45 lines
1.7 KiB
Python
45 lines
1.7 KiB
Python
import json
|
|
import os
|
|
import requests
|
|
|
|
TEST_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)))
|
|
MANIFESTS = [
|
|
os.path.join(TEST_DIR, "../agnos.json"),
|
|
os.path.join(TEST_DIR, "../agnos_tici_15_1.json"),
|
|
]
|
|
|
|
IMAGE_HOST = "gitlvb.teallvbs.xyz"
|
|
|
|
# image payloads are xz streams; the repo raw endpoint would serve an LFS pointer
|
|
XZ_MAGIC = b"\xfd7zXZ\x00"
|
|
LFS_POINTER_MAGIC = b"version https://git-lfs"
|
|
|
|
|
|
class TestAgnosUpdater:
|
|
|
|
def test_manifest(self):
|
|
for manifest in MANIFESTS:
|
|
with open(manifest) as f:
|
|
m = json.load(f)
|
|
|
|
for img in m:
|
|
assert img['url'].split('/')[2] == IMAGE_HOST
|
|
if not img['sparse']:
|
|
assert img['hash'] == img['hash_raw']
|
|
|
|
# contract: images are distributed from a private repo, so an anonymous
|
|
# request must never receive image content. The denial status varies by
|
|
# route (404 via the CDN, catch-all HTML page when resolved directly to
|
|
# the origin), so assert on the payload, not the status code. trust_env
|
|
# off: requests otherwise picks up ~/.netrc (CI runners have gitlvb
|
|
# credentials), silently authenticating the "anonymous" probe.
|
|
s = requests.Session()
|
|
s.trust_env = False
|
|
r = s.get(img['url'], timeout=10, stream=True,
|
|
headers={"User-Agent": "IQOS-Updater"})
|
|
if r.status_code in (401, 403, 404):
|
|
continue
|
|
head = next(r.iter_content(chunk_size=256), b"") or b""
|
|
assert not head.startswith(XZ_MAGIC), f"{img['name']}: anonymous request served image content"
|
|
assert not head.startswith(LFS_POINTER_MAGIC), f"{img['name']}: anonymous request served the LFS pointer"
|