mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
75 lines
2.5 KiB
Python
75 lines
2.5 KiB
Python
from __future__ import annotations
|
|
|
|
from types import SimpleNamespace
|
|
|
|
|
|
def test_push_docker_image_prefers_tls_verified_skopeo_when_ca_provided(
|
|
tmp_path, monkeypatch
|
|
):
|
|
from knoe.core import env
|
|
|
|
ca = tmp_path / "registry-ca.pem"
|
|
ca.write_text("dummy-ca")
|
|
monkeypatch.setenv("PROLE_REGISTRY_CA_CERT", str(ca))
|
|
|
|
monkeypatch.setattr(env.shutil, "which", lambda name: "/usr/bin/skopeo" if name == "skopeo" else None)
|
|
monkeypatch.setattr(env.shutil, "copyfile", lambda _src, _dst: None)
|
|
|
|
calls: list[list[str]] = []
|
|
|
|
def fake_run(cmd, capture_output=True, text=True):
|
|
calls.append(list(cmd))
|
|
if cmd[:2] == ["docker", "push"]:
|
|
return SimpleNamespace(returncode=1, stdout="", stderr="x509: unknown authority")
|
|
|
|
# Secure skopeo path should be used and succeed.
|
|
assert cmd[0] == "/usr/bin/skopeo"
|
|
assert "--dest-tls-verify=true" in cmd
|
|
assert "--dest-cert-dir" in cmd
|
|
assert "--dest-tls-verify=false" not in cmd
|
|
return SimpleNamespace(returncode=0, stdout="", stderr="")
|
|
|
|
monkeypatch.setattr(env.subprocess, "run", fake_run)
|
|
|
|
ok = env._push_docker_image("myrddin.knoe.org:5000/knoe-db:18-118")
|
|
assert ok is True
|
|
assert len(calls) == 2
|
|
|
|
|
|
def test_push_docker_image_auto_detects_repo_cert_for_myrddin(monkeypatch):
|
|
"""Regression: when no env var is provided, prefer repo-shipped certs (Ansible knoe_ssl role)."""
|
|
|
|
from knoe.core import env
|
|
|
|
monkeypatch.delenv("PROLE_REGISTRY_CA_CERT", raising=False)
|
|
monkeypatch.delenv("REGISTRY_CA_CERT", raising=False)
|
|
monkeypatch.delenv("PROLE_REGISTRY_CERT_DIR", raising=False)
|
|
|
|
monkeypatch.setattr(
|
|
env.shutil,
|
|
"which",
|
|
lambda name: "/usr/bin/skopeo" if name == "skopeo" else None,
|
|
)
|
|
monkeypatch.setattr(env.shutil, "copyfile", lambda _src, _dst: None)
|
|
|
|
calls: list[list[str]] = []
|
|
|
|
def fake_run(cmd, capture_output=True, text=True):
|
|
calls.append(list(cmd))
|
|
if cmd[:2] == ["docker", "push"]:
|
|
return SimpleNamespace(
|
|
returncode=1, stdout="", stderr="x509: unknown authority"
|
|
)
|
|
|
|
assert cmd[0] == "/usr/bin/skopeo"
|
|
assert "--dest-tls-verify=true" in cmd
|
|
assert "--dest-cert-dir" in cmd
|
|
assert "--dest-tls-verify=false" not in cmd
|
|
return SimpleNamespace(returncode=0, stdout="", stderr="")
|
|
|
|
monkeypatch.setattr(env.subprocess, "run", fake_run)
|
|
|
|
ok = env._push_docker_image("myrddin.knoe.org:5000/knoe-db:18-118")
|
|
assert ok is True
|
|
assert len(calls) == 2
|