commit 0b4d109aaf69d0891e6acd968878b43709ebb81a
parent 56ae7516e70029dd8b9abe850c7812ffb15668a1
Author: Florian Dold <dold@taler.net>
Date: Fri, 31 Jul 2026 15:46:30 +0200
add tests for the local fact helpers
Covers the argument checks and the shape of the generated secret fact.
Currently fails: [[ $# < N ]] is a string comparison, so ten arguments
count as fewer than five and setup-challenger-client-id-fact rejects the
call.
Diffstat:
2 files changed, 57 insertions(+), 0 deletions(-)
diff --git a/contrib/ci/jobs/001-build/build.sh b/contrib/ci/jobs/001-build/build.sh
@@ -7,6 +7,9 @@ set -exuo pipefail
# Print some debug info
id ; cat /proc/self/uid_map ; mount | grep cgroup || true
+# Check the fact helpers before spending time on the container
+contrib/test-fact-helpers.sh
+
# Hack to make podman adapt to being nested
rm -f /etc/containers/storage.conf
diff --git a/contrib/test-fact-helpers.sh b/contrib/test-fact-helpers.sh
@@ -0,0 +1,54 @@
+#!/bin/bash
+
+# Tests for the fact helpers that common_packages installs into /bin.
+# The helpers write files that become Ansible local facts, so their
+# output has to be valid JSON and their argument checks have to reject
+# exactly the calls that would produce a useless fact.
+
+set -u
+
+helpers="$(dirname "$0")/../roles/common_packages/files"
+failures=0
+
+check() {
+ if [ "$2" = "$3" ]; then
+ echo "PASS: $1"
+ else
+ echo "FAIL: $1 (expected '$3', got '$2')"
+ failures=$((failures + 1))
+ fi
+}
+
+# Report whether a helper rejected the call as malformed. Checking for
+# the usage message rather than the exit status, because a well-formed
+# call still fails here: challenger-admin is not installed.
+verdict() {
+ if "$@" 2>&1 | grep -q "^Usage:"; then
+ echo rejected
+ else
+ echo accepted
+ fi
+}
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+
+check "no arguments are rejected" \
+ "$(verdict "$helpers/setup-secret-fact")" rejected
+check "three arguments are rejected" \
+ "$(verdict "$helpers/setup-challenger-client-id-fact" a b c)" rejected
+# [[ $# < N ]] compares strings, so ten arguments sort before five.
+check "ten arguments are accepted" \
+ "$(verdict "$helpers/setup-challenger-client-id-fact" 1 2 3 4 5 6 7 8 9 10)" accepted
+
+# The generated secret has to be a JSON string with the requested prefix
+# and a full 32 bytes of entropy behind it.
+"$helpers/setup-secret-fact" "$workdir/secret.fact" "secret-token:"
+secret=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])))' \
+ "$workdir/secret.fact")
+check "secret is a JSON string" "$?" 0
+check "secret carries the prefix" "${secret%%:*}:" "secret-token:"
+# 32 bytes of unpadded base32 are 52 characters.
+check "secret is 32 bytes of base32" "${#secret}" 65
+
+test "$failures" -eq 0
