308057784e
- Fix upload response to return actual version (not requested version) when artifact already has a version in the package - Update ref_count tests to use multiple packages (one version per artifact per package design constraint) - Remove allow_public_internet references from upstream caching tests - Update consistency check test to not assert global system health - Add versions field to artifact schemas - Fix dependencies resolution to handle removed tag constraint
776 lines
29 KiB
Python
776 lines
29 KiB
Python
"""
|
|
Integration tests for artifact integrity verification.
|
|
|
|
Tests cover:
|
|
- Round-trip verification (upload -> download -> verify hash)
|
|
- Consistency check endpoint
|
|
- Header-based verification
|
|
- Integrity verification across file sizes
|
|
- Client-side verification workflow
|
|
"""
|
|
|
|
import pytest
|
|
import io
|
|
import hashlib
|
|
from tests.factories import (
|
|
compute_sha256,
|
|
upload_test_file,
|
|
generate_content_with_hash,
|
|
s3_object_exists,
|
|
get_s3_client,
|
|
get_s3_bucket,
|
|
)
|
|
from tests.conftest import (
|
|
SIZE_1KB,
|
|
SIZE_10KB,
|
|
SIZE_100KB,
|
|
SIZE_1MB,
|
|
SIZE_10MB,
|
|
)
|
|
|
|
|
|
class TestRoundTripVerification:
|
|
"""Tests for complete round-trip integrity verification."""
|
|
|
|
@pytest.mark.integration
|
|
def test_upload_download_hash_matches(self, integration_client, test_package):
|
|
"""Test that upload -> download round trip preserves content integrity."""
|
|
project, package = test_package
|
|
content = b"Round trip integrity test content"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
# Upload and capture returned hash
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="roundtrip"
|
|
)
|
|
uploaded_hash = result["artifact_id"]
|
|
|
|
# Verify upload returned correct hash
|
|
assert uploaded_hash == expected_hash
|
|
|
|
# Download artifact
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/roundtrip",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
|
|
# Compute hash of downloaded content
|
|
downloaded_hash = compute_sha256(response.content)
|
|
|
|
# All three hashes should match
|
|
assert downloaded_hash == expected_hash
|
|
assert downloaded_hash == uploaded_hash
|
|
|
|
@pytest.mark.integration
|
|
def test_upload_response_contains_hash(self, integration_client, test_package):
|
|
"""Test upload response contains artifact_id which is the SHA256 hash."""
|
|
project, package = test_package
|
|
content = b"Upload response hash test"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
result = upload_test_file(integration_client, project, package, content)
|
|
|
|
assert "artifact_id" in result
|
|
assert result["artifact_id"] == expected_hash
|
|
assert len(result["artifact_id"]) == 64
|
|
assert all(c in "0123456789abcdef" for c in result["artifact_id"])
|
|
|
|
@pytest.mark.integration
|
|
def test_download_header_matches_artifact_id(self, integration_client, test_package):
|
|
"""Test X-Checksum-SHA256 header matches artifact ID."""
|
|
project, package = test_package
|
|
content = b"Header verification test"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
upload_test_file(
|
|
integration_client, project, package, content, version="header-check"
|
|
)
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/header-check",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.headers.get("X-Checksum-SHA256") == expected_hash
|
|
|
|
@pytest.mark.integration
|
|
def test_etag_matches_artifact_id(self, integration_client, test_package):
|
|
"""Test ETag header matches artifact ID."""
|
|
project, package = test_package
|
|
content = b"ETag verification test"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
upload_test_file(
|
|
integration_client, project, package, content, version="etag-check"
|
|
)
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/etag-check",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
etag = response.headers.get("ETag", "").strip('"')
|
|
assert etag == expected_hash
|
|
|
|
@pytest.mark.integration
|
|
def test_artifact_endpoint_returns_correct_hash(self, integration_client, test_package):
|
|
"""Test artifact endpoint returns correct hash/ID."""
|
|
project, package = test_package
|
|
content = b"Artifact endpoint hash test"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
upload_test_file(integration_client, project, package, content)
|
|
|
|
# Query artifact directly
|
|
response = integration_client.get(f"/api/v1/artifact/{expected_hash}")
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert data["id"] == expected_hash
|
|
assert data.get("sha256") == expected_hash
|
|
|
|
|
|
class TestClientSideVerificationWorkflow:
|
|
"""Tests for client-side verification workflow."""
