64 lines
3.2 KiB
Python
64 lines
3.2 KiB
Python
import importlib.util
|
|
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
|
|
SCRIPT = Path(__file__).resolve().parents[1] / "tailscale-security.py"
|
|
spec = importlib.util.spec_from_file_location("tailscale_security", SCRIPT)
|
|
security = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(security)
|
|
|
|
|
|
class TailscaleSecurity(unittest.TestCase):
|
|
def test_security_boundary_and_numeric_order(self):
|
|
for value in ("1.78.0", "1.98.9", "1.102.4", "1.104.1", "1.104.2", "1.104.3"):
|
|
self.assertEqual(security.assess(value)["status"], "below-security-floor")
|
|
for value in ("1.104.4", "v1.104.4", "1.104.4-1", "1.104.10", "1.106.0"):
|
|
self.assertEqual(security.assess(value)["status"], "meets-security-floor")
|
|
|
|
def test_unknown_builds_fail_closed(self):
|
|
for value in ("", "stable", "latest", "1.104", "1.104.4-rc1", "1.104.4~rc1", "1.105.0", "2.0.0", "1.104.4+dirty", "1.104.4-tabcdef", "1.104.4\n1.104.2", "01.104.4", "1:1.104.4", "1.104.4-vendor"):
|
|
self.assertEqual(security.assess(value)["status"], "unknown-version", value)
|
|
|
|
def test_stale_daemon_fails_even_with_fixed_cli(self):
|
|
result = subprocess.run([sys.executable, str(SCRIPT), "--version", "1.104.4", "--version", "1.104.2"], capture_output=True, text=True)
|
|
self.assertEqual(result.returncode, 1)
|
|
self.assertIn("below-security-floor", result.stdout)
|
|
|
|
def test_no_evidence_is_not_a_pass(self):
|
|
result = subprocess.run([sys.executable, str(SCRIPT)], capture_output=True)
|
|
self.assertEqual(result.returncode, 2)
|
|
|
|
def test_manifest_rejects_floating_stale_or_mismatched_images(self):
|
|
for version, tag in (("1.104.4", "stable"), ("1.104.4", "v1.104.2"), ("1.78.0", "v1.78.0")):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
manifest = Path(directory) / "manifest.yml"
|
|
manifest.write_text(f"app:\n id: tailscale\n version: {version}\n container:\n image: example/tailscale:{tag}\n")
|
|
self.assertNotEqual(security.check_manifest(manifest)["status"], "meets-security-floor")
|
|
|
|
def test_owned_manifest_requires_fixed_release(self):
|
|
manifest = SCRIPT.parents[1] / "apps/tailscale/manifest.yml"
|
|
self.assertEqual(security.check_manifest(manifest)["status"], "meets-security-floor")
|
|
|
|
def test_iso_first_boot_image_matches_manifest(self):
|
|
import yaml
|
|
root = SCRIPT.parents[1]
|
|
manifest = yaml.safe_load((root / "apps/tailscale/manifest.yml").read_text())["app"]
|
|
image = manifest["container"]["image"]
|
|
registry = image.rsplit("/", 1)[0]
|
|
result = subprocess.run([
|
|
"bash", "-c",
|
|
'ARCHY_REGISTRY="$1"; source "$2"; printf "%s" "$TAILSCALE_IMAGE"',
|
|
"fixture", registry, str(root / "scripts/image-versions.sh"),
|
|
], check=True, capture_output=True, text=True)
|
|
self.assertEqual(result.stdout, image)
|
|
# Metadata agreement is necessary, but is not binary/image qualification.
|
|
self.assertEqual(security.check_manifest(root / "apps/tailscale/manifest.yml")["status"],
|
|
"meets-security-floor")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|