Align website and shared guide with three signed Linux channels

website/test_release_catalog.py

@@ -0,0 +1,73 @@
+#!/usr/bin/python3
+"""Catalog guards and rendered shell syntax; no signing or installation."""
+import copy
+import json
+from pathlib import Path
+import runpy
+import subprocess
+import unittest
+
+BASE = Path(__file__).resolve().parent
+catalog = runpy.run_path(str(BASE / "release_catalog.py"))
+
+class CatalogTests(unittest.TestCase):
+    def setUp(self):
+        self.meta = json.loads((BASE / "release.example.json").read_text())
+
+    def ready(self):
+        meta = copy.deepcopy(self.meta)
+        meta.update(state="ready", signing_fingerprint=catalog["FINGERPRINT"],
+                    checksums_url="/downloads/TEST-SHA256SUMS",
+                    checksums_signature_url="/downloads/TEST-SHA256SUMS.asc")
+        meta["source"] = dict(filename="TEST-source.tar.gz", url="/downloads/TEST-source.tar.gz",
+                              signature_url="/downloads/TEST-source.tar.gz.asc", sha256="a"*64, size_bytes=1)
+        for index, profile in enumerate(meta["profiles"]):
+            name = "TEST-profile-" + str(index) + ".deb"
+            profile.update(filename=name, url="/downloads/"+name,
+                           signature_url="/downloads/"+name+".asc", sha256="a"*64, size_bytes=1)
+        return meta
+
+    def test_preparation_has_no_install_or_download_claim(self):
+        catalog["validate"](self.meta, False)
+        text = catalog["download"](self.meta)
+        self.assertIn("Release preparation", text)
+        self.assertNotIn("sudo apt install", text)
+        self.assertNotIn("Download .deb", text)
+
+    def test_three_profile_shell_commands_are_valid_and_key_scoped(self):
+        meta = self.ready()
+        catalog["validate"](meta, True)
+        for profile in meta["profiles"]:
+            commands = catalog["apt_commands"](meta, profile)
+            result = subprocess.run(["bash", "-n"], input=commands, text=True, capture_output=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertIn("Suites: " + profile["suite"], commands)
+            self.assertIn("Signed-By:", commands)
+            self.assertIn("primary_count", commands)
+            self.assertNotIn("trusted=yes", commands)
+            self.assertNotIn("apt-key", commands)
+
+    def test_wrong_distribution_metadata_is_rejected(self):
+        self.meta["profiles"][1]["label"] = "Ubuntu 26.04"
+        with self.assertRaisesRegex(ValueError, "Profile identity"):
+            catalog["validate"](self.meta, False)
+
+    def test_duplicate_profiles_are_rejected(self):
+        self.meta["profiles"][1] = self.meta["profiles"][0]
+        with self.assertRaisesRegex(ValueError, "Duplicate profile"):
+            catalog["validate"](self.meta, False)
+
+    def test_extra_shell_characters_in_key_url_are_rejected(self):
+        meta = self.ready()
+        meta["signing_key_url"] = "/debian/key';echo-malicious"
+        with self.assertRaises(ValueError):
+            catalog["validate"](meta, True)
+
+    def test_missing_artifact_checksum_is_rejected(self):
+        meta = self.ready()
+        meta["profiles"][2]["sha256"] = ""
+        with self.assertRaisesRegex(ValueError, "SHA-256"):
+            catalog["validate"](meta, True)
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)