eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Bind delivered binaries to verified build source

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-06 00:51:56 +00:00
parent 1d6611601c
commit a1ee067b53
11 changed files with 154 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
cmd/releasekit/main_test.go
View File

@@ -411,7 +411,8 @@ func writeDeliveryReceipt(t *testing.T, repository string, settings cli.BuildSet
target := cli.ReceiptTarget{OS: "linux", Arch: "amd64"}
receipt := cli.BuildReceipt{
RepositoryDir: resolvedRepository, CandidateCommit: cliGitOutput(t, repository, "rev-parse", "HEAD"),
Version: "v1.2.3", MainPackage: settings.MainPackage, BinaryName: settings.BinaryName,
SourceVerified: true,
Version: "v1.2.3", MainPackage: settings.MainPackage, BinaryName: settings.BinaryName,
OutputDir: assetsDir, Targets: []cli.ReceiptTarget{target}, Compiler: "go version fixture",
Artifacts: []cli.ReceiptArtifact{{Path: artifactPath, Filename: filename, Target: target, SHA256: hex.EncodeToString(digest[:])}},
}
@@ -635,3 +636,42 @@ func cliGitOutput(t *testing.T, repository string, args ...string) string {
}
return strings.TrimSpace(string(output))
}
func TestDeliverRejectsReceiptBuiltFromDirtySourceAfterCleanup(t *testing.T) {
repository := newDeliveryBuildRepository(t)
state := &deliveryServerState{}
server := newDeliveryServer(t, state)
defer server.Close()
settings := cli.Settings{Product: "Example Product", Build: &cli.BuildSettings{MainPackage: ".", BinaryName: "helper", Targets: []string{"linux/amd64"}}, Delivery: &cli.DeliverySettings{BaseURL: server.URL, Owner: "owner", Repository: "example"}}
writeDeliveryProfile(t, repository, settings)
state.commit = cliGitOutput(t, repository, "rev-parse", "HEAD")
cliGitRun(t, repository, "tag", "v1.2.3")
mainPath := filepath.Join(repository, "main.go")
original, err := os.ReadFile(mainPath)
if err != nil {
t.Fatal(err)
}
if err := os.WriteFile(mainPath, append(original, []byte("\n// uncommitted build\n")...), 0600); err != nil {
t.Fatal(err)
}
assets := t.TempDir()
var stdout, stderr bytes.Buffer
if status := run(context.Background(), []string{"build", "--repo", repository, "--output", assets, "v1.2.3"}, &stdout, &stderr); status != 0 {
t.Fatalf("local build status=%d %s", status, stderr.String())
}
receipt, err := cli.LoadBuildReceipt(filepath.Join(assets, cli.BuildReceiptName))
if err != nil {
t.Fatal(err)
}
if receipt.SourceVerified {
t.Fatal("dirty build receipt claims verified source")
}
cliGitRun(t, repository, "restore", "main.go")
t.Setenv("RELEASEKIT_GITEA_TOKEN", "fixture-token")
stdout.Reset()
stderr.Reset()
status := run(context.Background(), []string{"deliver", "--repo", repository, "--assets", assets, "v1.2.3"}, &stdout, &stderr)
if status != 1 || state.apiRequests != 0 || !strings.Contains(stderr.String(), "build source") {
t.Fatalf("status=%d requests=%d %s", status, state.apiRequests, stderr.String())
}
}