From d37f5904920062d30454e6d8b192e460ec69ba74 Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Tue, 8 Sep 2026 04:07:05 +0000 Subject: [PATCH] Add focused Audita integration coverage --- README.md | 9 ++- tests/integration | 147 ++++++++++++++++++++++++++++++++++++++++-- tests/unsupported.yml | 11 ++++ 3 files changed, 159 insertions(+), 8 deletions(-) create mode 100644 tests/unsupported.yml diff --git a/README.md b/README.md index e2db79b..fadda56 100644 --- a/README.md +++ b/README.md @@ -48,8 +48,13 @@ than executing the CLI during production convergence. The integration driver installs pinned collection dependencies, runs syntax checking and ansible-lint, verifies the default release, file ownership and -modes, executable behavior, and native configuration validation, then proves -an immediate repeat is unchanged. It manages the default local installation: +modes, executable behavior, and native configuration validation. It covers +missing-binary and checkout rebuilds, caller-supplied Go with dependency +management disabled, metadata repair without rebuilding, configuration-only +convergence, and platform failures before isolated application state exists. +The suite mutates only `/usr/local/src/audita`, `/usr/local/bin/audita`, +`/usr/local/etc/audita/config.yml`, and paths inside its private temporary +directory, then leaves the default release and configuration installed: ```sh tests/integration diff --git a/tests/integration b/tests/integration index 966150e..9fa91e8 100755 --- a/tests/integration +++ b/tests/integration @@ -12,10 +12,16 @@ export ANSIBLE_ROLES_PATH="$(dirname "$repository_root")" inventory="$repository_root/tests/inventory" converge="$repository_root/tests/converge.yml" verify="$repository_root/tests/verify.yml" +unsupported="$repository_root/tests/unsupported.yml" ansible_playbook="$workspace_venv/bin/ansible-playbook" default_commit=a84941d68168a1ed9ea7423b6477ae8218be73f9 +alternate_commit=46b7356a3b54a2771ce9a617e4fa3e8d13728cac +source_dir=/usr/local/src/audita +binary_path=/usr/local/bin/audita +config_path=/usr/local/etc/audita/config.yml cleanup() { + "$ansible_playbook" -i "$inventory" "$converge" >/dev/null 2>&1 || true rm -rf -- "$test_tmp" } trap cleanup EXIT @@ -24,18 +30,147 @@ require_clean_recap() { grep -Eq 'changed=0 .*failed=0' "$1" } +require_changed_recap() { + grep -Eq 'changed=[1-9][0-9]* .*failed=0' "$1" +} + +run_converge() { + output_file=$1 + shift + "$ansible_playbook" -i "$inventory" "$@" "$converge" | tee "$output_file" +} + +verify_release() { + expected_commit=$1 + "$ansible_playbook" -i "$inventory" \ + -e "audita_expected_commit=$expected_commit" \ + "$verify" +} + +validate_config() { + [[ "$("$binary_path" config validate --config "$config_path")" == 'config is valid' ]] +} + cd "$repository_root" "$workspace_venv/bin/ansible-galaxy" collection install \ -r collections/requirements.yml \ -p "$ANSIBLE_COLLECTIONS_PATH" "$ansible_playbook" -i "$inventory" --syntax-check "$converge" -"$workspace_venv/bin/ansible-lint" "$converge" "$verify" +"$workspace_venv/bin/ansible-lint" "$converge" "$verify" "$unsupported" baseline_log="$test_tmp/baseline.log" -"$ansible_playbook" -i "$inventory" "$converge" | tee "$baseline_log" -"$ansible_playbook" -i "$inventory" \ - -e "audita_expected_commit=$default_commit" \ - "$verify" +run_converge "$baseline_log" +verify_release "$default_commit" baseline_repeat_log="$test_tmp/baseline-repeat.log" -"$ansible_playbook" -i "$inventory" "$converge" | tee "$baseline_repeat_log" +run_converge "$baseline_repeat_log" require_clean_recap "$baseline_repeat_log" + +sudo rm -f -- "$binary_path" +missing_binary_log="$test_tmp/missing-binary.log" +run_converge "$missing_binary_log" +require_changed_recap "$missing_binary_log" +grep -A1 -E 'TASK .*Build Audita' "$missing_binary_log" | grep -q '^changed:' +missing_binary_repeat_log="$test_tmp/missing-binary-repeat.log" +run_converge "$missing_binary_repeat_log" +require_clean_recap "$missing_binary_repeat_log" + +custom_go_binary="$test_tmp/go" +custom_go_invocation_log="$test_tmp/custom-go-invocation.log" +printf '%s\n' \ + '#!/usr/bin/env bash' \ + "printf 'invoked\\n' >> '$custom_go_invocation_log'" \ + 'exec /snap/bin/go "$@"' > "$custom_go_binary" +chmod 0755 "$custom_go_binary" +sudo rm -f -- "$binary_path" +custom_go_log="$test_tmp/custom-go.log" +run_converge "$custom_go_log" \ + -e '{"audita_manage_build_dependencies": false}' \ + -e "audita_go_binary=$custom_go_binary" +require_changed_recap "$custom_go_log" +grep -A1 -E 'TASK .