|
|
|
|
@pytest.mark.integration
|
|
def test_client_can_verify_before_upload(self, integration_client, test_package):
|
|
"""Test client can compute hash before upload and verify response matches."""
|
|
project, package = test_package
|
|
content = b"Client pre-upload verification test"
|
|
|
|
# Client computes hash locally before upload
|
|
client_hash = compute_sha256(content)
|
|
|
|
# Upload
|
|
result = upload_test_file(integration_client, project, package, content)
|
|
|
|
# Client verifies server returned the same hash
|
|
assert result["artifact_id"] == client_hash
|
|
|
|
@pytest.mark.integration
|
|
def test_client_can_provide_checksum_header(self, integration_client, test_package):
|
|
"""Test client can provide X-Checksum-SHA256 header for verification."""
|
|
project, package = test_package
|
|
content = b"Client checksum header test"
|
|
client_hash = compute_sha256(content)
|
|
|
|
files = {"file": ("test.bin", io.BytesIO(content), "application/octet-stream")}
|
|
response = integration_client.post(
|
|
f"/api/v1/project/{project}/{package}/upload",
|
|
files=files,
|
|
headers={"X-Checksum-SHA256": client_hash},
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json()["artifact_id"] == client_hash
|
|
|
|
@pytest.mark.integration
|
|
def test_checksum_mismatch_rejected(self, integration_client, test_package):
|
|
"""Test upload with wrong client checksum is rejected."""
|
|
project, package = test_package
|
|
content = b"Checksum mismatch test"
|
|
wrong_hash = "0" * 64
|
|
|
|
files = {"file": ("test.bin", io.BytesIO(content), "application/octet-stream")}
|
|
response = integration_client.post(
|
|
f"/api/v1/project/{project}/{package}/upload",
|
|
files=files,
|
|
headers={"X-Checksum-SHA256": wrong_hash},
|
|
)
|
|
assert response.status_code == 422
|
|
|
|
@pytest.mark.integration
|
|
def test_client_can_verify_after_download(self, integration_client, test_package):
|
|
"""Test client can verify downloaded content matches header hash."""
|
|
project, package = test_package
|
|
content = b"Client post-download verification"
|
|
|
|
upload_test_file(
|
|
integration_client, project, package, content, version="verify-after"
|
|
)
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/verify-after",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
|
|
# Client gets hash from header
|
|
header_hash = response.headers.get("X-Checksum-SHA256")
|
|
|
|
# Client computes hash of downloaded content
|
|
downloaded_hash = compute_sha256(response.content)
|
|
|
|
# Client verifies they match
|
|
assert downloaded_hash == header_hash
|
|
|
|
|
|
class TestIntegritySizeVariants:
|
|
"""Tests for integrity verification across different file sizes."""
|
|
|
|
@pytest.mark.integration
|
|
def test_integrity_1kb(self, integration_client, test_package, sized_content):
|
|
"""Test integrity verification for 1KB file."""
|
|
project, package = test_package
|
|
content, expected_hash = sized_content(SIZE_1KB, seed=100)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="int-1kb"
|
|
)
|
|
assert result["artifact_id"] == expected_hash
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/int-1kb",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert compute_sha256(response.content) == expected_hash
|
|
assert response.headers.get("X-Checksum-SHA256") == expected_hash
|
|
|
|
@pytest.mark.integration
|
|
def test_integrity_100kb(self, integration_client, test_package, sized_content):
|
|
"""Test integrity verification for 100KB file."""
|
|
project, package = test_package
|
|
content, expected_hash = sized_content(SIZE_100KB, seed=101)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="int-100kb"
|
|
)
|
|
assert result["artifact_id"] == expected_hash
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/int-100kb",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert compute_sha256(response.content) == expected_hash
|
|
assert response.headers.get("X-Checksum-SHA256") == expected_hash
|
|
|
|
@pytest.mark.integration
|
|
def test_integrity_1mb(self, integration_client, test_package, sized_content):
|
|
"""Test integrity verification for 1MB file."""
