test-fact-helpers.sh (1792B)
1 #!/bin/bash 2 3 # Tests for the fact helpers that common_packages installs into /bin. 4 # The helpers write files that become Ansible local facts, so their 5 # output has to be valid JSON and their argument checks have to reject 6 # exactly the calls that would produce a useless fact. 7 8 set -u 9 10 helpers="$(dirname "$0")/../roles/common_packages/files" 11 failures=0 12 13 check() { 14 if [ "$2" = "$3" ]; then 15 echo "PASS: $1" 16 else 17 echo "FAIL: $1 (expected '$3', got '$2')" 18 failures=$((failures + 1)) 19 fi 20 } 21 22 # Report whether a helper rejected the call as malformed. Checking for 23 # the usage message rather than the exit status, because a well-formed 24 # call still fails here: challenger-admin is not installed. 25 verdict() { 26 if "$@" 2>&1 | grep -q "^Usage:"; then 27 echo rejected 28 else 29 echo accepted 30 fi 31 } 32 33 workdir=$(mktemp -d) 34 trap 'rm -rf "$workdir"' EXIT 35 36 check "no arguments are rejected" \ 37 "$(verdict "$helpers/setup-secret-fact")" rejected 38 check "three arguments are rejected" \ 39 "$(verdict "$helpers/setup-challenger-client-id-fact" a b c)" rejected 40 # [[ $# < N ]] compares strings, so ten arguments sort before five. 41 check "ten arguments are accepted" \ 42 "$(verdict "$helpers/setup-challenger-client-id-fact" 1 2 3 4 5 6 7 8 9 10)" accepted 43 44 # The generated secret has to be a JSON string with the requested prefix 45 # and a full 32 bytes of entropy behind it. 46 "$helpers/setup-secret-fact" "$workdir/secret.fact" "secret-token:" 47 secret=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])))' \ 48 "$workdir/secret.fact") 49 check "secret is a JSON string" "$?" 0 50 check "secret carries the prefix" "${secret%%:*}:" "secret-token:" 51 # 32 bytes of unpadded base32 are 52 characters. 52 check "secret is 32 bytes of base32" "${#secret}" 65 53 54 test "$failures" -eq 0