELPER"
|
|
store_init
|
|
store_login 2>>"$dir/err"
|
|
store_seeded "$leaf" "$earlier" mint 2>"$dir/err"
|
|
)
|
|
rc=$?
|
|
}
|
|
|
|
# expect <status> <output>
|
|
expect() {
|
|
if [ "$rc" != "$1" ]; then fail "exited $rc, wanted $1: $(cat "$dir/err")"; fi
|
|
if [ "$got" != "$2" ]; then fail "printed '$got', wanted '$2'"; fi
|
|
}
|
|
|
|
# held <value>, or held "" for a leaf the store does not have.
|
|
held() {
|
|
if [ -z "$1" ]; then
|
|
if [ -e "$stored" ]; then fail "the store holds '$(cat "$stored")', wanted nothing"; fi
|
|
elif [ "$(cat "$stored" 2>/dev/null)" != "$1" ]; then
|
|
fail "the store holds '$(cat "$stored" 2>/dev/null)', wanted '$1'"
|
|
fi
|
|
}
|
|
|
|
ran_mint() {
|
|
[ -s "$minted" ]
|
|
}
|
|
|
|
setup "an empty store is seeded from the file, unchanged, and nothing is minted"
|
|
printf 'old-value\n' >"$earlier"
|
|
run
|
|
expect 0 old-value
|
|
held old-value
|
|
if ran_mint; then fail "minted although the file held a value"; fi
|
|
if ! grep -q '^kv put -cas=0 ' "$FAKE_BAO_LOG"; then fail "no create-only write was made"; fi
|
|
|
|
setup "a multi-line file is seeded unchanged"
|
|
printf '%s\n' "$pem" >"$earlier"
|
|
run
|
|
expect 0 "$pem"
|
|
held "$pem"
|
|
|
|
setup "the store's value wins over the file and is not written over"
|
|
printf 'stored-value' >"$stored"
|
|
printf 'old-value\n' >"$earlier"
|
|
run
|
|
expect 0 stored-value
|
|
held stored-value
|
|
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
|
|
if ran_mint; then fail "minted although the store held a value"; fi
|
|
|
|
setup "the store's value is used when there is no file"
|
|
printf 'stored-value' >"$stored"
|
|
run
|
|
expect 0 stored-value
|
|
if ran_mint; then fail "minted although the store held a value"; fi
|
|
|
|
setup "a value is minted into the store when neither holds one"
|
|
run
|
|
expect 0 minted-value
|
|
held minted-value
|
|
if ! ran_mint; then fail "did not mint"; fi
|
|
|
|
setup "a run that loses the race takes the winner's value, not its own seed"
|
|
printf 'old-value\n' >"$earlier"
|
|
export FAKE_BAO_RACE=winner-value
|
|
run
|
|
expect 0 winner-value
|
|
held winner-value
|
|
|
|
setup "a store that grants neither read nor write leaves the file's value in use"
|
|
printf 'old-value\n' >"$earlier"
|
|
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
|
|
run
|
|
expect 0 old-value
|
|
held ""
|
|
if ran_mint; then fail "minted although the file held a value"; fi
|
|
|
|
setup "a store that grants neither, and no file, gives no value and mints nothing into it"
|
|
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
|
|
run
|
|
expect 1 ""
|
|
held ""
|
|
|
|
setup "a store that refuses the login leaves the file's value in use and is not called again"
|
|
printf 'old-value\n' >"$earlier"
|
|
export FAKE_BAO_LOGIN_RC=1
|
|
run
|
|
expect 0 old-value
|
|
if grep -q '^kv' "$FAKE_BAO_LOG"; then fail "called kv after a refused login"; fi
|
|
|
|
setup "a store that refuses the login, and no file, gives no value"
|
|
export FAKE_BAO_LOGIN_RC=1
|
|
run
|
|
expect 1 ""
|
|
if ran_mint; then fail "minted with no store to hold the value"; fi
|
|
|
|
if [ "$failures" != 0 ]; then
|
|
echo "$failures of $count cases failed" >&2
|
|
exit 1
|
|
fi
|
|
echo "$count cases passed"
|