|
|
project, package = test_package
|
|
content, expected_hash = sized_content(SIZE_1MB, seed=102)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="int-1mb"
|
|
)
|
|
assert result["artifact_id"] == expected_hash
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/int-1mb",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert compute_sha256(response.content) == expected_hash
|
|
assert response.headers.get("X-Checksum-SHA256") == expected_hash
|
|
|
|
@pytest.mark.integration
|
|
@pytest.mark.slow
|
|
def test_integrity_10mb(self, integration_client, test_package, sized_content):
|
|
"""Test integrity verification for 10MB file."""
|
|
project, package = test_package
|
|
content, expected_hash = sized_content(SIZE_10MB, seed=103)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="int-10mb"
|
|
)
|
|
assert result["artifact_id"] == expected_hash
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/int-10mb",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert compute_sha256(response.content) == expected_hash
|
|
assert response.headers.get("X-Checksum-SHA256") == expected_hash
|
|
|
|
|
|
class TestConsistencyCheck:
|
|
"""Tests for the admin consistency check endpoint."""
|
|
|
|
@pytest.mark.integration
|
|
def test_consistency_check_returns_200(self, integration_client):
|
|
"""Test consistency check endpoint returns 200."""
|
|
response = integration_client.get("/api/v1/admin/consistency-check")
|
|
assert response.status_code == 200
|
|
|
|
@pytest.mark.integration
|
|
def test_consistency_check_response_format(self, integration_client):
|
|
"""Test consistency check returns expected response format."""
|
|
response = integration_client.get("/api/v1/admin/consistency-check")
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
|
|
# Check expected fields
|
|
assert "total_artifacts_checked" in data
|
|
assert "orphaned_s3_objects" in data
|
|
assert "missing_s3_objects" in data
|
|
assert "size_mismatches" in data
|
|
assert "healthy" in data
|
|
assert "orphaned_s3_keys" in data
|
|
assert "missing_s3_keys" in data
|
|
assert "size_mismatch_artifacts" in data
|
|
# Verify types
|
|
assert isinstance(data["total_artifacts_checked"], int)
|
|
assert isinstance(data["orphaned_s3_objects"], int)
|
|
assert isinstance(data["missing_s3_objects"], int)
|
|
assert isinstance(data["size_mismatches"], int)
|
|
assert isinstance(data["healthy"], bool)
|
|
assert isinstance(data["orphaned_s3_keys"], list)
|
|
assert isinstance(data["missing_s3_keys"], list)
|
|
assert isinstance(data["size_mismatch_artifacts"], list)
|
|
|
|
@pytest.mark.integration
|
|
def test_consistency_check_after_upload(self, integration_client, test_package):
|
|
"""Test consistency check runs successfully after a valid upload.
|
|
|
|
Note: We don't assert healthy=True because other tests (especially
|
|
corruption detection tests) may leave orphaned S3 objects behind.
|
|
This test validates the consistency check endpoint works and the
|
|
uploaded artifact is included in the check count.
|
|
"""
|
|
project, package = test_package
|
|
content = b"Consistency check test content"
|
|
|
|
# Upload artifact
|
|
upload_test_file(integration_client, project, package, content)
|
|
|
|
# Run consistency check
|
|
response = integration_client.get("/api/v1/admin/consistency-check")
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
|
|
# Verify check ran - at least 1 artifact was checked
|
|
assert data["total_artifacts_checked"] >= 1
|
|
# Verify no missing S3 objects (uploaded artifact should exist)
|
|
assert data["missing_s3_objects"] == 0
|
|
|
|
@pytest.mark.integration
|
|
def test_consistency_check_limit_parameter(self, integration_client):
|
|
"""Test consistency check respects limit parameter."""
|
|
response = integration_client.get(
|
|
"/api/v1/admin/consistency-check",
|
|
params={"limit": 10}
|
|
)
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
|
|
# Lists should not exceed limit
|
|
assert len(data["orphaned_s3_keys"]) <= 10
|
|
assert len(data["missing_s3_keys"]) <= 10
|
|
assert len(data["size_mismatch_artifacts"]) <= 10
|
|
|
|
|
|
class TestDigestHeader:
|
|
"""Tests for RFC 3230 Digest header."""
|
|
|
|
@pytest.mark.integration
|
|
def test_download_includes_digest_header(self, integration_client, test_package):
|
|
"""Test download includes Digest header in RFC 3230 format."""
