Pulse/scripts/release_control/release_candidate_manifest_test.py

import json
import sys
import tempfile
import unittest
from pathlib import Path

sys.path.insert(0, str(Path(__file__).resolve().parents[1]))

from release_candidate_manifest import (
    create_manifest,
    load_release_assets,
    manifest_assets_by_name,
    release_note_visual_assets,
    verify_local,
    verify_release,
)


SOURCE_SHA = "1" * 40


class ReleaseCandidateManifestTest(unittest.TestCase):
    def create_release_dir(self, root: Path) -> Path:
        release_dir = root / "release"
        release_dir.mkdir()
        (release_dir / "checksums.txt").write_text("abc\n", encoding="utf-8")
        (release_dir / "pulse-v6.1.0-linux-amd64.tar.gz").write_bytes(b"archive")
        return release_dir

    def test_create_and_verify_local_candidate(self) -> None:
        with tempfile.TemporaryDirectory() as temp_dir:
            release_dir = self.create_release_dir(Path(temp_dir))
            manifest = create_manifest(release_dir, "6.1.0", SOURCE_SHA)

            self.assertEqual(manifest["tag"], "v6.1.0")
            self.assertEqual(
                [asset["name"] for asset in manifest["assets"]],
                ["checksums.txt", "pulse-v6.1.0-linux-amd64.tar.gz"],
            )
            verify_local(release_dir, manifest, "6.1.0", SOURCE_SHA)

    def test_verify_local_rejects_tampered_asset(self) -> None:
        with tempfile.TemporaryDirectory() as temp_dir:
            release_dir = self.create_release_dir(Path(temp_dir))
            manifest = create_manifest(release_dir, "6.1.0-rc.1", SOURCE_SHA)
            (release_dir / "checksums.txt").write_text("xyz\n", encoding="utf-8")

            with self.assertRaisesRegex(ValueError, "digest mismatch"):
                verify_local(release_dir, manifest, "6.1.0-rc.1", SOURCE_SHA)

    def test_verify_local_accepts_manifest_covered_payload_tree(self) -> None:
        with tempfile.TemporaryDirectory() as temp_dir:
            release_dir = self.create_release_dir(Path(temp_dir))
            binary_dir = release_dir / "binaries"
            binary_dir.mkdir()
            (binary_dir / "pulse-agent-linux-amd64").write_bytes(b"agent")
            manifest = create_manifest(release_dir, "6.1.0-rc.1", SOURCE_SHA)

            verify_local(release_dir, manifest, "6.1.0-rc.1", SOURCE_SHA)
            self.assertIn(
                "binaries/pulse-agent-linux-amd64",
                [asset["name"] for asset in manifest["assets"]],
            )

    def test_manifest_rejects_noncanonical_or_traversing_asset_names(self) -> None:
        for name in (
            "../outside",
            "binaries/../outside",
            "/absolute",
            "binaries\\outside",
            "./binaries/agent",
        ):
            with self.subTest(name=name), self.assertRaisesRegex(
                ValueError, "invalid name"
            ):
                manifest_assets_by_name(
                    {
                        "assets": [
                            {"name": name, "size": 1, "sha256": "0" * 64}
                        ]
                    }
                )

    def test_verify_release_uses_server_side_digests(self) -> None:
        with tempfile.TemporaryDirectory() as temp_dir:
            release_dir = self.create_release_dir(Path(temp_dir))
            manifest = create_manifest(release_dir, "6.1.0", SOURCE_SHA)
            release_assets = [
                {
                    "name": asset["name"],
                    "size": asset["size"],
                    "digest": f"sha256:{asset['sha256']}",
                }
                for asset in manifest["assets"]
            ]

            verify_release(manifest, release_assets)
            release_assets[0]["digest"] = "sha256:" + "0" * 64
            with self.assertRaisesRegex(ValueError, "published asset digest mismatch"):
                verify_release(manifest, release_assets)

    def test_verify_release_accepts_only_body_referenced_visual_assets(self) -> None:
        with tempfile.TemporaryDirectory() as temp_dir:
            release_dir = self.create_release_dir(Path(temp_dir))
            manifest = create_manifest(release_dir, "6.1.0", SOURCE_SHA)
            release_assets = [
                {
                    "name": asset["name"],
                    "size": asset["size"],
                    "digest": f"sha256:{asset['sha256']}",
                }
                for asset in manifest["assets"]
            ]
            visual_name = "release-note-settings-before.png"
            release_assets.append(
                {
                    "name": visual_name,
                    "size": 123,
                    "digest": "sha256:" + "2" * 64,
                }
            )
            body = (
                "![Settings](https://github.com/rcourtman/Pulse/releases/download/"
                f"v6.1.0/{visual_name})"
            )
            visuals = release_note_visual_assets(body, "v6.1.0")

            self.assertEqual(visuals, {visual_name})
            verify_release(manifest, release_assets, visuals)

            release_assets.append(
                {
                    "name": "release-note-stale.png",
                    "size": 456,
                    "digest": "sha256:" + "3" * 64,
                }
            )
            with self.assertRaisesRegex(ValueError, "release-note-stale.png"):
                verify_release(manifest, release_assets, visuals)

    def test_verify_release_requires_every_body_referenced_visual(self) -> None:
        with tempfile.TemporaryDirectory() as temp_dir:
            release_dir = self.create_release_dir(Path(temp_dir))
            manifest = create_manifest(release_dir, "6.1.0", SOURCE_SHA)
            release_assets = [
                {
                    "name": asset["name"],
                    "size": asset["size"],
                    "digest": f"sha256:{asset['sha256']}",
                }
                for asset in manifest["assets"]
            ]

            with self.assertRaisesRegex(ValueError, "release-note-missing.png"):
                verify_release(
                    manifest,
                    release_assets,
                    {"release-note-missing.png"},
                )

    def test_verify_release_rejects_invalid_or_empty_visual_sidecar(self) -> None:
        with tempfile.TemporaryDirectory() as temp_dir:
            release_dir = self.create_release_dir(Path(temp_dir))
            manifest = create_manifest(release_dir, "6.1.0", SOURCE_SHA)
            release_assets = [
                {
                    "name": asset["name"],
                    "size": asset["size"],
                    "digest": f"sha256:{asset['sha256']}",
                }
                for asset in manifest["assets"]
            ]
            release_assets.append(
                {
                    "name": "release-note-settings-now.png",
                    "size": 0,
                    "digest": None,
                }
            )

            with self.assertRaisesRegex(ValueError, "empty"):
                verify_release(
                    manifest,
                    release_assets,
                    {"release-note-settings-now.png"},
                )
            with self.assertRaisesRegex(ValueError, "invalid release-note"):
                verify_release(
                    manifest,
                    release_assets,
                    {"release-note-settings-later.png"},
                )

    def test_release_metadata_loader_flattens_paginated_arrays(self) -> None:
        with tempfile.TemporaryDirectory() as temp_dir:
            path = Path(temp_dir) / "assets.json"
            path.write_text(
                json.dumps([[{"name": "a"}], [{"name": "b"}]]),
                encoding="utf-8",
            )
            self.assertEqual(
                [asset["name"] for asset in load_release_assets(path)],
                ["a", "b"],
            )


if __name__ == "__main__":
    unittest.main()