*Build Audita' "$custom_go_log" | grep -q '^changed:' +[[ -s "$custom_go_invocation_log" ]] +custom_go_repeat_log="$test_tmp/custom-go-repeat.log" +run_converge "$custom_go_repeat_log" \ + -e '{"audita_manage_build_dependencies": false}' \ + -e "audita_go_binary=$custom_go_binary" +require_clean_recap "$custom_go_repeat_log" + +sudo chmod 0700 "$binary_path" +metadata_log="$test_tmp/metadata.log" +run_converge "$metadata_log" +require_changed_recap "$metadata_log" +grep -A1 -E 'TASK .*Build Audita' "$metadata_log" | grep -q '^skipping:' +grep -A3 -E 'TASK .*Converge installed metadata' "$metadata_log" | \ + grep -q "^changed:.*'path': '$binary_path'" +metadata_repeat_log="$test_tmp/metadata-repeat.log" +run_converge "$metadata_repeat_log" +require_clean_recap "$metadata_repeat_log" + +custom_config='{"audita_config": {"version": 1, "context": {"description": "Focused integration coverage"}}}' +config_log="$test_tmp/config.log" +run_converge "$config_log" -e "$custom_config" +require_changed_recap "$config_log" +grep -A1 -E 'TASK .*Build Audita' "$config_log" | grep -q '^skipping:' +grep -A1 -E 'TASK .*Write Audita configuration' "$config_log" | grep -q '^changed:' +validate_config +config_repeat_log="$test_tmp/config-repeat.log" +run_converge "$config_repeat_log" -e "$custom_config" +require_clean_recap "$config_repeat_log" + +default_config_log="$test_tmp/default-config.log" +run_converge "$default_config_log" +require_changed_recap "$default_config_log" +grep -A1 -E 'TASK .*Build Audita' "$default_config_log" | grep -q '^skipping:' +default_config_repeat_log="$test_tmp/default-config-repeat.log" +run_converge "$default_config_repeat_log" +require_clean_recap "$default_config_repeat_log" + +alternate_release_log="$test_tmp/alternate-release.log" +run_converge "$alternate_release_log" -e "audita_version=$alternate_commit" +require_changed_recap "$alternate_release_log" +grep -A1 -E 'TASK .*Build Audita' "$alternate_release_log" | grep -q '^changed:' +verify_release "$alternate_commit" +alternate_repeat_log="$test_tmp/alternate-repeat.log" +run_converge "$alternate_repeat_log" -e "audita_version=$alternate_commit" +require_clean_recap "$alternate_repeat_log" + +restored_release_log="$test_tmp/restored-release.log" +run_converge "$restored_release_log" +require_changed_recap "$restored_release_log" +grep -A1 -E 'TASK .*Build Audita' "$restored_release_log" | grep -q '^changed:' +verify_release "$default_commit" +restored_repeat_log="$test_tmp/restored-repeat.log" +run_converge "$restored_repeat_log" +require_clean_recap "$restored_repeat_log" + +platform_cases=( + 'Debian 26.04 x86_64 distribution' + 'Ubuntu 24.04 x86_64 release' + 'Ubuntu 26.04 riscv64 architecture' +) +for platform_case in "${platform_cases[@]}"; do + read -r distribution release architecture label <<<"$platform_case" + case_root="$test_tmp/unsupported-$label" + case_source="$case_root/source" + case_binary="$case_root/bin/audita" + case_config="$case_root/etc/config.yml" + case_log="$test_tmp/unsupported-$label.log" + if "$ansible_playbook" -i "$inventory" \ + -e "test_distribution=$distribution" \ + -e "test_distribution_version=$release" \ + -e "test_architecture=$architecture" \ + -e "audita_source_dir=$case_source" \ + -e "audita_binary_path=$case_binary" \ + -e "audita_config_path=$case_config" \ + "$unsupported" | tee "$case_log"; then + echo "Unsupported $label case unexpectedly succeeded" >&2 + exit 1 + fi + grep -Eq 'failed=1' "$case_log" + [[ ! -e "$case_root" ]] +done + +[[ "$(sudo git -C "$source_dir" rev-parse HEAD)" == "$default_commit" ]] +[[ "$(sudo stat -c '%U:%G %a' "$binary_path")" == 'root:root 755' ]] +[[ "$(sudo stat -c '%U:%G %a' "$config_path")" == 'root:root 644' ]] +validate_config diff --git a/tests/unsupported.yml b/tests/unsupported.yml new file mode 100644 index 0000000..4a6e72c --- /dev/null +++ b/tests/unsupported.yml @@ -0,0 +1,11 @@ +--- +- name: Exercise Audita platform mutation guard + hosts: localhost + gather_facts: false + vars: + ansible_facts: + distribution: "{{ test_distribution }}" + distribution_version: "{{ test_distribution_version }}" + architecture: "{{ test_architecture }}" + roles: + - role: ansible-role-audita