|
|
project, package = test_package
|
|
content = b"Digest header test"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
upload_test_file(
|
|
integration_client, project, package, content, version="digest-test"
|
|
)
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/digest-test",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert "Digest" in response.headers
|
|
|
|
# Verify Digest format (sha-256=base64hash)
|
|
digest = response.headers["Digest"]
|
|
assert digest.startswith("sha-256=")
|
|
|
|
@pytest.mark.integration
|
|
def test_digest_header_base64_valid(self, integration_client, test_package):
|
|
"""Test Digest header contains valid base64 encoding."""
|
|
import base64
|
|
|
|
project, package = test_package
|
|
content = b"Digest base64 test"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
upload_test_file(
|
|
integration_client, project, package, content, version="digest-b64"
|
|
)
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/digest-b64",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
|
|
digest = response.headers["Digest"]
|
|
base64_part = digest.split("=", 1)[1]
|
|
|
|
# Should be valid base64
|
|
try:
|
|
decoded = base64.b64decode(base64_part)
|
|
assert len(decoded) == 32 # SHA256 is 32 bytes
|
|
except Exception as e:
|
|
pytest.fail(f"Invalid base64 in Digest header: {e}")
|
|
|
|
|
|
class TestVerificationModes:
|
|
"""Tests for download verification modes."""
|
|
|
|
@pytest.mark.integration
|
|
def test_pre_verification_mode(self, integration_client, test_package):
|
|
"""Test pre-verification mode verifies before streaming."""
|
|
project, package = test_package
|
|
content = b"Pre-verification mode test"
|
|
|
|
upload_test_file(
|
|
integration_client, project, package, content, version="pre-verify"
|
|
)
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/pre-verify",
|
|
params={"mode": "proxy", "verify": "true", "verify_mode": "pre"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.content == content
|
|
|
|
# X-Verified header should be true
|
|
assert response.headers.get("X-Verified") == "true"
|
|
|
|
@pytest.mark.integration
|
|
def test_stream_verification_mode(self, integration_client, test_package):
|
|
"""Test streaming verification mode."""
|
|
project, package = test_package
|
|
content = b"Stream verification mode test"
|
|
|
|
upload_test_file(
|
|
integration_client, project, package, content, version="stream-verify"
|
|
)
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/stream-verify",
|
|
params={"mode": "proxy", "verify": "true", "verify_mode": "stream"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.content == content
|
|
|
|
|
|
class TestArtifactIntegrityEndpoint:
|
|
"""Tests for artifact-specific integrity operations."""
|
|
|
|
@pytest.mark.integration
|
|
def test_artifact_size_matches(self, integration_client, test_package):
|
|
"""Test artifact endpoint returns correct size."""
|
|
project, package = test_package
|
|
content = b"Artifact size test content"
|
|
expected_size = len(content)
|
|
|
|
result = upload_test_file(integration_client, project, package, content)
|
|
artifact_id = result["artifact_id"]
|
|
|
|
response = integration_client.get(f"/api/v1/artifact/{artifact_id}")
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert data["size"] == expected_size
|
|
|
|
@pytest.mark.integration
|
|
def test_content_length_header_matches_size(self, integration_client, test_package):
|
|
"""Test Content-Length header matches artifact size."""
|
|
project, package = test_package
|
|
content = b"Content-Length header test"
|
|
expected_size = len(content)
|
|
|
|
upload_test_file(
|
|
integration_client, project, package, content, version="content-len"
|
|
)
|
|
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/content-len",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert int(response.headers.get("Content-Length", 0)) == expected_size
|
|
assert len(response.content) == expected_size
|
|
|
|
|
|
@pytest.mark.requires_direct_s3
|
|
class TestCorruptionDetection:
|
|
"""Tests for detecting corrupted S3 objects.
|
|
|
|
These tests directly manipulate S3 objects to simulate corruption
|
|
and verify that the system can detect hash mismatches.
|
|
|
|
Note: These tests require direct S3/MinIO access and are skipped in CI
|
|
where S3 is not directly accessible from the test runner.
|
|
"""
|
|
|
|
@pytest.mark.integration
|
|
def test_detection_of_corrupted_content(self, integration_client, test_package):
|
|
"""Test that corrupted S3 content is detected via hash mismatch.
|
|
|
|
Uploads content, then directly modifies the S3 object, then
|
|
verifies that the downloaded content hash doesn't match.
|
|
"""
|
|
project, package = test_package
|
|
content = b"Original content for corruption test"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
# Upload original content
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="corrupt-test"
|
|
)
|
|
assert result["artifact_id"] == expected_hash
|
|
|
|
# Get the S3 object and corrupt it
|
|
s3_client = get_s3_client()
|
|
bucket = get_s3_bucket()
|
|
s3_key = f"fruits/{expected_hash[:2]}/{expected_hash[2:4]}/{expected_hash}"
|
|
|
|
# Replace with corrupted content
|
|
corrupted_content = b"Corrupted content - different from original!"
