vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-13 00:34:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 15

Bind receipt completion to final evidence event

Browse source
This commit is contained in:
Richard Courtman 2026-08-30 19:06:37 +01:00
parent b369dc5410
commit defc24af83
1 changed files with 31 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

33
scripts/installtests/secure_runtime_systemd_lab_test.go
View file

@ -764,6 +764,12 @@ func secureRuntimeTranscriptSnapshot() []secureRuntimeTranscriptEvent {
return append([]secureRuntimeTranscriptEvent(nil), secureRuntimeTranscriptRecorder.events...)
}
func secureRuntimeFinalizeTranscript(receipt *secureRuntimeLabReceipt) []secureRuntimeTranscriptEvent {
events := secureRuntimeTranscriptSnapshot()
receipt.CompletedAt = time.Now().UTC().Format(time.RFC3339Nano)
return events
}
func TestSecureRuntimeReceiptCredentialDetection(t *testing.T) {
safe, err := json.Marshal(map[string]any{
"source_hashes": map[string]string{
@ -807,6 +813,30 @@ func TestSecureRuntimeTranscriptPreservesEmptyCommandOutput(t *testing.T) {
}
}
func TestSecureRuntimeReceiptCompletionEnclosesFinalTranscriptEvent(t *testing.T) {
secureRuntimeResetTranscript(true)
t.Cleanup(func() { secureRuntimeResetTranscript(false) })
event := secureRuntimeRecordTranscriptEvent(secureRuntimeTranscriptEvent{
Kind: "command_output", Operation: "systemctl", OutputSHA256: secureRuntimeHash(nil),
})
receipt := secureRuntimeLabReceipt{}
events := secureRuntimeFinalizeTranscript(&receipt)
if len(events) != 1 || events[0].EventID != event.EventID {
t.Fatalf("final transcript snapshot = %+v", events)
}
observedAt, err := time.Parse(time.RFC3339Nano, event.ObservedAt)
if err != nil {
t.Fatal(err)
}
completedAt, err := time.Parse(time.RFC3339Nano, receipt.CompletedAt)
if err != nil {
t.Fatal(err)
}
if observedAt.After(completedAt) {
t.Fatalf("final event %s falls after receipt completion %s", event.ObservedAt, receipt.CompletedAt)
}
}
func TestSecureRuntimeSourceManifestCoversTransitiveProviders(t *testing.T) {
_, hashes := secureRuntimeLoadSourceBoundary(t, runtime.GOARCH)
for _, required := range []string{
@ -1183,7 +1213,6 @@ func TestSecureRuntimeSystemdLab(t *testing.T) {
t.Fatalf("final report privilege posture = %+v", latest)
}
receipt.CompletedAt = time.Now().UTC().Format(time.RFC3339Nano)
receipt.CollectorServiceUser = secureRuntimeSystemdProperty(t, "User")
receipt.CollectorProcessUID = secureRuntimeCollectorProcessUID(t)
receipt.CollectorAuthority = latest.Authority
@ -1201,7 +1230,7 @@ func TestSecureRuntimeSystemdLab(t *testing.T) {
receipt.ReportCount = len(reports)
receipt.FirstReportAt = reports[0].ReceivedAt.Format(time.RFC3339Nano)
receipt.LastReportAt = reports[len(reports)-1].ReceivedAt.Format(time.RFC3339Nano)
secureRuntimeWriteEvidence(t, &receipt, secureRuntimeTranscriptSnapshot())
secureRuntimeWriteEvidence(t, &receipt, secureRuntimeFinalizeTranscript(&receipt))
}
func secureRuntimeRequireDisposableHost(t *testing.T) {