Archived
forge-recoveryandClaude Sonnet 5.5
2af1dcf3a2
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
38 lines
1.8 KiB
Python
38 lines
1.8 KiB
Python
"""The toolchain recipe patches only the observed vulnerable tool artifacts, each pinned to an upstream checksum."""
|
|
|
|
import re
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
DOCKERFILE = (Path(__file__).resolve().parent.parent / "runtime" / "toolchain.Dockerfile").read_text(encoding="utf-8")
|
|
|
|
PATCHED_ARTIFACTS = {
|
|
"guava-33.7.2-jre.jar": "sha256 b530942257fb935f8b2cfaa5f8eb5bd59c555fd8e8d01b8ce98912e077ea606c",
|
|
"plexus-utils-3.6.1.jar": "sha256 05a63effd67e2d6b9d610cc82e2bd7473289d34802e57a529b28110f28af5679",
|
|
"npm-11.21.1.tgz": "sha512 YTzL6QBEJXyHcTu0JiUc7RKMp+mzlJtl7rGLmERaXUQeFHIMc9atdr6G9M9C8vDWbv40epoTQAzNL2/PtZVDhQ==",
|
|
"undici-6.29.1.tgz": "sha512 EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==",
|
|
}
|
|
|
|
|
|
class ToolchainRecipeTest(unittest.TestCase):
|
|
"""Checksums are verified at build time and the unpatched distributions are never shipped."""
|
|
|
|
def test_each_patched_artifact_is_fetched_with_its_checksum(self) -> None:
|
|
for artifact, checksum in PATCHED_ARTIFACTS.items():
|
|
self.assertRegex(DOCKERFILE, re.escape(f"{checksum} /download/{artifact}"))
|
|
|
|
def test_old_npm_bundle_and_maven_tree_come_only_from_the_patched_stage(self) -> None:
|
|
self.assertNotIn("--from=node-source /usr/local/lib/node_modules", DOCKERFILE)
|
|
self.assertIn("--from=patched-tools /out/npm/", DOCKERFILE)
|
|
self.assertIn("--from=patched-tools /out/maven/", DOCKERFILE)
|
|
self.assertNotIn("--from=maven-source /usr/share/maven/ /usr/share/maven/", DOCKERFILE)
|
|
|
|
def test_smoke_checks_preserve_tool_versions(self) -> None:
|
|
self.assertIn('test "$(npm --version)" = "11.21.1"', DOCKERFILE)
|
|
self.assertIn("Apache Maven 3.9.11", DOCKERFILE)
|
|
self.assertIn("keytool -list -cacerts", DOCKERFILE)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|