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=corrupted_content)
|
|
|
|
# Download via proxy (bypasses hash verification)
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/corrupt-test",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
|
|
# Verify the downloaded content doesn't match original hash
|
|
downloaded_hash = compute_sha256(response.content)
|
|
assert downloaded_hash != expected_hash, "Corruption was not detected - hashes match"
|
|
assert response.content == corrupted_content
|
|
|
|
# The X-Checksum-SHA256 header should still show the original hash (from DB)
|
|
# but the actual content hash is different
|
|
header_hash = response.headers.get("X-Checksum-SHA256")
|
|
assert header_hash == expected_hash # Header shows expected hash
|
|
assert downloaded_hash != header_hash # But content is corrupted
|
|
|
|
# Restore original content for cleanup
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=content)
|
|
|
|
@pytest.mark.integration
|
|
def test_detection_of_single_bit_flip(self, integration_client, test_package):
|
|
"""Test detection of a single bit flip in S3 object content."""
|
|
project, package = test_package
|
|
content = b"Content for single bit flip detection test"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="bitflip-test"
|
|
)
|
|
assert result["artifact_id"] == expected_hash
|
|
|
|
# Get S3 object and flip a single bit
|
|
s3_client = get_s3_client()
|
|
bucket = get_s3_bucket()
|
|
s3_key = f"fruits/{expected_hash[:2]}/{expected_hash[2:4]}/{expected_hash}"
|
|
|
|
# Flip the first bit of the first byte
|
|
corrupted_content = bytearray(content)
|
|
corrupted_content[0] ^= 0x01
|
|
corrupted_content = bytes(corrupted_content)
|
|
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=corrupted_content)
|
|
|
|
# Download and verify hash mismatch
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/bitflip-test",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
|
|
downloaded_hash = compute_sha256(response.content)
|
|
assert downloaded_hash != expected_hash, "Single bit flip not detected"
|
|
|
|
# Restore original
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=content)
|
|
|
|
@pytest.mark.integration
|
|
def test_detection_of_truncated_content(self, integration_client, test_package):
|
|
"""Test detection of truncated S3 object."""
|
|
project, package = test_package
|
|
content = b"This is content that will be truncated for testing purposes"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="truncate-test"
|
|
)
|
|
assert result["artifact_id"] == expected_hash
|
|
|
|
# Get S3 object and truncate it
|
|
s3_client = get_s3_client()
|
|
bucket = get_s3_bucket()
|
|
s3_key = f"fruits/{expected_hash[:2]}/{expected_hash[2:4]}/{expected_hash}"
|
|
|
|
# Truncate to half the original size
|
|
truncated_content = content[: len(content) // 2]
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=truncated_content)
|
|
|
|
# Download and verify hash mismatch
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/truncate-test",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
|
|
downloaded_hash = compute_sha256(response.content)
|
|
assert downloaded_hash != expected_hash, "Truncation not detected"
|
|
assert len(response.content) < len(content), "Content was not truncated"
|
|
|
|
# Restore original
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=content)
|
|
|
|
@pytest.mark.integration
|
|
def test_detection_of_appended_content(self, integration_client, test_package):
|
|
"""Test detection of content with extra bytes appended."""
|
|
project, package = test_package
|
|
content = b"Original content"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="append-test"
|
|
)
|
|
assert result["artifact_id"] == expected_hash
|
|
|
|
# Get S3 object and append extra bytes
|
|
s3_client = get_s3_client()
|
|
bucket = get_s3_bucket()
|
|
s3_key = f"fruits/{expected_hash[:2]}/{expected_hash[2:4]}/{expected_hash}"
|
|
|
|
appended_content = content + b" - extra bytes appended"
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=appended_content)
|
|
|
|
# Download and verify hash mismatch
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/append-test",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
|
|
downloaded_hash = compute_sha256(response.content)
|
|
assert downloaded_hash != expected_hash, "Appended content not detected"
|
|
assert len(response.content) > len(content), "Content was not extended"
|
|
|
|
# Restore original
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=content)
|
|
|
|
@pytest.mark.integration
|
|
def test_client_detects_hash_mismatch_post_download(
|
|
self, integration_client, test_package
|
|
):
|
|
"""Test that a client can detect hash mismatch after downloading corrupted content.
