Add Debian, Ubuntu and Mint candidate profiles with scoped systemd 255 credentials

source/tests/test_archive_targets.py

@@ -0,0 +1,75 @@
+"""Candidate archive input selection; no host package or runtime changes."""
+import contextlib
+import io
+import json
+from pathlib import Path
+import sys
+import tarfile
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "packaging"))
+import archive_sources
+
+
+class CandidateArchiveTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.base = self.root / "source"
+        self.base.mkdir()
+        self.input = self.base / "example.py"
+        self.input.write_text("# candidate source\n")
+
+    def run_archive(self, args):
+        evidence = {"vendor_sha256": "a" * 64, "packages": [], "native_extensions": []}
+        with mock.patch.object(archive_sources, "BASE", self.base), \
+             mock.patch.object(archive_sources, "source_files", return_value={"source/example.py": self.input}), \
+             mock.patch.object(archive_sources, "vendor_versions", return_value={}), \
+             mock.patch.object(archive_sources, "validate_vendor", return_value=evidence), \
+             contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()) as stderr:
+            archive_sources.main(args)
+        return self.base / "release/candidate-source" / archive_sources.ARCHIVE_NAME, stderr.getvalue()
+
+    def test_default_archive_declares_missing_alternate_abis(self):
+        output, warning = self.run_archive([])
+        self.assertIn("cp312", warning)
+        with tarfile.open(output) as archive:
+            data = json.load(archive.extractfile(archive_sources.ARCHIVE_ROOT + "/TARGET-VENDOR-PROVENANCE.json"))
+            readme = archive.extractfile(archive_sources.ARCHIVE_ROOT + "/README-SOURCE-ARCHIVE.md").read().decode()
+        self.assertEqual(data["omitted_vendor_abis"], ["cp312", "cp314"])
+        self.assertIn("--target debian13-amd64-py313", readme)
+        self.assertIn("not a signed public release", readme)
+        self.assertEqual(data["validation_status"], "candidate")
+
+    def test_explicit_vendors_included_without_private_markers_or_bin(self):
+        args = []
+        for abi in ("cp312", "cp314"):
+            vendor = self.root / abi; vendor.mkdir()
+            (vendor / "module.py").write_text("# reviewed input\n")
+            (vendor / "private.log").write_text("private canary\n")
+            (vendor / "FB-ABI-PREPARED.json").write_text('{"private_path":"/home/example"}')
+            (vendor / "bin").mkdir(); (vendor / "bin/tool").write_text("#!/tmp/private/python\n")
+            args.extend(["--vendor-" + abi, str(vendor)])
+        output, warning = self.run_archive(args)
+        self.assertFalse(warning)
+        with tarfile.open(output) as archive:
+            names = archive.getnames()
+            data = json.load(archive.extractfile(archive_sources.ARCHIVE_ROOT + "/TARGET-VENDOR-PROVENANCE.json"))
+        self.assertIn(archive_sources.ARCHIVE_ROOT + "/source/target-vendors/cp312/module.py", names)
+        self.assertIn(archive_sources.ARCHIVE_ROOT + "/source/target-vendors/cp314/module.py", names)
+        self.assertFalse(any("FB-ABI-PREPARED" in name or name.endswith("bin/tool") or name.endswith("private.log") for name in names))
+        self.assertEqual(set(data["vendors"]), {"cp312", "cp313", "cp314"})
+        self.assertEqual(data["omitted_vendor_abis"], [])
+
+    def test_alternate_vendor_symlink_is_rejected(self):
+        vendor = self.root / "cp312"; vendor.mkdir()
+        (vendor / "unsafe.py").symlink_to(self.input)
+        with self.assertRaisesRegex(RuntimeError, "symlink rejected"):
+            self.run_archive(["--vendor-cp312", str(vendor)])
+
+
+if __name__ == "__main__":
+    unittest.main()