xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-10-22 23:58:13 +00:00
Code Issues Releases Wiki Activity

test(fips): reject malformed artifacts before writes

Browse Source
This commit is contained in:
Vinícius Ferrão
2026-10-21 11:30:00 -03:00
parent 26be5646f9
commit 0b42cb5fd4
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xCAT-test/unit/fips_policy_sources.t
+25
View File
@@ -112,6 +112,17 @@ for my $case (
['a library with two policy blocks', sub {
write_binary("$root/$libraries[0]", $generated[0] . $generated[0]) },
qr/\Q$libraries[0]\E must contain one FIPS policy block/],
['a library with an extra begin marker', sub {
write_binary("$root/$libraries[0]",
"# BEGIN generated FIPS policy: build-utils/sync-fips-policy --write\n" . $generated[0]) },
qr/\Q$libraries[0]\E must contain one FIPS policy block/],
['a library with an extra end marker', sub {
write_binary("$root/$libraries[0]", $generated[0] . "# END generated FIPS policy\n") },
qr/\Q$libraries[0]\E must contain one FIPS policy block/],
['a library with reversed policy markers', sub {
write_binary("$root/$libraries[0]", "# END generated FIPS policy\n"
. "# BEGIN generated FIPS policy: build-utils/sync-fips-policy --write\n") },
qr/\Q$libraries[0]\E must contain one FIPS policy block/],
['a library that is a symbolic link', sub {
write_binary("$root/$libraries[0]", $generated[0]);
rename("$root/$libraries[0]", "$root/$libraries[0]-real") or die "rename: $!";
@@ -132,6 +143,20 @@ for my $case (
unlink "$root/$libraries[0]" or die "unlink link: $!";
rename("$root/$libraries[0]-real", "$root/$libraries[0]") or die "restore: $!";
for my $mode (qw(check write)) {
write_binary("$root/$source", $policy);
write_binary("$root/$libraries[0]", $generated[0]);
write_binary("$root/$libraries[1]", "#!/bin/sh\n");
my @before = map { scalar read_binary("$root/$_") } @libraries;
my $answer = eval { sync_fips_policy(root => $root, mode => $mode) };
is($answer, undef, "$mode rejects an invalid second library");
like($@, qr/\Q$libraries[1]\E must contain one FIPS policy block/,
"the $mode error identifies the second library");
is_deeply([map { scalar read_binary("$root/$_") } @libraries], \@before,
"$mode leaves the stale first library untouched when the second is invalid");
}
for my $mode ('', 'Write', 'check ', 'rewrite') {
my $answer = eval { sync_fips_policy(root => $root, mode => $mode) };
is($answer, undef, "mode '$mode' is rejected");