|
|
|
|
This simulates the full client verification workflow:
|
|
1. Download content
|
|
2. Get expected hash from header
|
|
3. Compute actual hash of content
|
|
4. Verify they match (or detect corruption)
|
|
"""
|
|
project, package = test_package
|
|
content = b"Content for client-side corruption detection"
|
|
expected_hash = compute_sha256(content)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="client-detect"
|
|
)
|
|
|
|
# Corrupt the S3 object
|
|
s3_client = get_s3_client()
|
|
bucket = get_s3_bucket()
|
|
s3_key = f"fruits/{expected_hash[:2]}/{expected_hash[2:4]}/{expected_hash}"
|
|
corrupted = b"This is completely different content"
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=corrupted)
|
|
|
|
# Simulate client download and verification
|
|
response = integration_client.get(
|
|
f"/api/v1/project/{project}/{package}/+/client-detect",
|
|
params={"mode": "proxy"},
|
|
)
|
|
assert response.status_code == 200
|
|
|
|
# Client gets expected hash from header
|
|
header_hash = response.headers.get("X-Checksum-SHA256")
|
|
|
|
# Client computes hash of downloaded content
|
|
actual_hash = compute_sha256(response.content)
|
|
|
|
# Client detects the mismatch
|
|
corruption_detected = actual_hash != header_hash
|
|
assert corruption_detected, "Client should detect hash mismatch"
|
|
|
|
# Restore original
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=content)
|
|
|
|
@pytest.mark.integration
|
|
def test_consistency_check_detects_size_mismatch(
|
|
self, integration_client, test_package, unique_test_id
|
|
):
|
|
"""Test that consistency check detects size mismatches.
|
|
|
|
Uploads content, modifies S3 object size, then runs consistency check.
|
|
"""
|
|
project, package = test_package
|
|
content = b"Content for size mismatch consistency check test " + unique_test_id.encode()
|
|
expected_hash = compute_sha256(content)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="size-mismatch"
|
|
)
|
|
|
|
# Modify S3 object to have different size
|
|
s3_client = get_s3_client()
|
|
bucket = get_s3_bucket()
|
|
s3_key = f"fruits/{expected_hash[:2]}/{expected_hash[2:4]}/{expected_hash}"
|
|
different_size_content = content + b"extra extra extra"
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=different_size_content)
|
|
|
|
# Run consistency check
|
|
response = integration_client.get("/api/v1/admin/consistency-check")
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
|
|
# Should detect the size mismatch
|
|
assert data["size_mismatches"] >= 1 or len(data["size_mismatch_artifacts"]) >= 1
|
|
|
|
# Restore original
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=content)
|
|
|
|
@pytest.mark.integration
|
|
def test_consistency_check_detects_missing_s3_object(
|
|
self, integration_client, test_package, unique_test_id
|
|
):
|
|
"""Test that consistency check detects missing S3 objects.
|
|
|
|
Uploads content, deletes S3 object, then runs consistency check.
|
|
"""
|
|
project, package = test_package
|
|
content = b"Content for missing S3 object test " + unique_test_id.encode()
|
|
expected_hash = compute_sha256(content)
|
|
|
|
result = upload_test_file(
|
|
integration_client, project, package, content, version="missing-s3"
|
|
)
|
|
|
|
# Delete the S3 object
|
|
s3_client = get_s3_client()
|
|
bucket = get_s3_bucket()
|
|
s3_key = f"fruits/{expected_hash[:2]}/{expected_hash[2:4]}/{expected_hash}"
|
|
s3_client.delete_object(Bucket=bucket, Key=s3_key)
|
|
|
|
# Run consistency check
|
|
response = integration_client.get("/api/v1/admin/consistency-check")
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
|
|
# Should detect the missing S3 object
|
|
assert data["missing_s3_objects"] >= 1 or len(data["missing_s3_keys"]) >= 1
|
|
|
|
# Restore the object for cleanup
|
|
s3_client.put_object(Bucket=bucket, Key=s3_key, Body=content)
|